diff options
| author |   Anthony G. Basile <blueness@gentoo.org> | 2015-08-04 15:10:13 -0400 |
|---|---|---|
| committer | Anthony G. Basile <blueness@gentoo.org> | 2015-08-04 15:10:13 -0400 |
| commit | 7c4c8368ddc82a50b4d72387eac99fe9559cc720 (patch) | |
| tree | d5b14e34b4b9e7360c71f7672356a6d229747e29 | |
| parent | grsecurity-{3.2.69,3.14.48,4.1.3}-201508020901 (diff) | |
| download | hardened-patchset-7c4c8368ddc82a50b4d72387eac99fe9559cc720.tar.gz hardened-patchset-7c4c8368ddc82a50b4d72387eac99fe9559cc720.tar.bz2 hardened-patchset-7c4c8368ddc82a50b4d72387eac99fe9559cc720.zip | |
grsecurity-{3.14.49,4.1.4}-20150803231220150803
| -rw-r--r-- | 3.14.49/0000_README (renamed from 4.1.3/0000_README) | 10 | ||||
| -rw-r--r-- | 3.14.49/1047_linux-3.14.48.patch (renamed from 3.14.48/1047_linux-3.14.48.patch) | 0 | ||||
| -rw-r--r-- | 3.14.49/1048_linux-3.14.49.patch | 4039 | ||||
| -rw-r--r-- | 3.14.49/4420_grsecurity-3.1-3.14.49-201508032312.patch (renamed from 3.14.48/4420_grsecurity-3.1-3.14.48-201508020901.patch) | 199 | ||||
| -rw-r--r-- | 3.14.49/4425_grsec_remove_EI_PAX.patch (renamed from 3.14.48/4425_grsec_remove_EI_PAX.patch) | 0 | ||||
| -rw-r--r-- | 3.14.49/4427_force_XATTR_PAX_tmpfs.patch (renamed from 3.14.48/4427_force_XATTR_PAX_tmpfs.patch) | 0 | ||||
| -rw-r--r-- | 3.14.49/4430_grsec-remove-localversion-grsec.patch (renamed from 3.14.48/4430_grsec-remove-localversion-grsec.patch) | 0 | ||||
| -rw-r--r-- | 3.14.49/4435_grsec-mute-warnings.patch (renamed from 3.14.48/4435_grsec-mute-warnings.patch) | 0 | ||||
| -rw-r--r-- | 3.14.49/4440_grsec-remove-protected-paths.patch (renamed from 3.14.48/4440_grsec-remove-protected-paths.patch) | 0 | ||||
| -rw-r--r-- | 3.14.49/4450_grsec-kconfig-default-gids.patch (renamed from 3.14.48/4450_grsec-kconfig-default-gids.patch) | 0 | ||||
| -rw-r--r-- | 3.14.49/4465_selinux-avc_audit-log-curr_ip.patch (renamed from 3.14.48/4465_selinux-avc_audit-log-curr_ip.patch) | 0 | ||||
| -rw-r--r-- | 3.14.49/4470_disable-compat_vdso.patch (renamed from 3.14.48/4470_disable-compat_vdso.patch) | 0 | ||||
| -rw-r--r-- | 3.14.49/4475_emutramp_default_on.patch (renamed from 3.14.48/4475_emutramp_default_on.patch) | 0 | ||||
| -rw-r--r-- | 4.1.4/0000_README (renamed from 3.14.48/0000_README) | 6 | ||||
| -rw-r--r-- | 4.1.4/1003_linux-4.1.4.patch | 11078 | ||||
| -rw-r--r-- | 4.1.4/4420_grsecurity-3.1-4.1.4-201508032312.patch (renamed from 4.1.3/4420_grsecurity-3.1-4.1.3-201508011613.patch) | 340 | ||||
| -rw-r--r-- | 4.1.4/4425_grsec_remove_EI_PAX.patch (renamed from 4.1.3/4425_grsec_remove_EI_PAX.patch) | 0 | ||||
| -rw-r--r-- | 4.1.4/4427_force_XATTR_PAX_tmpfs.patch (renamed from 4.1.3/4427_force_XATTR_PAX_tmpfs.patch) | 0 | ||||
| -rw-r--r-- | 4.1.4/4430_grsec-remove-localversion-grsec.patch (renamed from 4.1.3/4430_grsec-remove-localversion-grsec.patch) | 0 | ||||
| -rw-r--r-- | 4.1.4/4435_grsec-mute-warnings.patch (renamed from 4.1.3/4435_grsec-mute-warnings.patch) | 0 | ||||
| -rw-r--r-- | 4.1.4/4440_grsec-remove-protected-paths.patch (renamed from 4.1.3/4440_grsec-remove-protected-paths.patch) | 0 | ||||
| -rw-r--r-- | 4.1.4/4450_grsec-kconfig-default-gids.patch (renamed from 4.1.3/4450_grsec-kconfig-default-gids.patch) | 0 | ||||
| -rw-r--r-- | 4.1.4/4465_selinux-avc_audit-log-curr_ip.patch (renamed from 4.1.3/4465_selinux-avc_audit-log-curr_ip.patch) | 0 | ||||
| -rw-r--r-- | 4.1.4/4470_disable-compat_vdso.patch (renamed from 4.1.3/4470_disable-compat_vdso.patch) | 0 | ||||
| -rw-r--r-- | 4.1.4/4475_emutramp_default_on.patch (renamed from 4.1.3/4475_emutramp_default_on.patch) | 0 |
25 files changed, 15337 insertions, 335 deletions
diff --git a/4.1.3/0000_README b/3.14.49/0000_README index 473ae13..eb9a47e 100644 --- a/4.1.3/0000_README +++ b/3.14.49/0000_README @@ -2,7 +2,15 @@ README ----------------------------------------------------------------------------- Individual Patch Descriptions: ----------------------------------------------------------------------------- -Patch: 4420_grsecurity-3.1-4.1.3-201508011613.patch +Patch: 1047_linux-3.14.48.patch +From: http://www.kernel.org +Desc: Linux 3.14.48 + +Patch: 1048_linux-3.14.49.patch +From: http://www.kernel.org +Desc: Linux 3.14.49 + +Patch: 4420_grsecurity-3.1-3.14.49-201508032312.patch From: http://www.grsecurity.net Desc: hardened-sources base patch from upstream grsecurity diff --git a/3.14.48/1047_linux-3.14.48.patch b/3.14.49/1047_linux-3.14.48.patch index 3a7169d..3a7169d 100644 --- a/3.14.48/1047_linux-3.14.48.patch +++ b/3.14.49/1047_linux-3.14.48.patch diff --git a/3.14.49/1048_linux-3.14.49.patch b/3.14.49/1048_linux-3.14.49.patch new file mode 100644 index 0000000..a202904 --- /dev/null +++ b/3.14.49/1048_linux-3.14.49.patch @@ -0,0 +1,4039 @@ +diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt +index 01ef408..8faff12 100644 +--- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt ++++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt +@@ -91,5 +91,5 @@ mpp61 61 gpo, dev(wen1), uart1(txd), audio(rclk) + mpp62 62 gpio, dev(a2), uart1(cts), tdm(drx), pcie(clkreq0), + audio(mclk), uart0(cts) + mpp63 63 gpo, spi0(sck), tclk +-mpp64 64 gpio, spi0(miso), spi0-1(cs1) +-mpp65 65 gpio, spi0(mosi), spi0-1(cs2) ++mpp64 64 gpio, spi0(miso), spi0(cs1) ++mpp65 65 gpio, spi0(mosi), spi0(cs2) +diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt +index bfa0a2e..86dec67 100644 +--- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt ++++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt +@@ -41,15 +41,15 @@ mpp20 20 gpio, ge0(rxd4), ge1(rxd2), lcd(d20), ptp(clk) + mpp21 21 gpio, ge0(rxd5), ge1(rxd3), lcd(d21), mem(bat) + mpp22 22 gpio, ge0(rxd6), ge1(rxctl), lcd(d22), sata0(prsnt) + mpp23 23 gpio, ge0(rxd7), ge1(rxclk), lcd(d23), sata1(prsnt) +-mpp24 24 gpio, lcd(hsync), sata1(prsnt), nf(bootcs-re), tdm(rst) +-mpp25 25 gpio, lcd(vsync), sata0(prsnt), nf(bootcs-we), tdm(pclk) +-mpp26 26 gpio, lcd(clk), tdm(fsync), vdd(cpu1-pd) ++mpp24 24 gpio, lcd(hsync), sata1(prsnt), tdm(rst) ++mpp25 25 gpio, lcd(vsync), sata0(prsnt), tdm(pclk) ++mpp26 26 gpio, lcd(clk), tdm(fsync) + mpp27 27 gpio, lcd(e), tdm(dtx), ptp(trig) + mpp28 28 gpio, lcd(pwm), tdm(drx), ptp(evreq) +-mpp29 29 gpio, lcd(ref-clk), tdm(int0), ptp(clk), vdd(cpu0-pd) ++mpp29 29 gpio, lcd(ref-clk), tdm(int0), ptp(clk) + mpp30 30 gpio, tdm(int1), sd0(clk) +-mpp31 31 gpio, tdm(int2), sd0(cmd), vdd(cpu0-pd) +-mpp32 32 gpio, tdm(int3), sd0(d0), vdd(cpu1-pd) ++mpp31 31 gpio, tdm(int2), sd0(cmd) ++mpp32 32 gpio, tdm(int3), sd0(d0) + mpp33 33 gpio, tdm(int4), sd0(d1), mem(bat) + mpp34 34 gpio, tdm(int5), sd0(d2), sata0(prsnt) + mpp35 35 gpio, tdm(int6), sd0(d3), sata1(prsnt) +@@ -57,21 +57,18 @@ mpp36 36 gpio, spi(mosi) + mpp37 37 gpio, spi(miso) + mpp38 38 gpio, spi(sck) + mpp39 39 gpio, spi(cs0) +-mpp40 40 gpio, spi(cs1), uart2(cts), lcd(vga-hsync), vdd(cpu1-pd), +- pcie(clkreq0) ++mpp40 40 gpio, spi(cs1), uart2(cts), lcd(vga-hsync), pcie(clkreq0) + mpp41 41 gpio, spi(cs2), uart2(rts), lcd(vga-vsync), sata1(prsnt), + pcie(clkreq1) +-mpp42 42 gpio, uart2(rxd), uart0(cts), tdm(int7), tdm-1(timer), +- vdd(cpu0-pd) +-mpp43 43 gpio, uart2(txd), uart0(rts), spi(cs3), pcie(rstout), +- vdd(cpu2-3-pd){1} ++mpp42 42 gpio, uart2(rxd), uart0(cts), tdm(int7), tdm-1(timer) ++mpp43 43 gpio, uart2(txd), uart0(rts), spi(cs3), pcie(rstout) + mpp44 44 gpio, uart2(cts), uart3(rxd), spi(cs4), pcie(clkreq2), + mem(bat) + mpp45 45 gpio, uart2(rts), uart3(txd), spi(cs5), sata1(prsnt) + mpp46 46 gpio, uart3(rts), uart1(rts), spi(cs6), sata0(prsnt) + mpp47 47 gpio, uart3(cts), uart1(cts), spi(cs7), pcie(clkreq3), + ref(clkout) +-mpp48 48 gpio, tclk, dev(burst/last) ++mpp48 48 gpio, dev(clkout), dev(burst/last) + + * Marvell Armada XP (mv78260 and mv78460 only) + +@@ -83,9 +80,9 @@ mpp51 51 gpio, dev(ad16) + mpp52 52 gpio, dev(ad17) + mpp53 53 gpio, dev(ad18) + mpp54 54 gpio, dev(ad19) +-mpp55 55 gpio, dev(ad20), vdd(cpu0-pd) +-mpp56 56 gpio, dev(ad21), vdd(cpu1-pd) +-mpp57 57 gpio, dev(ad22), vdd(cpu2-3-pd){1} ++mpp55 55 gpio, dev(ad20) ++mpp56 56 gpio, dev(ad21) ++mpp57 57 gpio, dev(ad22) + mpp58 58 gpio, dev(ad23) + mpp59 59 gpio, dev(ad24) + mpp60 60 gpio, dev(ad25) +@@ -95,6 +92,3 @@ mpp63 63 gpio, dev(ad28) + mpp64 64 gpio, dev(ad29) + mpp65 65 gpio, dev(ad30) + mpp66 66 gpio, dev(ad31) +- +-Notes: +-* {1} vdd(cpu2-3-pd) only available on mv78460. +diff --git a/Documentation/devicetree/bindings/spi/spi_pl022.txt b/Documentation/devicetree/bindings/spi/spi_pl022.txt +index 22ed679..4d1673c 100644 +--- a/Documentation/devicetree/bindings/spi/spi_pl022.txt ++++ b/Documentation/devicetree/bindings/spi/spi_pl022.txt +@@ -4,9 +4,9 @@ Required properties: + - compatible : "arm,pl022", "arm,primecell" + - reg : Offset and length of the register set for the device + - interrupts : Should contain SPI controller interrupt ++- num-cs : total number of chipselects + + Optional properties: +-- num-cs : total number of chipselects + - cs-gpios : should specify GPIOs used for chipselects. + The gpios will be referred to as reg = <index> in the SPI child nodes. + If unspecified, a single SPI device without a chip select can be used. +diff --git a/Makefile b/Makefile +index 25393e8..fee8460 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 14 +-SUBLEVEL = 48 ++SUBLEVEL = 49 + EXTRAVERSION = + NAME = Remembering Coco + +diff --git a/arch/arc/include/asm/cmpxchg.h b/arch/arc/include/asm/cmpxchg.h +index 03cd689..90de5c5 100644 +--- a/arch/arc/include/asm/cmpxchg.h ++++ b/arch/arc/include/asm/cmpxchg.h +@@ -25,10 +25,11 @@ __cmpxchg(volatile void *ptr, unsigned long expected, unsigned long new) + " scond %3, [%1] \n" + " bnz 1b \n" + "2: \n" +- : "=&r"(prev) +- : "r"(ptr), "ir"(expected), +- "r"(new) /* can't be "ir". scond can't take limm for "b" */ +- : "cc"); ++ : "=&r"(prev) /* Early clobber, to prevent reg reuse */ ++ : "r"(ptr), /* Not "m": llock only supports reg direct addr mode */ ++ "ir"(expected), ++ "r"(new) /* can't be "ir". scond can't take LIMM for "b" */ ++ : "cc", "memory"); /* so that gcc knows memory is being written here */ + + return prev; + } +diff --git a/arch/arm64/kernel/vdso/Makefile b/arch/arm64/kernel/vdso/Makefile +index a268a9a..a622dd0 100644 +--- a/arch/arm64/kernel/vdso/Makefile ++++ b/arch/arm64/kernel/vdso/Makefile +@@ -15,6 +15,10 @@ ccflags-y := -shared -fno-common -fno-builtin + ccflags-y += -nostdlib -Wl,-soname=linux-vdso.so.1 \ + $(call cc-ldoption, -Wl$(comma)--hash-style=sysv) + ++# Workaround for bare-metal (ELF) toolchains that neglect to pass -shared ++# down to collect2, resulting in silent corruption of the vDSO image. ++ccflags-y += -Wl,-shared ++ + obj-y += vdso.o + extra-y += vdso.lds vdso-offsets.h + CPPFLAGS_vdso.lds += -P -C -U$(ARCH) +diff --git a/arch/arm64/mm/context.c b/arch/arm64/mm/context.c +index baa758d..76c1e6c 100644 +--- a/arch/arm64/mm/context.c ++++ b/arch/arm64/mm/context.c +@@ -92,6 +92,14 @@ static void reset_context(void *info) + unsigned int cpu = smp_processor_id(); + struct mm_struct *mm = current->active_mm; + ++ /* ++ * current->active_mm could be init_mm for the idle thread immediately ++ * after secondary CPU boot or hotplug. TTBR0_EL1 is already set to ++ * the reserved value, so no need to reset any context. ++ */ ++ if (mm == &init_mm) ++ return; ++ + smp_rmb(); + asid = cpu_last_asid + cpu; + +diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c +index 023747b..e3a24b7 100644 +--- a/arch/arm64/mm/hugetlbpage.c ++++ b/arch/arm64/mm/hugetlbpage.c +@@ -46,13 +46,13 @@ struct page *follow_huge_addr(struct mm_struct *mm, unsigned long address, + + int pmd_huge(pmd_t pmd) + { +- return !(pmd_val(pmd) & PMD_TABLE_BIT); ++ return pmd_val(pmd) && !(pmd_val(pmd) & PMD_TABLE_BIT); + } + + int pud_huge(pud_t pud) + { + #ifndef __PAGETABLE_PMD_FOLDED +- return !(pud_val(pud) & PUD_TABLE_BIT); ++ return pud_val(pud) && !(pud_val(pud) & PUD_TABLE_BIT); + #else + return 0; + #endif +diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c +index d0b4c2e..aeb95a1 100644 +--- a/arch/arm64/mm/init.c ++++ b/arch/arm64/mm/init.c +@@ -243,7 +243,7 @@ static void __init free_unused_memmap(void) + * memmap entries are valid from the bank end aligned to + * MAX_ORDER_NR_PAGES. + */ +- prev_end = ALIGN(start + __phys_to_pfn(reg->size), ++ prev_end = ALIGN(__phys_to_pfn(reg->base + reg->size), + MAX_ORDER_NR_PAGES); + } + +diff --git a/arch/mips/kvm/kvm_mips_emul.c b/arch/mips/kvm/kvm_mips_emul.c +index e75ef82..c76f297 100644 +--- a/arch/mips/kvm/kvm_mips_emul.c ++++ b/arch/mips/kvm/kvm_mips_emul.c +@@ -1626,7 +1626,7 @@ kvm_mips_complete_mmio_load(struct kvm_vcpu *vcpu, struct kvm_run *run) + if (vcpu->mmio_needed == 2) + *gpr = *(int16_t *) run->mmio.data; + else +- *gpr = *(int16_t *) run->mmio.data; ++ *gpr = *(uint16_t *)run->mmio.data; + + break; + case 1: +diff --git a/drivers/acpi/acpica/utxfinit.c b/drivers/acpi/acpica/utxfinit.c +index 246ef68..2c3c578 100644 +--- a/drivers/acpi/acpica/utxfinit.c ++++ b/drivers/acpi/acpica/utxfinit.c +@@ -175,10 +175,12 @@ acpi_status __init acpi_enable_subsystem(u32 flags) + * Obtain a permanent mapping for the FACS. This is required for the + * Global Lock and the Firmware Waking Vector + */ +- status = acpi_tb_initialize_facs(); +- if (ACPI_FAILURE(status)) { +- ACPI_WARNING((AE_INFO, "Could not map the FACS table")); +- return_ACPI_STATUS(status); ++ if (!(flags & ACPI_NO_FACS_INIT)) { ++ status = acpi_tb_initialize_facs(); ++ if (ACPI_FAILURE(status)) { ++ ACPI_WARNING((AE_INFO, "Could not map the FACS table")); ++ return_ACPI_STATUS(status); ++ } + } + #endif /* !ACPI_REDUCED_HARDWARE */ + +diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c +index b48aefa..60be8d0 100644 +--- a/drivers/acpi/bus.c ++++ b/drivers/acpi/bus.c +@@ -450,6 +450,16 @@ static int __init acpi_bus_init_irq(void) + u8 acpi_gbl_permanent_mmap; + + ++/** ++ * acpi_early_init - Initialize ACPICA and populate the ACPI namespace. ++ * ++ * The ACPI tables are accessible after this, but the handling of events has not ++ * been initialized and the global lock is not available yet, so AML should not ++ * be executed at this point. ++ * ++ * Doing this before switching the EFI runtime services to virtual mode allows ++ * the EfiBootServices memory to be freed slightly earlier on boot. ++ */ + void __init acpi_early_init(void) + { + acpi_status status; +@@ -510,26 +520,42 @@ void __init acpi_early_init(void) + acpi_gbl_FADT.sci_interrupt = acpi_sci_override_gsi; + } + #endif ++ return; ++ ++ error0: ++ disable_acpi(); ++} ++ ++/** ++ * acpi_subsystem_init - Finalize the early initialization of ACPI. ++ * ++ * Switch over the platform to the ACPI mode (if possible), initialize the ++ * handling of ACPI events, install the interrupt and global lock handlers. ++ * ++ * Doing this too early is generally unsafe, but at the same time it needs to be ++ * done before all things that really depend on ACPI. The right spot appears to ++ * be before finalizing the EFI initialization. ++ */ ++void __init acpi_subsystem_init(void) ++{ ++ acpi_status status; ++ ++ if (acpi_disabled) ++ return; + + status = acpi_enable_subsystem(~ACPI_NO_ACPI_ENABLE); + if (ACPI_FAILURE(status)) { + printk(KERN_ERR PREFIX "Unable to enable ACPI\n"); +- goto error0; ++ disable_acpi(); ++ } else { ++ /* ++ * If the system is using ACPI then we can be reasonably ++ * confident that any regulators are managed by the firmware ++ * so tell the regulator core it has everything it needs to ++ * know. ++ */ ++ regulator_has_full_constraints(); + } +- +- /* +- * If the system is using ACPI then we can be reasonably +- * confident that any regulators are managed by the firmware +- * so tell the regulator core it has everything it needs to +- * know. +- */ +- regulator_has_full_constraints(); +- +- return; +- +- error0: +- disable_acpi(); +- return; + } + + static int __init acpi_bus_init(void) +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index b1c0fcd..b0e6691 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -4173,9 +4173,10 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { + { "ST3320[68]13AS", "SD1[5-9]", ATA_HORKAGE_NONCQ | + ATA_HORKAGE_FIRMWARE_WARN }, + +- /* Seagate Momentus SpinPoint M8 seem to have FPMDA_AA issues */ ++ /* drives which fail FPDMA_AA activation (some may freeze afterwards) */ + { "ST1000LM024 HN-M101MBB", "2AR10001", ATA_HORKAGE_BROKEN_FPDMA_AA }, + { "ST1000LM024 HN-M101MBB", "2BA30001", ATA_HORKAGE_BROKEN_FPDMA_AA }, ++ { "VB0250EAVER", "HPG7", ATA_HORKAGE_BROKEN_FPDMA_AA }, + + /* Blacklist entries taken from Silicon Image 3124/3132 + Windows driver .inf file - also several Linux problem reports */ +@@ -4229,6 +4230,9 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { + { "Micron_M550*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, }, + { "Crucial_CT*M550SSD*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, }, + ++ /* devices that don't properly handle TRIM commands */ ++ { "SuperSSpeed S238*", NULL, ATA_HORKAGE_NOTRIM, }, ++ + /* + * Some WD SATA-I drives spin up and down erratically when the link + * is put into the slumber mode. We don't have full list of the +@@ -4533,7 +4537,8 @@ static unsigned int ata_dev_set_xfermode(struct ata_device *dev) + else /* In the ancient relic department - skip all of this */ + return 0; + +- err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 0); ++ /* On some disks, this command causes spin-up, so we need longer timeout */ ++ err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 15000); + + DPRINTK("EXIT, err_mask=%x\n", err_mask); + return err_mask; +diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c +index ef8567d..6fecf0b 100644 +--- a/drivers/ata/libata-scsi.c ++++ b/drivers/ata/libata-scsi.c +@@ -2510,7 +2510,8 @@ static unsigned int ata_scsiop_read_cap(struct ata_scsi_args *args, u8 *rbuf) + rbuf[14] = (lowest_aligned >> 8) & 0x3f; + rbuf[15] = lowest_aligned; + +- if (ata_id_has_trim(args->id)) { ++ if (ata_id_has_trim(args->id) && ++ !(dev->horkage & ATA_HORKAGE_NOTRIM)) { + rbuf[14] |= 0x80; /* TPE */ + + if (ata_id_has_zero_after_trim(args->id)) +diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c +index 2495ee5..f0c15f9 100644 +--- a/drivers/base/firmware_class.c ++++ b/drivers/base/firmware_class.c +@@ -544,10 +544,8 @@ static void fw_dev_release(struct device *dev) + kfree(fw_priv); + } + +-static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env) ++static int do_firmware_uevent(struct firmware_priv *fw_priv, struct kobj_uevent_env *env) + { +- struct firmware_priv *fw_priv = to_firmware_priv(dev); +- + if (add_uevent_var(env, "FIRMWARE=%s", fw_priv->buf->fw_id)) + return -ENOMEM; + if (add_uevent_var(env, "TIMEOUT=%i", loading_timeout)) +@@ -558,6 +556,18 @@ static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env) + return 0; + } + ++static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env) ++{ ++ struct firmware_priv *fw_priv = to_firmware_priv(dev); ++ int err = 0; ++ ++ mutex_lock(&fw_lock); ++ if (fw_priv->buf) ++ err = do_firmware_uevent(fw_priv, env); ++ mutex_unlock(&fw_lock); ++ return err; ++} ++ + static struct class firmware_class = { + .name = "firmware", + .class_attrs = firmware_class_attrs, +diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c +index 2f9a3d8..58559d7 100644 +--- a/drivers/base/regmap/regmap.c ++++ b/drivers/base/regmap/regmap.c +@@ -808,11 +808,10 @@ EXPORT_SYMBOL_GPL(devm_regmap_init); + static void regmap_field_init(struct regmap_field *rm_field, + struct regmap *regmap, struct reg_field reg_field) + { +- int field_bits = reg_field.msb - reg_field.lsb + 1; + rm_field->regmap = regmap; + rm_field->reg = reg_field.reg; + rm_field->shift = reg_field.lsb; +- rm_field->mask = ((BIT(field_bits) - 1) << reg_field.lsb); ++ rm_field->mask = GENMASK(reg_field.msb, reg_field.lsb); + rm_field->id_size = reg_field.id_size; + rm_field->id_offset = reg_field.id_offset; + } +@@ -1947,7 +1946,7 @@ int regmap_bulk_read(struct regmap *map, unsigned int reg, void *val, + &ival); + if (ret != 0) + return ret; +- memcpy(val + (i * val_bytes), &ival, val_bytes); ++ map->format.format_val(val + (i * val_bytes), ival, 0); + } + } + +diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c +index 63688d3..12be7cb 100644 +--- a/drivers/block/rbd.c ++++ b/drivers/block/rbd.c +@@ -1826,11 +1826,11 @@ static struct rbd_obj_request *rbd_obj_request_create(const char *object_name, + rbd_assert(obj_request_type_valid(type)); + + size = strlen(object_name) + 1; +- name = kmalloc(size, GFP_KERNEL); ++ name = kmalloc(size, GFP_NOIO); + if (!name) + return NULL; + +- obj_request = kmem_cache_zalloc(rbd_obj_request_cache, GFP_KERNEL); ++ obj_request = kmem_cache_zalloc(rbd_obj_request_cache, GFP_NOIO); + if (!obj_request) { + kfree(name); + return NULL; +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index c0e7a9aa9..c23658e 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -1293,6 +1293,8 @@ static int btusb_setup_intel(struct hci_dev *hdev) + } + fw_ptr = fw->data; + ++ kfree_skb(skb); ++ + /* This Intel specific command enables the manufacturer mode of the + * controller. + * +diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c +index 5c85350..19e301f 100644 +--- a/drivers/char/agp/intel-gtt.c ++++ b/drivers/char/agp/intel-gtt.c +@@ -586,7 +586,7 @@ static inline int needs_ilk_vtd_wa(void) + /* Query intel_iommu to see if we need the workaround. Presumably that + * was loaded first. + */ +- if ((gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB || ++ if ((gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_D_IG || + gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_M_IG) && + intel_iommu_gfx_mapped) + return 1; +diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c +index 102463ba..643bba7 100644 +--- a/drivers/char/tpm/tpm_ibmvtpm.c ++++ b/drivers/char/tpm/tpm_ibmvtpm.c +@@ -579,6 +579,9 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev, + goto cleanup; + } + ++ ibmvtpm->dev = dev; ++ ibmvtpm->vdev = vio_dev; ++ + crq_q = &ibmvtpm->crq_queue; + crq_q->crq_addr = (struct ibmvtpm_crq *)get_zeroed_page(GFP_KERNEL); + if (!crq_q->crq_addr) { +@@ -623,8 +626,6 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev, + + crq_q->index = 0; + +- ibmvtpm->dev = dev; +- ibmvtpm->vdev = vio_dev; + TPM_VPRIV(chip) = (void *)ibmvtpm; + + spin_lock_init(&ibmvtpm->rtce_lock); +diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c +index 831b482..ddd03f8 100644 +--- a/drivers/clocksource/exynos_mct.c ++++ b/drivers/clocksource/exynos_mct.c +@@ -422,15 +422,12 @@ static int exynos4_local_timer_setup(struct clock_event_device *evt) + exynos4_mct_write(TICK_BASE_CNT, mevt->base + MCT_L_TCNTB_OFFSET); + + if (mct_int_type == MCT_INT_SPI) { +- evt->irq = mct_irqs[MCT_L0_IRQ + cpu]; +- if (request_irq(evt->irq, exynos4_mct_tick_isr, +- IRQF_TIMER | IRQF_NOBALANCING, +- evt->name, mevt)) { +- pr_err("exynos-mct: cannot register IRQ %d\n", +- evt->irq); ++ ++ if (evt->irq == -1) + return -EIO; +- } +- irq_force_affinity(mct_irqs[MCT_L0_IRQ + cpu], cpumask_of(cpu)); ++ ++ irq_force_affinity(evt->irq, cpumask_of(cpu)); ++ enable_irq(evt->irq); + } else { + enable_percpu_irq(mct_irqs[MCT_L0_IRQ], 0); + } +@@ -443,10 +440,12 @@ static int exynos4_local_timer_setup(struct clock_event_device *evt) + static void exynos4_local_timer_stop(struct clock_event_device *evt) + { + evt->set_mode(CLOCK_EVT_MODE_UNUSED, evt); +- if (mct_int_type == MCT_INT_SPI) +- free_irq(evt->irq, this_cpu_ptr(&percpu_mct_tick)); +- else ++ if (mct_int_type == MCT_INT_SPI) { ++ if (evt->irq != -1) ++ disable_irq_nosync(evt->irq); ++ } else { + disable_percpu_irq(mct_irqs[MCT_L0_IRQ]); ++ } + } + + static int exynos4_mct_cpu_notify(struct notifier_block *self, +@@ -478,7 +477,7 @@ static struct notifier_block exynos4_mct_cpu_nb = { + + static void __init exynos4_timer_resources(struct device_node *np, void __iomem *base) + { +- int err; ++ int err, cpu; + struct mct_clock_event_device *mevt = this_cpu_ptr(&percpu_mct_tick); + struct clk *mct_clk, *tick_clk; + +@@ -505,7 +504,25 @@ static void __init exynos4_timer_resources(struct device_node *np, void __iomem + WARN(err, "MCT: can't request IRQ %d (%d)\n", + mct_irqs[MCT_L0_IRQ], err); + } else { +- irq_set_affinity(mct_irqs[MCT_L0_IRQ], cpumask_of(0)); ++ for_each_possible_cpu(cpu) { ++ int mct_irq = mct_irqs[MCT_L0_IRQ + cpu]; ++ struct mct_clock_event_device *pcpu_mevt = ++ per_cpu_ptr(&percpu_mct_tick, cpu); ++ ++ pcpu_mevt->evt.irq = -1; ++ ++ irq_set_status_flags(mct_irq, IRQ_NOAUTOEN); ++ if (request_irq(mct_irq, ++ exynos4_mct_tick_isr, ++ IRQF_TIMER | IRQF_NOBALANCING, ++ pcpu_mevt->name, pcpu_mevt)) { ++ pr_err("exynos-mct: cannot register IRQ (cpu%d)\n", ++ cpu); ++ ++ continue; ++ } ++ pcpu_mevt->evt.irq = mct_irq; ++ } + } + + err = register_cpu_notifier(&exynos4_mct_cpu_nb); +diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c +index e3d2052..1adc039 100644 +--- a/drivers/cpuidle/cpuidle.c ++++ b/drivers/cpuidle/cpuidle.c +@@ -131,6 +131,9 @@ int cpuidle_idle_call(void) + + /* ask the governor for the next state */ + next_state = cpuidle_curr_governor->select(drv, dev); ++ if (next_state < 0) ++ return -EBUSY; ++ + if (need_resched()) { + dev->last_residency = 0; + /* give the governor an opportunity to reflect on the outcome */ +diff --git a/drivers/cpuidle/governors/menu.c b/drivers/cpuidle/governors/menu.c +index cf7f2f0..027c484 100644 +--- a/drivers/cpuidle/governors/menu.c ++++ b/drivers/cpuidle/governors/menu.c +@@ -297,7 +297,7 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev) + data->needs_update = 0; + } + +- data->last_state_idx = 0; ++ data->last_state_idx = CPUIDLE_DRIVER_STATE_START - 1; + data->exit_us = 0; + + /* Special case when user has set very strict latency requirement */ +diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c +index 394cbc5..6b2f01d 100644 +--- a/drivers/dma/mv_xor.c ++++ b/drivers/dma/mv_xor.c +@@ -316,7 +316,8 @@ static void __mv_xor_slot_cleanup(struct mv_xor_chan *mv_chan) + dma_cookie_t cookie = 0; + int busy = mv_chan_is_busy(mv_chan); + u32 current_desc = mv_chan_get_current_desc(mv_chan); +- int seen_current = 0; ++ int current_cleaned = 0; ++ struct mv_xor_desc *hw_desc; + + dev_dbg(mv_chan_to_devp(mv_chan), "%s %d\n", __func__, __LINE__); + dev_dbg(mv_chan_to_devp(mv_chan), "current_desc %x\n", current_desc); +@@ -328,38 +329,57 @@ static void __mv_xor_slot_cleanup(struct mv_xor_chan *mv_chan) + + list_for_each_entry_safe(iter, _iter, &mv_chan->chain, + chain_node) { +- prefetch(_iter); +- prefetch(&_iter->async_tx); + +- /* do not advance past the current descriptor loaded into the +- * hardware channel, subsequent descriptors are either in +- * process or have not been submitted +- */ +- if (seen_current) +- break; ++ /* clean finished descriptors */ ++ hw_desc = iter->hw_desc; ++ if (hw_desc->status & XOR_DESC_SUCCESS) { ++ cookie = mv_xor_run_tx_complete_actions(iter, mv_chan, ++ cookie); + +- /* stop the search if we reach the current descriptor and the +- * channel is busy +- */ +- if (iter->async_tx.phys == current_desc) { +- seen_current = 1; +- if (busy) ++ /* done processing desc, clean slot */ ++ mv_xor_clean_slot(iter, mv_chan); ++ ++ /* break if we did cleaned the current */ ++ if (iter->async_tx.phys == current_desc) { ++ current_cleaned = 1; ++ break; ++ } ++ } else { ++ if (iter->async_tx.phys == current_desc) { ++ current_cleaned = 0; + break; ++ } + } +- +- cookie = mv_xor_run_tx_complete_actions(iter, mv_chan, cookie); +- +- if (mv_xor_clean_slot(iter, mv_chan)) +- break; + } + + if ((busy == 0) && !list_empty(&mv_chan->chain)) { +- struct mv_xor_desc_slot *chain_head; +- chain_head = list_entry(mv_chan->chain.next, +- struct mv_xor_desc_slot, +- chain_node); +- +- mv_xor_start_new_chain(mv_chan, chain_head); ++ if (current_cleaned) { ++ /* ++ * current descriptor cleaned and removed, run ++ * from list head ++ */ ++ iter = list_entry(mv_chan->chain.next, ++ struct mv_xor_desc_slot, ++ chain_node); ++ mv_xor_start_new_chain(mv_chan, iter); ++ } else { ++ if (!list_is_last(&iter->chain_node, &mv_chan->chain)) { ++ /* ++ * descriptors are still waiting after ++ * current, trigger them ++ */ ++ iter = list_entry(iter->chain_node.next, ++ struct mv_xor_desc_slot, ++ chain_node); ++ mv_xor_start_new_chain(mv_chan, iter); ++ } else { ++ /* ++ * some descriptors are still waiting ++ * to be cleaned ++ */ ++ tasklet_schedule(&mv_chan->irq_tasklet); ++ } ++ } + } + + if (cookie > 0) +diff --git a/drivers/dma/mv_xor.h b/drivers/dma/mv_xor.h +index d074922..5d14e4b 100644 +--- a/drivers/dma/mv_xor.h ++++ b/drivers/dma/mv_xor.h +@@ -33,6 +33,7 @@ + #define XOR_OPERATION_MODE_XOR 0 + #define XOR_OPERATION_MODE_MEMCPY 2 + #define XOR_DESCRIPTOR_SWAP BIT(14) ++#define XOR_DESC_SUCCESS 0x40000000 + + #define XOR_CURR_DESC(chan) (chan->mmr_high_base + 0x10 + (chan->idx * 4)) + #define XOR_NEXT_DESC(chan) (chan->mmr_high_base + 0x00 + (chan->idx * 4)) +diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c +index 3b7d32d..903db3c 100644 +--- a/drivers/gpu/drm/drm_crtc.c ++++ b/drivers/gpu/drm/drm_crtc.c +@@ -2155,8 +2155,11 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, + if (!drm_core_check_feature(dev, DRIVER_MODESET)) + return -EINVAL; + +- /* For some reason crtc x/y offsets are signed internally. */ +- if (crtc_req->x > INT_MAX || crtc_req->y > INT_MAX) ++ /* ++ * Universal plane src offsets are only 16.16, prevent havoc for ++ * drivers using universal plane code internally. ++ */ ++ if (crtc_req->x & 0xffff0000 || crtc_req->y & 0xffff0000) + return -ERANGE; + + drm_modeset_lock_all(dev); +diff --git a/drivers/gpu/drm/qxl/qxl_cmd.c b/drivers/gpu/drm/qxl/qxl_cmd.c +index eb89653..c5e96a3 100644 +--- a/drivers/gpu/drm/qxl/qxl_cmd.c ++++ b/drivers/gpu/drm/qxl/qxl_cmd.c +@@ -505,6 +505,7 @@ int qxl_hw_surface_alloc(struct qxl_device *qdev, + + cmd = (struct qxl_surface_cmd *)qxl_release_map(qdev, release); + cmd->type = QXL_SURFACE_CMD_CREATE; ++ cmd->flags = QXL_SURF_FLAG_KEEP_DATA; + cmd->u.surface_create.format = surf->surf.format; + cmd->u.surface_create.width = surf->surf.width; + cmd->u.surface_create.height = surf->surf.height; +diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c +index 0bb86e6..56a13a9 100644 +--- a/drivers/gpu/drm/qxl/qxl_ioctl.c ++++ b/drivers/gpu/drm/qxl/qxl_ioctl.c +@@ -122,8 +122,10 @@ static struct qxl_bo *qxlhw_handle_to_bo(struct qxl_device *qdev, + qobj = gem_to_qxl_bo(gobj); + + ret = qxl_release_list_add(release, qobj); +- if (ret) ++ if (ret) { ++ drm_gem_object_unreference_unlocked(gobj); + return NULL; ++ } + + return qobj; + } +diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c +index c4558bd..2fd2fb3 100644 +--- a/drivers/gpu/drm/radeon/cik.c ++++ b/drivers/gpu/drm/radeon/cik.c +@@ -4148,6 +4148,31 @@ void cik_compute_set_wptr(struct radeon_device *rdev, + WDOORBELL32(ring->doorbell_index, ring->wptr); + } + ++static void cik_compute_stop(struct radeon_device *rdev, ++ struct radeon_ring *ring) ++{ ++ u32 j, tmp; ++ ++ cik_srbm_select(rdev, ring->me, ring->pipe, ring->queue, 0); ++ /* Disable wptr polling. */ ++ tmp = RREG32(CP_PQ_WPTR_POLL_CNTL); ++ tmp &= ~WPTR_POLL_EN; ++ WREG32(CP_PQ_WPTR_POLL_CNTL, tmp); ++ /* Disable HQD. */ ++ if (RREG32(CP_HQD_ACTIVE) & 1) { ++ WREG32(CP_HQD_DEQUEUE_REQUEST, 1); ++ for (j = 0; j < rdev->usec_timeout; j++) { ++ if (!(RREG32(CP_HQD_ACTIVE) & 1)) ++ break; ++ udelay(1); ++ } ++ WREG32(CP_HQD_DEQUEUE_REQUEST, 0); ++ WREG32(CP_HQD_PQ_RPTR, 0); ++ WREG32(CP_HQD_PQ_WPTR, 0); ++ } ++ cik_srbm_select(rdev, 0, 0, 0, 0); ++} ++ + /** + * cik_cp_compute_enable - enable/disable the compute CP MEs + * +@@ -4161,6 +4186,15 @@ static void cik_cp_compute_enable(struct radeon_device *rdev, bool enable) + if (enable) + WREG32(CP_MEC_CNTL, 0); + else { ++ /* ++ * To make hibernation reliable we need to clear compute ring ++ * configuration before halting the compute ring. ++ */ ++ mutex_lock(&rdev->srbm_mutex); ++ cik_compute_stop(rdev,&rdev->ring[CAYMAN_RING_TYPE_CP1_INDEX]); ++ cik_compute_stop(rdev,&rdev->ring[CAYMAN_RING_TYPE_CP2_INDEX]); ++ mutex_unlock(&rdev->srbm_mutex); ++ + WREG32(CP_MEC_CNTL, (MEC_ME1_HALT | MEC_ME2_HALT)); + rdev->ring[CAYMAN_RING_TYPE_CP1_INDEX].ready = false; + rdev->ring[CAYMAN_RING_TYPE_CP2_INDEX].ready = false; +diff --git a/drivers/gpu/drm/radeon/cik_sdma.c b/drivers/gpu/drm/radeon/cik_sdma.c +index 66ba713..e590aec 100644 +--- a/drivers/gpu/drm/radeon/cik_sdma.c ++++ b/drivers/gpu/drm/radeon/cik_sdma.c +@@ -266,6 +266,17 @@ static void cik_sdma_gfx_stop(struct radeon_device *rdev) + } + rdev->ring[R600_RING_TYPE_DMA_INDEX].ready = false; + rdev->ring[CAYMAN_RING_TYPE_DMA1_INDEX].ready = false; ++ ++ /* FIXME use something else than big hammer but after few days can not ++ * seem to find good combination so reset SDMA blocks as it seems we ++ * do not shut them down properly. This fix hibernation and does not ++ * affect suspend to ram. ++ */ ++ WREG32(SRBM_SOFT_RESET, SOFT_RESET_SDMA | SOFT_RESET_SDMA1); ++ (void)RREG32(SRBM_SOFT_RESET); ++ udelay(50); ++ WREG32(SRBM_SOFT_RESET, 0); ++ (void)RREG32(SRBM_SOFT_RESET); + } + + /** +diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c +index a8f9b46..e609722 100644 +--- a/drivers/gpu/drm/radeon/radeon_gart.c ++++ b/drivers/gpu/drm/radeon/radeon_gart.c +@@ -251,8 +251,10 @@ void radeon_gart_unbind(struct radeon_device *rdev, unsigned offset, + } + } + } +- mb(); +- radeon_gart_tlb_flush(rdev); ++ if (rdev->gart.ptr) { ++ mb(); ++ radeon_gart_tlb_flush(rdev); ++ } + } + + /** +@@ -294,8 +296,10 @@ int radeon_gart_bind(struct radeon_device *rdev, unsigned offset, + } + } + } +- mb(); +- radeon_gart_tlb_flush(rdev); ++ if (rdev->gart.ptr) { ++ mb(); ++ radeon_gart_tlb_flush(rdev); ++ } + return 0; + } + +diff --git a/drivers/gpu/drm/radeon/radeon_irq_kms.c b/drivers/gpu/drm/radeon/radeon_irq_kms.c +index b3f0293..f8b20e1 100644 +--- a/drivers/gpu/drm/radeon/radeon_irq_kms.c ++++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c +@@ -79,10 +79,12 @@ static void radeon_hotplug_work_func(struct work_struct *work) + struct drm_mode_config *mode_config = &dev->mode_config; + struct drm_connector *connector; + ++ mutex_lock(&mode_config->mutex); + if (mode_config->num_connector) { + list_for_each_entry(connector, &mode_config->connector_list, head) + radeon_connector_hotplug(connector); + } ++ mutex_unlock(&mode_config->mutex); + /* Just fire off a uevent and let userspace tell us what to do */ + drm_helper_hpd_irq_event(dev); + } +diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c +index 11804cc..c9053f7 100644 +--- a/drivers/gpu/drm/radeon/si_dpm.c ++++ b/drivers/gpu/drm/radeon/si_dpm.c +@@ -2914,6 +2914,7 @@ static struct si_dpm_quirk si_dpm_quirk_list[] = { + /* PITCAIRN - https://bugs.freedesktop.org/show_bug.cgi?id=76490 */ + { PCI_VENDOR_ID_ATI, 0x6810, 0x1462, 0x3036, 0, 120000 }, + { PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0xe271, 0, 120000 }, ++ { PCI_VENDOR_ID_ATI, 0x6810, 0x174b, 0xe271, 85000, 90000 }, + { 0, 0, 0, 0 }, + }; + +diff --git a/drivers/hwmon/mcp3021.c b/drivers/hwmon/mcp3021.c +index d219c06..972444a 100644 +--- a/drivers/hwmon/mcp3021.c ++++ b/drivers/hwmon/mcp3021.c +@@ -31,14 +31,11 @@ + /* output format */ + #define MCP3021_SAR_SHIFT 2 + #define MCP3021_SAR_MASK 0x3ff +- + #define MCP3021_OUTPUT_RES 10 /* 10-bit resolution */ +-#define MCP3021_OUTPUT_SCALE 4 + + #define MCP3221_SAR_SHIFT 0 + #define MCP3221_SAR_MASK 0xfff + #define MCP3221_OUTPUT_RES 12 /* 12-bit resolution */ +-#define MCP3221_OUTPUT_SCALE 1 + + enum chips { + mcp3021, +@@ -54,7 +51,6 @@ struct mcp3021_data { + u16 sar_shift; + u16 sar_mask; + u8 output_res; +- u8 output_scale; + }; + + static int mcp3021_read16(struct i2c_client *client) +@@ -84,13 +80,7 @@ static int mcp3021_read16(struct i2c_client *client) + + static inline u16 volts_from_reg(struct mcp3021_data *data, u16 val) + { +- if (val == 0) +- return 0; +- +- val = val * data->output_scale - data->output_scale / 2; +- +- return val * DIV_ROUND_CLOSEST(data->vdd, +- (1 << data->output_res) * data->output_scale); ++ return DIV_ROUND_CLOSEST(data->vdd * val, 1 << data->output_res); + } + + static ssize_t show_in_input(struct device *dev, struct device_attribute *attr, +@@ -132,14 +122,12 @@ static int mcp3021_probe(struct i2c_client *client, + data->sar_shift = MCP3021_SAR_SHIFT; + data->sar_mask = MCP3021_SAR_MASK; + data->output_res = MCP3021_OUTPUT_RES; +- data->output_scale = MCP3021_OUTPUT_SCALE; + break; + + case mcp3221: + data->sar_shift = MCP3221_SAR_SHIFT; + data->sar_mask = MCP3221_SAR_MASK; + data->output_res = MCP3221_OUTPUT_RES; +- data->output_scale = MCP3221_OUTPUT_SCALE; + break; + } + +diff --git a/drivers/i2c/busses/i2c-at91.c b/drivers/i2c/busses/i2c-at91.c +index 8873d84..50862c9 100644 +--- a/drivers/i2c/busses/i2c-at91.c ++++ b/drivers/i2c/busses/i2c-at91.c +@@ -62,6 +62,9 @@ + #define AT91_TWI_UNRE 0x0080 /* Underrun Error */ + #define AT91_TWI_NACK 0x0100 /* Not Acknowledged */ + ++#define AT91_TWI_INT_MASK \ ++ (AT91_TWI_TXCOMP | AT91_TWI_RXRDY | AT91_TWI_TXRDY | AT91_TWI_NACK) ++ + #define AT91_TWI_IER 0x0024 /* Interrupt Enable Register */ + #define AT91_TWI_IDR 0x0028 /* Interrupt Disable Register */ + #define AT91_TWI_IMR 0x002c /* Interrupt Mask Register */ +@@ -117,13 +120,12 @@ static void at91_twi_write(struct at91_twi_dev *dev, unsigned reg, unsigned val) + + static void at91_disable_twi_interrupts(struct at91_twi_dev *dev) + { +- at91_twi_write(dev, AT91_TWI_IDR, +- AT91_TWI_TXCOMP | AT91_TWI_RXRDY | AT91_TWI_TXRDY); ++ at91_twi_write(dev, AT91_TWI_IDR, AT91_TWI_INT_MASK); + } + + static void at91_twi_irq_save(struct at91_twi_dev *dev) + { +- dev->imr = at91_twi_read(dev, AT91_TWI_IMR) & 0x7; ++ dev->imr = at91_twi_read(dev, AT91_TWI_IMR) & AT91_TWI_INT_MASK; + at91_disable_twi_interrupts(dev); + } + +@@ -213,6 +215,14 @@ static void at91_twi_write_data_dma_callback(void *data) + dma_unmap_single(dev->dev, sg_dma_address(&dev->dma.sg), + dev->buf_len, DMA_TO_DEVICE); + ++ /* ++ * When this callback is called, THR/TX FIFO is likely not to be empty ++ * yet. So we have to wait for TXCOMP or NACK bits to be set into the ++ * Status Register to be sure that the STOP bit has been sent and the ++ * transfer is completed. The NACK interrupt has already been enabled, ++ * we just have to enable TXCOMP one. ++ */ ++ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_TXCOMP); + at91_twi_write(dev, AT91_TWI_CR, AT91_TWI_STOP); + } + +@@ -307,7 +317,7 @@ static void at91_twi_read_data_dma_callback(void *data) + /* The last two bytes have to be read without using dma */ + dev->buf += dev->buf_len - 2; + dev->buf_len = 2; +- at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_RXRDY); ++ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_RXRDY | AT91_TWI_TXCOMP); + } + + static void at91_twi_read_data_dma(struct at91_twi_dev *dev) +@@ -368,7 +378,7 @@ static irqreturn_t atmel_twi_interrupt(int irq, void *dev_id) + /* catch error flags */ + dev->transfer_status |= status; + +- if (irqstatus & AT91_TWI_TXCOMP) { ++ if (irqstatus & (AT91_TWI_TXCOMP | AT91_TWI_NACK)) { + at91_disable_twi_interrupts(dev); + complete(&dev->cmd_complete); + } +@@ -381,6 +391,34 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev) + int ret; + bool has_unre_flag = dev->pdata->has_unre_flag; + ++ /* ++ * WARNING: the TXCOMP bit in the Status Register is NOT a clear on ++ * read flag but shows the state of the transmission at the time the ++ * Status Register is read. According to the programmer datasheet, ++ * TXCOMP is set when both holding register and internal shifter are ++ * empty and STOP condition has been sent. ++ * Consequently, we should enable NACK interrupt rather than TXCOMP to ++ * detect transmission failure. ++ * ++ * Besides, the TXCOMP bit is already set before the i2c transaction ++ * has been started. For read transactions, this bit is cleared when ++ * writing the START bit into the Control Register. So the ++ * corresponding interrupt can safely be enabled just after. ++ * However for write transactions managed by the CPU, we first write ++ * into THR, so TXCOMP is cleared. Then we can safely enable TXCOMP ++ * interrupt. If TXCOMP interrupt were enabled before writing into THR, ++ * the interrupt handler would be called immediately and the i2c command ++ * would be reported as completed. ++ * Also when a write transaction is managed by the DMA controller, ++ * enabling the TXCOMP interrupt in this function may lead to a race ++ * condition since we don't know whether the TXCOMP interrupt is enabled ++ * before or after the DMA has started to write into THR. So the TXCOMP ++ * interrupt is enabled later by at91_twi_write_data_dma_callback(). ++ * Immediately after in that DMA callback, we still need to send the ++ * STOP condition manually writing the corresponding bit into the ++ * Control Register. ++ */ ++ + dev_dbg(dev->dev, "transfer: %s %d bytes.\n", + (dev->msg->flags & I2C_M_RD) ? "read" : "write", dev->buf_len); + +@@ -411,26 +449,24 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev) + * seems to be the best solution. + */ + if (dev->use_dma && (dev->buf_len > AT91_I2C_DMA_THRESHOLD)) { ++ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_NACK); + at91_twi_read_data_dma(dev); +- /* +- * It is important to enable TXCOMP irq here because +- * doing it only when transferring the last two bytes +- * will mask NACK errors since TXCOMP is set when a +- * NACK occurs. +- */ +- at91_twi_write(dev, AT91_TWI_IER, +- AT91_TWI_TXCOMP); +- } else ++ } else { + at91_twi_write(dev, AT91_TWI_IER, +- AT91_TWI_TXCOMP | AT91_TWI_RXRDY); ++ AT91_TWI_TXCOMP | ++ AT91_TWI_NACK | ++ AT91_TWI_RXRDY); ++ } + } else { + if (dev->use_dma && (dev->buf_len > AT91_I2C_DMA_THRESHOLD)) { ++ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_NACK); + at91_twi_write_data_dma(dev); +- at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_TXCOMP); + } else { + at91_twi_write_next_byte(dev); + at91_twi_write(dev, AT91_TWI_IER, +- AT91_TWI_TXCOMP | AT91_TWI_TXRDY); ++ AT91_TWI_TXCOMP | ++ AT91_TWI_NACK | ++ AT91_TWI_TXRDY); + } + } + +diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c +index e6bf77d..ed4e45f 100644 +--- a/drivers/iio/adc/at91_adc.c ++++ b/drivers/iio/adc/at91_adc.c +@@ -58,7 +58,7 @@ struct at91_adc_caps { + u8 ts_pen_detect_sensitivity; + + /* startup time calculate function */ +- u32 (*calc_startup_ticks)(u8 startup_time, u32 adc_clk_khz); ++ u32 (*calc_startup_ticks)(u32 startup_time, u32 adc_clk_khz); + + u8 num_channels; + struct at91_adc_reg_desc registers; +@@ -82,7 +82,7 @@ struct at91_adc_state { + u8 num_channels; + void __iomem *reg_base; + struct at91_adc_reg_desc *registers; +- u8 startup_time; ++ u32 startup_time; + u8 sample_hold_time; + bool sleep_mode; + struct iio_trigger **trig; +@@ -590,7 +590,7 @@ ret: + return ret; + } + +-static u32 calc_startup_ticks_9260(u8 startup_time, u32 adc_clk_khz) ++static u32 calc_startup_ticks_9260(u32 startup_time, u32 adc_clk_khz) + { + /* + * Number of ticks needed to cover the startup time of the ADC +@@ -601,7 +601,7 @@ static u32 calc_startup_ticks_9260(u8 startup_time, u32 adc_clk_khz) + return round_up((startup_time * adc_clk_khz / 1000) - 1, 8) / 8; + } + +-static u32 calc_startup_ticks_9x5(u8 startup_time, u32 adc_clk_khz) ++static u32 calc_startup_ticks_9x5(u32 startup_time, u32 adc_clk_khz) + { + /* + * For sama5d3x and at91sam9x5, the formula changes to: +diff --git a/drivers/iio/dac/ad5624r_spi.c b/drivers/iio/dac/ad5624r_spi.c +index e8199cc..1e66651 100644 +--- a/drivers/iio/dac/ad5624r_spi.c ++++ b/drivers/iio/dac/ad5624r_spi.c +@@ -22,7 +22,7 @@ + #include "ad5624r.h" + + static int ad5624r_spi_write(struct spi_device *spi, +- u8 cmd, u8 addr, u16 val, u8 len) ++ u8 cmd, u8 addr, u16 val, u8 shift) + { + u32 data; + u8 msg[3]; +@@ -35,7 +35,7 @@ static int ad5624r_spi_write(struct spi_device *spi, + * 14-, 12-bit input code followed by 0, 2, or 4 don't care bits, + * for the AD5664R, AD5644R, and AD5624R, respectively. + */ +- data = (0 << 22) | (cmd << 19) | (addr << 16) | (val << (16 - len)); ++ data = (0 << 22) | (cmd << 19) | (addr << 16) | (val << shift); + msg[0] = data >> 16; + msg[1] = data >> 8; + msg[2] = data; +diff --git a/drivers/iio/temperature/tmp006.c b/drivers/iio/temperature/tmp006.c +index 84a0789..7a80509 100644 +--- a/drivers/iio/temperature/tmp006.c ++++ b/drivers/iio/temperature/tmp006.c +@@ -132,6 +132,9 @@ static int tmp006_write_raw(struct iio_dev *indio_dev, + struct tmp006_data *data = iio_priv(indio_dev); + int i; + ++ if (mask != IIO_CHAN_INFO_SAMP_FREQ) ++ return -EINVAL; ++ + for (i = 0; i < ARRAY_SIZE(tmp006_freqs); i++) + if ((val == tmp006_freqs[i][0]) && + (val2 == tmp006_freqs[i][1])) { +diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c +index 6014227..dd2b610 100644 +--- a/drivers/infiniband/ulp/isert/ib_isert.c ++++ b/drivers/infiniband/ulp/isert/ib_isert.c +@@ -59,6 +59,8 @@ static int + isert_rdma_accept(struct isert_conn *isert_conn); + struct rdma_cm_id *isert_setup_id(struct isert_np *isert_np); + ++static void isert_release_work(struct work_struct *work); ++ + static void + isert_qp_event_callback(struct ib_event *e, void *context) + { +@@ -206,7 +208,7 @@ fail: + static void + isert_free_rx_descriptors(struct isert_conn *isert_conn) + { +- struct ib_device *ib_dev = isert_conn->conn_cm_id->device; ++ struct ib_device *ib_dev = isert_conn->conn_device->ib_device; + struct iser_rx_desc *rx_desc; + int i; + +@@ -534,6 +536,7 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event) + mutex_init(&isert_conn->conn_mutex); + spin_lock_init(&isert_conn->conn_lock); + INIT_LIST_HEAD(&isert_conn->conn_fr_pool); ++ INIT_WORK(&isert_conn->release_work, isert_release_work); + + isert_conn->conn_cm_id = cma_id; + isert_conn->responder_resources = event->param.conn.responder_resources; +@@ -647,9 +650,9 @@ out: + static void + isert_connect_release(struct isert_conn *isert_conn) + { +- struct ib_device *ib_dev = isert_conn->conn_cm_id->device; + struct isert_device *device = isert_conn->conn_device; + int cq_index; ++ struct ib_device *ib_dev = device->ib_device; + + pr_debug("Entering isert_connect_release(): >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n"); + +@@ -657,7 +660,8 @@ isert_connect_release(struct isert_conn *isert_conn) + isert_conn_free_fastreg_pool(isert_conn); + + isert_free_rx_descriptors(isert_conn); +- rdma_destroy_id(isert_conn->conn_cm_id); ++ if (isert_conn->conn_cm_id) ++ rdma_destroy_id(isert_conn->conn_cm_id); + + if (isert_conn->conn_qp) { + cq_index = ((struct isert_cq_desc *) +@@ -799,6 +803,7 @@ isert_disconnected_handler(struct rdma_cm_id *cma_id, + { + struct isert_np *isert_np = cma_id->context; + struct isert_conn *isert_conn; ++ bool terminating = false; + + if (isert_np->np_cm_id == cma_id) + return isert_np_cma_handler(cma_id->context, event); +@@ -806,21 +811,37 @@ isert_disconnected_handler(struct rdma_cm_id *cma_id, + isert_conn = cma_id->qp->qp_context; + + mutex_lock(&isert_conn->conn_mutex); ++ terminating = (isert_conn->state == ISER_CONN_TERMINATING); + isert_conn_terminate(isert_conn); + mutex_unlock(&isert_conn->conn_mutex); + + pr_info("conn %p completing conn_wait\n", isert_conn); + complete(&isert_conn->conn_wait); + ++ if (terminating) ++ goto out; ++ ++ mutex_lock(&isert_np->np_accept_mutex); ++ if (!list_empty(&isert_conn->conn_accept_node)) { ++ list_del_init(&isert_conn->conn_accept_node); ++ isert_put_conn(isert_conn); ++ queue_work(isert_release_wq, &isert_conn->release_work); ++ } ++ mutex_unlock(&isert_np->np_accept_mutex); ++ ++out: + return 0; + } + +-static void ++static int + isert_connect_error(struct rdma_cm_id *cma_id) + { + struct isert_conn *isert_conn = cma_id->qp->qp_context; + ++ isert_conn->conn_cm_id = NULL; + isert_put_conn(isert_conn); ++ ++ return -1; + } + + static int +@@ -850,7 +871,7 @@ isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event) + case RDMA_CM_EVENT_REJECTED: /* FALLTHRU */ + case RDMA_CM_EVENT_UNREACHABLE: /* FALLTHRU */ + case RDMA_CM_EVENT_CONNECT_ERROR: +- isert_connect_error(cma_id); ++ ret = isert_connect_error(cma_id); + break; + default: + pr_err("Unhandled RDMA CMA event: %d\n", event->event); +@@ -2944,7 +2965,6 @@ static void isert_wait_conn(struct iscsi_conn *conn) + + wait_for_completion(&isert_conn->conn_wait_comp_err); + +- INIT_WORK(&isert_conn->release_work, isert_release_work); + queue_work(isert_release_wq, &isert_conn->release_work); + } + +diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c +index f37d63c..825545c 100644 +--- a/drivers/leds/led-class.c ++++ b/drivers/leds/led-class.c +@@ -178,6 +178,7 @@ void led_classdev_resume(struct led_classdev *led_cdev) + } + EXPORT_SYMBOL_GPL(led_classdev_resume); + ++#ifdef CONFIG_PM_SLEEP + static int led_suspend(struct device *dev) + { + struct led_classdev *led_cdev = dev_get_drvdata(dev); +@@ -197,11 +198,9 @@ static int led_resume(struct device *dev) + + return 0; + } ++#endif + +-static const struct dev_pm_ops leds_class_dev_pm_ops = { +- .suspend = led_suspend, +- .resume = led_resume, +-}; ++static SIMPLE_DEV_PM_OPS(leds_class_dev_pm_ops, led_suspend, led_resume); + + /** + * led_classdev_register - register a new object of led_classdev class. +diff --git a/drivers/md/dm-stats.c b/drivers/md/dm-stats.c +index 28a9012..b3b0697 100644 +--- a/drivers/md/dm-stats.c ++++ b/drivers/md/dm-stats.c +@@ -795,6 +795,8 @@ static int message_stats_create(struct mapped_device *md, + return -EINVAL; + + if (sscanf(argv[2], "/%u%c", &divisor, &dummy) == 1) { ++ if (!divisor) ++ return -EINVAL; + step = end - start; + if (do_div(step, divisor)) + step++; +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 40959ee..b4067b9 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -6232,7 +6232,7 @@ static int update_array_info(struct mddev *mddev, mdu_array_info_t *info) + mddev->ctime != info->ctime || + mddev->level != info->level || + /* mddev->layout != info->layout || */ +- !mddev->persistent != info->not_persistent|| ++ mddev->persistent != !info->not_persistent || + mddev->chunk_sectors != info->chunk_size >> 9 || + /* ignore bottom 8 bits of state, and allow SB_BITMAP_PRESENT to change */ + ((state^info->state) & 0xfffffe00) +diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c +index b88757c..a03178e 100644 +--- a/drivers/md/persistent-data/dm-btree-remove.c ++++ b/drivers/md/persistent-data/dm-btree-remove.c +@@ -309,8 +309,8 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent, + + if (s < 0 && nr_center < -s) { + /* not enough in central node */ +- shift(left, center, nr_center); +- s = nr_center - target; ++ shift(left, center, -nr_center); ++ s += nr_center; + shift(left, right, s); + nr_right += s; + } else +@@ -323,7 +323,7 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent, + if (s > 0 && nr_center < s) { + /* not enough in central node */ + shift(center, right, nr_center); +- s = target - nr_center; ++ s -= nr_center; + shift(left, right, s); + nr_left -= s; + } else +diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c +index 200ac12..fdd3793 100644 +--- a/drivers/md/persistent-data/dm-btree.c ++++ b/drivers/md/persistent-data/dm-btree.c +@@ -255,7 +255,7 @@ int dm_btree_del(struct dm_btree_info *info, dm_block_t root) + int r; + struct del_stack *s; + +- s = kmalloc(sizeof(*s), GFP_KERNEL); ++ s = kmalloc(sizeof(*s), GFP_NOIO); + if (!s) + return -ENOMEM; + s->info = info; +diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c +index f4e22bc..199c9cc 100644 +--- a/drivers/md/persistent-data/dm-space-map-metadata.c ++++ b/drivers/md/persistent-data/dm-space-map-metadata.c +@@ -204,6 +204,27 @@ static void in(struct sm_metadata *smm) + smm->recursion_count++; + } + ++static int apply_bops(struct sm_metadata *smm) ++{ ++ int r = 0; ++ ++ while (!brb_empty(&smm->uncommitted)) { ++ struct block_op bop; ++ ++ r = brb_pop(&smm->uncommitted, &bop); ++ if (r) { ++ DMERR("bug in bop ring buffer"); ++ break; ++ } ++ ++ r = commit_bop(smm, &bop); ++ if (r) ++ break; ++ } ++ ++ return r; ++} ++ + static int out(struct sm_metadata *smm) + { + int r = 0; +@@ -216,21 +237,8 @@ static int out(struct sm_metadata *smm) + return -ENOMEM; + } + +- if (smm->recursion_count == 1) { +- while (!brb_empty(&smm->uncommitted)) { +- struct block_op bop; +- +- r = brb_pop(&smm->uncommitted, &bop); +- if (r) { +- DMERR("bug in bop ring buffer"); +- break; +- } +- +- r = commit_bop(smm, &bop); +- if (r) +- break; +- } +- } ++ if (smm->recursion_count == 1) ++ apply_bops(smm); + + smm->recursion_count--; + +@@ -702,6 +710,12 @@ static int sm_metadata_extend(struct dm_space_map *sm, dm_block_t extra_blocks) + } + old_len = smm->begin; + ++ r = apply_bops(smm); ++ if (r) { ++ DMERR("%s: apply_bops failed", __func__); ++ goto out; ++ } ++ + r = sm_ll_commit(&smm->ll); + if (r) + goto out; +@@ -771,6 +785,12 @@ int dm_sm_metadata_create(struct dm_space_map *sm, + if (r) + return r; + ++ r = apply_bops(smm); ++ if (r) { ++ DMERR("%s: apply_bops failed", __func__); ++ return r; ++ } ++ + return sm_metadata_commit(sm); + } + +diff --git a/drivers/media/dvb-frontends/af9013.c b/drivers/media/dvb-frontends/af9013.c +index fb504f1..5930aee 100644 +--- a/drivers/media/dvb-frontends/af9013.c ++++ b/drivers/media/dvb-frontends/af9013.c +@@ -606,6 +606,10 @@ static int af9013_set_frontend(struct dvb_frontend *fe) + } + } + ++ /* Return an error if can't find bandwidth or the right clock */ ++ if (i == ARRAY_SIZE(coeff_lut)) ++ return -EINVAL; ++ + ret = af9013_wr_regs(state, 0xae00, coeff_lut[i].val, + sizeof(coeff_lut[i].val)); + } +diff --git a/drivers/media/dvb-frontends/cx24116.c b/drivers/media/dvb-frontends/cx24116.c +index 2916d7c..7bc68b3 100644 +--- a/drivers/media/dvb-frontends/cx24116.c ++++ b/drivers/media/dvb-frontends/cx24116.c +@@ -963,6 +963,10 @@ static int cx24116_send_diseqc_msg(struct dvb_frontend *fe, + struct cx24116_state *state = fe->demodulator_priv; + int i, ret; + ++ /* Validate length */ ++ if (d->msg_len > sizeof(d->msg)) ++ return -EINVAL; ++ + /* Dump DiSEqC message */ + if (debug) { + printk(KERN_INFO "cx24116: %s(", __func__); +@@ -974,10 +978,6 @@ static int cx24116_send_diseqc_msg(struct dvb_frontend *fe, + printk(") toneburst=%d\n", toneburst); + } + +- /* Validate length */ +- if (d->msg_len > (CX24116_ARGLEN - CX24116_DISEQC_MSGOFS)) +- return -EINVAL; +- + /* DiSEqC message */ + for (i = 0; i < d->msg_len; i++) + state->dsec_cmd.args[CX24116_DISEQC_MSGOFS + i] = d->msg[i]; +diff --git a/drivers/media/dvb-frontends/cx24117.c b/drivers/media/dvb-frontends/cx24117.c +index a6c3c9e..d2eab06 100644 +--- a/drivers/media/dvb-frontends/cx24117.c ++++ b/drivers/media/dvb-frontends/cx24117.c +@@ -1043,7 +1043,7 @@ static int cx24117_send_diseqc_msg(struct dvb_frontend *fe, + dev_dbg(&state->priv->i2c->dev, ")\n"); + + /* Validate length */ +- if (d->msg_len > 15) ++ if (d->msg_len > sizeof(d->msg)) + return -EINVAL; + + /* DiSEqC message */ +diff --git a/drivers/media/dvb-frontends/s5h1420.c b/drivers/media/dvb-frontends/s5h1420.c +index 93eeaf7..0b4f8fe 100644 +--- a/drivers/media/dvb-frontends/s5h1420.c ++++ b/drivers/media/dvb-frontends/s5h1420.c +@@ -180,7 +180,7 @@ static int s5h1420_send_master_cmd (struct dvb_frontend* fe, + int result = 0; + + dprintk("enter %s\n", __func__); +- if (cmd->msg_len > 8) ++ if (cmd->msg_len > sizeof(cmd->msg)) + return -EINVAL; + + /* setup for DISEQC */ +diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c +index b1e21fc..d71f5ef 100644 +--- a/drivers/mmc/card/block.c ++++ b/drivers/mmc/card/block.c +@@ -205,6 +205,8 @@ static ssize_t power_ro_lock_show(struct device *dev, + + ret = snprintf(buf, PAGE_SIZE, "%d\n", locked); + ++ mmc_blk_put(md); ++ + return ret; + } + +@@ -1861,9 +1863,11 @@ static int mmc_blk_issue_rw_rq(struct mmc_queue *mq, struct request *rqc) + break; + case MMC_BLK_CMD_ERR: + ret = mmc_blk_cmd_err(md, card, brq, req, ret); +- if (!mmc_blk_reset(md, card->host, type)) +- break; +- goto cmd_abort; ++ if (mmc_blk_reset(md, card->host, type)) ++ goto cmd_abort; ++ if (!ret) ++ goto start_new_req; ++ break; + case MMC_BLK_RETRY: + if (retry++ < 5) + break; +diff --git a/drivers/mtd/maps/dc21285.c b/drivers/mtd/maps/dc21285.c +index f8a7dd1..70a3db3 100644 +--- a/drivers/mtd/maps/dc21285.c ++++ b/drivers/mtd/maps/dc21285.c +@@ -38,9 +38,9 @@ static void nw_en_write(void) + * we want to write a bit pattern XXX1 to Xilinx to enable + * the write gate, which will be open for about the next 2ms. + */ +- spin_lock_irqsave(&nw_gpio_lock, flags); ++ raw_spin_lock_irqsave(&nw_gpio_lock, flags); + nw_cpld_modify(CPLD_FLASH_WR_ENABLE, CPLD_FLASH_WR_ENABLE); +- spin_unlock_irqrestore(&nw_gpio_lock, flags); ++ raw_spin_unlock_irqrestore(&nw_gpio_lock, flags); + + /* + * let the ISA bus to catch on... +diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c +index 5073cbc..32d5e40 100644 +--- a/drivers/mtd/mtd_blkdevs.c ++++ b/drivers/mtd/mtd_blkdevs.c +@@ -199,6 +199,7 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode) + return -ERESTARTSYS; /* FIXME: busy loop! -arnd*/ + + mutex_lock(&dev->lock); ++ mutex_lock(&mtd_table_mutex); + + if (dev->open) + goto unlock; +@@ -222,6 +223,7 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode) + + unlock: + dev->open++; ++ mutex_unlock(&mtd_table_mutex); + mutex_unlock(&dev->lock); + blktrans_dev_put(dev); + return ret; +@@ -232,6 +234,7 @@ error_release: + error_put: + module_put(dev->tr->owner); + kref_put(&dev->ref, blktrans_dev_release); ++ mutex_unlock(&mtd_table_mutex); + mutex_unlock(&dev->lock); + blktrans_dev_put(dev); + return ret; +@@ -245,6 +248,7 @@ static void blktrans_release(struct gendisk *disk, fmode_t mode) + return; + + mutex_lock(&dev->lock); ++ mutex_lock(&mtd_table_mutex); + + if (--dev->open) + goto unlock; +@@ -258,6 +262,7 @@ static void blktrans_release(struct gendisk *disk, fmode_t mode) + __put_mtd_device(dev->mtd); + } + unlock: ++ mutex_unlock(&mtd_table_mutex); + mutex_unlock(&dev->lock); + blktrans_dev_put(dev); + } +diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c +index 9715a7b..efc542d 100644 +--- a/drivers/mtd/nand/nand_base.c ++++ b/drivers/mtd/nand/nand_base.c +@@ -2000,7 +2000,7 @@ static int nand_write_page_raw_syndrome(struct mtd_info *mtd, + oob += chip->ecc.prepad; + } + +- chip->read_buf(mtd, oob, eccbytes); ++ chip->write_buf(mtd, oob, eccbytes); + oob += eccbytes; + + if (chip->ecc.postpad) { +@@ -3063,7 +3063,7 @@ static int nand_flash_detect_onfi(struct mtd_info *mtd, struct nand_chip *chip, + int *busw) + { + struct nand_onfi_params *p = &chip->onfi_params; +- int i; ++ int i, j; + int val; + + /* Try ONFI for unknown chip or LP */ +@@ -3072,18 +3072,10 @@ static int nand_flash_detect_onfi(struct mtd_info *mtd, struct nand_chip *chip, + chip->read_byte(mtd) != 'F' || chip->read_byte(mtd) != 'I') + return 0; + +- /* +- * ONFI must be probed in 8-bit mode or with NAND_BUSWIDTH_AUTO, not +- * with NAND_BUSWIDTH_16 +- */ +- if (chip->options & NAND_BUSWIDTH_16) { +- pr_err("ONFI cannot be probed in 16-bit mode; aborting\n"); +- return 0; +- } +- + chip->cmdfunc(mtd, NAND_CMD_PARAM, 0, -1); + for (i = 0; i < 3; i++) { +- chip->read_buf(mtd, (uint8_t *)p, sizeof(*p)); ++ for (j = 0; j < sizeof(*p); j++) ++ ((uint8_t *)p)[j] = chip->read_byte(mtd); + if (onfi_crc16(ONFI_CRC_BASE, (uint8_t *)p, 254) == + le16_to_cpu(p->crc)) { + break; +diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c +index 5924f72..f35ce8e 100644 +--- a/drivers/net/wireless/ath/ath9k/main.c ++++ b/drivers/net/wireless/ath/ath9k/main.c +@@ -205,11 +205,13 @@ static bool ath_prepare_reset(struct ath_softc *sc) + ath_stop_ani(sc); + ath9k_hw_disable_interrupts(ah); + +- if (!ath_drain_all_txq(sc)) +- ret = false; +- +- if (!ath_stoprecv(sc)) +- ret = false; ++ if (AR_SREV_9300_20_OR_LATER(ah)) { ++ ret &= ath_stoprecv(sc); ++ ret &= ath_drain_all_txq(sc); ++ } else { ++ ret &= ath_drain_all_txq(sc); ++ ret &= ath_stoprecv(sc); ++ } + + return ret; + } +diff --git a/drivers/of/base.c b/drivers/of/base.c +index 3935614..e99f329 100644 +--- a/drivers/of/base.c ++++ b/drivers/of/base.c +@@ -77,7 +77,7 @@ EXPORT_SYMBOL(of_n_size_cells); + #ifdef CONFIG_NUMA + int __weak of_node_to_nid(struct device_node *np) + { +- return numa_node_id(); ++ return NUMA_NO_NODE; + } + #endif + +diff --git a/drivers/pcmcia/topic.h b/drivers/pcmcia/topic.h +index 615a45a..582688fe 100644 +--- a/drivers/pcmcia/topic.h ++++ b/drivers/pcmcia/topic.h +@@ -104,6 +104,9 @@ + #define TOPIC_EXCA_IF_CONTROL 0x3e /* 8 bit */ + #define TOPIC_EXCA_IFC_33V_ENA 0x01 + ++#define TOPIC_PCI_CFG_PPBCN 0x3e /* 16-bit */ ++#define TOPIC_PCI_CFG_PPBCN_WBEN 0x0400 ++ + static void topic97_zoom_video(struct pcmcia_socket *sock, int onoff) + { + struct yenta_socket *socket = container_of(sock, struct yenta_socket, socket); +@@ -138,6 +141,7 @@ static int topic97_override(struct yenta_socket *socket) + static int topic95_override(struct yenta_socket *socket) + { + u8 fctrl; ++ u16 ppbcn; + + /* enable 3.3V support for 16bit cards */ + fctrl = exca_readb(socket, TOPIC_EXCA_IF_CONTROL); +@@ -146,6 +150,18 @@ static int topic95_override(struct yenta_socket *socket) + /* tell yenta to use exca registers to power 16bit cards */ + socket->flags |= YENTA_16BIT_POWER_EXCA | YENTA_16BIT_POWER_DF; + ++ /* Disable write buffers to prevent lockups under load with numerous ++ Cardbus cards, observed on Tecra 500CDT and reported elsewhere on the ++ net. This is not a power-on default according to the datasheet ++ but some BIOSes seem to set it. */ ++ if (pci_read_config_word(socket->dev, TOPIC_PCI_CFG_PPBCN, &ppbcn) == 0 ++ && socket->dev->revision <= 7 ++ && (ppbcn & TOPIC_PCI_CFG_PPBCN_WBEN)) { ++ ppbcn &= ~TOPIC_PCI_CFG_PPBCN_WBEN; ++ pci_write_config_word(socket->dev, TOPIC_PCI_CFG_PPBCN, ppbcn); ++ dev_info(&socket->dev->dev, "Disabled ToPIC95 Cardbus write buffers.\n"); ++ } ++ + return 0; + } + +diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-370.c b/drivers/pinctrl/mvebu/pinctrl-armada-370.c +index ae1f760..bb525b1 100644 +--- a/drivers/pinctrl/mvebu/pinctrl-armada-370.c ++++ b/drivers/pinctrl/mvebu/pinctrl-armada-370.c +@@ -358,11 +358,11 @@ static struct mvebu_mpp_mode mv88f6710_mpp_modes[] = { + MPP_MODE(64, + MPP_FUNCTION(0x0, "gpio", NULL), + MPP_FUNCTION(0x1, "spi0", "miso"), +- MPP_FUNCTION(0x2, "spi0-1", "cs1")), ++ MPP_FUNCTION(0x2, "spi0", "cs1")), + MPP_MODE(65, + MPP_FUNCTION(0x0, "gpio", NULL), + MPP_FUNCTION(0x1, "spi0", "mosi"), +- MPP_FUNCTION(0x2, "spi0-1", "cs2")), ++ MPP_FUNCTION(0x2, "spi0", "cs2")), + }; + + static struct mvebu_pinctrl_soc_info armada_370_pinctrl_info; +diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-xp.c b/drivers/pinctrl/mvebu/pinctrl-armada-xp.c +index 843a51f..d918c51 100644 +--- a/drivers/pinctrl/mvebu/pinctrl-armada-xp.c ++++ b/drivers/pinctrl/mvebu/pinctrl-armada-xp.c +@@ -14,10 +14,7 @@ + * available: mv78230, mv78260 and mv78460. From a pin muxing + * perspective, the mv78230 has 49 MPP pins. The mv78260 and mv78460 + * both have 67 MPP pins (more GPIOs and address lines for the memory +- * bus mainly). The only difference between the mv78260 and the +- * mv78460 in terms of pin muxing is the addition of two functions on +- * pins 43 and 56 to access the VDD of the CPU2 and 3 (mv78260 has two +- * cores, mv78460 has four cores). ++ * bus mainly). + */ + + #include <linux/err.h> +@@ -159,20 +156,17 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = { + MPP_MODE(24, + MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x1, "sata1", "prsnt", V_MV78230_PLUS), +- MPP_VAR_FUNCTION(0x2, "nf", "bootcs-re", V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x3, "tdm", "rst", V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x4, "lcd", "hsync", V_MV78230_PLUS)), + MPP_MODE(25, + MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x1, "sata0", "prsnt", V_MV78230_PLUS), +- MPP_VAR_FUNCTION(0x2, "nf", "bootcs-we", V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x3, "tdm", "pclk", V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x4, "lcd", "vsync", V_MV78230_PLUS)), + MPP_MODE(26, + MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x3, "tdm", "fsync", V_MV78230_PLUS), +- MPP_VAR_FUNCTION(0x4, "lcd", "clk", V_MV78230_PLUS), +- MPP_VAR_FUNCTION(0x5, "vdd", "cpu1-pd", V_MV78230_PLUS)), ++ MPP_VAR_FUNCTION(0x4, "lcd", "clk", V_MV78230_PLUS)), + MPP_MODE(27, + MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x1, "ptp", "trig", V_MV78230_PLUS), +@@ -187,8 +181,7 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = { + MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x1, "ptp", "clk", V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x3, "tdm", "int0", V_MV78230_PLUS), +- MPP_VAR_FUNCTION(0x4, "lcd", "ref-clk", V_MV78230_PLUS), +- MPP_VAR_FUNCTION(0x5, "vdd", "cpu0-pd", V_MV78230_PLUS)), ++ MPP_VAR_FUNCTION(0x4, "lcd", "ref-clk", V_MV78230_PLUS)), + MPP_MODE(30, + MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x1, "sd0", "clk", V_MV78230_PLUS), +@@ -196,13 +189,11 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = { + MPP_MODE(31, + MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x1, "sd0", "cmd", V_MV78230_PLUS), +- MPP_VAR_FUNCTION(0x3, "tdm", "int2", V_MV78230_PLUS), +- MPP_VAR_FUNCTION(0x5, "vdd", "cpu0-pd", V_MV78230_PLUS)), ++ MPP_VAR_FUNCTION(0x3, "tdm", "int2", V_MV78230_PLUS)), + MPP_MODE(32, + MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x1, "sd0", "d0", V_MV78230_PLUS), +- MPP_VAR_FUNCTION(0x3, "tdm", "int3", V_MV78230_PLUS), +- MPP_VAR_FUNCTION(0x5, "vdd", "cpu1-pd", V_MV78230_PLUS)), ++ MPP_VAR_FUNCTION(0x3, "tdm", "int3", V_MV78230_PLUS)), + MPP_MODE(33, + MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x1, "sd0", "d1", V_MV78230_PLUS), +@@ -234,7 +225,6 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = { + MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x1, "spi", "cs1", V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x2, "uart2", "cts", V_MV78230_PLUS), +- MPP_VAR_FUNCTION(0x3, "vdd", "cpu1-pd", V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x4, "lcd", "vga-hsync", V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x5, "pcie", "clkreq0", V_MV78230_PLUS)), + MPP_MODE(41, +@@ -249,15 +239,13 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = { + MPP_VAR_FUNCTION(0x1, "uart2", "rxd", V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x2, "uart0", "cts", V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x3, "tdm", "int7", V_MV78230_PLUS), +- MPP_VAR_FUNCTION(0x4, "tdm-1", "timer", V_MV78230_PLUS), +- MPP_VAR_FUNCTION(0x5, "vdd", "cpu0-pd", V_MV78230_PLUS)), ++ MPP_VAR_FUNCTION(0x4, "tdm-1", "timer", V_MV78230_PLUS)), + MPP_MODE(43, + MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x1, "uart2", "txd", V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x2, "uart0", "rts", V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x3, "spi", "cs3", V_MV78230_PLUS), +- MPP_VAR_FUNCTION(0x4, "pcie", "rstout", V_MV78230_PLUS), +- MPP_VAR_FUNCTION(0x5, "vdd", "cpu2-3-pd", V_MV78460)), ++ MPP_VAR_FUNCTION(0x4, "pcie", "rstout", V_MV78230_PLUS)), + MPP_MODE(44, + MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x1, "uart2", "cts", V_MV78230_PLUS), +@@ -286,7 +274,7 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = { + MPP_VAR_FUNCTION(0x5, "pcie", "clkreq3", V_MV78230_PLUS)), + MPP_MODE(48, + MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), +- MPP_VAR_FUNCTION(0x1, "tclk", NULL, V_MV78230_PLUS), ++ MPP_VAR_FUNCTION(0x1, "dev", "clkout", V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x2, "dev", "burst/last", V_MV78230_PLUS)), + MPP_MODE(49, + MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS), +@@ -308,16 +296,13 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = { + MPP_VAR_FUNCTION(0x1, "dev", "ad19", V_MV78260_PLUS)), + MPP_MODE(55, + MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS), +- MPP_VAR_FUNCTION(0x1, "dev", "ad20", V_MV78260_PLUS), +- MPP_VAR_FUNCTION(0x2, "vdd", "cpu0-pd", V_MV78260_PLUS)), ++ MPP_VAR_FUNCTION(0x1, "dev", "ad20", V_MV78260_PLUS)), + MPP_MODE(56, + MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS), +- MPP_VAR_FUNCTION(0x1, "dev", "ad21", V_MV78260_PLUS), +- MPP_VAR_FUNCTION(0x2, "vdd", "cpu1-pd", V_MV78260_PLUS)), ++ MPP_VAR_FUNCTION(0x1, "dev", "ad21", V_MV78260_PLUS)), + MPP_MODE(57, + MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS), +- MPP_VAR_FUNCTION(0x1, "dev", "ad22", V_MV78260_PLUS), +- MPP_VAR_FUNCTION(0x2, "vdd", "cpu2-3-pd", V_MV78460)), ++ MPP_VAR_FUNCTION(0x1, "dev", "ad22", V_MV78260_PLUS)), + MPP_MODE(58, + MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS), + MPP_VAR_FUNCTION(0x1, "dev", "ad23", V_MV78260_PLUS)), +diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c +index fed4111..1beb232 100644 +--- a/drivers/platform/x86/dell-laptop.c ++++ b/drivers/platform/x86/dell-laptop.c +@@ -272,7 +272,6 @@ static struct dmi_system_id dell_quirks[] = { + }; + + static struct calling_interface_buffer *buffer; +-static struct page *bufferpage; + static DEFINE_MUTEX(buffer_mutex); + + static int hwswitch_state; +@@ -825,12 +824,11 @@ static int __init dell_init(void) + * Allocate buffer below 4GB for SMI data--only 32-bit physical addr + * is passed to SMI handler. + */ +- bufferpage = alloc_page(GFP_KERNEL | GFP_DMA32); +- if (!bufferpage) { ++ buffer = (void *)__get_free_page(GFP_KERNEL | GFP_DMA32); ++ if (!buffer) { + ret = -ENOMEM; + goto fail_buffer; + } +- buffer = page_address(bufferpage); + + ret = dell_setup_rfkill(); + +@@ -892,7 +890,7 @@ fail_backlight: + cancel_delayed_work_sync(&dell_rfkill_work); + dell_cleanup_rfkill(); + fail_rfkill: +- free_page((unsigned long)bufferpage); ++ free_page((unsigned long)buffer); + fail_buffer: + platform_device_del(platform_device); + fail_platform_device2: +diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c +index 6dd060a..0d1a5d4 100644 +--- a/drivers/platform/x86/ideapad-laptop.c ++++ b/drivers/platform/x86/ideapad-laptop.c +@@ -461,8 +461,9 @@ const struct ideapad_rfk_data ideapad_rfk_data[] = { + static int ideapad_rfk_set(void *data, bool blocked) + { + struct ideapad_rfk_priv *priv = data; ++ int opcode = ideapad_rfk_data[priv->dev].opcode; + +- return write_ec_cmd(priv->priv->adev->handle, priv->dev, !blocked); ++ return write_ec_cmd(priv->priv->adev->handle, opcode, !blocked); + } + + static struct rfkill_ops ideapad_rfk_ops = { +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index 5d8d2dc..427cb62 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -773,7 +773,7 @@ static int suspend_prepare(struct regulator_dev *rdev, suspend_state_t state) + static void print_constraints(struct regulator_dev *rdev) + { + struct regulation_constraints *constraints = rdev->constraints; +- char buf[80] = ""; ++ char buf[160] = ""; + int count = 0; + int ret; + +diff --git a/drivers/scsi/ipr.h b/drivers/scsi/ipr.h +index 0801f3d..02edae7 100644 +--- a/drivers/scsi/ipr.h ++++ b/drivers/scsi/ipr.h +@@ -264,7 +264,7 @@ + #define IPR_RUNTIME_RESET 0x40000000 + + #define IPR_IPL_INIT_MIN_STAGE_TIME 5 +-#define IPR_IPL_INIT_DEFAULT_STAGE_TIME 15 ++#define IPR_IPL_INIT_DEFAULT_STAGE_TIME 30 + #define IPR_IPL_INIT_STAGE_UNKNOWN 0x0 + #define IPR_IPL_INIT_STAGE_TRANSOP 0xB0000000 + #define IPR_IPL_INIT_STAGE_MASK 0xff000000 +diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c +index 0a1dcb4..13f4bef 100644 +--- a/drivers/scsi/qla2xxx/qla_isr.c ++++ b/drivers/scsi/qla2xxx/qla_isr.c +@@ -572,8 +572,9 @@ qla2x00_async_event(scsi_qla_host_t *vha, struct rsp_que *rsp, uint16_t *mb) + struct device_reg_2xxx __iomem *reg = &ha->iobase->isp; + struct device_reg_24xx __iomem *reg24 = &ha->iobase->isp24; + struct device_reg_82xx __iomem *reg82 = &ha->iobase->isp82; +- uint32_t rscn_entry, host_pid; ++ uint32_t rscn_entry, host_pid, tmp_pid; + unsigned long flags; ++ fc_port_t *fcport = NULL; + + /* Setup to process RIO completion. */ + handle_cnt = 0; +@@ -968,6 +969,20 @@ skip_rio: + if (qla2x00_is_a_vp_did(vha, rscn_entry)) + break; + ++ /* ++ * Search for the rport related to this RSCN entry and mark it ++ * as lost. ++ */ ++ list_for_each_entry(fcport, &vha->vp_fcports, list) { ++ if (atomic_read(&fcport->state) != FCS_ONLINE) ++ continue; ++ tmp_pid = fcport->d_id.b24; ++ if (fcport->d_id.b24 == rscn_entry) { ++ qla2x00_mark_device_lost(vha, fcport, 0, 0); ++ break; ++ } ++ } ++ + atomic_set(&vha->loop_down_timer, 0); + vha->flags.management_server_logged_in = 0; + +diff --git a/drivers/scsi/scsi_transport_srp.c b/drivers/scsi/scsi_transport_srp.c +index e3e794e..b85eaa0 100644 +--- a/drivers/scsi/scsi_transport_srp.c ++++ b/drivers/scsi/scsi_transport_srp.c +@@ -397,6 +397,36 @@ static void srp_reconnect_work(struct work_struct *work) + } + } + ++/** ++ * scsi_request_fn_active() - number of kernel threads inside scsi_request_fn() ++ * @shost: SCSI host for which to count the number of scsi_request_fn() callers. ++ * ++ * To do: add support for scsi-mq in this function. ++ */ ++static int scsi_request_fn_active(struct Scsi_Host *shost) ++{ ++ struct scsi_device *sdev; ++ struct request_queue *q; ++ int request_fn_active = 0; ++ ++ shost_for_each_device(sdev, shost) { ++ q = sdev->request_queue; ++ ++ spin_lock_irq(q->queue_lock); ++ request_fn_active += q->request_fn_active; ++ spin_unlock_irq(q->queue_lock); ++ } ++ ++ return request_fn_active; ++} ++ ++/* Wait until ongoing shost->hostt->queuecommand() calls have finished. */ ++static void srp_wait_for_queuecommand(struct Scsi_Host *shost) ++{ ++ while (scsi_request_fn_active(shost)) ++ msleep(20); ++} ++ + static void __rport_fail_io_fast(struct srp_rport *rport) + { + struct Scsi_Host *shost = rport_to_shost(rport); +@@ -410,8 +440,10 @@ static void __rport_fail_io_fast(struct srp_rport *rport) + + /* Involve the LLD if possible to terminate all I/O on the rport. */ + i = to_srp_internal(shost->transportt); +- if (i->f->terminate_rport_io) ++ if (i->f->terminate_rport_io) { ++ srp_wait_for_queuecommand(shost); + i->f->terminate_rport_io(rport); ++ } + } + + /** +@@ -505,27 +537,6 @@ void srp_start_tl_fail_timers(struct srp_rport *rport) + EXPORT_SYMBOL(srp_start_tl_fail_timers); + + /** +- * scsi_request_fn_active() - number of kernel threads inside scsi_request_fn() +- * @shost: SCSI host for which to count the number of scsi_request_fn() callers. +- */ +-static int scsi_request_fn_active(struct Scsi_Host *shost) +-{ +- struct scsi_device *sdev; +- struct request_queue *q; +- int request_fn_active = 0; +- +- shost_for_each_device(sdev, shost) { +- q = sdev->request_queue; +- +- spin_lock_irq(q->queue_lock); +- request_fn_active += q->request_fn_active; +- spin_unlock_irq(q->queue_lock); +- } +- +- return request_fn_active; +-} +- +-/** + * srp_reconnect_rport() - reconnect to an SRP target port + * @rport: SRP target port. + * +@@ -560,8 +571,7 @@ int srp_reconnect_rport(struct srp_rport *rport) + if (res) + goto out; + scsi_target_block(&shost->shost_gendev); +- while (scsi_request_fn_active(shost)) +- msleep(20); ++ srp_wait_for_queuecommand(shost); + res = rport->state != SRP_RPORT_LOST ? i->f->reconnect(rport) : -ENODEV; + pr_debug("%s (state %d): transport.reconnect() returned %d\n", + dev_name(&shost->shost_gendev), rport->state, res); +diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c +index d6563ec..f3e3ae8 100644 +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -834,9 +834,6 @@ void spi_finalize_current_message(struct spi_master *master) + + spin_lock_irqsave(&master->queue_lock, flags); + mesg = master->cur_msg; +- master->cur_msg = NULL; +- +- queue_kthread_work(&master->kworker, &master->pump_messages); + spin_unlock_irqrestore(&master->queue_lock, flags); + + if (master->cur_msg_prepared && master->unprepare_message) { +@@ -847,9 +844,13 @@ void spi_finalize_current_message(struct spi_master *master) + } + } + +- trace_spi_message_done(mesg); +- ++ spin_lock_irqsave(&master->queue_lock, flags); ++ master->cur_msg = NULL; + master->cur_msg_prepared = false; ++ queue_kthread_work(&master->kworker, &master->pump_messages); ++ spin_unlock_irqrestore(&master->queue_lock, flags); ++ ++ trace_spi_message_done(mesg); + + mesg->state = NULL; + if (mesg->complete) +diff --git a/drivers/staging/rtl8712/rtl8712_recv.c b/drivers/staging/rtl8712/rtl8712_recv.c +index ea96537..d060b1f 100644 +--- a/drivers/staging/rtl8712/rtl8712_recv.c ++++ b/drivers/staging/rtl8712/rtl8712_recv.c +@@ -1075,7 +1075,8 @@ static int recvbuf2recvframe(struct _adapter *padapter, struct sk_buff *pskb) + /* for first fragment packet, driver need allocate 1536 + + * drvinfo_sz + RXDESC_SIZE to defrag packet. */ + if ((mf == 1) && (frag == 0)) +- alloc_sz = 1658;/*1658+6=1664, 1664 is 128 alignment.*/ ++ /*1658+6=1664, 1664 is 128 alignment.*/ ++ alloc_sz = max_t(u16, tmp_len, 1658); + else + alloc_sz = tmp_len; + /* 2 is for IP header 4 bytes alignment in QoS packet case. +diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c +index b61c555..c8d7b30 100644 +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -518,7 +518,7 @@ static struct iscsit_transport iscsi_target_transport = { + + static int __init iscsi_target_init_module(void) + { +- int ret = 0; ++ int ret = 0, size; + + pr_debug("iSCSI-Target "ISCSIT_VERSION"\n"); + +@@ -527,6 +527,7 @@ static int __init iscsi_target_init_module(void) + pr_err("Unable to allocate memory for iscsit_global\n"); + return -1; + } ++ spin_lock_init(&iscsit_global->ts_bitmap_lock); + mutex_init(&auth_id_lock); + spin_lock_init(&sess_idr_lock); + idr_init(&tiqn_idr); +@@ -536,15 +537,11 @@ static int __init iscsi_target_init_module(void) + if (ret < 0) + goto out; + +- ret = iscsi_thread_set_init(); +- if (ret < 0) ++ size = BITS_TO_LONGS(ISCSIT_BITMAP_BITS) * sizeof(long); ++ iscsit_global->ts_bitmap = vzalloc(size); ++ if (!iscsit_global->ts_bitmap) { ++ pr_err("Unable to allocate iscsit_global->ts_bitmap\n"); + goto configfs_out; +- +- if (iscsi_allocate_thread_sets(TARGET_THREAD_SET_COUNT) != +- TARGET_THREAD_SET_COUNT) { +- pr_err("iscsi_allocate_thread_sets() returned" +- " unexpected value!\n"); +- goto ts_out1; + } + + lio_qr_cache = kmem_cache_create("lio_qr_cache", +@@ -553,7 +550,7 @@ static int __init iscsi_target_init_module(void) + if (!lio_qr_cache) { + pr_err("nable to kmem_cache_create() for" + " lio_qr_cache\n"); +- goto ts_out2; ++ goto bitmap_out; + } + + lio_dr_cache = kmem_cache_create("lio_dr_cache", +@@ -597,10 +594,8 @@ dr_out: + kmem_cache_destroy(lio_dr_cache); + qr_out: + kmem_cache_destroy(lio_qr_cache); +-ts_out2: +- iscsi_deallocate_thread_sets(); +-ts_out1: +- iscsi_thread_set_free(); ++bitmap_out: ++ vfree(iscsit_global->ts_bitmap); + configfs_out: + iscsi_target_deregister_configfs(); + out: +@@ -610,8 +605,6 @@ out: + + static void __exit iscsi_target_cleanup_module(void) + { +- iscsi_deallocate_thread_sets(); +- iscsi_thread_set_free(); + iscsit_release_discovery_tpg(); + iscsit_unregister_transport(&iscsi_target_transport); + kmem_cache_destroy(lio_qr_cache); +@@ -621,6 +614,7 @@ static void __exit iscsi_target_cleanup_module(void) + + iscsi_target_deregister_configfs(); + ++ vfree(iscsit_global->ts_bitmap); + kfree(iscsit_global); + } + +@@ -3653,17 +3647,16 @@ static int iscsit_send_reject( + + void iscsit_thread_get_cpumask(struct iscsi_conn *conn) + { +- struct iscsi_thread_set *ts = conn->thread_set; + int ord, cpu; + /* +- * thread_id is assigned from iscsit_global->ts_bitmap from +- * within iscsi_thread_set.c:iscsi_allocate_thread_sets() ++ * bitmap_id is assigned from iscsit_global->ts_bitmap from ++ * within iscsit_start_kthreads() + * +- * Here we use thread_id to determine which CPU that this +- * iSCSI connection's iscsi_thread_set will be scheduled to ++ * Here we use bitmap_id to determine which CPU that this ++ * iSCSI connection's RX/TX threads will be scheduled to + * execute upon. + */ +- ord = ts->thread_id % cpumask_weight(cpu_online_mask); ++ ord = conn->bitmap_id % cpumask_weight(cpu_online_mask); + for_each_online_cpu(cpu) { + if (ord-- == 0) { + cpumask_set_cpu(cpu, conn->conn_cpumask); +@@ -3855,7 +3848,7 @@ check_rsp_state: + switch (state) { + case ISTATE_SEND_LOGOUTRSP: + if (!iscsit_logout_post_handler(cmd, conn)) +- goto restart; ++ return -ECONNRESET; + /* fall through */ + case ISTATE_SEND_STATUS: + case ISTATE_SEND_ASYNCMSG: +@@ -3883,8 +3876,6 @@ check_rsp_state: + + err: + return -1; +-restart: +- return -EAGAIN; + } + + static int iscsit_handle_response_queue(struct iscsi_conn *conn) +@@ -3911,21 +3902,13 @@ static int iscsit_handle_response_queue(struct iscsi_conn *conn) + int iscsi_target_tx_thread(void *arg) + { + int ret = 0; +- struct iscsi_conn *conn; +- struct iscsi_thread_set *ts = arg; ++ struct iscsi_conn *conn = arg; + /* + * Allow ourselves to be interrupted by SIGINT so that a + * connection recovery / failure event can be triggered externally. + */ + allow_signal(SIGINT); + +-restart: +- conn = iscsi_tx_thread_pre_handler(ts); +- if (!conn) +- goto out; +- +- ret = 0; +- + while (!kthread_should_stop()) { + /* + * Ensure that both TX and RX per connection kthreads +@@ -3934,11 +3917,9 @@ restart: + iscsit_thread_check_cpumask(conn, current, 1); + + wait_event_interruptible(conn->queues_wq, +- !iscsit_conn_all_queues_empty(conn) || +- ts->status == ISCSI_THREAD_SET_RESET); ++ !iscsit_conn_all_queues_empty(conn)); + +- if ((ts->status == ISCSI_THREAD_SET_RESET) || +- signal_pending(current)) ++ if (signal_pending(current)) + goto transport_err; + + get_immediate: +@@ -3949,15 +3930,14 @@ get_immediate: + ret = iscsit_handle_response_queue(conn); + if (ret == 1) + goto get_immediate; +- else if (ret == -EAGAIN) +- goto restart; ++ else if (ret == -ECONNRESET) ++ goto out; + else if (ret < 0) + goto transport_err; + } + + transport_err: + iscsit_take_action_for_connection_exit(conn); +- goto restart; + out: + return 0; + } +@@ -4046,8 +4026,7 @@ int iscsi_target_rx_thread(void *arg) + int ret; + u8 buffer[ISCSI_HDR_LEN], opcode; + u32 checksum = 0, digest = 0; +- struct iscsi_conn *conn = NULL; +- struct iscsi_thread_set *ts = arg; ++ struct iscsi_conn *conn = arg; + struct kvec iov; + /* + * Allow ourselves to be interrupted by SIGINT so that a +@@ -4055,11 +4034,6 @@ int iscsi_target_rx_thread(void *arg) + */ + allow_signal(SIGINT); + +-restart: +- conn = iscsi_rx_thread_pre_handler(ts); +- if (!conn) +- goto out; +- + if (conn->conn_transport->transport_type == ISCSI_INFINIBAND) { + struct completion comp; + int rc; +@@ -4069,7 +4043,7 @@ restart: + if (rc < 0) + goto transport_err; + +- goto out; ++ goto transport_err; + } + + while (!kthread_should_stop()) { +@@ -4145,8 +4119,6 @@ transport_err: + if (!signal_pending(current)) + atomic_set(&conn->transport_failed, 1); + iscsit_take_action_for_connection_exit(conn); +- goto restart; +-out: + return 0; + } + +@@ -4208,7 +4180,24 @@ int iscsit_close_connection( + if (conn->conn_transport->transport_type == ISCSI_TCP) + complete(&conn->conn_logout_comp); + +- iscsi_release_thread_set(conn); ++ if (!strcmp(current->comm, ISCSI_RX_THREAD_NAME)) { ++ if (conn->tx_thread && ++ cmpxchg(&conn->tx_thread_active, true, false)) { ++ send_sig(SIGINT, conn->tx_thread, 1); ++ kthread_stop(conn->tx_thread); ++ } ++ } else if (!strcmp(current->comm, ISCSI_TX_THREAD_NAME)) { ++ if (conn->rx_thread && ++ cmpxchg(&conn->rx_thread_active, true, false)) { ++ send_sig(SIGINT, conn->rx_thread, 1); ++ kthread_stop(conn->rx_thread); ++ } ++ } ++ ++ spin_lock(&iscsit_global->ts_bitmap_lock); ++ bitmap_release_region(iscsit_global->ts_bitmap, conn->bitmap_id, ++ get_order(1)); ++ spin_unlock(&iscsit_global->ts_bitmap_lock); + + iscsit_stop_timers_for_cmds(conn); + iscsit_stop_nopin_response_timer(conn); +@@ -4487,15 +4476,13 @@ static void iscsit_logout_post_handler_closesession( + struct iscsi_conn *conn) + { + struct iscsi_session *sess = conn->sess; +- +- iscsi_set_thread_clear(conn, ISCSI_CLEAR_TX_THREAD); +- iscsi_set_thread_set_signal(conn, ISCSI_SIGNAL_TX_THREAD); ++ int sleep = cmpxchg(&conn->tx_thread_active, true, false); + + atomic_set(&conn->conn_logout_remove, 0); + complete(&conn->conn_logout_comp); + + iscsit_dec_conn_usage_count(conn); +- iscsit_stop_session(sess, 1, 1); ++ iscsit_stop_session(sess, sleep, sleep); + iscsit_dec_session_usage_count(sess); + target_put_session(sess->se_sess); + } +@@ -4503,13 +4490,12 @@ static void iscsit_logout_post_handler_closesession( + static void iscsit_logout_post_handler_samecid( + struct iscsi_conn *conn) + { +- iscsi_set_thread_clear(conn, ISCSI_CLEAR_TX_THREAD); +- iscsi_set_thread_set_signal(conn, ISCSI_SIGNAL_TX_THREAD); ++ int sleep = cmpxchg(&conn->tx_thread_active, true, false); + + atomic_set(&conn->conn_logout_remove, 0); + complete(&conn->conn_logout_comp); + +- iscsit_cause_connection_reinstatement(conn, 1); ++ iscsit_cause_connection_reinstatement(conn, sleep); + iscsit_dec_conn_usage_count(conn); + } + +diff --git a/drivers/target/iscsi/iscsi_target_core.h b/drivers/target/iscsi/iscsi_target_core.h +index 1d4a8c8..825b579 100644 +--- a/drivers/target/iscsi/iscsi_target_core.h ++++ b/drivers/target/iscsi/iscsi_target_core.h +@@ -601,6 +601,11 @@ struct iscsi_conn { + struct iscsi_session *sess; + /* Pointer to thread_set in use for this conn's threads */ + struct iscsi_thread_set *thread_set; ++ int bitmap_id; ++ int rx_thread_active; ++ struct task_struct *rx_thread; ++ int tx_thread_active; ++ struct task_struct *tx_thread; + /* list_head for session connection list */ + struct list_head conn_list; + } ____cacheline_aligned; +@@ -869,10 +874,12 @@ struct iscsit_global { + /* Unique identifier used for the authentication daemon */ + u32 auth_id; + u32 inactive_ts; ++#define ISCSIT_BITMAP_BITS 262144 + /* Thread Set bitmap count */ + int ts_bitmap_count; + /* Thread Set bitmap pointer */ + unsigned long *ts_bitmap; ++ spinlock_t ts_bitmap_lock; + /* Used for iSCSI discovery session authentication */ + struct iscsi_node_acl discovery_acl; + struct iscsi_portal_group *discovery_tpg; +diff --git a/drivers/target/iscsi/iscsi_target_erl0.c b/drivers/target/iscsi/iscsi_target_erl0.c +index 0d1e6ee..7396d90 100644 +--- a/drivers/target/iscsi/iscsi_target_erl0.c ++++ b/drivers/target/iscsi/iscsi_target_erl0.c +@@ -864,7 +864,10 @@ void iscsit_connection_reinstatement_rcfr(struct iscsi_conn *conn) + } + spin_unlock_bh(&conn->state_lock); + +- iscsi_thread_set_force_reinstatement(conn); ++ if (conn->tx_thread && conn->tx_thread_active) ++ send_sig(SIGINT, conn->tx_thread, 1); ++ if (conn->rx_thread && conn->rx_thread_active) ++ send_sig(SIGINT, conn->rx_thread, 1); + + sleep: + wait_for_completion(&conn->conn_wait_rcfr_comp); +@@ -889,10 +892,10 @@ void iscsit_cause_connection_reinstatement(struct iscsi_conn *conn, int sleep) + return; + } + +- if (iscsi_thread_set_force_reinstatement(conn) < 0) { +- spin_unlock_bh(&conn->state_lock); +- return; +- } ++ if (conn->tx_thread && conn->tx_thread_active) ++ send_sig(SIGINT, conn->tx_thread, 1); ++ if (conn->rx_thread && conn->rx_thread_active) ++ send_sig(SIGINT, conn->rx_thread, 1); + + atomic_set(&conn->connection_reinstatement, 1); + if (!sleep) { +diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c +index c5d3811..449df09 100644 +--- a/drivers/target/iscsi/iscsi_target_login.c ++++ b/drivers/target/iscsi/iscsi_target_login.c +@@ -681,6 +681,51 @@ static void iscsi_post_login_start_timers(struct iscsi_conn *conn) + iscsit_start_nopin_timer(conn); + } + ++int iscsit_start_kthreads(struct iscsi_conn *conn) ++{ ++ int ret = 0; ++ ++ spin_lock(&iscsit_global->ts_bitmap_lock); ++ conn->bitmap_id = bitmap_find_free_region(iscsit_global->ts_bitmap, ++ ISCSIT_BITMAP_BITS, get_order(1)); ++ spin_unlock(&iscsit_global->ts_bitmap_lock); ++ ++ if (conn->bitmap_id < 0) { ++ pr_err("bitmap_find_free_region() failed for" ++ " iscsit_start_kthreads()\n"); ++ return -ENOMEM; ++ } ++ ++ conn->tx_thread = kthread_run(iscsi_target_tx_thread, conn, ++ "%s", ISCSI_TX_THREAD_NAME); ++ if (IS_ERR(conn->tx_thread)) { ++ pr_err("Unable to start iscsi_target_tx_thread\n"); ++ ret = PTR_ERR(conn->tx_thread); ++ goto out_bitmap; ++ } ++ conn->tx_thread_active = true; ++ ++ conn->rx_thread = kthread_run(iscsi_target_rx_thread, conn, ++ "%s", ISCSI_RX_THREAD_NAME); ++ if (IS_ERR(conn->rx_thread)) { ++ pr_err("Unable to start iscsi_target_rx_thread\n"); ++ ret = PTR_ERR(conn->rx_thread); ++ goto out_tx; ++ } ++ conn->rx_thread_active = true; ++ ++ return 0; ++out_tx: ++ kthread_stop(conn->tx_thread); ++ conn->tx_thread_active = false; ++out_bitmap: ++ spin_lock(&iscsit_global->ts_bitmap_lock); ++ bitmap_release_region(iscsit_global->ts_bitmap, conn->bitmap_id, ++ get_order(1)); ++ spin_unlock(&iscsit_global->ts_bitmap_lock); ++ return ret; ++} ++ + int iscsi_post_login_handler( + struct iscsi_np *np, + struct iscsi_conn *conn, +@@ -691,7 +736,7 @@ int iscsi_post_login_handler( + struct se_session *se_sess = sess->se_sess; + struct iscsi_portal_group *tpg = sess->tpg; + struct se_portal_group *se_tpg = &tpg->tpg_se_tpg; +- struct iscsi_thread_set *ts; ++ int rc; + + iscsit_inc_conn_usage_count(conn); + +@@ -706,7 +751,6 @@ int iscsi_post_login_handler( + /* + * SCSI Initiator -> SCSI Target Port Mapping + */ +- ts = iscsi_get_thread_set(); + if (!zero_tsih) { + iscsi_set_session_parameters(sess->sess_ops, + conn->param_list, 0); +@@ -733,9 +777,11 @@ int iscsi_post_login_handler( + sess->sess_ops->InitiatorName); + spin_unlock_bh(&sess->conn_lock); + +- iscsi_post_login_start_timers(conn); ++ rc = iscsit_start_kthreads(conn); ++ if (rc) ++ return rc; + +- iscsi_activate_thread_set(conn, ts); ++ iscsi_post_login_start_timers(conn); + /* + * Determine CPU mask to ensure connection's RX and TX kthreads + * are scheduled on the same CPU. +@@ -792,8 +838,11 @@ int iscsi_post_login_handler( + " iSCSI Target Portal Group: %hu\n", tpg->nsessions, tpg->tpgt); + spin_unlock_bh(&se_tpg->session_lock); + ++ rc = iscsit_start_kthreads(conn); ++ if (rc) ++ return rc; ++ + iscsi_post_login_start_timers(conn); +- iscsi_activate_thread_set(conn, ts); + /* + * Determine CPU mask to ensure connection's RX and TX kthreads + * are scheduled on the same CPU. +diff --git a/drivers/thermal/step_wise.c b/drivers/thermal/step_wise.c +index ee52ab7..c501eba 100644 +--- a/drivers/thermal/step_wise.c ++++ b/drivers/thermal/step_wise.c +@@ -76,7 +76,7 @@ static unsigned long get_target_state(struct thermal_instance *instance, + next_target = instance->upper; + break; + case THERMAL_TREND_DROPPING: +- if (cur_state == instance->lower) { ++ if (cur_state <= instance->lower) { + if (!throttle) + next_target = THERMAL_NO_TARGET; + } else { +diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c +index 45b7b96..8016aaa 100644 +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -513,7 +513,7 @@ static void async_completed(struct urb *urb) + snoop(&urb->dev->dev, "urb complete\n"); + snoop_urb(urb->dev, as->userurb, urb->pipe, urb->actual_length, + as->status, COMPLETE, NULL, 0); +- if ((urb->transfer_flags & URB_DIR_MASK) == USB_DIR_IN) ++ if ((urb->transfer_flags & URB_DIR_MASK) == URB_DIR_IN) + snoop_urb_data(urb, urb->actual_length); + + if (as->status < 0 && as->bulk_addr && as->status != -ECONNRESET && +@@ -1591,7 +1591,7 @@ static struct async *reap_as(struct dev_state *ps) + for (;;) { + __set_current_state(TASK_INTERRUPTIBLE); + as = async_getcompleted(ps); +- if (as) ++ if (as || !connected(ps)) + break; + if (signal_pending(current)) + break; +@@ -1614,7 +1614,7 @@ static int proc_reapurb(struct dev_state *ps, void __user *arg) + } + if (signal_pending(current)) + return -EINTR; +- return -EIO; ++ return -ENODEV; + } + + static int proc_reapurbnonblock(struct dev_state *ps, void __user *arg) +@@ -1623,10 +1623,11 @@ static int proc_reapurbnonblock(struct dev_state *ps, void __user *arg) + struct async *as; + + as = async_getcompleted(ps); +- retval = -EAGAIN; + if (as) { + retval = processcompl(as, (void __user * __user *)arg); + free_async(as); ++ } else { ++ retval = (connected(ps) ? -EAGAIN : -ENODEV); + } + return retval; + } +@@ -1756,7 +1757,7 @@ static int proc_reapurb_compat(struct dev_state *ps, void __user *arg) + } + if (signal_pending(current)) + return -EINTR; +- return -EIO; ++ return -ENODEV; + } + + static int proc_reapurbnonblock_compat(struct dev_state *ps, void __user *arg) +@@ -1764,11 +1765,12 @@ static int proc_reapurbnonblock_compat(struct dev_state *ps, void __user *arg) + int retval; + struct async *as; + +- retval = -EAGAIN; + as = async_getcompleted(ps); + if (as) { + retval = processcompl_compat(as, (void __user * __user *)arg); + free_async(as); ++ } else { ++ retval = (connected(ps) ? -EAGAIN : -ENODEV); + } + return retval; + } +@@ -1940,7 +1942,8 @@ static int proc_get_capabilities(struct dev_state *ps, void __user *arg) + { + __u32 caps; + +- caps = USBDEVFS_CAP_ZERO_PACKET | USBDEVFS_CAP_NO_PACKET_SIZE_LIM; ++ caps = USBDEVFS_CAP_ZERO_PACKET | USBDEVFS_CAP_NO_PACKET_SIZE_LIM | ++ USBDEVFS_CAP_REAP_AFTER_DISCONNECT; + if (!ps->dev->bus->no_stop_on_short) + caps |= USBDEVFS_CAP_BULK_CONTINUATION; + if (ps->dev->bus->sg_tablesize) +@@ -2001,6 +2004,32 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd, + return -EPERM; + + usb_lock_device(dev); ++ ++ /* Reap operations are allowed even after disconnection */ ++ switch (cmd) { ++ case USBDEVFS_REAPURB: ++ snoop(&dev->dev, "%s: REAPURB\n", __func__); ++ ret = proc_reapurb(ps, p); ++ goto done; ++ ++ case USBDEVFS_REAPURBNDELAY: ++ snoop(&dev->dev, "%s: REAPURBNDELAY\n", __func__); ++ ret = proc_reapurbnonblock(ps, p); ++ goto done; ++ ++#ifdef CONFIG_COMPAT ++ case USBDEVFS_REAPURB32: ++ snoop(&dev->dev, "%s: REAPURB32\n", __func__); ++ ret = proc_reapurb_compat(ps, p); ++ goto done; ++ ++ case USBDEVFS_REAPURBNDELAY32: ++ snoop(&dev->dev, "%s: REAPURBNDELAY32\n", __func__); ++ ret = proc_reapurbnonblock_compat(ps, p); ++ goto done; ++#endif ++ } ++ + if (!connected(ps)) { + usb_unlock_device(dev); + return -ENODEV; +@@ -2094,16 +2123,6 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd, + inode->i_mtime = CURRENT_TIME; + break; + +- case USBDEVFS_REAPURB32: +- snoop(&dev->dev, "%s: REAPURB32\n", __func__); +- ret = proc_reapurb_compat(ps, p); +- break; +- +- case USBDEVFS_REAPURBNDELAY32: +- snoop(&dev->dev, "%s: REAPURBNDELAY32\n", __func__); +- ret = proc_reapurbnonblock_compat(ps, p); +- break; +- + case USBDEVFS_IOCTL32: + snoop(&dev->dev, "%s: IOCTL32\n", __func__); + ret = proc_ioctl_compat(ps, ptr_to_compat(p)); +@@ -2115,16 +2134,6 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd, + ret = proc_unlinkurb(ps, p); + break; + +- case USBDEVFS_REAPURB: +- snoop(&dev->dev, "%s: REAPURB\n", __func__); +- ret = proc_reapurb(ps, p); +- break; +- +- case USBDEVFS_REAPURBNDELAY: +- snoop(&dev->dev, "%s: REAPURBNDELAY\n", __func__); +- ret = proc_reapurbnonblock(ps, p); +- break; +- + case USBDEVFS_DISCSIGNAL: + snoop(&dev->dev, "%s: DISCSIGNAL\n", __func__); + ret = proc_disconnectsignal(ps, p); +@@ -2161,6 +2170,8 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd, + ret = proc_disconnect_claim(ps, p); + break; + } ++ ++ done: + usb_unlock_device(dev); + if (ret >= 0) + inode->i_atime = CURRENT_TIME; +diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c +index 0985ff7..a05fc58 100644 +--- a/drivers/usb/dwc3/ep0.c ++++ b/drivers/usb/dwc3/ep0.c +@@ -707,6 +707,10 @@ static int dwc3_ep0_std_request(struct dwc3 *dwc, struct usb_ctrlrequest *ctrl) + dev_vdbg(dwc->dev, "USB_REQ_SET_ISOCH_DELAY\n"); + ret = dwc3_ep0_set_isoch_delay(dwc, ctrl); + break; ++ case USB_REQ_SET_INTERFACE: ++ dev_vdbg(dwc->dev, "USB_REQ_SET_INTERFACE\n"); ++ dwc->start_config_issued = false; ++ /* Fall through */ + default: + dev_vdbg(dwc->dev, "Forwarding to gadget driver\n"); + ret = dwc3_ep0_delegate_req(dwc, ctrl); +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index 8f6738d..a57ad1f 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -299,6 +299,8 @@ int dwc3_send_gadget_generic_command(struct dwc3 *dwc, int cmd, u32 param) + if (!(reg & DWC3_DGCMD_CMDACT)) { + dev_vdbg(dwc->dev, "Command Complete --> %d\n", + DWC3_DGCMD_STATUS(reg)); ++ if (DWC3_DGCMD_STATUS(reg)) ++ return -EINVAL; + return 0; + } + +@@ -335,6 +337,8 @@ int dwc3_send_gadget_ep_cmd(struct dwc3 *dwc, unsigned ep, + if (!(reg & DWC3_DEPCMD_CMDACT)) { + dev_vdbg(dwc->dev, "Command Complete --> %d\n", + DWC3_DEPCMD_STATUS(reg)); ++ if (DWC3_DEPCMD_STATUS(reg)) ++ return -EINVAL; + return 0; + } + +diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c +index 9bce4f0..f8893b3 100644 +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -1331,10 +1331,10 @@ int xhci_endpoint_init(struct xhci_hcd *xhci, + /* Attempt to use the ring cache */ + if (virt_dev->num_rings_cached == 0) + return -ENOMEM; ++ virt_dev->num_rings_cached--; + virt_dev->eps[ep_index].new_ring = + virt_dev->ring_cache[virt_dev->num_rings_cached]; + virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL; +- virt_dev->num_rings_cached--; + xhci_reinit_cached_ring(xhci, virt_dev->eps[ep_index].new_ring, + 1, type); + } +diff --git a/drivers/usb/musb/musb_virthub.c b/drivers/usb/musb/musb_virthub.c +index 0241a3a..1e9bde4 100644 +--- a/drivers/usb/musb/musb_virthub.c ++++ b/drivers/usb/musb/musb_virthub.c +@@ -273,9 +273,7 @@ static int musb_has_gadget(struct musb *musb) + #ifdef CONFIG_USB_MUSB_HOST + return 1; + #else +- if (musb->port_mode == MUSB_PORT_MODE_HOST) +- return 1; +- return musb->g.dev.driver != NULL; ++ return musb->port_mode == MUSB_PORT_MODE_HOST; + #endif + } + +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index 73c7292..d11335d 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -187,6 +187,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x1FB9, 0x0602) }, /* Lake Shore Model 648 Magnet Power Supply */ + { USB_DEVICE(0x1FB9, 0x0700) }, /* Lake Shore Model 737 VSM Controller */ + { USB_DEVICE(0x1FB9, 0x0701) }, /* Lake Shore Model 776 Hall Matrix */ ++ { USB_DEVICE(0x2626, 0xEA60) }, /* Aruba Networks 7xxx USB Serial Console */ + { USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */ + { USB_DEVICE(0x3195, 0xF280) }, /* Link Instruments MSO-28 */ + { USB_DEVICE(0x3195, 0xF281) }, /* Link Instruments MSO-28 */ +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 8b34841..096438e 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1755,6 +1755,7 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ ++ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */ + { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) }, + { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) }, + { } /* Terminating entry */ +diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c +index 9a08e18..3d66e9c 100644 +--- a/drivers/usb/serial/usb-serial.c ++++ b/drivers/usb/serial/usb-serial.c +@@ -1300,6 +1300,7 @@ static void __exit usb_serial_exit(void) + tty_unregister_driver(usb_serial_tty_driver); + put_tty_driver(usb_serial_tty_driver); + bus_unregister(&usb_serial_bus_type); ++ idr_destroy(&serial_minors); + } + + +diff --git a/drivers/watchdog/omap_wdt.c b/drivers/watchdog/omap_wdt.c +index 09cf013..90a6406 100644 +--- a/drivers/watchdog/omap_wdt.c ++++ b/drivers/watchdog/omap_wdt.c +@@ -134,6 +134,13 @@ static int omap_wdt_start(struct watchdog_device *wdog) + + pm_runtime_get_sync(wdev->dev); + ++ /* ++ * Make sure the watchdog is disabled. This is unfortunately required ++ * because writing to various registers with the watchdog running has no ++ * effect. ++ */ ++ omap_wdt_disable(wdev); ++ + /* initialize prescaler */ + while (readl_relaxed(base + OMAP_WATCHDOG_WPS) & 0x01) + cpu_relax(); +diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c +index bb7991c..bfdeadb 100644 +--- a/fs/9p/vfs_inode.c ++++ b/fs/9p/vfs_inode.c +@@ -540,8 +540,7 @@ static struct inode *v9fs_qid_iget(struct super_block *sb, + unlock_new_inode(inode); + return inode; + error: +- unlock_new_inode(inode); +- iput(inode); ++ iget_failed(inode); + return ERR_PTR(retval); + + } +diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c +index 59dc8e8..de8606c 100644 +--- a/fs/9p/vfs_inode_dotl.c ++++ b/fs/9p/vfs_inode_dotl.c +@@ -149,8 +149,7 @@ static struct inode *v9fs_qid_iget_dotl(struct super_block *sb, + unlock_new_inode(inode); + return inode; + error: +- unlock_new_inode(inode); +- iput(inode); ++ iget_failed(inode); + return ERR_PTR(retval); + + } +diff --git a/fs/bio.c b/fs/bio.c +index 8754e7b..b2b1451 100644 +--- a/fs/bio.c ++++ b/fs/bio.c +@@ -1806,8 +1806,9 @@ EXPORT_SYMBOL(bio_endio_nodec); + * Allocates and returns a new bio which represents @sectors from the start of + * @bio, and updates @bio to represent the remaining sectors. + * +- * The newly allocated bio will point to @bio's bi_io_vec; it is the caller's +- * responsibility to ensure that @bio is not freed before the split. ++ * Unless this is a discard request the newly allocated bio will point ++ * to @bio's bi_io_vec; it is the caller's responsibility to ensure that ++ * @bio is not freed before the split. + */ + struct bio *bio_split(struct bio *bio, int sectors, + gfp_t gfp, struct bio_set *bs) +@@ -1817,7 +1818,15 @@ struct bio *bio_split(struct bio *bio, int sectors, + BUG_ON(sectors <= 0); + BUG_ON(sectors >= bio_sectors(bio)); + +- split = bio_clone_fast(bio, gfp, bs); ++ /* ++ * Discards need a mutable bio_vec to accommodate the payload ++ * required by the DSM TRIM and UNMAP commands. ++ */ ++ if (bio->bi_rw & REQ_DISCARD) ++ split = bio_clone_bioset(bio, gfp, bs); ++ else ++ split = bio_clone_fast(bio, gfp, bs); ++ + if (!split) + return NULL; + +diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c +index ab485e5..644942a 100644 +--- a/fs/btrfs/inode-map.c ++++ b/fs/btrfs/inode-map.c +@@ -281,7 +281,7 @@ void btrfs_unpin_free_ino(struct btrfs_root *root) + __btrfs_add_free_space(ctl, info->offset, count); + free: + rb_erase(&info->offset_index, rbroot); +- kfree(info); ++ kmem_cache_free(btrfs_free_space_cachep, info); + } + } + +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index 3e16042..d40ae42 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -2743,7 +2743,7 @@ out_unlock: + static long btrfs_ioctl_file_extent_same(struct file *file, + struct btrfs_ioctl_same_args __user *argp) + { +- struct btrfs_ioctl_same_args *same; ++ struct btrfs_ioctl_same_args *same = NULL; + struct btrfs_ioctl_same_extent_info *info; + struct inode *src = file_inode(file); + u64 off; +@@ -2773,6 +2773,7 @@ static long btrfs_ioctl_file_extent_same(struct file *file, + + if (IS_ERR(same)) { + ret = PTR_ERR(same); ++ same = NULL; + goto out; + } + +@@ -2843,6 +2844,7 @@ static long btrfs_ioctl_file_extent_same(struct file *file, + + out: + mnt_drop_write_file(file); ++ kfree(same); + return ret; + } + +diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c +index e6574d7..a7c5277 100644 +--- a/fs/ext4/indirect.c ++++ b/fs/ext4/indirect.c +@@ -576,7 +576,7 @@ int ext4_ind_map_blocks(handle_t *handle, struct inode *inode, + EXT4_FEATURE_RO_COMPAT_BIGALLOC)) { + EXT4_ERROR_INODE(inode, "Can't allocate blocks for " + "non-extent mapped inodes with bigalloc"); +- return -ENOSPC; ++ return -EUCLEAN; + } + + goal = ext4_find_goal(inode, map->m_lblk, partial); +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index da03340..f9c63ae 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -1357,7 +1357,7 @@ static void ext4_da_page_release_reservation(struct page *page, + unsigned int offset, + unsigned int length) + { +- int to_release = 0; ++ int to_release = 0, contiguous_blks = 0; + struct buffer_head *head, *bh; + unsigned int curr_off = 0; + struct inode *inode = page->mapping->host; +@@ -1378,14 +1378,23 @@ static void ext4_da_page_release_reservation(struct page *page, + + if ((offset <= curr_off) && (buffer_delay(bh))) { + to_release++; ++ contiguous_blks++; + clear_buffer_delay(bh); ++ } else if (contiguous_blks) { ++ lblk = page->index << ++ (PAGE_CACHE_SHIFT - inode->i_blkbits); ++ lblk += (curr_off >> inode->i_blkbits) - ++ contiguous_blks; ++ ext4_es_remove_extent(inode, lblk, contiguous_blks); ++ contiguous_blks = 0; + } + curr_off = next_off; + } while ((bh = bh->b_this_page) != head); + +- if (to_release) { ++ if (contiguous_blks) { + lblk = page->index << (PAGE_CACHE_SHIFT - inode->i_blkbits); +- ext4_es_remove_extent(inode, lblk, to_release); ++ lblk += (curr_off >> inode->i_blkbits) - contiguous_blks; ++ ext4_es_remove_extent(inode, lblk, contiguous_blks); + } + + /* If we have released all the blocks belonging to a cluster, then we +@@ -1744,19 +1753,32 @@ static int __ext4_journalled_writepage(struct page *page, + ext4_walk_page_buffers(handle, page_bufs, 0, len, + NULL, bget_one); + } +- /* As soon as we unlock the page, it can go away, but we have +- * references to buffers so we are safe */ ++ /* ++ * We need to release the page lock before we start the ++ * journal, so grab a reference so the page won't disappear ++ * out from under us. ++ */ ++ get_page(page); + unlock_page(page); + + handle = ext4_journal_start(inode, EXT4_HT_WRITE_PAGE, + ext4_writepage_trans_blocks(inode)); + if (IS_ERR(handle)) { + ret = PTR_ERR(handle); +- goto out; ++ put_page(page); ++ goto out_no_pagelock; + } +- + BUG_ON(!ext4_handle_valid(handle)); + ++ lock_page(page); ++ put_page(page); ++ if (page->mapping != mapping) { ++ /* The page got truncated from under us */ ++ ext4_journal_stop(handle); ++ ret = 0; ++ goto out; ++ } ++ + if (inline_data) { + ret = ext4_journal_get_write_access(handle, inode_bh); + +@@ -1781,6 +1803,8 @@ static int __ext4_journalled_writepage(struct page *page, + NULL, bput_one); + ext4_set_inode_state(inode, EXT4_STATE_JDATA); + out: ++ unlock_page(page); ++out_no_pagelock: + brelse(inode_bh); + return ret; + } +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index 7620133..c4a5e4d 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -4793,18 +4793,12 @@ do_more: + /* + * blocks being freed are metadata. these blocks shouldn't + * be used until this transaction is committed ++ * ++ * We use __GFP_NOFAIL because ext4_free_blocks() is not allowed ++ * to fail. + */ +- retry: +- new_entry = kmem_cache_alloc(ext4_free_data_cachep, GFP_NOFS); +- if (!new_entry) { +- /* +- * We use a retry loop because +- * ext4_free_blocks() is not allowed to fail. +- */ +- cond_resched(); +- congestion_wait(BLK_RW_ASYNC, HZ/50); +- goto retry; +- } ++ new_entry = kmem_cache_alloc(ext4_free_data_cachep, ++ GFP_NOFS|__GFP_NOFAIL); + new_entry->efd_start_cluster = bit; + new_entry->efd_group = block_group; + new_entry->efd_count = count_clusters; +diff --git a/fs/ext4/migrate.c b/fs/ext4/migrate.c +index 2ae73a8..be92ed2 100644 +--- a/fs/ext4/migrate.c ++++ b/fs/ext4/migrate.c +@@ -616,6 +616,7 @@ int ext4_ind_migrate(struct inode *inode) + struct ext4_inode_info *ei = EXT4_I(inode); + struct ext4_extent *ex; + unsigned int i, len; ++ ext4_lblk_t start, end; + ext4_fsblk_t blk; + handle_t *handle; + int ret; +@@ -629,6 +630,14 @@ int ext4_ind_migrate(struct inode *inode) + EXT4_FEATURE_RO_COMPAT_BIGALLOC)) + return -EOPNOTSUPP; + ++ /* ++ * In order to get correct extent info, force all delayed allocation ++ * blocks to be allocated, otherwise delayed allocation blocks may not ++ * be reflected and bypass the checks on extent header. ++ */ ++ if (test_opt(inode->i_sb, DELALLOC)) ++ ext4_alloc_da_blocks(inode); ++ + handle = ext4_journal_start(inode, EXT4_HT_MIGRATE, 1); + if (IS_ERR(handle)) + return PTR_ERR(handle); +@@ -646,11 +655,13 @@ int ext4_ind_migrate(struct inode *inode) + goto errout; + } + if (eh->eh_entries == 0) +- blk = len = 0; ++ blk = len = start = end = 0; + else { + len = le16_to_cpu(ex->ee_len); + blk = ext4_ext_pblock(ex); +- if (len > EXT4_NDIR_BLOCKS) { ++ start = le32_to_cpu(ex->ee_block); ++ end = start + len - 1; ++ if (end >= EXT4_NDIR_BLOCKS) { + ret = -EOPNOTSUPP; + goto errout; + } +@@ -658,7 +669,7 @@ int ext4_ind_migrate(struct inode *inode) + + ext4_clear_inode_flag(inode, EXT4_INODE_EXTENTS); + memset(ei->i_data, 0, sizeof(ei->i_data)); +- for (i=0; i < len; i++) ++ for (i = start; i <= end; i++) + ei->i_data[i] = cpu_to_le32(blk++); + ext4_mark_inode_dirty(handle, inode); + errout: +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 9fb3e6c..a07af5b 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -832,6 +832,7 @@ static void ext4_put_super(struct super_block *sb) + dump_orphan_list(sb, sbi); + J_ASSERT(list_empty(&sbi->s_orphan)); + ++ sync_blockdev(sb->s_bdev); + invalidate_bdev(sb->s_bdev); + if (sbi->journal_bdev && sbi->journal_bdev != sb->s_bdev) { + /* +diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c +index 73f6bcb..faf00af 100644 +--- a/fs/fuse/inode.c ++++ b/fs/fuse/inode.c +@@ -1026,6 +1026,7 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent) + goto err_fput; + + fuse_conn_init(fc); ++ fc->release = fuse_free_conn; + + fc->dev = sb->s_dev; + fc->sb = sb; +@@ -1040,7 +1041,6 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent) + fc->dont_mask = 1; + sb->s_flags |= MS_POSIXACL; + +- fc->release = fuse_free_conn; + fc->flags = d.flags; + fc->user_id = d.user_id; + fc->group_id = d.group_id; +diff --git a/fs/hpfs/super.c b/fs/hpfs/super.c +index 4534ff6..77b583d 100644 +--- a/fs/hpfs/super.c ++++ b/fs/hpfs/super.c +@@ -52,17 +52,20 @@ static void unmark_dirty(struct super_block *s) + } + + /* Filesystem error... */ +-static char err_buf[1024]; +- + void hpfs_error(struct super_block *s, const char *fmt, ...) + { ++ struct va_format vaf; + va_list args; + + va_start(args, fmt); +- vsnprintf(err_buf, sizeof(err_buf), fmt, args); ++ ++ vaf.fmt = fmt; ++ vaf.va = &args; ++ ++ pr_err("filesystem error: %pV", &vaf); ++ + va_end(args); + +- printk("HPFS: filesystem error: %s", err_buf); + if (!hpfs_sb(s)->sb_was_error) { + if (hpfs_sb(s)->sb_err == 2) { + printk("; crashing the system because you wanted it\n"); +diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c +index 7f34f47..b892355 100644 +--- a/fs/jbd2/checkpoint.c ++++ b/fs/jbd2/checkpoint.c +@@ -448,7 +448,7 @@ int jbd2_cleanup_journal_tail(journal_t *journal) + unsigned long blocknr; + + if (is_journal_aborted(journal)) +- return 1; ++ return -EIO; + + if (!jbd2_journal_get_log_tail(journal, &first_tid, &blocknr)) + return 1; +@@ -463,10 +463,9 @@ int jbd2_cleanup_journal_tail(journal_t *journal) + * jbd2_cleanup_journal_tail() doesn't get called all that often. + */ + if (journal->j_flags & JBD2_BARRIER) +- blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL); ++ blkdev_issue_flush(journal->j_fs_dev, GFP_NOFS, NULL); + +- __jbd2_update_log_tail(journal, first_tid, blocknr); +- return 0; ++ return __jbd2_update_log_tail(journal, first_tid, blocknr); + } + + +diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c +index f2d78a3..e8d62d7 100644 +--- a/fs/jbd2/journal.c ++++ b/fs/jbd2/journal.c +@@ -885,9 +885,10 @@ int jbd2_journal_get_log_tail(journal_t *journal, tid_t *tid, + * + * Requires j_checkpoint_mutex + */ +-void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block) ++int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block) + { + unsigned long freed; ++ int ret; + + BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex)); + +@@ -897,7 +898,10 @@ void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block) + * space and if we lose sb update during power failure we'd replay + * old transaction with possibly newly overwritten data. + */ +- jbd2_journal_update_sb_log_tail(journal, tid, block, WRITE_FUA); ++ ret = jbd2_journal_update_sb_log_tail(journal, tid, block, WRITE_FUA); ++ if (ret) ++ goto out; ++ + write_lock(&journal->j_state_lock); + freed = block - journal->j_tail; + if (block < journal->j_tail) +@@ -913,6 +917,9 @@ void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block) + journal->j_tail_sequence = tid; + journal->j_tail = block; + write_unlock(&journal->j_state_lock); ++ ++out: ++ return ret; + } + + /* +@@ -1331,7 +1338,7 @@ static int journal_reset(journal_t *journal) + return jbd2_journal_start_thread(journal); + } + +-static void jbd2_write_superblock(journal_t *journal, int write_op) ++static int jbd2_write_superblock(journal_t *journal, int write_op) + { + struct buffer_head *bh = journal->j_sb_buffer; + journal_superblock_t *sb = journal->j_superblock; +@@ -1370,7 +1377,10 @@ static void jbd2_write_superblock(journal_t *journal, int write_op) + printk(KERN_ERR "JBD2: Error %d detected when updating " + "journal superblock for %s.\n", ret, + journal->j_devname); ++ jbd2_journal_abort(journal, ret); + } ++ ++ return ret; + } + + /** +@@ -1383,10 +1393,11 @@ static void jbd2_write_superblock(journal_t *journal, int write_op) + * Update a journal's superblock information about log tail and write it to + * disk, waiting for the IO to complete. + */ +-void jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid, ++int jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid, + unsigned long tail_block, int write_op) + { + journal_superblock_t *sb = journal->j_superblock; ++ int ret; + + BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex)); + jbd_debug(1, "JBD2: updating superblock (start %lu, seq %u)\n", +@@ -1395,13 +1406,18 @@ void jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid, + sb->s_sequence = cpu_to_be32(tail_tid); + sb->s_start = cpu_to_be32(tail_block); + +- jbd2_write_superblock(journal, write_op); ++ ret = jbd2_write_superblock(journal, write_op); ++ if (ret) ++ goto out; + + /* Log is no longer empty */ + write_lock(&journal->j_state_lock); + WARN_ON(!sb->s_sequence); + journal->j_flags &= ~JBD2_FLUSHED; + write_unlock(&journal->j_state_lock); ++ ++out: ++ return ret; + } + + /** +@@ -1952,7 +1968,14 @@ int jbd2_journal_flush(journal_t *journal) + return -EIO; + + mutex_lock(&journal->j_checkpoint_mutex); +- jbd2_cleanup_journal_tail(journal); ++ if (!err) { ++ err = jbd2_cleanup_journal_tail(journal); ++ if (err < 0) { ++ mutex_unlock(&journal->j_checkpoint_mutex); ++ goto out; ++ } ++ err = 0; ++ } + + /* Finally, mark the journal as really needing no recovery. + * This sets s_start==0 in the underlying superblock, which is +@@ -1968,7 +1991,8 @@ int jbd2_journal_flush(journal_t *journal) + J_ASSERT(journal->j_head == journal->j_tail); + J_ASSERT(journal->j_tail_sequence == journal->j_transaction_sequence); + write_unlock(&journal->j_state_lock); +- return 0; ++out: ++ return err; + } + + /** +diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c +index fa6d721..4495cad 100644 +--- a/fs/nfs/nfs3xdr.c ++++ b/fs/nfs/nfs3xdr.c +@@ -1342,7 +1342,7 @@ static void nfs3_xdr_enc_setacl3args(struct rpc_rqst *req, + if (args->npages != 0) + xdr_write_pages(xdr, args->pages, 0, args->len); + else +- xdr_reserve_space(xdr, NFS_ACL_INLINE_BUFSIZE); ++ xdr_reserve_space(xdr, args->len); + + error = nfsacl_encode(xdr->buf, base, args->inode, + (args->mask & NFS_ACL) ? +diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c +index b4f177f..c402b67 100644 +--- a/fs/nfs/nfs4state.c ++++ b/fs/nfs/nfs4state.c +@@ -1482,6 +1482,8 @@ restart: + spin_unlock(&state->state_lock); + } + nfs4_put_open_state(state); ++ clear_bit(NFS4CLNT_RECLAIM_NOGRACE, ++ &state->flags); + spin_lock(&sp->so_lock); + goto restart; + } +diff --git a/fs/xfs/xfs_symlink.c b/fs/xfs/xfs_symlink.c +index 14e58f2..98d4948 100644 +--- a/fs/xfs/xfs_symlink.c ++++ b/fs/xfs/xfs_symlink.c +@@ -102,7 +102,7 @@ xfs_readlink_bmap( + cur_chunk += sizeof(struct xfs_dsymlink_hdr); + } + +- memcpy(link + offset, bp->b_addr, byte_cnt); ++ memcpy(link + offset, cur_chunk, byte_cnt); + + pathlen -= byte_cnt; + offset += byte_cnt; +diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h +index 8fc12f8..69afb57 100644 +--- a/include/acpi/actypes.h ++++ b/include/acpi/actypes.h +@@ -561,6 +561,7 @@ typedef u64 acpi_integer; + #define ACPI_NO_ACPI_ENABLE 0x10 + #define ACPI_NO_DEVICE_INIT 0x20 + #define ACPI_NO_OBJECT_INIT 0x40 ++#define ACPI_NO_FACS_INIT 0x80 + + /* + * Initialization state +diff --git a/include/linux/acpi.h b/include/linux/acpi.h +index cd80aa8..77af621 100644 +--- a/include/linux/acpi.h ++++ b/include/linux/acpi.h +@@ -402,6 +402,7 @@ extern acpi_status acpi_pci_osc_control_set(acpi_handle handle, + #define ACPI_OST_SC_INSERT_NOT_SUPPORTED 0x82 + + extern void acpi_early_init(void); ++extern void acpi_subsystem_init(void); + + extern int acpi_nvs_register(__u64 start, __u64 size); + +@@ -436,6 +437,7 @@ static inline const char *acpi_dev_name(struct acpi_device *adev) + } + + static inline void acpi_early_init(void) { } ++static inline void acpi_subsystem_init(void) { } + + static inline int early_acpi_boot_init(void) + { +diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h +index 0dae71e..e1fb0f6 100644 +--- a/include/linux/jbd2.h ++++ b/include/linux/jbd2.h +@@ -1035,7 +1035,7 @@ struct buffer_head *jbd2_journal_get_descriptor_buffer(journal_t *journal); + int jbd2_journal_next_log_block(journal_t *, unsigned long long *); + int jbd2_journal_get_log_tail(journal_t *journal, tid_t *tid, + unsigned long *block); +-void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block); ++int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block); + void jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block); + + /* Commit management */ +@@ -1157,7 +1157,7 @@ extern int jbd2_journal_recover (journal_t *journal); + extern int jbd2_journal_wipe (journal_t *, int); + extern int jbd2_journal_skip_recovery (journal_t *); + extern void jbd2_journal_update_sb_errno(journal_t *); +-extern void jbd2_journal_update_sb_log_tail (journal_t *, tid_t, ++extern int jbd2_journal_update_sb_log_tail (journal_t *, tid_t, + unsigned long, int); + extern void __jbd2_journal_abort_hard (journal_t *); + extern void jbd2_journal_abort (journal_t *, int); +diff --git a/include/linux/libata.h b/include/linux/libata.h +index b84e786..189c9ff 100644 +--- a/include/linux/libata.h ++++ b/include/linux/libata.h +@@ -428,6 +428,7 @@ enum { + ATA_HORKAGE_NO_NCQ_TRIM = (1 << 19), /* don't use queued TRIM */ + ATA_HORKAGE_NOLPM = (1 << 20), /* don't use LPM */ + ATA_HORKAGE_WD_BROKEN_LPM = (1 << 21), /* some WDs have broken LPM */ ++ ATA_HORKAGE_NOTRIM = (1 << 24), /* don't use TRIM */ + + /* DMA mask for user DMA control: User visible values; DO NOT + renumber */ +diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h +index 53988cb..3a36a2c 100644 +--- a/include/linux/nfs_xdr.h ++++ b/include/linux/nfs_xdr.h +@@ -1155,7 +1155,7 @@ struct nfs41_state_protection { + struct nfs4_op_map allow; + }; + +-#define NFS4_EXCHANGE_ID_LEN (48) ++#define NFS4_EXCHANGE_ID_LEN (127) + struct nfs41_exchange_id_args { + struct nfs_client *client; + nfs4_verifier *verifier; +diff --git a/include/linux/of.h b/include/linux/of.h +index 3f8144d..9f2698d 100644 +--- a/include/linux/of.h ++++ b/include/linux/of.h +@@ -517,7 +517,10 @@ static inline const char *of_prop_next_string(struct property *prop, + #if defined(CONFIG_OF) && defined(CONFIG_NUMA) + extern int of_node_to_nid(struct device_node *np); + #else +-static inline int of_node_to_nid(struct device_node *device) { return 0; } ++static inline int of_node_to_nid(struct device_node *device) ++{ ++ return NUMA_NO_NODE; ++} + #endif + + static inline struct device_node *of_find_matching_node( +diff --git a/include/uapi/linux/usbdevice_fs.h b/include/uapi/linux/usbdevice_fs.h +index 0c65e4b..ef29266 100644 +--- a/include/uapi/linux/usbdevice_fs.h ++++ b/include/uapi/linux/usbdevice_fs.h +@@ -125,11 +125,12 @@ struct usbdevfs_hub_portinfo { + char port [127]; /* e.g. port 3 connects to device 27 */ + }; + +-/* Device capability flags */ ++/* System and bus capability flags */ + #define USBDEVFS_CAP_ZERO_PACKET 0x01 + #define USBDEVFS_CAP_BULK_CONTINUATION 0x02 + #define USBDEVFS_CAP_NO_PACKET_SIZE_LIM 0x04 + #define USBDEVFS_CAP_BULK_SCATTER_GATHER 0x08 ++#define USBDEVFS_CAP_REAP_AFTER_DISCONNECT 0x10 + + /* USBDEVFS_DISCONNECT_CLAIM flags & struct */ + +diff --git a/init/main.c b/init/main.c +index 58c132d..008edce 100644 +--- a/init/main.c ++++ b/init/main.c +@@ -643,6 +643,7 @@ asmlinkage void __init start_kernel(void) + + check_bugs(); + ++ acpi_subsystem_init(); + sfi_init_late(); + + if (efi_enabled(EFI_RUNTIME_SERVICES)) { +diff --git a/kernel/irq/devres.c b/kernel/irq/devres.c +index 1ef0606..0296d6f 100644 +--- a/kernel/irq/devres.c ++++ b/kernel/irq/devres.c +@@ -104,7 +104,7 @@ int devm_request_any_context_irq(struct device *dev, unsigned int irq, + return -ENOMEM; + + rc = request_any_context_irq(irq, handler, irqflags, devname, dev_id); +- if (rc) { ++ if (rc < 0) { + devres_free(dr); + return rc; + } +@@ -113,7 +113,7 @@ int devm_request_any_context_irq(struct device *dev, unsigned int irq, + dr->dev_id = dev_id; + devres_add(dev, dr); + +- return 0; ++ return rc; + } + EXPORT_SYMBOL(devm_request_any_context_irq); + +diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig +index 2fac9cc..9d18628 100644 +--- a/kernel/power/Kconfig ++++ b/kernel/power/Kconfig +@@ -191,7 +191,7 @@ config DPM_WATCHDOG + config DPM_WATCHDOG_TIMEOUT + int "Watchdog timeout in seconds" + range 1 120 +- default 12 ++ default 60 + depends on DPM_WATCHDOG + + config PM_TRACE +diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c +index a755ad7..02e7fb4 100644 +--- a/kernel/printk/printk.c ++++ b/kernel/printk/printk.c +@@ -383,11 +383,11 @@ static int check_syslog_permissions(int type, bool from_file) + * already done the capabilities checks at open time. + */ + if (from_file && type != SYSLOG_ACTION_OPEN) +- return 0; ++ goto ok; + + if (syslog_action_restricted(type)) { + if (capable(CAP_SYSLOG)) +- return 0; ++ goto ok; + /* + * For historical reasons, accept CAP_SYS_ADMIN too, with + * a warning. +@@ -397,10 +397,11 @@ static int check_syslog_permissions(int type, bool from_file) + "CAP_SYS_ADMIN but no CAP_SYSLOG " + "(deprecated).\n", + current->comm, task_pid_nr(current)); +- return 0; ++ goto ok; + } + return -EPERM; + } ++ok: + return security_syslog(type); + } + +@@ -1126,10 +1127,6 @@ int do_syslog(int type, char __user *buf, int len, bool from_file) + if (error) + goto out; + +- error = security_syslog(type); +- if (error) +- return error; +- + switch (type) { + case SYSLOG_ACTION_CLOSE: /* Close log */ + break; +diff --git a/kernel/rcu/tiny.c b/kernel/rcu/tiny.c +index 1254f31..ae359f0 100644 +--- a/kernel/rcu/tiny.c ++++ b/kernel/rcu/tiny.c +@@ -284,6 +284,11 @@ static void __rcu_process_callbacks(struct rcu_ctrlblk *rcp) + + /* Move the ready-to-invoke callbacks to a local list. */ + local_irq_save(flags); ++ if (rcp->donetail == &rcp->rcucblist) { ++ /* No callbacks ready, so just leave. */ ++ local_irq_restore(flags); ++ return; ++ } + RCU_TRACE(trace_rcu_batch_start(rcp->name, 0, rcp->qlen, -1)); + list = rcp->rcucblist; + rcp->rcucblist = *rcp->donetail; +diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h +index c8bd809..c1be95c 100644 +--- a/kernel/trace/trace.h ++++ b/kernel/trace/trace.h +@@ -422,6 +422,7 @@ enum { + + TRACE_CONTROL_BIT, + ++ TRACE_BRANCH_BIT, + /* + * Abuse of the trace_recursion. + * As we need a way to maintain state if we are tracing the function +diff --git a/kernel/trace/trace_branch.c b/kernel/trace/trace_branch.c +index 697fb9b..60850b4 100644 +--- a/kernel/trace/trace_branch.c ++++ b/kernel/trace/trace_branch.c +@@ -37,9 +37,12 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect) + struct trace_branch *entry; + struct ring_buffer *buffer; + unsigned long flags; +- int cpu, pc; ++ int pc; + const char *p; + ++ if (current->trace_recursion & TRACE_BRANCH_BIT) ++ return; ++ + /* + * I would love to save just the ftrace_likely_data pointer, but + * this code can also be used by modules. Ugly things can happen +@@ -50,10 +53,10 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect) + if (unlikely(!tr)) + return; + +- local_irq_save(flags); +- cpu = raw_smp_processor_id(); +- data = per_cpu_ptr(tr->trace_buffer.data, cpu); +- if (atomic_inc_return(&data->disabled) != 1) ++ raw_local_irq_save(flags); ++ current->trace_recursion |= TRACE_BRANCH_BIT; ++ data = this_cpu_ptr(tr->trace_buffer.data); ++ if (atomic_read(&data->disabled)) + goto out; + + pc = preempt_count(); +@@ -82,8 +85,8 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect) + __buffer_unlock_commit(buffer, event); + + out: +- atomic_dec(&data->disabled); +- local_irq_restore(flags); ++ current->trace_recursion &= ~TRACE_BRANCH_BIT; ++ raw_local_irq_restore(flags); + } + + static inline +diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c +index cb347e8..7b244d0 100644 +--- a/kernel/trace/trace_events_filter.c ++++ b/kernel/trace/trace_events_filter.c +@@ -1086,6 +1086,9 @@ static void parse_init(struct filter_parse_state *ps, + + static char infix_next(struct filter_parse_state *ps) + { ++ if (!ps->infix.cnt) ++ return 0; ++ + ps->infix.cnt--; + + return ps->infix.string[ps->infix.tail++]; +@@ -1101,6 +1104,9 @@ static char infix_peek(struct filter_parse_state *ps) + + static void infix_advance(struct filter_parse_state *ps) + { ++ if (!ps->infix.cnt) ++ return; ++ + ps->infix.cnt--; + ps->infix.tail++; + } +@@ -1413,7 +1419,9 @@ static int check_preds(struct filter_parse_state *ps) + continue; + } + n_normal_preds++; +- WARN_ON_ONCE(cnt < 0); ++ /* all ops should have operands */ ++ if (cnt < 0) ++ break; + } + + if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) { +diff --git a/lib/bitmap.c b/lib/bitmap.c +index e5c4ebe..c0634aa 100644 +--- a/lib/bitmap.c ++++ b/lib/bitmap.c +@@ -603,12 +603,12 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen, + unsigned a, b; + int c, old_c, totaldigits; + const char __user __force *ubuf = (const char __user __force *)buf; +- int exp_digit, in_range; ++ int at_start, in_range; + + totaldigits = c = 0; + bitmap_zero(maskp, nmaskbits); + do { +- exp_digit = 1; ++ at_start = 1; + in_range = 0; + a = b = 0; + +@@ -637,11 +637,10 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen, + break; + + if (c == '-') { +- if (exp_digit || in_range) ++ if (at_start || in_range) + return -EINVAL; + b = 0; + in_range = 1; +- exp_digit = 1; + continue; + } + +@@ -651,16 +650,18 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen, + b = b * 10 + (c - '0'); + if (!in_range) + a = b; +- exp_digit = 0; ++ at_start = 0; + totaldigits++; + } + if (!(a <= b)) + return -EINVAL; + if (b >= nmaskbits) + return -ERANGE; +- while (a <= b) { +- set_bit(a, maskp); +- a++; ++ if (!at_start) { ++ while (a <= b) { ++ set_bit(a, maskp); ++ a++; ++ } + } + } while (buflen && c == ','); + return 0; +diff --git a/net/9p/client.c b/net/9p/client.c +index 9186550..08046f3 100644 +--- a/net/9p/client.c ++++ b/net/9p/client.c +@@ -839,7 +839,8 @@ static struct p9_req_t *p9_client_zc_rpc(struct p9_client *c, int8_t type, + if (err < 0) { + if (err == -EIO) + c->status = Disconnected; +- goto reterr; ++ if (err != -ERESTARTSYS) ++ goto reterr; + } + if (req->status == REQ_STATUS_ERROR) { + p9_debug(P9_DEBUG_ERROR, "req_status error %d\n", req->t_err); +diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c +index aade4a5..bde94d8 100644 +--- a/net/ceph/osdmap.c ++++ b/net/ceph/osdmap.c +@@ -89,7 +89,7 @@ static int crush_decode_tree_bucket(void **p, void *end, + { + int j; + dout("crush_decode_tree_bucket %p to %p\n", *p, end); +- ceph_decode_32_safe(p, end, b->num_nodes, bad); ++ ceph_decode_8_safe(p, end, b->num_nodes, bad); + b->node_weights = kcalloc(b->num_nodes, sizeof(u32), GFP_NOFS); + if (b->node_weights == NULL) + return -ENOMEM; +diff --git a/net/mac80211/main.c b/net/mac80211/main.c +index c7a7a86..9e58c99 100644 +--- a/net/mac80211/main.c ++++ b/net/mac80211/main.c +@@ -248,6 +248,7 @@ static void ieee80211_restart_work(struct work_struct *work) + { + struct ieee80211_local *local = + container_of(work, struct ieee80211_local, restart_work); ++ struct ieee80211_sub_if_data *sdata; + + /* wait for scan work complete */ + flush_workqueue(local->workqueue); +@@ -256,6 +257,8 @@ static void ieee80211_restart_work(struct work_struct *work) + "%s called with hardware scan in progress\n", __func__); + + rtnl_lock(); ++ list_for_each_entry(sdata, &local->interfaces, list) ++ flush_delayed_work(&sdata->dec_tailroom_needed_wk); + ieee80211_scan_cancel(local); + ieee80211_reconfig(local); + rtnl_unlock(); +diff --git a/net/sunrpc/backchannel_rqst.c b/net/sunrpc/backchannel_rqst.c +index e860d4f..ab21968 100644 +--- a/net/sunrpc/backchannel_rqst.c ++++ b/net/sunrpc/backchannel_rqst.c +@@ -60,7 +60,7 @@ static void xprt_free_allocation(struct rpc_rqst *req) + + dprintk("RPC: free allocations for req= %p\n", req); + WARN_ON_ONCE(test_bit(RPC_BC_PA_IN_USE, &req->rq_bc_pa_state)); +- xbufp = &req->rq_private_buf; ++ xbufp = &req->rq_rcv_buf; + free_page((unsigned long)xbufp->head[0].iov_base); + xbufp = &req->rq_snd_buf; + free_page((unsigned long)xbufp->head[0].iov_base); +diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c +index 7e71e06..048550a 100644 +--- a/security/integrity/evm/evm_main.c ++++ b/security/integrity/evm/evm_main.c +@@ -20,6 +20,7 @@ + #include <linux/xattr.h> + #include <linux/integrity.h> + #include <linux/evm.h> ++#include <linux/magic.h> + #include <crypto/hash.h> + #include "evm.h" + +@@ -275,6 +276,17 @@ static int evm_protect_xattr(struct dentry *dentry, const char *xattr_name, + iint = integrity_iint_find(dentry->d_inode); + if (iint && (iint->flags & IMA_NEW_FILE)) + return 0; ++ ++ /* exception for pseudo filesystems */ ++ if (dentry->d_inode->i_sb->s_magic == TMPFS_MAGIC ++ || dentry->d_inode->i_sb->s_magic == SYSFS_MAGIC) ++ return 0; ++ ++ integrity_audit_msg(AUDIT_INTEGRITY_METADATA, ++ dentry->d_inode, dentry->d_name.name, ++ "update_metadata", ++ integrity_status_msg[evm_status], ++ -EPERM, 0); + } + out: + if (evm_status != INTEGRITY_PASS) +diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h +index f79fa8b..5cb7de9 100644 +--- a/security/integrity/ima/ima.h ++++ b/security/integrity/ima/ima.h +@@ -106,7 +106,7 @@ void ima_add_violation(struct file *file, const unsigned char *filename, + const char *op, const char *cause); + int ima_init_crypto(void); + void ima_putc(struct seq_file *m, void *data, int datalen); +-void ima_print_digest(struct seq_file *m, u8 *digest, int size); ++void ima_print_digest(struct seq_file *m, u8 *digest, u32 size); + struct ima_template_desc *ima_template_desc_current(void); + int ima_init_template(void); + +diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c +index 468a3ba..35f3c90 100644 +--- a/security/integrity/ima/ima_fs.c ++++ b/security/integrity/ima/ima_fs.c +@@ -186,9 +186,9 @@ static const struct file_operations ima_measurements_ops = { + .release = seq_release, + }; + +-void ima_print_digest(struct seq_file *m, u8 *digest, int size) ++void ima_print_digest(struct seq_file *m, u8 *digest, u32 size) + { +- int i; ++ u32 i; + + for (i = 0; i < size; i++) + seq_printf(m, "%02x", *(digest + i)); +diff --git a/security/integrity/ima/ima_template_lib.c b/security/integrity/ima/ima_template_lib.c +index e8592e7..dcf77b7 100644 +--- a/security/integrity/ima/ima_template_lib.c ++++ b/security/integrity/ima/ima_template_lib.c +@@ -79,7 +79,8 @@ static void ima_show_template_data_ascii(struct seq_file *m, + enum data_formats datafmt, + struct ima_field_data *field_data) + { +- u8 *buf_ptr = field_data->data, buflen = field_data->len; ++ u8 *buf_ptr = field_data->data; ++ u32 buflen = field_data->len; + + switch (datafmt) { + case DATA_FMT_DIGEST_WITH_ALGO: +diff --git a/security/keys/keyring.c b/security/keys/keyring.c +index 2fb2576..04d0d7c 100644 +--- a/security/keys/keyring.c ++++ b/security/keys/keyring.c +@@ -1151,9 +1151,11 @@ void __key_link_end(struct key *keyring, + if (index_key->type == &key_type_keyring) + up_write(&keyring_serialise_link_sem); + +- if (edit && !edit->dead_leaf) { +- key_payload_reserve(keyring, +- keyring->datalen - KEYQUOTA_LINK_BYTES); ++ if (edit) { ++ if (!edit->dead_leaf) { ++ key_payload_reserve(keyring, ++ keyring->datalen - KEYQUOTA_LINK_BYTES); ++ } + assoc_array_cancel_edit(edit); + } + up_write(&keyring->sem); +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index ba17522..2f503c0 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -3955,6 +3955,7 @@ enum { + ALC269_FIXUP_LIFEBOOK, + ALC269_FIXUP_LIFEBOOK_EXTMIC, + ALC269_FIXUP_LIFEBOOK_HP_PIN, ++ ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT, + ALC269_FIXUP_AMIC, + ALC269_FIXUP_DMIC, + ALC269VB_FIXUP_AMIC, +@@ -3973,6 +3974,7 @@ enum { + ALC269_FIXUP_DELL3_MIC_NO_PRESENCE, + ALC269_FIXUP_HEADSET_MODE, + ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC, ++ ALC269_FIXUP_ASPIRE_HEADSET_MIC, + ALC269_FIXUP_ASUS_X101_FUNC, + ALC269_FIXUP_ASUS_X101_VERB, + ALC269_FIXUP_ASUS_X101, +@@ -4096,6 +4098,10 @@ static const struct hda_fixup alc269_fixups[] = { + { } + }, + }, ++ [ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc269_fixup_pincfg_no_hp_to_lineout, ++ }, + [ALC269_FIXUP_AMIC] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl[]) { +@@ -4214,6 +4220,15 @@ static const struct hda_fixup alc269_fixups[] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc_fixup_headset_mode_no_hp_mic, + }, ++ [ALC269_FIXUP_ASPIRE_HEADSET_MIC] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x19, 0x01a1913c }, /* headset mic w/o jack detect */ ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC269_FIXUP_HEADSET_MODE, ++ }, + [ALC286_FIXUP_SONY_MIC_NO_PRESENCE] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl[]) { +@@ -4397,6 +4412,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1025, 0x029b, "Acer 1810TZ", ALC269_FIXUP_INV_DMIC), + SND_PCI_QUIRK(0x1025, 0x0349, "Acer AOD260", ALC269_FIXUP_INV_DMIC), + SND_PCI_QUIRK(0x1025, 0x047c, "Acer AC700", ALC269_FIXUP_ACER_AC700), ++ SND_PCI_QUIRK(0x1025, 0x072d, "Acer Aspire V5-571G", ALC269_FIXUP_ASPIRE_HEADSET_MIC), ++ SND_PCI_QUIRK(0x1025, 0x080d, "Acer Aspire V5-122P", ALC269_FIXUP_ASPIRE_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x0740, "Acer AO725", ALC271_FIXUP_HP_GATE_MIC_JACK), + SND_PCI_QUIRK(0x1025, 0x0742, "Acer AO756", ALC271_FIXUP_HP_GATE_MIC_JACK), + SND_PCI_QUIRK_VENDOR(0x1025, "Acer Aspire", ALC271_FIXUP_DMIC), +@@ -4549,6 +4566,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x104d, 0x9084, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ), + SND_PCI_QUIRK_VENDOR(0x104d, "Sony VAIO", ALC269_FIXUP_SONY_VAIO), + SND_PCI_QUIRK(0x10cf, 0x1475, "Lifebook", ALC269_FIXUP_LIFEBOOK), ++ SND_PCI_QUIRK(0x10cf, 0x159f, "Lifebook E780", ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT), + SND_PCI_QUIRK(0x10cf, 0x15dc, "Lifebook T731", ALC269_FIXUP_LIFEBOOK_HP_PIN), + SND_PCI_QUIRK(0x10cf, 0x1757, "Lifebook E752", ALC269_FIXUP_LIFEBOOK_HP_PIN), + SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC), +diff --git a/sound/soc/codecs/wm5102.c b/sound/soc/codecs/wm5102.c +index ce9c8e1..fbee45c 100644 +--- a/sound/soc/codecs/wm5102.c ++++ b/sound/soc/codecs/wm5102.c +@@ -41,7 +41,7 @@ struct wm5102_priv { + static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0); + static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0); + static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0); +-static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0); ++static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0); + static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0); + + static const struct wm_adsp_region wm5102_dsp1_regions[] = { +diff --git a/sound/soc/codecs/wm5110.c b/sound/soc/codecs/wm5110.c +index 2c3c962..0fce853 100644 +--- a/sound/soc/codecs/wm5110.c ++++ b/sound/soc/codecs/wm5110.c +@@ -167,7 +167,7 @@ static int wm5110_sysclk_ev(struct snd_soc_dapm_widget *w, + static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0); + static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0); + static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0); +-static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0); ++static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0); + static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0); + + #define WM5110_NG_SRC(name, base) \ +diff --git a/sound/soc/codecs/wm8737.c b/sound/soc/codecs/wm8737.c +index 2f167a8..62bacb8 100644 +--- a/sound/soc/codecs/wm8737.c ++++ b/sound/soc/codecs/wm8737.c +@@ -494,7 +494,8 @@ static int wm8737_set_bias_level(struct snd_soc_codec *codec, + + /* Fast VMID ramp at 2*2.5k */ + snd_soc_update_bits(codec, WM8737_MISC_BIAS_CONTROL, +- WM8737_VMIDSEL_MASK, 0x4); ++ WM8737_VMIDSEL_MASK, ++ 2 << WM8737_VMIDSEL_SHIFT); + + /* Bring VMID up */ + snd_soc_update_bits(codec, WM8737_POWER_MANAGEMENT, +@@ -508,7 +509,8 @@ static int wm8737_set_bias_level(struct snd_soc_codec *codec, + + /* VMID at 2*300k */ + snd_soc_update_bits(codec, WM8737_MISC_BIAS_CONTROL, +- WM8737_VMIDSEL_MASK, 2); ++ WM8737_VMIDSEL_MASK, ++ 1 << WM8737_VMIDSEL_SHIFT); + + break; + +diff --git a/sound/soc/codecs/wm8903.h b/sound/soc/codecs/wm8903.h +index db94931..0bb4a64 100644 +--- a/sound/soc/codecs/wm8903.h ++++ b/sound/soc/codecs/wm8903.h +@@ -172,7 +172,7 @@ extern int wm8903_mic_detect(struct snd_soc_codec *codec, + #define WM8903_VMID_BUF_ENA_WIDTH 1 /* VMID_BUF_ENA */ + + #define WM8903_VMID_RES_50K 2 +-#define WM8903_VMID_RES_250K 3 ++#define WM8903_VMID_RES_250K 4 + #define WM8903_VMID_RES_5K 6 + + /* +diff --git a/sound/soc/codecs/wm8955.c b/sound/soc/codecs/wm8955.c +index 1c1fc61..475fc24 100644 +--- a/sound/soc/codecs/wm8955.c ++++ b/sound/soc/codecs/wm8955.c +@@ -298,7 +298,7 @@ static int wm8955_configure_clocking(struct snd_soc_codec *codec) + snd_soc_update_bits(codec, WM8955_PLL_CONTROL_2, + WM8955_K_17_9_MASK, + (pll.k >> 9) & WM8955_K_17_9_MASK); +- snd_soc_update_bits(codec, WM8955_PLL_CONTROL_2, ++ snd_soc_update_bits(codec, WM8955_PLL_CONTROL_3, + WM8955_K_8_0_MASK, + pll.k & WM8955_K_8_0_MASK); + if (pll.k) +diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c +index edfd4ed..e04dbaa 100644 +--- a/sound/soc/codecs/wm8960.c ++++ b/sound/soc/codecs/wm8960.c +@@ -242,7 +242,7 @@ SOC_SINGLE("PCM Playback -6dB Switch", WM8960_DACCTL1, 7, 1, 0), + SOC_ENUM("ADC Polarity", wm8960_enum[0]), + SOC_SINGLE("ADC High Pass Filter Switch", WM8960_DACCTL1, 0, 1, 0), + +-SOC_ENUM("DAC Polarity", wm8960_enum[2]), ++SOC_ENUM("DAC Polarity", wm8960_enum[1]), + SOC_SINGLE_BOOL_EXT("DAC Deemphasis Switch", 0, + wm8960_get_deemph, wm8960_put_deemph), + +diff --git a/sound/soc/codecs/wm8997.c b/sound/soc/codecs/wm8997.c +index 555115e..1461ae61 100644 +--- a/sound/soc/codecs/wm8997.c ++++ b/sound/soc/codecs/wm8997.c +@@ -40,7 +40,7 @@ struct wm8997_priv { + static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0); + static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0); + static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0); +-static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0); ++static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0); + static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0); + + static const struct reg_default wm8997_sysclk_reva_patch[] = { +diff --git a/sound/soc/fsl/imx-wm8962.c b/sound/soc/fsl/imx-wm8962.c +index 3a3d17c..6644525 100644 +--- a/sound/soc/fsl/imx-wm8962.c ++++ b/sound/soc/fsl/imx-wm8962.c +@@ -190,7 +190,7 @@ static int imx_wm8962_probe(struct platform_device *pdev) + dev_err(&pdev->dev, "audmux internal port setup failed\n"); + return ret; + } +- imx_audmux_v2_configure_port(ext_port, ++ ret = imx_audmux_v2_configure_port(ext_port, + IMX_AUDMUX_V2_PTCR_SYN, + IMX_AUDMUX_V2_PDCR_RXDSEL(int_port)); + if (ret) { diff --git a/3.14.48/4420_grsecurity-3.1-3.14.48-201508020901.patch b/3.14.49/4420_grsecurity-3.1-3.14.49-201508032312.patch index 2727f73..75ba2f6 100644 --- a/3.14.48/4420_grsecurity-3.1-3.14.48-201508020901.patch +++ b/3.14.49/4420_grsecurity-3.1-3.14.49-201508032312.patch @@ -328,7 +328,7 @@ index 855d9b3..154c500 100644 A toggle value indicating if modules are allowed to be loaded diff --git a/Makefile b/Makefile -index 25393e8..65e3b07 100644 +index fee8460..5d81b33 100644 --- a/Makefile +++ b/Makefile @@ -244,8 +244,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \ @@ -37469,7 +37469,7 @@ index 3d8413d..95f638c 100644 .callback = dmi_disable_osi_vista, .ident = "Fujitsu Siemens", diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c -index b48aefa..91b17ef 100644 +index 60be8d0..e76df2e 100644 --- a/drivers/acpi/bus.c +++ b/drivers/acpi/bus.c @@ -67,7 +67,7 @@ static int set_copy_dsdt(const struct dmi_system_id *id) @@ -37641,7 +37641,7 @@ index b65d79c..27ae93d 100644 unsigned long timeout_msec) { diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c -index b1c0fcd..fcc0dd1 100644 +index b0e6691..aecb86a 100644 --- a/drivers/ata/libata-core.c +++ b/drivers/ata/libata-core.c @@ -98,7 +98,7 @@ static unsigned int ata_dev_set_xfermode(struct ata_device *dev); @@ -37653,7 +37653,7 @@ index b1c0fcd..fcc0dd1 100644 struct ata_force_param { const char *name; -@@ -4863,7 +4863,7 @@ void ata_qc_free(struct ata_queued_cmd *qc) +@@ -4868,7 +4868,7 @@ void ata_qc_free(struct ata_queued_cmd *qc) struct ata_port *ap; unsigned int tag; @@ -37662,7 +37662,7 @@ index b1c0fcd..fcc0dd1 100644 ap = qc->ap; qc->flags = 0; -@@ -4879,7 +4879,7 @@ void __ata_qc_complete(struct ata_queued_cmd *qc) +@@ -4884,7 +4884,7 @@ void __ata_qc_complete(struct ata_queued_cmd *qc) struct ata_port *ap; struct ata_link *link; @@ -37671,7 +37671,7 @@ index b1c0fcd..fcc0dd1 100644 WARN_ON_ONCE(!(qc->flags & ATA_QCFLAG_ACTIVE)); ap = qc->ap; link = qc->dev->link; -@@ -5998,6 +5998,7 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops) +@@ -6003,6 +6003,7 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops) return; spin_lock(&lock); @@ -37679,7 +37679,7 @@ index b1c0fcd..fcc0dd1 100644 for (cur = ops->inherits; cur; cur = cur->inherits) { void **inherit = (void **)cur; -@@ -6011,8 +6012,9 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops) +@@ -6016,8 +6017,9 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops) if (IS_ERR(*pp)) *pp = NULL; @@ -37690,7 +37690,7 @@ index b1c0fcd..fcc0dd1 100644 spin_unlock(&lock); } -@@ -6208,7 +6210,7 @@ int ata_host_register(struct ata_host *host, struct scsi_host_template *sht) +@@ -6213,7 +6215,7 @@ int ata_host_register(struct ata_host *host, struct scsi_host_template *sht) /* give ports names and add SCSI hosts */ for (i = 0; i < host->n_ports; i++) { @@ -37700,10 +37700,10 @@ index b1c0fcd..fcc0dd1 100644 } diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c -index ef8567d..8bdbd03 100644 +index 6fecf0b..9c1bd61 100644 --- a/drivers/ata/libata-scsi.c +++ b/drivers/ata/libata-scsi.c -@@ -4147,7 +4147,7 @@ int ata_sas_port_init(struct ata_port *ap) +@@ -4148,7 +4148,7 @@ int ata_sas_port_init(struct ata_port *ap) if (rc) return rc; @@ -41486,10 +41486,10 @@ index 9902732..64b62dd 100644 return -EINVAL; } diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c -index 3b7d32d..05c2f74 100644 +index 903db3c..37d500c 100644 --- a/drivers/gpu/drm/drm_crtc.c +++ b/drivers/gpu/drm/drm_crtc.c -@@ -3123,7 +3123,7 @@ int drm_mode_getproperty_ioctl(struct drm_device *dev, +@@ -3126,7 +3126,7 @@ int drm_mode_getproperty_ioctl(struct drm_device *dev, goto done; } @@ -42264,7 +42264,7 @@ index a92fb01..35e0602 100644 return can_switch; } diff --git a/drivers/gpu/drm/qxl/qxl_cmd.c b/drivers/gpu/drm/qxl/qxl_cmd.c -index eb89653..613cf71 100644 +index c5e96a3..89901d7 100644 --- a/drivers/gpu/drm/qxl/qxl_cmd.c +++ b/drivers/gpu/drm/qxl/qxl_cmd.c @@ -285,27 +285,27 @@ static int wait_for_io_cmd_user(struct qxl_device *qdev, uint8_t val, long port, @@ -42340,10 +42340,10 @@ index 36ed40b..0397633 100644 wait_queue_head_t display_event; wait_queue_head_t cursor_event; diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c -index 0bb86e6..d41416d 100644 +index 56a13a9..10dbab0 100644 --- a/drivers/gpu/drm/qxl/qxl_ioctl.c +++ b/drivers/gpu/drm/qxl/qxl_ioctl.c -@@ -181,7 +181,7 @@ static int qxl_process_single_command(struct qxl_device *qdev, +@@ -183,7 +183,7 @@ static int qxl_process_single_command(struct qxl_device *qdev, /* TODO copy slow path code from i915 */ fb_cmd = qxl_bo_kmap_atomic_page(qdev, cmd_bo, (release->release_offset & PAGE_SIZE)); @@ -42352,7 +42352,7 @@ index 0bb86e6..d41416d 100644 { struct qxl_drawable *draw = fb_cmd; -@@ -201,7 +201,7 @@ static int qxl_process_single_command(struct qxl_device *qdev, +@@ -203,7 +203,7 @@ static int qxl_process_single_command(struct qxl_device *qdev, struct drm_qxl_reloc reloc; if (copy_from_user(&reloc, @@ -42361,7 +42361,7 @@ index 0bb86e6..d41416d 100644 sizeof(reloc))) { ret = -EFAULT; goto out_free_bos; -@@ -294,10 +294,10 @@ static int qxl_execbuffer_ioctl(struct drm_device *dev, void *data, +@@ -296,10 +296,10 @@ static int qxl_execbuffer_ioctl(struct drm_device *dev, void *data, for (cmd_num = 0; cmd_num < execbuffer->commands_num; ++cmd_num) { @@ -45733,7 +45733,7 @@ index 089d627..ef7352e 100644 return (test_bit(DM_RAID1_FLUSH_ERROR, &(m->error_type))) ? 'F' : diff --git a/drivers/md/dm-stats.c b/drivers/md/dm-stats.c -index 28a9012..9c0f6a5 100644 +index b3b0697..b556265 100644 --- a/drivers/md/dm-stats.c +++ b/drivers/md/dm-stats.c @@ -382,7 +382,7 @@ do_sync_free: @@ -45901,7 +45901,7 @@ index e400591..a94ae6b 100644 void dm_uevent_add(struct mapped_device *md, struct list_head *elist) diff --git a/drivers/md/md.c b/drivers/md/md.c -index 40959ee..2da5090 100644 +index b4067b9..91b08f3 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -194,10 +194,10 @@ EXPORT_SYMBOL_GPL(bio_clone_mddev); @@ -46059,10 +46059,10 @@ index 07bba96..2d6788c 100644 struct md_personality diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c -index f4e22bc..8f83114 100644 +index 199c9cc..0f72f8a 100644 --- a/drivers/md/persistent-data/dm-space-map-metadata.c +++ b/drivers/md/persistent-data/dm-space-map-metadata.c -@@ -681,7 +681,7 @@ static int sm_metadata_extend(struct dm_space_map *sm, dm_block_t extra_blocks) +@@ -689,7 +689,7 @@ static int sm_metadata_extend(struct dm_space_map *sm, dm_block_t extra_blocks) * Flick into a mode where all blocks get allocated in the new area. */ smm->begin = old_len; @@ -46071,7 +46071,7 @@ index f4e22bc..8f83114 100644 /* * Extend. -@@ -712,7 +712,7 @@ out: +@@ -726,7 +726,7 @@ out: /* * Switch back to normal behaviour. */ @@ -48304,10 +48304,10 @@ index 82dc574..8539ab2 100644 break; diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c -index b1e21fc..f14200a 100644 +index d71f5ef..30aa1c0 100644 --- a/drivers/mmc/card/block.c +++ b/drivers/mmc/card/block.c -@@ -575,7 +575,7 @@ static int mmc_blk_ioctl_cmd(struct block_device *bdev, +@@ -577,7 +577,7 @@ static int mmc_blk_ioctl_cmd(struct block_device *bdev, if (idata->ic.postsleep_min_us) usleep_range(idata->ic.postsleep_min_us, idata->ic.postsleep_max_us); @@ -51638,7 +51638,7 @@ index 84419af..268ede8 100644 &dev_attr_energy_uj.attr; } diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c -index 5d8d2dc..99fd3db 100644 +index 427cb62..4bdf48a 100644 --- a/drivers/regulator/core.c +++ b/drivers/regulator/core.c @@ -3372,7 +3372,7 @@ regulator_register(const struct regulator_desc *regulator_desc, @@ -52916,7 +52916,7 @@ index fd8ffe6..fd0bebf 100644 err = class_register(&iscsi_transport_class); if (err) diff --git a/drivers/scsi/scsi_transport_srp.c b/drivers/scsi/scsi_transport_srp.c -index e3e794e..f72f20c 100644 +index b85eaa0..5876bc1 100644 --- a/drivers/scsi/scsi_transport_srp.c +++ b/drivers/scsi/scsi_transport_srp.c @@ -36,7 +36,7 @@ @@ -52937,7 +52937,7 @@ index e3e794e..f72f20c 100644 return 0; } -@@ -735,7 +735,7 @@ struct srp_rport *srp_rport_add(struct Scsi_Host *shost, +@@ -745,7 +745,7 @@ struct srp_rport *srp_rport_add(struct Scsi_Host *shost, rport_fast_io_fail_timedout); INIT_DELAYED_WORK(&rport->dev_loss_work, rport_dev_loss_timedout); @@ -53044,10 +53044,10 @@ index a1d6986..f310982 100644 } diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c -index d6563ec..a1c5da2 100644 +index f3e3ae8..f876b14 100644 --- a/drivers/spi/spi.c +++ b/drivers/spi/spi.c -@@ -1981,7 +1981,7 @@ int spi_bus_unlock(struct spi_master *master) +@@ -1982,7 +1982,7 @@ int spi_bus_unlock(struct spi_master *master) EXPORT_SYMBOL_GPL(spi_bus_unlock); /* portable code must never pass more than 32 bytes */ @@ -55512,7 +55512,7 @@ index 2a3bbdf..91d72cf 100644 file->f_version = event_count; return POLLIN | POLLRDNORM; diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c -index 45b7b96..e016243 100644 +index 8016aaa..2f0f65e 100644 --- a/drivers/usb/core/devio.c +++ b/drivers/usb/core/devio.c @@ -187,7 +187,7 @@ static ssize_t usbdev_read(struct file *file, char __user *buf, size_t nbytes, @@ -71936,20 +71936,10 @@ index c71e886..61d3d44b 100644 if (retval > 0) retval = 0; diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c -index bb7991c..9c2bc01 100644 +index bfdeadb..9c2bc01 100644 --- a/fs/9p/vfs_inode.c +++ b/fs/9p/vfs_inode.c -@@ -540,8 +540,7 @@ static struct inode *v9fs_qid_iget(struct super_block *sb, - unlock_new_inode(inode); - return inode; - error: -- unlock_new_inode(inode); -- iput(inode); -+ iget_failed(inode); - return ERR_PTR(retval); - - } -@@ -1312,7 +1311,7 @@ static void *v9fs_vfs_follow_link(struct dentry *dentry, struct nameidata *nd) +@@ -1311,7 +1311,7 @@ static void *v9fs_vfs_follow_link(struct dentry *dentry, struct nameidata *nd) void v9fs_vfs_put_link(struct dentry *dentry, struct nameidata *nd, void *p) { @@ -71958,20 +71948,6 @@ index bb7991c..9c2bc01 100644 p9_debug(P9_DEBUG_VFS, " %s %s\n", dentry->d_name.name, IS_ERR(s) ? "<error>" : s); -diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c -index 59dc8e8..de8606c 100644 ---- a/fs/9p/vfs_inode_dotl.c -+++ b/fs/9p/vfs_inode_dotl.c -@@ -149,8 +149,7 @@ static struct inode *v9fs_qid_iget_dotl(struct super_block *sb, - unlock_new_inode(inode); - return inode; - error: -- unlock_new_inode(inode); -- iput(inode); -+ iget_failed(inode); - return ERR_PTR(retval); - - } diff --git a/fs/Kconfig.binfmt b/fs/Kconfig.binfmt index 370b24c..ff0be7b 100644 --- a/fs/Kconfig.binfmt @@ -73170,7 +73146,7 @@ index 35240a7..a5edf69 100644 { register_binfmt(&elf_format); diff --git a/fs/bio.c b/fs/bio.c -index 8754e7b..0669094 100644 +index b2b1451..8cb6eb3 100644 --- a/fs/bio.c +++ b/fs/bio.c @@ -1145,7 +1145,7 @@ struct bio *bio_copy_user_iov(struct request_queue *q, @@ -75651,7 +75627,7 @@ index 2a6830a..d25d59c 100644 /* locality groups */ diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c -index e6574d7..c30cbe2 100644 +index a7c5277..fed626f 100644 --- a/fs/ext4/indirect.c +++ b/fs/ext4/indirect.c @@ -1345,8 +1345,8 @@ static int free_hole_blocks(handle_t *handle, struct inode *inode, @@ -75666,7 +75642,7 @@ index e6574d7..c30cbe2 100644 brelse(bh); bh = NULL; diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c -index 7620133..212880d 100644 +index c4a5e4d..586022a 100644 --- a/fs/ext4/mballoc.c +++ b/fs/ext4/mballoc.c @@ -1884,7 +1884,7 @@ void ext4_mb_simple_scan_group(struct ext4_allocation_context *ac, @@ -75838,10 +75814,10 @@ index 2400ad1..0bc93ab 100644 err = ext4_handle_dirty_metadata(handle, NULL, bh); if (unlikely(err)) diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index 9fb3e6c..9a82508 100644 +index a07af5b..831ce8a 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c -@@ -1268,7 +1268,7 @@ static ext4_fsblk_t get_sb_block(void **data) +@@ -1269,7 +1269,7 @@ static ext4_fsblk_t get_sb_block(void **data) } #define DEFAULT_JOURNAL_IOPRIO (IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, 3)) @@ -75850,7 +75826,7 @@ index 9fb3e6c..9a82508 100644 "Contact linux-ext4@vger.kernel.org if you think we should keep it.\n"; #ifdef CONFIG_QUOTA -@@ -2442,7 +2442,7 @@ struct ext4_attr { +@@ -2443,7 +2443,7 @@ struct ext4_attr { int offset; int deprecated_val; } u; @@ -98286,10 +98262,10 @@ index b8e9a43..632678d 100644 int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu); diff --git a/include/linux/libata.h b/include/linux/libata.h -index b84e786..2e320a9 100644 +index 189c9ff..53741969 100644 --- a/include/linux/libata.h +++ b/include/linux/libata.h -@@ -986,7 +986,7 @@ struct ata_port_operations { +@@ -987,7 +987,7 @@ struct ata_port_operations { * fields must be pointers. */ const struct ata_port_operations *inherits; @@ -103101,7 +103077,7 @@ index 93b6139..8d628b7 100644 next_state = Reset; return 0; diff --git a/init/main.c b/init/main.c -index 58c132d..310b5fa 100644 +index 008edce..eb10ef5 100644 --- a/init/main.c +++ b/init/main.c @@ -97,6 +97,8 @@ extern void radix_tree_init(void); @@ -103199,7 +103175,7 @@ index 58c132d..310b5fa 100644 static const char * argv_init[MAX_INIT_ARGS+2] = { "init", NULL, }; const char * envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, }; static const char *panic_later, *panic_param; -@@ -692,25 +773,24 @@ int __init_or_module do_one_initcall(initcall_t fn) +@@ -693,25 +774,24 @@ int __init_or_module do_one_initcall(initcall_t fn) { int count = preempt_count(); int ret; @@ -103230,7 +103206,7 @@ index 58c132d..310b5fa 100644 return ret; } -@@ -817,8 +897,8 @@ static int run_init_process(const char *init_filename) +@@ -818,8 +898,8 @@ static int run_init_process(const char *init_filename) { argv_init[0] = init_filename; return do_execve(getname_kernel(init_filename), @@ -103241,7 +103217,7 @@ index 58c132d..310b5fa 100644 } static int try_to_run_init_process(const char *init_filename) -@@ -835,6 +915,10 @@ static int try_to_run_init_process(const char *init_filename) +@@ -836,6 +916,10 @@ static int try_to_run_init_process(const char *init_filename) return ret; } @@ -103252,7 +103228,7 @@ index 58c132d..310b5fa 100644 static noinline void __init kernel_init_freeable(void); static int __ref kernel_init(void *unused) -@@ -859,6 +943,11 @@ static int __ref kernel_init(void *unused) +@@ -860,6 +944,11 @@ static int __ref kernel_init(void *unused) ramdisk_execute_command, ret); } @@ -103264,7 +103240,7 @@ index 58c132d..310b5fa 100644 /* * We try each of these until one succeeds. * -@@ -914,7 +1003,7 @@ static noinline void __init kernel_init_freeable(void) +@@ -915,7 +1004,7 @@ static noinline void __init kernel_init_freeable(void) do_basic_setup(); /* Open the /dev/console on the rootfs, this should never fail */ @@ -103273,7 +103249,7 @@ index 58c132d..310b5fa 100644 pr_err("Warning: unable to open an initial console.\n"); (void) sys_dup(0); -@@ -927,11 +1016,13 @@ static noinline void __init kernel_init_freeable(void) +@@ -928,11 +1017,13 @@ static noinline void __init kernel_init_freeable(void) if (!ramdisk_execute_command) ramdisk_execute_command = "/init"; @@ -107001,7 +106977,7 @@ index 77e6b83..fc021bd 100644 } diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig -index 2fac9cc..56fef29 100644 +index 9d18628..64def06 100644 --- a/kernel/power/Kconfig +++ b/kernel/power/Kconfig @@ -24,6 +24,8 @@ config HIBERNATE_CALLBACKS @@ -107057,7 +107033,7 @@ index f1fe7ec..7d4e641 100644 if (pm_wakeup_pending()) { diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c -index a755ad7..ba98f34 100644 +index 02e7fb4..a77ae80 100644 --- a/kernel/printk/printk.c +++ b/kernel/printk/printk.c @@ -359,9 +359,9 @@ static void log_store(int facility, int level, @@ -107074,7 +107050,7 @@ index a755ad7..ba98f34 100644 static int syslog_action_restricted(int type) @@ -385,6 +385,11 @@ static int check_syslog_permissions(int type, bool from_file) if (from_file && type != SYSLOG_ACTION_OPEN) - return 0; + goto ok; +#ifdef CONFIG_GRKERNSEC_DMESG + if (grsec_enable_dmesg && !capable(CAP_SYSLOG) && !capable_nolog(CAP_SYS_ADMIN)) @@ -107083,7 +107059,7 @@ index a755ad7..ba98f34 100644 + if (syslog_action_restricted(type)) { if (capable(CAP_SYSLOG)) - return 0; + goto ok; diff --git a/kernel/profile.c b/kernel/profile.c index ebdd9c1..612ee05 100644 --- a/kernel/profile.c @@ -107279,7 +107255,7 @@ index 3318d82..1a5b2d1 100644 return idx; } diff --git a/kernel/rcu/tiny.c b/kernel/rcu/tiny.c -index 1254f31..16258dc 100644 +index ae359f0..8a80d1b 100644 --- a/kernel/rcu/tiny.c +++ b/kernel/rcu/tiny.c @@ -46,7 +46,7 @@ @@ -107291,7 +107267,7 @@ index 1254f31..16258dc 100644 static void __call_rcu(struct rcu_head *head, void (*func)(struct rcu_head *rcu), struct rcu_ctrlblk *rcp); -@@ -312,7 +312,7 @@ static void __rcu_process_callbacks(struct rcu_ctrlblk *rcp) +@@ -317,7 +317,7 @@ static void __rcu_process_callbacks(struct rcu_ctrlblk *rcp) false)); } @@ -109780,10 +109756,10 @@ index a2d62b3..1997260 100644 /* do nothing if flag is already set */ if (!!(trace_flags & mask) == !!enabled) diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h -index c8bd809..33d7539 100644 +index c1be95c..237f555 100644 --- a/kernel/trace/trace.h +++ b/kernel/trace/trace.h -@@ -1233,7 +1233,7 @@ extern const char *__stop___tracepoint_str[]; +@@ -1234,7 +1234,7 @@ extern const char *__stop___tracepoint_str[]; void trace_printk_init_buffers(void); void trace_printk_start_comm(void); int trace_keep_overwrite(struct tracer *tracer, u32 mask, int set); @@ -109825,30 +109801,10 @@ index c6646a5..574b47c 100644 /* Add an additional event_call dynamically */ diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c -index cb347e8..0adf74e 100644 +index 7b244d0..4c20cff 100644 --- a/kernel/trace/trace_events_filter.c +++ b/kernel/trace/trace_events_filter.c -@@ -1086,6 +1086,9 @@ static void parse_init(struct filter_parse_state *ps, - - static char infix_next(struct filter_parse_state *ps) - { -+ if (!ps->infix.cnt) -+ return 0; -+ - ps->infix.cnt--; - - return ps->infix.string[ps->infix.tail++]; -@@ -1101,6 +1104,9 @@ static char infix_peek(struct filter_parse_state *ps) - - static void infix_advance(struct filter_parse_state *ps) - { -+ if (!ps->infix.cnt) -+ return; -+ - ps->infix.cnt--; - ps->infix.tail++; - } -@@ -1410,8 +1416,12 @@ static int check_preds(struct filter_parse_state *ps) +@@ -1416,8 +1416,12 @@ static int check_preds(struct filter_parse_state *ps) cnt--; if (elt->op == OP_AND || elt->op == OP_OR) { n_logical_preds++; @@ -109859,8 +109815,8 @@ index cb347e8..0adf74e 100644 + // a reject here when it's backported + cnt--; n_normal_preds++; - WARN_ON_ONCE(cnt < 0); - } + /* all ops should have operands */ + if (cnt < 0) diff --git a/kernel/trace/trace_functions_graph.c b/kernel/trace/trace_functions_graph.c index 0b99120..881174f 100644 --- a/kernel/trace/trace_functions_graph.c @@ -110191,7 +110147,7 @@ index 114d1be..ab0350c 100644 (val << avg->factor)) >> avg->weight : (val << avg->factor); diff --git a/lib/bitmap.c b/lib/bitmap.c -index e5c4ebe..9078e42 100644 +index c0634aa..dfedffb 100644 --- a/lib/bitmap.c +++ b/lib/bitmap.c @@ -426,7 +426,7 @@ int __bitmap_parse(const char *buf, unsigned int buflen, @@ -110218,10 +110174,10 @@ index e5c4ebe..9078e42 100644 int c, old_c, totaldigits; - const char __user __force *ubuf = (const char __user __force *)buf; + const char __user *ubuf = (const char __force_user *)buf; - int exp_digit, in_range; + int at_start, in_range; totaldigits = c = 0; -@@ -702,7 +702,7 @@ int bitmap_parselist_user(const char __user *ubuf, +@@ -703,7 +703,7 @@ int bitmap_parselist_user(const char __user *ubuf, { if (!access_ok(VERIFY_READ, ubuf, ulen)) return -EFAULT; @@ -116219,7 +116175,7 @@ index c7e634a..041cbdb 100644 .maxtype = IFLA_VLAN_MAX, .policy = vlan_policy, diff --git a/net/9p/client.c b/net/9p/client.c -index 9186550..e604a2f 100644 +index 08046f3..8d89aa4 100644 --- a/net/9p/client.c +++ b/net/9p/client.c @@ -588,7 +588,7 @@ static int p9_check_zc_errors(struct p9_client *c, struct p9_req_t *req, @@ -116231,7 +116187,7 @@ index 9186550..e604a2f 100644 if (err) { err = -EFAULT; goto out_err; -@@ -1560,7 +1560,7 @@ p9_client_read(struct p9_fid *fid, char *data, char __user *udata, u64 offset, +@@ -1561,7 +1561,7 @@ p9_client_read(struct p9_fid *fid, char *data, char __user *udata, u64 offset, kernel_buf = 1; indata = data; } else @@ -116240,7 +116196,7 @@ index 9186550..e604a2f 100644 /* * response header len is 11 * PDU Header(7) + IO Size (4) -@@ -1635,7 +1635,7 @@ p9_client_write(struct p9_fid *fid, char *data, const char __user *udata, +@@ -1636,7 +1636,7 @@ p9_client_write(struct p9_fid *fid, char *data, const char __user *udata, kernel_buf = 1; odata = data; } else @@ -120816,7 +120772,7 @@ index 06f5de4..f2e0437 100644 } diff --git a/net/mac80211/main.c b/net/mac80211/main.c -index c7a7a86..a74f57b 100644 +index 9e58c99..486f226 100644 --- a/net/mac80211/main.c +++ b/net/mac80211/main.c @@ -174,7 +174,7 @@ int ieee80211_hw_config(struct ieee80211_local *local, u32 changed) @@ -125529,7 +125485,7 @@ index 963dc59..12ebd0c 100644 if (bprm->cap_effective) return 1; diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h -index f79fa8b..6161868 100644 +index 5cb7de9..3e40530 100644 --- a/security/integrity/ima/ima.h +++ b/security/integrity/ima/ima.h @@ -118,8 +118,8 @@ int ima_init_template(void); @@ -125557,7 +125513,7 @@ index 025824a..2a681b1 100644 result = ima_alloc_init_template(NULL, file, filename, NULL, 0, &entry); diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c -index 468a3ba..9af5cae 100644 +index 35f3c90..e2c2ddb 100644 --- a/security/integrity/ima/ima_fs.c +++ b/security/integrity/ima/ima_fs.c @@ -28,12 +28,12 @@ @@ -125711,25 +125667,6 @@ index cee72ce..e46074a 100644 err: if (iov != iovstack) kfree(iov); -diff --git a/security/keys/keyring.c b/security/keys/keyring.c -index 2fb2576..04d0d7c 100644 ---- a/security/keys/keyring.c -+++ b/security/keys/keyring.c -@@ -1151,9 +1151,11 @@ void __key_link_end(struct key *keyring, - if (index_key->type == &key_type_keyring) - up_write(&keyring_serialise_link_sem); - -- if (edit && !edit->dead_leaf) { -- key_payload_reserve(keyring, -- keyring->datalen - KEYQUOTA_LINK_BYTES); -+ if (edit) { -+ if (!edit->dead_leaf) { -+ key_payload_reserve(keyring, -+ keyring->datalen - KEYQUOTA_LINK_BYTES); -+ } - assoc_array_cancel_edit(edit); - } - up_write(&keyring->sem); diff --git a/security/keys/request_key.c b/security/keys/request_key.c index 3814119..2e8ebaa 100644 --- a/security/keys/request_key.c diff --git a/3.14.48/4425_grsec_remove_EI_PAX.patch b/3.14.49/4425_grsec_remove_EI_PAX.patch index a80a5d7..a80a5d7 100644 --- a/3.14.48/4425_grsec_remove_EI_PAX.patch +++ b/3.14.49/4425_grsec_remove_EI_PAX.patch diff --git a/3.14.48/4427_force_XATTR_PAX_tmpfs.patch b/3.14.49/4427_force_XATTR_PAX_tmpfs.patch index 4c236cc..4c236cc 100644 --- a/3.14.48/4427_force_XATTR_PAX_tmpfs.patch +++ b/3.14.49/4427_force_XATTR_PAX_tmpfs.patch diff --git a/3.14.48/4430_grsec-remove-localversion-grsec.patch b/3.14.49/4430_grsec-remove-localversion-grsec.patch index 31cf878..31cf878 100644 --- a/3.14.48/4430_grsec-remove-localversion-grsec.patch +++ b/3.14.49/4430_grsec-remove-localversion-grsec.patch diff --git a/3.14.48/4435_grsec-mute-warnings.patch b/3.14.49/4435_grsec-mute-warnings.patch index 2c2d463..2c2d463 100644 --- a/3.14.48/4435_grsec-mute-warnings.patch +++ b/3.14.49/4435_grsec-mute-warnings.patch diff --git a/3.14.48/4440_grsec-remove-protected-paths.patch b/3.14.49/4440_grsec-remove-protected-paths.patch index 741546d..741546d 100644 --- a/3.14.48/4440_grsec-remove-protected-paths.patch +++ b/3.14.49/4440_grsec-remove-protected-paths.patch diff --git a/3.14.48/4450_grsec-kconfig-default-gids.patch b/3.14.49/4450_grsec-kconfig-default-gids.patch index b96defc..b96defc 100644 --- a/3.14.48/4450_grsec-kconfig-default-gids.patch +++ b/3.14.49/4450_grsec-kconfig-default-gids.patch diff --git a/3.14.48/4465_selinux-avc_audit-log-curr_ip.patch b/3.14.49/4465_selinux-avc_audit-log-curr_ip.patch index bba906e..bba906e 100644 --- a/3.14.48/4465_selinux-avc_audit-log-curr_ip.patch +++ b/3.14.49/4465_selinux-avc_audit-log-curr_ip.patch diff --git a/3.14.48/4470_disable-compat_vdso.patch b/3.14.49/4470_disable-compat_vdso.patch index 3b3953b..3b3953b 100644 --- a/3.14.48/4470_disable-compat_vdso.patch +++ b/3.14.49/4470_disable-compat_vdso.patch diff --git a/3.14.48/4475_emutramp_default_on.patch b/3.14.49/4475_emutramp_default_on.patch index a128205..a128205 100644 --- a/3.14.48/4475_emutramp_default_on.patch +++ b/3.14.49/4475_emutramp_default_on.patch diff --git a/3.14.48/0000_README b/4.1.4/0000_README index e334e8a..9d09b8e 100644 --- a/3.14.48/0000_README +++ b/4.1.4/0000_README @@ -2,11 +2,11 @@ README ----------------------------------------------------------------------------- Individual Patch Descriptions: ----------------------------------------------------------------------------- -Patch: 1047_linux-3.14.48.patch +Patch: 1003_linux-4.1.4.patch From: http://www.kernel.org -Desc: Linux 3.14.48 +Desc: Linux 4.1.4 -Patch: 4420_grsecurity-3.1-3.14.48-201508020901.patch +Patch: 4420_grsecurity-3.1-4.1.4-201508032312.patch From: http://www.grsecurity.net Desc: hardened-sources base patch from upstream grsecurity diff --git a/4.1.4/1003_linux-4.1.4.patch b/4.1.4/1003_linux-4.1.4.patch new file mode 100644 index 0000000..d9bc159 --- /dev/null +++ b/4.1.4/1003_linux-4.1.4.patch @@ -0,0 +1,11078 @@ +diff --git a/Documentation/ABI/testing/ima_policy b/Documentation/ABI/testing/ima_policy +index d0d0c57..0a378a8 100644 +--- a/Documentation/ABI/testing/ima_policy ++++ b/Documentation/ABI/testing/ima_policy +@@ -20,17 +20,19 @@ Description: + action: measure | dont_measure | appraise | dont_appraise | audit + condition:= base | lsm [option] + base: [[func=] [mask=] [fsmagic=] [fsuuid=] [uid=] +- [fowner]] ++ [euid=] [fowner=]] + lsm: [[subj_user=] [subj_role=] [subj_type=] + [obj_user=] [obj_role=] [obj_type=]] + option: [[appraise_type=]] [permit_directio] + + base: func:= [BPRM_CHECK][MMAP_CHECK][FILE_CHECK][MODULE_CHECK] + [FIRMWARE_CHECK] +- mask:= [MAY_READ] [MAY_WRITE] [MAY_APPEND] [MAY_EXEC] ++ mask:= [[^]MAY_READ] [[^]MAY_WRITE] [[^]MAY_APPEND] ++ [[^]MAY_EXEC] + fsmagic:= hex value + fsuuid:= file system UUID (e.g 8bcbe394-4f13-4144-be8e-5aa9ea2ce2f6) + uid:= decimal value ++ euid:= decimal value + fowner:=decimal value + lsm: are LSM specific + option: appraise_type:= [imasig] +@@ -49,11 +51,25 @@ Description: + dont_measure fsmagic=0x01021994 + dont_appraise fsmagic=0x01021994 + # RAMFS_MAGIC +- dont_measure fsmagic=0x858458f6 + dont_appraise fsmagic=0x858458f6 ++ # DEVPTS_SUPER_MAGIC ++ dont_measure fsmagic=0x1cd1 ++ dont_appraise fsmagic=0x1cd1 ++ # BINFMTFS_MAGIC ++ dont_measure fsmagic=0x42494e4d ++ dont_appraise fsmagic=0x42494e4d + # SECURITYFS_MAGIC + dont_measure fsmagic=0x73636673 + dont_appraise fsmagic=0x73636673 ++ # SELINUX_MAGIC ++ dont_measure fsmagic=0xf97cff8c ++ dont_appraise fsmagic=0xf97cff8c ++ # CGROUP_SUPER_MAGIC ++ dont_measure fsmagic=0x27e0eb ++ dont_appraise fsmagic=0x27e0eb ++ # NSFS_MAGIC ++ dont_measure fsmagic=0x6e736673 ++ dont_appraise fsmagic=0x6e736673 + + measure func=BPRM_CHECK + measure func=FILE_MMAP mask=MAY_EXEC +@@ -70,10 +86,6 @@ Description: + Examples of LSM specific definitions: + + SELinux: +- # SELINUX_MAGIC +- dont_measure fsmagic=0xf97cff8c +- dont_appraise fsmagic=0xf97cff8c +- + dont_measure obj_type=var_log_t + dont_appraise obj_type=var_log_t + dont_measure obj_type=auditd_log_t +diff --git a/Documentation/ABI/testing/sysfs-ata b/Documentation/ABI/testing/sysfs-ata +index 0a93215..9231dae 100644 +--- a/Documentation/ABI/testing/sysfs-ata ++++ b/Documentation/ABI/testing/sysfs-ata +@@ -90,6 +90,17 @@ gscr + 130: SATA_PMP_GSCR_SII_GPIO + Only valid if the device is a PM. + ++trim ++ ++ Shows the DSM TRIM mode currently used by the device. Valid ++ values are: ++ unsupported: Drive does not support DSM TRIM ++ unqueued: Drive supports unqueued DSM TRIM only ++ queued: Drive supports queued DSM TRIM ++ forced_unqueued: Drive's unqueued DSM support is known to be ++ buggy and only unqueued TRIM commands ++ are sent ++ + spdn_cnt + + Number of time libata decided to lower the speed of link due to errors. +diff --git a/Documentation/ABI/testing/sysfs-bus-iio b/Documentation/ABI/testing/sysfs-bus-iio +index 3befcb1..1fbdd79 100644 +--- a/Documentation/ABI/testing/sysfs-bus-iio ++++ b/Documentation/ABI/testing/sysfs-bus-iio +@@ -1165,10 +1165,8 @@ Description: + object is near the sensor, usually be observing + reflectivity of infrared or ultrasound emitted. + Often these sensors are unit less and as such conversion +- to SI units is not possible. Where it is, the units should +- be meters. If such a conversion is not possible, the reported +- values should behave in the same way as a distance, i.e. lower +- values indicate something is closer to the sensor. ++ to SI units is not possible. Higher proximity measurements ++ indicate closer objects, and vice versa. + + What: /sys/.../iio:deviceX/in_illuminance_input + What: /sys/.../iio:deviceX/in_illuminance_raw +diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt +index adda2a8..e357b02 100644 +--- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt ++++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt +@@ -92,5 +92,5 @@ mpp61 61 gpo, dev(wen1), uart1(txd), audio(rclk) + mpp62 62 gpio, dev(a2), uart1(cts), tdm(drx), pcie(clkreq0), + audio(mclk), uart0(cts) + mpp63 63 gpo, spi0(sck), tclk +-mpp64 64 gpio, spi0(miso), spi0-1(cs1) +-mpp65 65 gpio, spi0(mosi), spi0-1(cs2) ++mpp64 64 gpio, spi0(miso), spi0(cs1) ++mpp65 65 gpio, spi0(mosi), spi0(cs2) +diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-375-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-375-pinctrl.txt +index 7de0cda..bedbe42 100644 +--- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-375-pinctrl.txt ++++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-375-pinctrl.txt +@@ -22,8 +22,8 @@ mpp5 5 gpio, dev(ad7), spi0(cs2), spi1(cs2) + mpp6 6 gpio, dev(ad0), led(p1), audio(rclk) + mpp7 7 gpio, dev(ad1), ptp(clk), led(p2), audio(extclk) + mpp8 8 gpio, dev (bootcs), spi0(cs0), spi1(cs0) +-mpp9 9 gpio, nf(wen), spi0(sck), spi1(sck) +-mpp10 10 gpio, nf(ren), dram(vttctrl), led(c1) ++mpp9 9 gpio, spi0(sck), spi1(sck), nand(we) ++mpp10 10 gpio, dram(vttctrl), led(c1), nand(re) + mpp11 11 gpio, dev(a0), led(c2), audio(sdo) + mpp12 12 gpio, dev(a1), audio(bclk) + mpp13 13 gpio, dev(readyn), pcie0(rstoutn), pcie1(rstoutn) +diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-38x-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-38x-pinctrl.txt +index b17c968..4ac138a 100644 +--- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-38x-pinctrl.txt ++++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-38x-pinctrl.txt +@@ -27,15 +27,15 @@ mpp8 8 gpio, ge0(txd1), dev(ad10) + mpp9 9 gpio, ge0(txd2), dev(ad11) + mpp10 10 gpio, ge0(txd3), dev(ad12) + mpp11 11 gpio, ge0(txctl), dev(ad13) +-mpp12 12 gpio, ge0(rxd0), pcie0(rstout), pcie1(rstout) [1], spi0(cs1), dev(ad14) +-mpp13 13 gpio, ge0(rxd1), pcie0(clkreq), pcie1(clkreq) [1], spi0(cs2), dev(ad15) +-mpp14 14 gpio, ge0(rxd2), ptp(clk), m(vtt_ctrl), spi0(cs3), dev(wen1) +-mpp15 15 gpio, ge0(rxd3), ge(mdc slave), pcie0(rstout), spi0(mosi), pcie1(rstout) [1] +-mpp16 16 gpio, ge0(rxctl), ge(mdio slave), m(decc_err), spi0(miso), pcie0(clkreq) ++mpp12 12 gpio, ge0(rxd0), pcie0(rstout), spi0(cs1), dev(ad14), pcie3(clkreq) ++mpp13 13 gpio, ge0(rxd1), pcie0(clkreq), pcie1(clkreq) [1], spi0(cs2), dev(ad15), pcie2(clkreq) ++mpp14 14 gpio, ge0(rxd2), ptp(clk), m(vtt_ctrl), spi0(cs3), dev(wen1), pcie3(clkreq) ++mpp15 15 gpio, ge0(rxd3), ge(mdc slave), pcie0(rstout), spi0(mosi) ++mpp16 16 gpio, ge0(rxctl), ge(mdio slave), m(decc_err), spi0(miso), pcie0(clkreq), pcie1(clkreq) [1] + mpp17 17 gpio, ge0(rxclk), ptp(clk), ua1(rxd), spi0(sck), sata1(prsnt) +-mpp18 18 gpio, ge0(rxerr), ptp(trig_gen), ua1(txd), spi0(cs0), pcie1(rstout) [1] +-mpp19 19 gpio, ge0(col), ptp(event_req), pcie0(clkreq), sata1(prsnt), ua0(cts) +-mpp20 20 gpio, ge0(txclk), ptp(clk), pcie1(rstout) [1], sata0(prsnt), ua0(rts) ++mpp18 18 gpio, ge0(rxerr), ptp(trig_gen), ua1(txd), spi0(cs0) ++mpp19 19 gpio, ge0(col), ptp(event_req), ge0(txerr), sata1(prsnt), ua0(cts) ++mpp20 20 gpio, ge0(txclk), ptp(clk), sata0(prsnt), ua0(rts) + mpp21 21 gpio, spi0(cs1), ge1(rxd0), sata0(prsnt), sd0(cmd), dev(bootcs) + mpp22 22 gpio, spi0(mosi), dev(ad0) + mpp23 23 gpio, spi0(sck), dev(ad2) +@@ -58,23 +58,23 @@ mpp39 39 gpio, i2c1(sck), ge1(rxd2), ua0(cts), sd0(d1), dev(a2) + mpp40 40 gpio, i2c1(sda), ge1(rxd3), ua0(rts), sd0(d2), dev(ad6) + mpp41 41 gpio, ua1(rxd), ge1(rxctl), ua0(cts), spi1(cs3), dev(burst/last) + mpp42 42 gpio, ua1(txd), ua0(rts), dev(ad7) +-mpp43 43 gpio, pcie0(clkreq), m(vtt_ctrl), m(decc_err), pcie0(rstout), dev(clkout) +-mpp44 44 gpio, sata0(prsnt), sata1(prsnt), sata2(prsnt) [2], sata3(prsnt) [3], pcie0(rstout) +-mpp45 45 gpio, ref(clk_out0), pcie0(rstout), pcie1(rstout) [1], pcie2(rstout), pcie3(rstout) +-mpp46 46 gpio, ref(clk_out1), pcie0(rstout), pcie1(rstout) [1], pcie2(rstout), pcie3(rstout) +-mpp47 47 gpio, sata0(prsnt), sata1(prsnt), sata2(prsnt) [2], spi1(cs2), sata3(prsnt) [2] +-mpp48 48 gpio, sata0(prsnt), m(vtt_ctrl), tdm2c(pclk), audio(mclk), sd0(d4) +-mpp49 49 gpio, sata2(prsnt) [2], sata3(prsnt) [2], tdm2c(fsync), audio(lrclk), sd0(d5) +-mpp50 50 gpio, pcie0(rstout), pcie1(rstout) [1], tdm2c(drx), audio(extclk), sd0(cmd) ++mpp43 43 gpio, pcie0(clkreq), m(vtt_ctrl), m(decc_err), spi1(cs2), dev(clkout) ++mpp44 44 gpio, sata0(prsnt), sata1(prsnt), sata2(prsnt) [2], sata3(prsnt) [3] ++mpp45 45 gpio, ref(clk_out0), pcie0(rstout) ++mpp46 46 gpio, ref(clk_out1), pcie0(rstout) ++mpp47 47 gpio, sata0(prsnt), sata1(prsnt), sata2(prsnt) [2], sata3(prsnt) [2] ++mpp48 48 gpio, sata0(prsnt), m(vtt_ctrl), tdm2c(pclk), audio(mclk), sd0(d4), pcie0(clkreq) ++mpp49 49 gpio, sata2(prsnt) [2], sata3(prsnt) [2], tdm2c(fsync), audio(lrclk), sd0(d5), pcie1(clkreq) ++mpp50 50 gpio, pcie0(rstout), tdm2c(drx), audio(extclk), sd0(cmd) + mpp51 51 gpio, tdm2c(dtx), audio(sdo), m(decc_err) +-mpp52 52 gpio, pcie0(rstout), pcie1(rstout) [1], tdm2c(intn), audio(sdi), sd0(d6) ++mpp52 52 gpio, pcie0(rstout), tdm2c(intn), audio(sdi), sd0(d6) + mpp53 53 gpio, sata1(prsnt), sata0(prsnt), tdm2c(rstn), audio(bclk), sd0(d7) +-mpp54 54 gpio, sata0(prsnt), sata1(prsnt), pcie0(rstout), pcie1(rstout) [1], sd0(d3) ++mpp54 54 gpio, sata0(prsnt), sata1(prsnt), pcie0(rstout), ge0(txerr), sd0(d3) + mpp55 55 gpio, ua1(cts), ge(mdio), pcie1(clkreq) [1], spi1(cs1), sd0(d0) + mpp56 56 gpio, ua1(rts), ge(mdc), m(decc_err), spi1(mosi) + mpp57 57 gpio, spi1(sck), sd0(clk) + mpp58 58 gpio, pcie1(clkreq) [1], i2c1(sck), pcie2(clkreq), spi1(miso), sd0(d1) +-mpp59 59 gpio, pcie0(rstout), i2c1(sda), pcie1(rstout) [1], spi1(cs0), sd0(d2) ++mpp59 59 gpio, pcie0(rstout), i2c1(sda), spi1(cs0), sd0(d2) + + [1]: only available on 88F6820 and 88F6828 + [2]: only available on 88F6828 +diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt +index 373dbccd..96e7744 100644 +--- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt ++++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt +@@ -42,15 +42,15 @@ mpp20 20 gpio, ge0(rxd4), ge1(rxd2), lcd(d20), ptp(clk) + mpp21 21 gpio, ge0(rxd5), ge1(rxd3), lcd(d21), mem(bat) + mpp22 22 gpio, ge0(rxd6), ge1(rxctl), lcd(d22), sata0(prsnt) + mpp23 23 gpio, ge0(rxd7), ge1(rxclk), lcd(d23), sata1(prsnt) +-mpp24 24 gpio, lcd(hsync), sata1(prsnt), nf(bootcs-re), tdm(rst) +-mpp25 25 gpio, lcd(vsync), sata0(prsnt), nf(bootcs-we), tdm(pclk) +-mpp26 26 gpio, lcd(clk), tdm(fsync), vdd(cpu1-pd) ++mpp24 24 gpio, lcd(hsync), sata1(prsnt), tdm(rst) ++mpp25 25 gpio, lcd(vsync), sata0(prsnt), tdm(pclk) ++mpp26 26 gpio, lcd(clk), tdm(fsync) + mpp27 27 gpio, lcd(e), tdm(dtx), ptp(trig) + mpp28 28 gpio, lcd(pwm), tdm(drx), ptp(evreq) +-mpp29 29 gpio, lcd(ref-clk), tdm(int0), ptp(clk), vdd(cpu0-pd) ++mpp29 29 gpio, lcd(ref-clk), tdm(int0), ptp(clk) + mpp30 30 gpio, tdm(int1), sd0(clk) +-mpp31 31 gpio, tdm(int2), sd0(cmd), vdd(cpu0-pd) +-mpp32 32 gpio, tdm(int3), sd0(d0), vdd(cpu1-pd) ++mpp31 31 gpio, tdm(int2), sd0(cmd) ++mpp32 32 gpio, tdm(int3), sd0(d0) + mpp33 33 gpio, tdm(int4), sd0(d1), mem(bat) + mpp34 34 gpio, tdm(int5), sd0(d2), sata0(prsnt) + mpp35 35 gpio, tdm(int6), sd0(d3), sata1(prsnt) +@@ -58,21 +58,18 @@ mpp36 36 gpio, spi(mosi) + mpp37 37 gpio, spi(miso) + mpp38 38 gpio, spi(sck) + mpp39 39 gpio, spi(cs0) +-mpp40 40 gpio, spi(cs1), uart2(cts), lcd(vga-hsync), vdd(cpu1-pd), +- pcie(clkreq0) ++mpp40 40 gpio, spi(cs1), uart2(cts), lcd(vga-hsync), pcie(clkreq0) + mpp41 41 gpio, spi(cs2), uart2(rts), lcd(vga-vsync), sata1(prsnt), + pcie(clkreq1) +-mpp42 42 gpio, uart2(rxd), uart0(cts), tdm(int7), tdm-1(timer), +- vdd(cpu0-pd) +-mpp43 43 gpio, uart2(txd), uart0(rts), spi(cs3), pcie(rstout), +- vdd(cpu2-3-pd){1} ++mpp42 42 gpio, uart2(rxd), uart0(cts), tdm(int7), tdm-1(timer) ++mpp43 43 gpio, uart2(txd), uart0(rts), spi(cs3), pcie(rstout) + mpp44 44 gpio, uart2(cts), uart3(rxd), spi(cs4), pcie(clkreq2), + mem(bat) + mpp45 45 gpio, uart2(rts), uart3(txd), spi(cs5), sata1(prsnt) + mpp46 46 gpio, uart3(rts), uart1(rts), spi(cs6), sata0(prsnt) + mpp47 47 gpio, uart3(cts), uart1(cts), spi(cs7), pcie(clkreq3), + ref(clkout) +-mpp48 48 gpio, tclk, dev(burst/last) ++mpp48 48 gpio, dev(clkout), dev(burst/last) + + * Marvell Armada XP (mv78260 and mv78460 only) + +@@ -84,9 +81,9 @@ mpp51 51 gpio, dev(ad16) + mpp52 52 gpio, dev(ad17) + mpp53 53 gpio, dev(ad18) + mpp54 54 gpio, dev(ad19) +-mpp55 55 gpio, dev(ad20), vdd(cpu0-pd) +-mpp56 56 gpio, dev(ad21), vdd(cpu1-pd) +-mpp57 57 gpio, dev(ad22), vdd(cpu2-3-pd){1} ++mpp55 55 gpio, dev(ad20) ++mpp56 56 gpio, dev(ad21) ++mpp57 57 gpio, dev(ad22) + mpp58 58 gpio, dev(ad23) + mpp59 59 gpio, dev(ad24) + mpp60 60 gpio, dev(ad25) +@@ -96,6 +93,3 @@ mpp63 63 gpio, dev(ad28) + mpp64 64 gpio, dev(ad29) + mpp65 65 gpio, dev(ad30) + mpp66 66 gpio, dev(ad31) +- +-Notes: +-* {1} vdd(cpu2-3-pd) only available on mv78460. +diff --git a/Documentation/devicetree/bindings/usb/atmel-usb.txt b/Documentation/devicetree/bindings/usb/atmel-usb.txt +index e180d56..de773a0 100644 +--- a/Documentation/devicetree/bindings/usb/atmel-usb.txt ++++ b/Documentation/devicetree/bindings/usb/atmel-usb.txt +@@ -60,9 +60,9 @@ Atmel High-Speed USB device controller + + Required properties: + - compatible: Should be one of the following +- "at91sam9rl-udc" +- "at91sam9g45-udc" +- "sama5d3-udc" ++ "atmel,at91sam9rl-udc" ++ "atmel,at91sam9g45-udc" ++ "atmel,sama5d3-udc" + - reg: Address and length of the register set for the device + - interrupts: Should contain usba interrupt + - ep childnode: To specify the number of endpoints and their properties. +diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt +index 6726139..cd03a0f 100644 +--- a/Documentation/kernel-parameters.txt ++++ b/Documentation/kernel-parameters.txt +@@ -1398,7 +1398,15 @@ bytes respectively. Such letter suffixes can also be entirely omitted. + The list of supported hash algorithms is defined + in crypto/hash_info.h. + +- ima_tcb [IMA] ++ ima_policy= [IMA] ++ The builtin measurement policy to load during IMA ++ setup. Specyfing "tcb" as the value, measures all ++ programs exec'd, files mmap'd for exec, and all files ++ opened with the read mode bit set by either the ++ effective uid (euid=0) or uid=0. ++ Format: "tcb" ++ ++ ima_tcb [IMA] Deprecated. Use ima_policy= instead. + Load a policy which meets the needs of the Trusted + Computing Base. This means IMA will measure all + programs exec'd, files mmap'd for exec, and all files +diff --git a/Makefile b/Makefile +index e3cdec4..36f3225 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 1 +-SUBLEVEL = 3 ++SUBLEVEL = 4 + EXTRAVERSION = + NAME = Series 4800 + +diff --git a/arch/arm/boot/dts/at91-sama5d4ek.dts b/arch/arm/boot/dts/at91-sama5d4ek.dts +index 89ef4a5..45e7761 100644 +--- a/arch/arm/boot/dts/at91-sama5d4ek.dts ++++ b/arch/arm/boot/dts/at91-sama5d4ek.dts +@@ -108,8 +108,8 @@ + mmc0: mmc@f8000000 { + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_mmc0_clk_cmd_dat0 &pinctrl_mmc0_dat1_3 &pinctrl_mmc0_cd>; +- slot@1 { +- reg = <1>; ++ slot@0 { ++ reg = <0>; + bus-width = <4>; + cd-gpios = <&pioE 5 0>; + }; +diff --git a/arch/arm/boot/dts/at91sam9g45.dtsi b/arch/arm/boot/dts/at91sam9g45.dtsi +index 70e59c5..e544211 100644 +--- a/arch/arm/boot/dts/at91sam9g45.dtsi ++++ b/arch/arm/boot/dts/at91sam9g45.dtsi +@@ -1148,7 +1148,7 @@ + usb2: gadget@fff78000 { + #address-cells = <1>; + #size-cells = <0>; +- compatible = "atmel,at91sam9rl-udc"; ++ compatible = "atmel,at91sam9g45-udc"; + reg = <0x00600000 0x80000 + 0xfff78000 0x400>; + interrupts = <27 IRQ_TYPE_LEVEL_HIGH 0>; +diff --git a/arch/arm/boot/dts/at91sam9x5.dtsi b/arch/arm/boot/dts/at91sam9x5.dtsi +index 3aa56ae..3314a73 100644 +--- a/arch/arm/boot/dts/at91sam9x5.dtsi ++++ b/arch/arm/boot/dts/at91sam9x5.dtsi +@@ -1062,7 +1062,7 @@ + usb2: gadget@f803c000 { + #address-cells = <1>; + #size-cells = <0>; +- compatible = "atmel,at91sam9rl-udc"; ++ compatible = "atmel,at91sam9g45-udc"; + reg = <0x00500000 0x80000 + 0xf803c000 0x400>; + interrupts = <23 IRQ_TYPE_LEVEL_HIGH 0>; +diff --git a/arch/arm/boot/dts/imx23.dtsi b/arch/arm/boot/dts/imx23.dtsi +index bbcfb5a..0cb8b0b 100644 +--- a/arch/arm/boot/dts/imx23.dtsi ++++ b/arch/arm/boot/dts/imx23.dtsi +@@ -435,6 +435,7 @@ + interrupts = <36 37 38 39 40 41 42 43 44>; + status = "disabled"; + clocks = <&clks 26>; ++ #io-channel-cells = <1>; + }; + + spdif@80054000 { +diff --git a/arch/arm/boot/dts/sama5d3.dtsi b/arch/arm/boot/dts/sama5d3.dtsi +index 57ab858..37e6182 100644 +--- a/arch/arm/boot/dts/sama5d3.dtsi ++++ b/arch/arm/boot/dts/sama5d3.dtsi +@@ -1321,7 +1321,7 @@ + usb0: gadget@00500000 { + #address-cells = <1>; + #size-cells = <0>; +- compatible = "atmel,at91sam9rl-udc"; ++ compatible = "atmel,sama5d3-udc"; + reg = <0x00500000 0x100000 + 0xf8030000 0x4000>; + interrupts = <33 IRQ_TYPE_LEVEL_HIGH 2>; +diff --git a/arch/arm/boot/dts/sama5d4.dtsi b/arch/arm/boot/dts/sama5d4.dtsi +index 6b1bb58..a5f5f40 100644 +--- a/arch/arm/boot/dts/sama5d4.dtsi ++++ b/arch/arm/boot/dts/sama5d4.dtsi +@@ -123,7 +123,7 @@ + usb0: gadget@00400000 { + #address-cells = <1>; + #size-cells = <0>; +- compatible = "atmel,at91sam9rl-udc"; ++ compatible = "atmel,sama5d3-udc"; + reg = <0x00400000 0x100000 + 0xfc02c000 0x4000>; + interrupts = <47 IRQ_TYPE_LEVEL_HIGH 2>; +@@ -1125,10 +1125,10 @@ + compatible = "atmel,at91sam9g46-aes"; + reg = <0xfc044000 0x100>; + interrupts = <12 IRQ_TYPE_LEVEL_HIGH 0>; +- dmas = <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1)) +- AT91_XDMAC_DT_PERID(41)>, +- <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1)) +- AT91_XDMAC_DT_PERID(40)>; ++ dmas = <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1) ++ | AT91_XDMAC_DT_PERID(41))>, ++ <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1) ++ | AT91_XDMAC_DT_PERID(40))>; + dma-names = "tx", "rx"; + clocks = <&aes_clk>; + clock-names = "aes_clk"; +@@ -1139,10 +1139,10 @@ + compatible = "atmel,at91sam9g46-tdes"; + reg = <0xfc04c000 0x100>; + interrupts = <14 IRQ_TYPE_LEVEL_HIGH 0>; +- dmas = <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1)) +- AT91_XDMAC_DT_PERID(42)>, +- <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1)) +- AT91_XDMAC_DT_PERID(43)>; ++ dmas = <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1) ++ | AT91_XDMAC_DT_PERID(42))>, ++ <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1) ++ | AT91_XDMAC_DT_PERID(43))>; + dma-names = "tx", "rx"; + clocks = <&tdes_clk>; + clock-names = "tdes_clk"; +@@ -1153,8 +1153,8 @@ + compatible = "atmel,at91sam9g46-sha"; + reg = <0xfc050000 0x100>; + interrupts = <15 IRQ_TYPE_LEVEL_HIGH 0>; +- dmas = <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1)) +- AT91_XDMAC_DT_PERID(44)>; ++ dmas = <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1) ++ | AT91_XDMAC_DT_PERID(44))>; + dma-names = "tx"; + clocks = <&sha_clk>; + clock-names = "sha_clk"; +diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c +index cca5b87..f11d825 100644 +--- a/arch/arm/kernel/smp.c ++++ b/arch/arm/kernel/smp.c +@@ -576,7 +576,7 @@ void handle_IPI(int ipinr, struct pt_regs *regs) + struct pt_regs *old_regs = set_irq_regs(regs); + + if ((unsigned)ipinr < NR_IPI) { +- trace_ipi_entry(ipi_types[ipinr]); ++ trace_ipi_entry_rcuidle(ipi_types[ipinr]); + __inc_irq_stat(cpu, ipi_irqs[ipinr]); + } + +@@ -635,7 +635,7 @@ void handle_IPI(int ipinr, struct pt_regs *regs) + } + + if ((unsigned)ipinr < NR_IPI) +- trace_ipi_exit(ipi_types[ipinr]); ++ trace_ipi_exit_rcuidle(ipi_types[ipinr]); + set_irq_regs(old_regs); + } + +diff --git a/arch/arm/mach-dove/include/mach/irqs.h b/arch/arm/mach-dove/include/mach/irqs.h +index 03d401d..3f29e6bc 100644 +--- a/arch/arm/mach-dove/include/mach/irqs.h ++++ b/arch/arm/mach-dove/include/mach/irqs.h +@@ -14,73 +14,73 @@ + /* + * Dove Low Interrupt Controller + */ +-#define IRQ_DOVE_BRIDGE 0 +-#define IRQ_DOVE_H2C 1 +-#define IRQ_DOVE_C2H 2 +-#define IRQ_DOVE_NAND 3 +-#define IRQ_DOVE_PDMA 4 +-#define IRQ_DOVE_SPI1 5 +-#define IRQ_DOVE_SPI0 6 +-#define IRQ_DOVE_UART_0 7 +-#define IRQ_DOVE_UART_1 8 +-#define IRQ_DOVE_UART_2 9 +-#define IRQ_DOVE_UART_3 10 +-#define IRQ_DOVE_I2C 11 +-#define IRQ_DOVE_GPIO_0_7 12 +-#define IRQ_DOVE_GPIO_8_15 13 +-#define IRQ_DOVE_GPIO_16_23 14 +-#define IRQ_DOVE_PCIE0_ERR 15 +-#define IRQ_DOVE_PCIE0 16 +-#define IRQ_DOVE_PCIE1_ERR 17 +-#define IRQ_DOVE_PCIE1 18 +-#define IRQ_DOVE_I2S0 19 +-#define IRQ_DOVE_I2S0_ERR 20 +-#define IRQ_DOVE_I2S1 21 +-#define IRQ_DOVE_I2S1_ERR 22 +-#define IRQ_DOVE_USB_ERR 23 +-#define IRQ_DOVE_USB0 24 +-#define IRQ_DOVE_USB1 25 +-#define IRQ_DOVE_GE00_RX 26 +-#define IRQ_DOVE_GE00_TX 27 +-#define IRQ_DOVE_GE00_MISC 28 +-#define IRQ_DOVE_GE00_SUM 29 +-#define IRQ_DOVE_GE00_ERR 30 +-#define IRQ_DOVE_CRYPTO 31 ++#define IRQ_DOVE_BRIDGE (1 + 0) ++#define IRQ_DOVE_H2C (1 + 1) ++#define IRQ_DOVE_C2H (1 + 2) ++#define IRQ_DOVE_NAND (1 + 3) ++#define IRQ_DOVE_PDMA (1 + 4) ++#define IRQ_DOVE_SPI1 (1 + 5) ++#define IRQ_DOVE_SPI0 (1 + 6) ++#define IRQ_DOVE_UART_0 (1 + 7) ++#define IRQ_DOVE_UART_1 (1 + 8) ++#define IRQ_DOVE_UART_2 (1 + 9) ++#define IRQ_DOVE_UART_3 (1 + 10) ++#define IRQ_DOVE_I2C (1 + 11) ++#define IRQ_DOVE_GPIO_0_7 (1 + 12) ++#define IRQ_DOVE_GPIO_8_15 (1 + 13) ++#define IRQ_DOVE_GPIO_16_23 (1 + 14) ++#define IRQ_DOVE_PCIE0_ERR (1 + 15) ++#define IRQ_DOVE_PCIE0 (1 + 16) ++#define IRQ_DOVE_PCIE1_ERR (1 + 17) ++#define IRQ_DOVE_PCIE1 (1 + 18) ++#define IRQ_DOVE_I2S0 (1 + 19) ++#define IRQ_DOVE_I2S0_ERR (1 + 20) ++#define IRQ_DOVE_I2S1 (1 + 21) ++#define IRQ_DOVE_I2S1_ERR (1 + 22) ++#define IRQ_DOVE_USB_ERR (1 + 23) ++#define IRQ_DOVE_USB0 (1 + 24) ++#define IRQ_DOVE_USB1 (1 + 25) ++#define IRQ_DOVE_GE00_RX (1 + 26) ++#define IRQ_DOVE_GE00_TX (1 + 27) ++#define IRQ_DOVE_GE00_MISC (1 + 28) ++#define IRQ_DOVE_GE00_SUM (1 + 29) ++#define IRQ_DOVE_GE00_ERR (1 + 30) ++#define IRQ_DOVE_CRYPTO (1 + 31) + + /* + * Dove High Interrupt Controller + */ +-#define IRQ_DOVE_AC97 32 +-#define IRQ_DOVE_PMU 33 +-#define IRQ_DOVE_CAM 34 +-#define IRQ_DOVE_SDIO0 35 +-#define IRQ_DOVE_SDIO1 36 +-#define IRQ_DOVE_SDIO0_WAKEUP 37 +-#define IRQ_DOVE_SDIO1_WAKEUP 38 +-#define IRQ_DOVE_XOR_00 39 +-#define IRQ_DOVE_XOR_01 40 +-#define IRQ_DOVE_XOR0_ERR 41 +-#define IRQ_DOVE_XOR_10 42 +-#define IRQ_DOVE_XOR_11 43 +-#define IRQ_DOVE_XOR1_ERR 44 +-#define IRQ_DOVE_LCD_DCON 45 +-#define IRQ_DOVE_LCD1 46 +-#define IRQ_DOVE_LCD0 47 +-#define IRQ_DOVE_GPU 48 +-#define IRQ_DOVE_PERFORM_MNTR 49 +-#define IRQ_DOVE_VPRO_DMA1 51 +-#define IRQ_DOVE_SSP_TIMER 54 +-#define IRQ_DOVE_SSP 55 +-#define IRQ_DOVE_MC_L2_ERR 56 +-#define IRQ_DOVE_CRYPTO_ERR 59 +-#define IRQ_DOVE_GPIO_24_31 60 +-#define IRQ_DOVE_HIGH_GPIO 61 +-#define IRQ_DOVE_SATA 62 ++#define IRQ_DOVE_AC97 (1 + 32) ++#define IRQ_DOVE_PMU (1 + 33) ++#define IRQ_DOVE_CAM (1 + 34) ++#define IRQ_DOVE_SDIO0 (1 + 35) ++#define IRQ_DOVE_SDIO1 (1 + 36) ++#define IRQ_DOVE_SDIO0_WAKEUP (1 + 37) ++#define IRQ_DOVE_SDIO1_WAKEUP (1 + 38) ++#define IRQ_DOVE_XOR_00 (1 + 39) ++#define IRQ_DOVE_XOR_01 (1 + 40) ++#define IRQ_DOVE_XOR0_ERR (1 + 41) ++#define IRQ_DOVE_XOR_10 (1 + 42) ++#define IRQ_DOVE_XOR_11 (1 + 43) ++#define IRQ_DOVE_XOR1_ERR (1 + 44) ++#define IRQ_DOVE_LCD_DCON (1 + 45) ++#define IRQ_DOVE_LCD1 (1 + 46) ++#define IRQ_DOVE_LCD0 (1 + 47) ++#define IRQ_DOVE_GPU (1 + 48) ++#define IRQ_DOVE_PERFORM_MNTR (1 + 49) ++#define IRQ_DOVE_VPRO_DMA1 (1 + 51) ++#define IRQ_DOVE_SSP_TIMER (1 + 54) ++#define IRQ_DOVE_SSP (1 + 55) ++#define IRQ_DOVE_MC_L2_ERR (1 + 56) ++#define IRQ_DOVE_CRYPTO_ERR (1 + 59) ++#define IRQ_DOVE_GPIO_24_31 (1 + 60) ++#define IRQ_DOVE_HIGH_GPIO (1 + 61) ++#define IRQ_DOVE_SATA (1 + 62) + + /* + * DOVE General Purpose Pins + */ +-#define IRQ_DOVE_GPIO_START 64 ++#define IRQ_DOVE_GPIO_START 65 + #define NR_GPIO_IRQS 64 + + /* +diff --git a/arch/arm/mach-dove/irq.c b/arch/arm/mach-dove/irq.c +index 4a5a7ae..df0223f 100644 +--- a/arch/arm/mach-dove/irq.c ++++ b/arch/arm/mach-dove/irq.c +@@ -126,14 +126,14 @@ __exception_irq_entry dove_legacy_handle_irq(struct pt_regs *regs) + stat = readl_relaxed(dove_irq_base + IRQ_CAUSE_LOW_OFF); + stat &= readl_relaxed(dove_irq_base + IRQ_MASK_LOW_OFF); + if (stat) { +- unsigned int hwirq = __fls(stat); ++ unsigned int hwirq = 1 + __fls(stat); + handle_IRQ(hwirq, regs); + return; + } + stat = readl_relaxed(dove_irq_base + IRQ_CAUSE_HIGH_OFF); + stat &= readl_relaxed(dove_irq_base + IRQ_MASK_HIGH_OFF); + if (stat) { +- unsigned int hwirq = 32 + __fls(stat); ++ unsigned int hwirq = 33 + __fls(stat); + handle_IRQ(hwirq, regs); + return; + } +@@ -144,8 +144,8 @@ void __init dove_init_irq(void) + { + int i; + +- orion_irq_init(0, IRQ_VIRT_BASE + IRQ_MASK_LOW_OFF); +- orion_irq_init(32, IRQ_VIRT_BASE + IRQ_MASK_HIGH_OFF); ++ orion_irq_init(1, IRQ_VIRT_BASE + IRQ_MASK_LOW_OFF); ++ orion_irq_init(33, IRQ_VIRT_BASE + IRQ_MASK_HIGH_OFF); + + #ifdef CONFIG_MULTI_IRQ_HANDLER + set_handle_irq(dove_legacy_handle_irq); +diff --git a/arch/arm/vdso/vdsomunge.c b/arch/arm/vdso/vdsomunge.c +index 9005b07..aedec81 100644 +--- a/arch/arm/vdso/vdsomunge.c ++++ b/arch/arm/vdso/vdsomunge.c +@@ -45,13 +45,11 @@ + * it does. + */ + +-#define _GNU_SOURCE +- + #include <byteswap.h> + #include <elf.h> + #include <errno.h> +-#include <error.h> + #include <fcntl.h> ++#include <stdarg.h> + #include <stdbool.h> + #include <stdio.h> + #include <stdlib.h> +@@ -82,11 +80,25 @@ + #define EF_ARM_ABI_FLOAT_HARD 0x400 + #endif + ++static int failed; ++static const char *argv0; + static const char *outfile; + ++static void fail(const char *fmt, ...) ++{ ++ va_list ap; ++ ++ failed = 1; ++ fprintf(stderr, "%s: ", argv0); ++ va_start(ap, fmt); ++ vfprintf(stderr, fmt, ap); ++ va_end(ap); ++ exit(EXIT_FAILURE); ++} ++ + static void cleanup(void) + { +- if (error_message_count > 0 && outfile != NULL) ++ if (failed && outfile != NULL) + unlink(outfile); + } + +@@ -119,68 +131,66 @@ int main(int argc, char **argv) + int infd; + + atexit(cleanup); ++ argv0 = argv[0]; + + if (argc != 3) +- error(EXIT_FAILURE, 0, "Usage: %s [infile] [outfile]", argv[0]); ++ fail("Usage: %s [infile] [outfile]\n", argv[0]); + + infile = argv[1]; + outfile = argv[2]; + + infd = open(infile, O_RDONLY); + if (infd < 0) +- error(EXIT_FAILURE, errno, "Cannot open %s", infile); ++ fail("Cannot open %s: %s\n", infile, strerror(errno)); + + if (fstat(infd, &stat) != 0) +- error(EXIT_FAILURE, errno, "Failed stat for %s", infile); ++ fail("Failed stat for %s: %s\n", infile, strerror(errno)); + + inbuf = mmap(NULL, stat.st_size, PROT_READ, MAP_PRIVATE, infd, 0); + if (inbuf == MAP_FAILED) +- error(EXIT_FAILURE, errno, "Failed to map %s", infile); ++ fail("Failed to map %s: %s\n", infile, strerror(errno)); + + close(infd); + + inhdr = inbuf; + + if (memcmp(&inhdr->e_ident, ELFMAG, SELFMAG) != 0) +- error(EXIT_FAILURE, 0, "Not an ELF file"); ++ fail("Not an ELF file\n"); + + if (inhdr->e_ident[EI_CLASS] != ELFCLASS32) +- error(EXIT_FAILURE, 0, "Unsupported ELF class"); ++ fail("Unsupported ELF class\n"); + + swap = inhdr->e_ident[EI_DATA] != HOST_ORDER; + + if (read_elf_half(inhdr->e_type, swap) != ET_DYN) +- error(EXIT_FAILURE, 0, "Not a shared object"); ++ fail("Not a shared object\n"); + +- if (read_elf_half(inhdr->e_machine, swap) != EM_ARM) { +- error(EXIT_FAILURE, 0, "Unsupported architecture %#x", +- inhdr->e_machine); +- } ++ if (read_elf_half(inhdr->e_machine, swap) != EM_ARM) ++ fail("Unsupported architecture %#x\n", inhdr->e_machine); + + e_flags = read_elf_word(inhdr->e_flags, swap); + + if (EF_ARM_EABI_VERSION(e_flags) != EF_ARM_EABI_VER5) { +- error(EXIT_FAILURE, 0, "Unsupported EABI version %#x", +- EF_ARM_EABI_VERSION(e_flags)); ++ fail("Unsupported EABI version %#x\n", ++ EF_ARM_EABI_VERSION(e_flags)); + } + + if (e_flags & EF_ARM_ABI_FLOAT_HARD) +- error(EXIT_FAILURE, 0, +- "Unexpected hard-float flag set in e_flags"); ++ fail("Unexpected hard-float flag set in e_flags\n"); + + clear_soft_float = !!(e_flags & EF_ARM_ABI_FLOAT_SOFT); + + outfd = open(outfile, O_RDWR | O_CREAT | O_TRUNC, S_IRUSR | S_IWUSR); + if (outfd < 0) +- error(EXIT_FAILURE, errno, "Cannot open %s", outfile); ++ fail("Cannot open %s: %s\n", outfile, strerror(errno)); + + if (ftruncate(outfd, stat.st_size) != 0) +- error(EXIT_FAILURE, errno, "Cannot truncate %s", outfile); ++ fail("Cannot truncate %s: %s\n", outfile, strerror(errno)); + + outbuf = mmap(NULL, stat.st_size, PROT_READ | PROT_WRITE, MAP_SHARED, + outfd, 0); + if (outbuf == MAP_FAILED) +- error(EXIT_FAILURE, errno, "Failed to map %s", outfile); ++ fail("Failed to map %s: %s\n", outfile, strerror(errno)); + + close(outfd); + +@@ -195,7 +205,7 @@ int main(int argc, char **argv) + } + + if (msync(outbuf, stat.st_size, MS_SYNC) != 0) +- error(EXIT_FAILURE, errno, "Failed to sync %s", outfile); ++ fail("Failed to sync %s: %s\n", outfile, strerror(errno)); + + return EXIT_SUCCESS; + } +diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c +index 2cb0081..d3a202b 100644 +--- a/arch/arm64/kernel/smp.c ++++ b/arch/arm64/kernel/smp.c +@@ -569,7 +569,7 @@ void handle_IPI(int ipinr, struct pt_regs *regs) + struct pt_regs *old_regs = set_irq_regs(regs); + + if ((unsigned)ipinr < NR_IPI) { +- trace_ipi_entry(ipi_types[ipinr]); ++ trace_ipi_entry_rcuidle(ipi_types[ipinr]); + __inc_irq_stat(cpu, ipi_irqs[ipinr]); + } + +@@ -612,7 +612,7 @@ void handle_IPI(int ipinr, struct pt_regs *regs) + } + + if ((unsigned)ipinr < NR_IPI) +- trace_ipi_exit(ipi_types[ipinr]); ++ trace_ipi_exit_rcuidle(ipi_types[ipinr]); + set_irq_regs(old_regs); + } + +diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c +index 2de9d2e..0eeb4f09 100644 +--- a/arch/arm64/mm/hugetlbpage.c ++++ b/arch/arm64/mm/hugetlbpage.c +@@ -40,13 +40,13 @@ int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep) + + int pmd_huge(pmd_t pmd) + { +- return !(pmd_val(pmd) & PMD_TABLE_BIT); ++ return pmd_val(pmd) && !(pmd_val(pmd) & PMD_TABLE_BIT); + } + + int pud_huge(pud_t pud) + { + #ifndef __PAGETABLE_PMD_FOLDED +- return !(pud_val(pud) & PUD_TABLE_BIT); ++ return pud_val(pud) && !(pud_val(pud) & PUD_TABLE_BIT); + #else + return 0; + #endif +diff --git a/arch/arm64/net/bpf_jit.h b/arch/arm64/net/bpf_jit.h +index de0a81a..98a26ce 100644 +--- a/arch/arm64/net/bpf_jit.h ++++ b/arch/arm64/net/bpf_jit.h +@@ -110,6 +110,10 @@ + /* Rd = Rn >> shift; signed */ + #define A64_ASR(sf, Rd, Rn, shift) A64_SBFM(sf, Rd, Rn, shift, (sf) ? 63 : 31) + ++/* Zero extend */ ++#define A64_UXTH(sf, Rd, Rn) A64_UBFM(sf, Rd, Rn, 0, 15) ++#define A64_UXTW(sf, Rd, Rn) A64_UBFM(sf, Rd, Rn, 0, 31) ++ + /* Move wide (immediate) */ + #define A64_MOVEW(sf, Rd, imm16, shift, type) \ + aarch64_insn_gen_movewide(Rd, imm16, shift, \ +diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c +index dc6a484..c047598 100644 +--- a/arch/arm64/net/bpf_jit_comp.c ++++ b/arch/arm64/net/bpf_jit_comp.c +@@ -113,9 +113,9 @@ static inline void emit_a64_mov_i(const int is64, const int reg, + static inline int bpf2a64_offset(int bpf_to, int bpf_from, + const struct jit_ctx *ctx) + { +- int to = ctx->offset[bpf_to + 1]; ++ int to = ctx->offset[bpf_to]; + /* -1 to account for the Branch instruction */ +- int from = ctx->offset[bpf_from + 1] - 1; ++ int from = ctx->offset[bpf_from] - 1; + + return to - from; + } +@@ -289,23 +289,41 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx) + case BPF_ALU | BPF_END | BPF_FROM_BE: + #ifdef CONFIG_CPU_BIG_ENDIAN + if (BPF_SRC(code) == BPF_FROM_BE) +- break; ++ goto emit_bswap_uxt; + #else /* !CONFIG_CPU_BIG_ENDIAN */ + if (BPF_SRC(code) == BPF_FROM_LE) +- break; ++ goto emit_bswap_uxt; + #endif + switch (imm) { + case 16: + emit(A64_REV16(is64, dst, dst), ctx); ++ /* zero-extend 16 bits into 64 bits */ ++ emit(A64_UXTH(is64, dst, dst), ctx); + break; + case 32: + emit(A64_REV32(is64, dst, dst), ctx); ++ /* upper 32 bits already cleared */ + break; + case 64: + emit(A64_REV64(dst, dst), ctx); + break; + } + break; ++emit_bswap_uxt: ++ switch (imm) { ++ case 16: ++ /* zero-extend 16 bits into 64 bits */ ++ emit(A64_UXTH(is64, dst, dst), ctx); ++ break; ++ case 32: ++ /* zero-extend 32 bits into 64 bits */ ++ emit(A64_UXTW(is64, dst, dst), ctx); ++ break; ++ case 64: ++ /* nop */ ++ break; ++ } ++ break; + /* dst = imm */ + case BPF_ALU | BPF_MOV | BPF_K: + case BPF_ALU64 | BPF_MOV | BPF_K: +@@ -640,10 +658,11 @@ static int build_body(struct jit_ctx *ctx) + const struct bpf_insn *insn = &prog->insnsi[i]; + int ret; + ++ ret = build_insn(insn, ctx); ++ + if (ctx->image == NULL) + ctx->offset[i] = ctx->idx; + +- ret = build_insn(insn, ctx); + if (ret > 0) { + i++; + continue; +diff --git a/arch/m68k/Kconfig.cpu b/arch/m68k/Kconfig.cpu +index 33013df..5c68c85 100644 +--- a/arch/m68k/Kconfig.cpu ++++ b/arch/m68k/Kconfig.cpu +@@ -125,6 +125,13 @@ endif # M68KCLASSIC + + if COLDFIRE + ++choice ++ prompt "ColdFire SoC type" ++ default M520x ++ help ++ Select the type of ColdFire System-on-Chip (SoC) that you want ++ to build for. ++ + config M5206 + bool "MCF5206" + depends on !MMU +@@ -174,9 +181,6 @@ config M525x + help + Freescale (Motorola) Coldfire 5251/5253 processor support. + +-config M527x +- bool +- + config M5271 + bool "MCF5271" + depends on !MMU +@@ -223,9 +227,6 @@ config M5307 + help + Motorola ColdFire 5307 processor support. + +-config M53xx +- bool +- + config M532x + bool "MCF532x" + depends on !MMU +@@ -251,9 +252,6 @@ config M5407 + help + Motorola ColdFire 5407 processor support. + +-config M54xx +- bool +- + config M547x + bool "MCF547x" + select M54xx +@@ -280,6 +278,17 @@ config M5441x + help + Freescale Coldfire 54410/54415/54416/54417/54418 processor support. + ++endchoice ++ ++config M527x ++ bool ++ ++config M53xx ++ bool ++ ++config M54xx ++ bool ++ + endif # COLDFIRE + + +@@ -416,22 +425,10 @@ config HAVE_MBAR + config HAVE_IPSBAR + bool + +-config CLOCK_SET +- bool "Enable setting the CPU clock frequency" +- depends on COLDFIRE +- default n +- help +- On some CPU's you do not need to know what the core CPU clock +- frequency is. On these you can disable clock setting. On some +- traditional 68K parts, and on all ColdFire parts you need to set +- the appropriate CPU clock frequency. On these devices many of the +- onboard peripherals derive their timing from the master CPU clock +- frequency. +- + config CLOCK_FREQ + int "Set the core clock frequency" + default "66666666" +- depends on CLOCK_SET ++ depends on COLDFIRE + help + Define the CPU clock frequency in use. This is the core clock + frequency, it may or may not be the same as the external clock +diff --git a/arch/m68k/include/asm/coldfire.h b/arch/m68k/include/asm/coldfire.h +index c94557b..50aa4da 100644 +--- a/arch/m68k/include/asm/coldfire.h ++++ b/arch/m68k/include/asm/coldfire.h +@@ -19,7 +19,7 @@ + * in any case new boards come along from time to time that have yet + * another different clocking frequency. + */ +-#ifdef CONFIG_CLOCK_SET ++#ifdef CONFIG_CLOCK_FREQ + #define MCF_CLK CONFIG_CLOCK_FREQ + #else + #error "Don't know what your ColdFire CPU clock frequency is??" +diff --git a/arch/openrisc/Kconfig b/arch/openrisc/Kconfig +index e5a693b..443f44d 100644 +--- a/arch/openrisc/Kconfig ++++ b/arch/openrisc/Kconfig +@@ -17,6 +17,7 @@ config OPENRISC + select GENERIC_IRQ_SHOW + select GENERIC_IOMAP + select GENERIC_CPU_DEVICES ++ select HAVE_UID16 + select GENERIC_ATOMIC64 + select GENERIC_CLOCKEVENTS + select GENERIC_STRNCPY_FROM_USER +@@ -31,9 +32,6 @@ config MMU + config HAVE_DMA_ATTRS + def_bool y + +-config UID16 +- def_bool y +- + config RWSEM_GENERIC_SPINLOCK + def_bool y + +diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c +index 9d518d6..844b06d 100644 +--- a/arch/x86/mm/mmap.c ++++ b/arch/x86/mm/mmap.c +@@ -126,3 +126,10 @@ void arch_pick_mmap_layout(struct mm_struct *mm) + mm->get_unmapped_area = arch_get_unmapped_area_topdown; + } + } ++ ++const char *arch_vma_name(struct vm_area_struct *vma) ++{ ++ if (vma->vm_flags & VM_MPX) ++ return "[mpx]"; ++ return NULL; ++} +diff --git a/arch/x86/mm/mpx.c b/arch/x86/mm/mpx.c +index c439ec4..4d1c11c 100644 +--- a/arch/x86/mm/mpx.c ++++ b/arch/x86/mm/mpx.c +@@ -18,26 +18,9 @@ + #include <asm/processor.h> + #include <asm/fpu-internal.h> + +-static const char *mpx_mapping_name(struct vm_area_struct *vma) +-{ +- return "[mpx]"; +-} +- +-static struct vm_operations_struct mpx_vma_ops = { +- .name = mpx_mapping_name, +-}; +- +-static int is_mpx_vma(struct vm_area_struct *vma) +-{ +- return (vma->vm_ops == &mpx_vma_ops); +-} +- + /* + * This is really a simplified "vm_mmap". it only handles MPX + * bounds tables (the bounds directory is user-allocated). +- * +- * Later on, we use the vma->vm_ops to uniquely identify these +- * VMAs. + */ + static unsigned long mpx_mmap(unsigned long len) + { +@@ -83,7 +66,6 @@ static unsigned long mpx_mmap(unsigned long len) + ret = -ENOMEM; + goto out; + } +- vma->vm_ops = &mpx_vma_ops; + + if (vm_flags & VM_LOCKED) { + up_write(&mm->mmap_sem); +@@ -661,7 +643,7 @@ static int zap_bt_entries(struct mm_struct *mm, + * so stop immediately and return an error. This + * probably results in a SIGSEGV. + */ +- if (!is_mpx_vma(vma)) ++ if (!(vma->vm_flags & VM_MPX)) + return -EINVAL; + + len = min(vma->vm_end, end) - addr; +diff --git a/block/bio.c b/block/bio.c +index f66a4ea..4441522 100644 +--- a/block/bio.c ++++ b/block/bio.c +@@ -1814,8 +1814,9 @@ EXPORT_SYMBOL(bio_endio_nodec); + * Allocates and returns a new bio which represents @sectors from the start of + * @bio, and updates @bio to represent the remaining sectors. + * +- * The newly allocated bio will point to @bio's bi_io_vec; it is the caller's +- * responsibility to ensure that @bio is not freed before the split. ++ * Unless this is a discard request the newly allocated bio will point ++ * to @bio's bi_io_vec; it is the caller's responsibility to ensure that ++ * @bio is not freed before the split. + */ + struct bio *bio_split(struct bio *bio, int sectors, + gfp_t gfp, struct bio_set *bs) +@@ -1825,7 +1826,15 @@ struct bio *bio_split(struct bio *bio, int sectors, + BUG_ON(sectors <= 0); + BUG_ON(sectors >= bio_sectors(bio)); + +- split = bio_clone_fast(bio, gfp, bs); ++ /* ++ * Discards need a mutable bio_vec to accommodate the payload ++ * required by the DSM TRIM and UNMAP commands. ++ */ ++ if (bio->bi_rw & REQ_DISCARD) ++ split = bio_clone_bioset(bio, gfp, bs); ++ else ++ split = bio_clone_fast(bio, gfp, bs); ++ + if (!split) + return NULL; + +diff --git a/crypto/asymmetric_keys/asymmetric_keys.h b/crypto/asymmetric_keys/asymmetric_keys.h +index f973308..3f5b537 100644 +--- a/crypto/asymmetric_keys/asymmetric_keys.h ++++ b/crypto/asymmetric_keys/asymmetric_keys.h +@@ -11,6 +11,9 @@ + + extern struct asymmetric_key_id *asymmetric_key_hex_to_key_id(const char *id); + ++extern int __asymmetric_key_hex_to_key_id(const char *id, ++ struct asymmetric_key_id *match_id, ++ size_t hexlen); + static inline + const struct asymmetric_key_ids *asymmetric_key_ids(const struct key *key) + { +diff --git a/crypto/asymmetric_keys/asymmetric_type.c b/crypto/asymmetric_keys/asymmetric_type.c +index bcbbbd7..b0e4ed2 100644 +--- a/crypto/asymmetric_keys/asymmetric_type.c ++++ b/crypto/asymmetric_keys/asymmetric_type.c +@@ -104,6 +104,15 @@ static bool asymmetric_match_key_ids( + return false; + } + ++/* helper function can be called directly with pre-allocated memory */ ++inline int __asymmetric_key_hex_to_key_id(const char *id, ++ struct asymmetric_key_id *match_id, ++ size_t hexlen) ++{ ++ match_id->len = hexlen; ++ return hex2bin(match_id->data, id, hexlen); ++} ++ + /** + * asymmetric_key_hex_to_key_id - Convert a hex string into a key ID. + * @id: The ID as a hex string. +@@ -111,21 +120,20 @@ static bool asymmetric_match_key_ids( + struct asymmetric_key_id *asymmetric_key_hex_to_key_id(const char *id) + { + struct asymmetric_key_id *match_id; +- size_t hexlen; ++ size_t asciihexlen; + int ret; + + if (!*id) + return ERR_PTR(-EINVAL); +- hexlen = strlen(id); +- if (hexlen & 1) ++ asciihexlen = strlen(id); ++ if (asciihexlen & 1) + return ERR_PTR(-EINVAL); + +- match_id = kmalloc(sizeof(struct asymmetric_key_id) + hexlen / 2, ++ match_id = kmalloc(sizeof(struct asymmetric_key_id) + asciihexlen / 2, + GFP_KERNEL); + if (!match_id) + return ERR_PTR(-ENOMEM); +- match_id->len = hexlen / 2; +- ret = hex2bin(match_id->data, id, hexlen / 2); ++ ret = __asymmetric_key_hex_to_key_id(id, match_id, asciihexlen / 2); + if (ret < 0) { + kfree(match_id); + return ERR_PTR(-EINVAL); +diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c +index a6c4203..24f17e6 100644 +--- a/crypto/asymmetric_keys/x509_public_key.c ++++ b/crypto/asymmetric_keys/x509_public_key.c +@@ -28,17 +28,30 @@ static bool use_builtin_keys; + static struct asymmetric_key_id *ca_keyid; + + #ifndef MODULE ++static struct { ++ struct asymmetric_key_id id; ++ unsigned char data[10]; ++} cakey; ++ + static int __init ca_keys_setup(char *str) + { + if (!str) /* default system keyring */ + return 1; + + if (strncmp(str, "id:", 3) == 0) { +- struct asymmetric_key_id *p; +- p = asymmetric_key_hex_to_key_id(str + 3); +- if (p == ERR_PTR(-EINVAL)) +- pr_err("Unparsable hex string in ca_keys\n"); +- else if (!IS_ERR(p)) ++ struct asymmetric_key_id *p = &cakey.id; ++ size_t hexlen = (strlen(str) - 3) / 2; ++ int ret; ++ ++ if (hexlen == 0 || hexlen > sizeof(cakey.data)) { ++ pr_err("Missing or invalid ca_keys id\n"); ++ return 1; ++ } ++ ++ ret = __asymmetric_key_hex_to_key_id(str + 3, p, hexlen); ++ if (ret < 0) ++ pr_err("Unparsable ca_keys id hex string\n"); ++ else + ca_keyid = p; /* owner key 'id:xxxxxx' */ + } else if (strcmp(str, "builtin") == 0) { + use_builtin_keys = true; +diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c +index 37fb190..73f056a 100644 +--- a/drivers/acpi/acpi_lpss.c ++++ b/drivers/acpi/acpi_lpss.c +@@ -352,13 +352,16 @@ static int acpi_lpss_create_device(struct acpi_device *adev, + pdata->mmio_size = resource_size(rentry->res); + pdata->mmio_base = ioremap(rentry->res->start, + pdata->mmio_size); +- if (!pdata->mmio_base) +- goto err_out; + break; + } + + acpi_dev_free_resource_list(&resource_list); + ++ if (!pdata->mmio_base) { ++ ret = -ENOMEM; ++ goto err_out; ++ } ++ + pdata->dev_desc = dev_desc; + + if (dev_desc->setup) +diff --git a/drivers/acpi/acpica/aclocal.h b/drivers/acpi/acpica/aclocal.h +index 87b2752..7f50dd9 100644 +--- a/drivers/acpi/acpica/aclocal.h ++++ b/drivers/acpi/acpica/aclocal.h +@@ -213,6 +213,7 @@ struct acpi_table_list { + + #define ACPI_TABLE_INDEX_DSDT (0) + #define ACPI_TABLE_INDEX_FACS (1) ++#define ACPI_TABLE_INDEX_X_FACS (2) + + struct acpi_find_context { + char *search_for; +diff --git a/drivers/acpi/acpica/tbfadt.c b/drivers/acpi/acpica/tbfadt.c +index 7d24860..05be59c 100644 +--- a/drivers/acpi/acpica/tbfadt.c ++++ b/drivers/acpi/acpica/tbfadt.c +@@ -350,9 +350,18 @@ void acpi_tb_parse_fadt(u32 table_index) + /* If Hardware Reduced flag is set, there is no FACS */ + + if (!acpi_gbl_reduced_hardware) { +- acpi_tb_install_fixed_table((acpi_physical_address) +- acpi_gbl_FADT.Xfacs, ACPI_SIG_FACS, +- ACPI_TABLE_INDEX_FACS); ++ if (acpi_gbl_FADT.facs) { ++ acpi_tb_install_fixed_table((acpi_physical_address) ++ acpi_gbl_FADT.facs, ++ ACPI_SIG_FACS, ++ ACPI_TABLE_INDEX_FACS); ++ } ++ if (acpi_gbl_FADT.Xfacs) { ++ acpi_tb_install_fixed_table((acpi_physical_address) ++ acpi_gbl_FADT.Xfacs, ++ ACPI_SIG_FACS, ++ ACPI_TABLE_INDEX_X_FACS); ++ } + } + } + +@@ -491,13 +500,9 @@ static void acpi_tb_convert_fadt(void) + acpi_gbl_FADT.header.length = sizeof(struct acpi_table_fadt); + + /* +- * Expand the 32-bit FACS and DSDT addresses to 64-bit as necessary. ++ * Expand the 32-bit DSDT addresses to 64-bit as necessary. + * Later ACPICA code will always use the X 64-bit field. + */ +- acpi_gbl_FADT.Xfacs = acpi_tb_select_address("FACS", +- acpi_gbl_FADT.facs, +- acpi_gbl_FADT.Xfacs); +- + acpi_gbl_FADT.Xdsdt = acpi_tb_select_address("DSDT", + acpi_gbl_FADT.dsdt, + acpi_gbl_FADT.Xdsdt); +diff --git a/drivers/acpi/acpica/tbutils.c b/drivers/acpi/acpica/tbutils.c +index 6559a58..2fb1afa 100644 +--- a/drivers/acpi/acpica/tbutils.c ++++ b/drivers/acpi/acpica/tbutils.c +@@ -68,7 +68,8 @@ acpi_tb_get_root_table_entry(u8 *table_entry, u32 table_entry_size); + + acpi_status acpi_tb_initialize_facs(void) + { +- acpi_status status; ++ struct acpi_table_facs *facs32; ++ struct acpi_table_facs *facs64; + + /* If Hardware Reduced flag is set, there is no FACS */ + +@@ -77,11 +78,22 @@ acpi_status acpi_tb_initialize_facs(void) + return (AE_OK); + } + +- status = acpi_get_table_by_index(ACPI_TABLE_INDEX_FACS, +- ACPI_CAST_INDIRECT_PTR(struct +- acpi_table_header, +- &acpi_gbl_FACS)); +- return (status); ++ (void)acpi_get_table_by_index(ACPI_TABLE_INDEX_FACS, ++ ACPI_CAST_INDIRECT_PTR(struct ++ acpi_table_header, ++ &facs32)); ++ (void)acpi_get_table_by_index(ACPI_TABLE_INDEX_X_FACS, ++ ACPI_CAST_INDIRECT_PTR(struct ++ acpi_table_header, ++ &facs64)); ++ ++ if (acpi_gbl_use32_bit_facs_addresses) { ++ acpi_gbl_FACS = facs32 ? facs32 : facs64; ++ } else { ++ acpi_gbl_FACS = facs64 ? facs64 : facs32; ++ } ++ ++ return (AE_OK); + } + #endif /* !ACPI_REDUCED_HARDWARE */ + +@@ -101,7 +113,7 @@ acpi_status acpi_tb_initialize_facs(void) + u8 acpi_tb_tables_loaded(void) + { + +- if (acpi_gbl_root_table_list.current_table_count >= 3) { ++ if (acpi_gbl_root_table_list.current_table_count >= 4) { + return (TRUE); + } + +@@ -357,11 +369,11 @@ acpi_status __init acpi_tb_parse_root_table(acpi_physical_address rsdp_address) + table_entry = ACPI_ADD_PTR(u8, table, sizeof(struct acpi_table_header)); + + /* +- * First two entries in the table array are reserved for the DSDT +- * and FACS, which are not actually present in the RSDT/XSDT - they +- * come from the FADT ++ * First three entries in the table array are reserved for the DSDT ++ * and 32bit/64bit FACS, which are not actually present in the ++ * RSDT/XSDT - they come from the FADT + */ +- acpi_gbl_root_table_list.current_table_count = 2; ++ acpi_gbl_root_table_list.current_table_count = 3; + + /* Initialize the root table array from the RSDT/XSDT */ + +diff --git a/drivers/acpi/acpica/tbxfload.c b/drivers/acpi/acpica/tbxfload.c +index aadb300..b63e35d 100644 +--- a/drivers/acpi/acpica/tbxfload.c ++++ b/drivers/acpi/acpica/tbxfload.c +@@ -166,7 +166,8 @@ static acpi_status acpi_tb_load_namespace(void) + + (void)acpi_ut_acquire_mutex(ACPI_MTX_TABLES); + for (i = 0; i < acpi_gbl_root_table_list.current_table_count; ++i) { +- if ((!ACPI_COMPARE_NAME ++ if (!acpi_gbl_root_table_list.tables[i].address || ++ (!ACPI_COMPARE_NAME + (&(acpi_gbl_root_table_list.tables[i].signature), + ACPI_SIG_SSDT) + && +diff --git a/drivers/acpi/acpica/utxfinit.c b/drivers/acpi/acpica/utxfinit.c +index 083a768..42a32a6 100644 +--- a/drivers/acpi/acpica/utxfinit.c ++++ b/drivers/acpi/acpica/utxfinit.c +@@ -179,10 +179,12 @@ acpi_status __init acpi_enable_subsystem(u32 flags) + * Obtain a permanent mapping for the FACS. This is required for the + * Global Lock and the Firmware Waking Vector + */ +- status = acpi_tb_initialize_facs(); +- if (ACPI_FAILURE(status)) { +- ACPI_WARNING((AE_INFO, "Could not map the FACS table")); +- return_ACPI_STATUS(status); ++ if (!(flags & ACPI_NO_FACS_INIT)) { ++ status = acpi_tb_initialize_facs(); ++ if (ACPI_FAILURE(status)) { ++ ACPI_WARNING((AE_INFO, "Could not map the FACS table")); ++ return_ACPI_STATUS(status); ++ } + } + #endif /* !ACPI_REDUCED_HARDWARE */ + +diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c +index 5226a8b..98f5316 100644 +--- a/drivers/acpi/osl.c ++++ b/drivers/acpi/osl.c +@@ -175,10 +175,14 @@ static void __init acpi_request_region (struct acpi_generic_address *gas, + if (!addr || !length) + return; + +- acpi_reserve_region(addr, length, gas->space_id, 0, desc); ++ /* Resources are never freed */ ++ if (gas->space_id == ACPI_ADR_SPACE_SYSTEM_IO) ++ request_region(addr, length, desc); ++ else if (gas->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY) ++ request_mem_region(addr, length, desc); + } + +-static void __init acpi_reserve_resources(void) ++static int __init acpi_reserve_resources(void) + { + acpi_request_region(&acpi_gbl_FADT.xpm1a_event_block, acpi_gbl_FADT.pm1_event_length, + "ACPI PM1a_EVT_BLK"); +@@ -207,7 +211,10 @@ static void __init acpi_reserve_resources(void) + if (!(acpi_gbl_FADT.gpe1_block_length & 0x1)) + acpi_request_region(&acpi_gbl_FADT.xgpe1_block, + acpi_gbl_FADT.gpe1_block_length, "ACPI GPE1_BLK"); ++ ++ return 0; + } ++fs_initcall_sync(acpi_reserve_resources); + + void acpi_os_printf(const char *fmt, ...) + { +@@ -1838,7 +1845,6 @@ acpi_status __init acpi_os_initialize(void) + + acpi_status __init acpi_os_initialize1(void) + { +- acpi_reserve_resources(); + kacpid_wq = alloc_workqueue("kacpid", 0, 1); + kacpi_notify_wq = alloc_workqueue("kacpi_notify", 0, 1); + kacpi_hotplug_wq = alloc_ordered_workqueue("kacpi_hotplug", 0); +diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c +index fcb7807..f1c966e 100644 +--- a/drivers/acpi/resource.c ++++ b/drivers/acpi/resource.c +@@ -26,7 +26,6 @@ + #include <linux/device.h> + #include <linux/export.h> + #include <linux/ioport.h> +-#include <linux/list.h> + #include <linux/slab.h> + + #ifdef CONFIG_X86 +@@ -194,6 +193,7 @@ static bool acpi_decode_space(struct resource_win *win, + u8 iodec = attr->granularity == 0xfff ? ACPI_DECODE_10 : ACPI_DECODE_16; + bool wp = addr->info.mem.write_protect; + u64 len = attr->address_length; ++ u64 start, end, offset = 0; + struct resource *res = &win->res; + + /* +@@ -205,9 +205,6 @@ static bool acpi_decode_space(struct resource_win *win, + pr_debug("ACPI: Invalid address space min_addr_fix %d, max_addr_fix %d, len %llx\n", + addr->min_address_fixed, addr->max_address_fixed, len); + +- res->start = attr->minimum; +- res->end = attr->maximum; +- + /* + * For bridges that translate addresses across the bridge, + * translation_offset is the offset that must be added to the +@@ -215,12 +212,22 @@ static bool acpi_decode_space(struct resource_win *win, + * primary side. Non-bridge devices must list 0 for all Address + * Translation offset bits. + */ +- if (addr->producer_consumer == ACPI_PRODUCER) { +- res->start += attr->translation_offset; +- res->end += attr->translation_offset; +- } else if (attr->translation_offset) { ++ if (addr->producer_consumer == ACPI_PRODUCER) ++ offset = attr->translation_offset; ++ else if (attr->translation_offset) + pr_debug("ACPI: translation_offset(%lld) is invalid for non-bridge device.\n", + attr->translation_offset); ++ start = attr->minimum + offset; ++ end = attr->maximum + offset; ++ ++ win->offset = offset; ++ res->start = start; ++ res->end = end; ++ if (sizeof(resource_size_t) < sizeof(u64) && ++ (offset != win->offset || start != res->start || end != res->end)) { ++ pr_warn("acpi resource window ([%#llx-%#llx] ignored, not CPU addressable)\n", ++ attr->minimum, attr->maximum); ++ return false; + } + + switch (addr->resource_type) { +@@ -237,8 +244,6 @@ static bool acpi_decode_space(struct resource_win *win, + return false; + } + +- win->offset = attr->translation_offset; +- + if (addr->producer_consumer == ACPI_PRODUCER) + res->flags |= IORESOURCE_WINDOW; + +@@ -622,162 +627,3 @@ int acpi_dev_filter_resource_type(struct acpi_resource *ares, + return (type & types) ? 0 : 1; + } + EXPORT_SYMBOL_GPL(acpi_dev_filter_resource_type); +- +-struct reserved_region { +- struct list_head node; +- u64 start; +- u64 end; +-}; +- +-static LIST_HEAD(reserved_io_regions); +-static LIST_HEAD(reserved_mem_regions); +- +-static int request_range(u64 start, u64 end, u8 space_id, unsigned long flags, +- char *desc) +-{ +- unsigned int length = end - start + 1; +- struct resource *res; +- +- res = space_id == ACPI_ADR_SPACE_SYSTEM_IO ? +- request_region(start, length, desc) : +- request_mem_region(start, length, desc); +- if (!res) +- return -EIO; +- +- res->flags &= ~flags; +- return 0; +-} +- +-static int add_region_before(u64 start, u64 end, u8 space_id, +- unsigned long flags, char *desc, +- struct list_head *head) +-{ +- struct reserved_region *reg; +- int error; +- +- reg = kmalloc(sizeof(*reg), GFP_KERNEL); +- if (!reg) +- return -ENOMEM; +- +- error = request_range(start, end, space_id, flags, desc); +- if (error) +- return error; +- +- reg->start = start; +- reg->end = end; +- list_add_tail(®->node, head); +- return 0; +-} +- +-/** +- * acpi_reserve_region - Reserve an I/O or memory region as a system resource. +- * @start: Starting address of the region. +- * @length: Length of the region. +- * @space_id: Identifier of address space to reserve the region from. +- * @flags: Resource flags to clear for the region after requesting it. +- * @desc: Region description (for messages). +- * +- * Reserve an I/O or memory region as a system resource to prevent others from +- * using it. If the new region overlaps with one of the regions (in the given +- * address space) already reserved by this routine, only the non-overlapping +- * parts of it will be reserved. +- * +- * Returned is either 0 (success) or a negative error code indicating a resource +- * reservation problem. It is the code of the first encountered error, but the +- * routine doesn't abort until it has attempted to request all of the parts of +- * the new region that don't overlap with other regions reserved previously. +- * +- * The resources requested by this routine are never released. +- */ +-int acpi_reserve_region(u64 start, unsigned int length, u8 space_id, +- unsigned long flags, char *desc) +-{ +- struct list_head *regions; +- struct reserved_region *reg; +- u64 end = start + length - 1; +- int ret = 0, error = 0; +- +- if (space_id == ACPI_ADR_SPACE_SYSTEM_IO) +- regions = &reserved_io_regions; +- else if (space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY) +- regions = &reserved_mem_regions; +- else +- return -EINVAL; +- +- if (list_empty(regions)) +- return add_region_before(start, end, space_id, flags, desc, regions); +- +- list_for_each_entry(reg, regions, node) +- if (reg->start == end + 1) { +- /* The new region can be prepended to this one. */ +- ret = request_range(start, end, space_id, flags, desc); +- if (!ret) +- reg->start = start; +- +- return ret; +- } else if (reg->start > end) { +- /* No overlap. Add the new region here and get out. */ +- return add_region_before(start, end, space_id, flags, +- desc, ®->node); +- } else if (reg->end == start - 1) { +- goto combine; +- } else if (reg->end >= start) { +- goto overlap; +- } +- +- /* The new region goes after the last existing one. */ +- return add_region_before(start, end, space_id, flags, desc, regions); +- +- overlap: +- /* +- * The new region overlaps an existing one. +- * +- * The head part of the new region immediately preceding the existing +- * overlapping one can be combined with it right away. +- */ +- if (reg->start > start) { +- error = request_range(start, reg->start - 1, space_id, flags, desc); +- if (error) +- ret = error; +- else +- reg->start = start; +- } +- +- combine: +- /* +- * The new region is adjacent to an existing one. If it extends beyond +- * that region all the way to the next one, it is possible to combine +- * all three of them. +- */ +- while (reg->end < end) { +- struct reserved_region *next = NULL; +- u64 a = reg->end + 1, b = end; +- +- if (!list_is_last(®->node, regions)) { +- next = list_next_entry(reg, node); +- if (next->start <= end) +- b = next->start - 1; +- } +- error = request_range(a, b, space_id, flags, desc); +- if (!error) { +- if (next && next->start == b + 1) { +- reg->end = next->end; +- list_del(&next->node); +- kfree(next); +- } else { +- reg->end = end; +- break; +- } +- } else if (next) { +- if (!ret) +- ret = error; +- +- reg = next; +- } else { +- break; +- } +- } +- +- return ret ? ret : error; +-} +-EXPORT_SYMBOL_GPL(acpi_reserve_region); +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index 577849c..41c99be 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -2478,6 +2478,10 @@ int ata_dev_configure(struct ata_device *dev) + dev->max_sectors = min_t(unsigned int, ATA_MAX_SECTORS_128, + dev->max_sectors); + ++ if (dev->horkage & ATA_HORKAGE_MAX_SEC_1024) ++ dev->max_sectors = min_t(unsigned int, ATA_MAX_SECTORS_1024, ++ dev->max_sectors); ++ + if (dev->horkage & ATA_HORKAGE_MAX_SEC_LBA48) + dev->max_sectors = ATA_MAX_SECTORS_LBA48; + +@@ -4146,6 +4150,12 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { + { "Slimtype DVD A DS8A8SH", NULL, ATA_HORKAGE_MAX_SEC_LBA48 }, + { "Slimtype DVD A DS8A9SH", NULL, ATA_HORKAGE_MAX_SEC_LBA48 }, + ++ /* ++ * Causes silent data corruption with higher max sects. ++ * http://lkml.kernel.org/g/x49wpy40ysk.fsf@segfault.boston.devel.redhat.com ++ */ ++ { "ST380013AS", "3.20", ATA_HORKAGE_MAX_SEC_1024 }, ++ + /* Devices we expect to fail diagnostics */ + + /* Devices where NCQ should be avoided */ +@@ -4174,9 +4184,10 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { + { "ST3320[68]13AS", "SD1[5-9]", ATA_HORKAGE_NONCQ | + ATA_HORKAGE_FIRMWARE_WARN }, + +- /* Seagate Momentus SpinPoint M8 seem to have FPMDA_AA issues */ ++ /* drives which fail FPDMA_AA activation (some may freeze afterwards) */ + { "ST1000LM024 HN-M101MBB", "2AR10001", ATA_HORKAGE_BROKEN_FPDMA_AA }, + { "ST1000LM024 HN-M101MBB", "2BA30001", ATA_HORKAGE_BROKEN_FPDMA_AA }, ++ { "VB0250EAVER", "HPG7", ATA_HORKAGE_BROKEN_FPDMA_AA }, + + /* Blacklist entries taken from Silicon Image 3124/3132 + Windows driver .inf file - also several Linux problem reports */ +@@ -4225,11 +4236,11 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { + { "PIONEER DVD-RW DVR-216D", NULL, ATA_HORKAGE_NOSETXFER }, + + /* devices that don't properly handle queued TRIM commands */ +- { "Micron_M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | ++ { "Micron_M500_*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | + ATA_HORKAGE_ZERO_AFTER_TRIM, }, + { "Crucial_CT*M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | + ATA_HORKAGE_ZERO_AFTER_TRIM, }, +- { "Micron_M5[15]0*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM | ++ { "Micron_M5[15]0_*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM | + ATA_HORKAGE_ZERO_AFTER_TRIM, }, + { "Crucial_CT*M550*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM | + ATA_HORKAGE_ZERO_AFTER_TRIM, }, +@@ -4238,6 +4249,9 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { + { "Samsung SSD 8*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | + ATA_HORKAGE_ZERO_AFTER_TRIM, }, + ++ /* devices that don't properly handle TRIM commands */ ++ { "SuperSSpeed S238*", NULL, ATA_HORKAGE_NOTRIM, }, ++ + /* + * As defined, the DRAT (Deterministic Read After Trim) and RZAT + * (Return Zero After Trim) flags in the ATA Command Set are +@@ -4501,7 +4515,8 @@ static unsigned int ata_dev_set_xfermode(struct ata_device *dev) + else /* In the ancient relic department - skip all of this */ + return 0; + +- err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 0); ++ /* On some disks, this command causes spin-up, so we need longer timeout */ ++ err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 15000); + + DPRINTK("EXIT, err_mask=%x\n", err_mask); + return err_mask; +diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c +index cf0022e..7465031 100644 +--- a/drivers/ata/libata-eh.c ++++ b/drivers/ata/libata-eh.c +@@ -1507,16 +1507,21 @@ unsigned int ata_read_log_page(struct ata_device *dev, u8 log, + { + struct ata_taskfile tf; + unsigned int err_mask; ++ bool dma = false; + + DPRINTK("read log page - log 0x%x, page 0x%x\n", log, page); + ++retry: + ata_tf_init(dev, &tf); +- if (dev->dma_mode && ata_id_has_read_log_dma_ext(dev->id)) { ++ if (dev->dma_mode && ata_id_has_read_log_dma_ext(dev->id) && ++ !(dev->horkage & ATA_HORKAGE_NO_NCQ_LOG)) { + tf.command = ATA_CMD_READ_LOG_DMA_EXT; + tf.protocol = ATA_PROT_DMA; ++ dma = true; + } else { + tf.command = ATA_CMD_READ_LOG_EXT; + tf.protocol = ATA_PROT_PIO; ++ dma = false; + } + tf.lbal = log; + tf.lbam = page; +@@ -1527,6 +1532,12 @@ unsigned int ata_read_log_page(struct ata_device *dev, u8 log, + err_mask = ata_exec_internal(dev, &tf, NULL, DMA_FROM_DEVICE, + buf, sectors * ATA_SECT_SIZE, 0); + ++ if (err_mask && dma) { ++ dev->horkage |= ATA_HORKAGE_NO_NCQ_LOG; ++ ata_dev_warn(dev, "READ LOG DMA EXT failed, trying unqueued\n"); ++ goto retry; ++ } ++ + DPRINTK("EXIT, err_mask=%x\n", err_mask); + return err_mask; + } +diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c +index 3131adc..641a61a 100644 +--- a/drivers/ata/libata-scsi.c ++++ b/drivers/ata/libata-scsi.c +@@ -2568,7 +2568,8 @@ static unsigned int ata_scsiop_read_cap(struct ata_scsi_args *args, u8 *rbuf) + rbuf[14] = (lowest_aligned >> 8) & 0x3f; + rbuf[15] = lowest_aligned; + +- if (ata_id_has_trim(args->id)) { ++ if (ata_id_has_trim(args->id) && ++ !(dev->horkage & ATA_HORKAGE_NOTRIM)) { + rbuf[14] |= 0x80; /* LBPME */ + + if (ata_id_has_zero_after_trim(args->id) && +diff --git a/drivers/ata/libata-transport.c b/drivers/ata/libata-transport.c +index 3227b7c..e2d9497 100644 +--- a/drivers/ata/libata-transport.c ++++ b/drivers/ata/libata-transport.c +@@ -560,6 +560,29 @@ show_ata_dev_gscr(struct device *dev, + + static DEVICE_ATTR(gscr, S_IRUGO, show_ata_dev_gscr, NULL); + ++static ssize_t ++show_ata_dev_trim(struct device *dev, ++ struct device_attribute *attr, char *buf) ++{ ++ struct ata_device *ata_dev = transport_class_to_dev(dev); ++ unsigned char *mode; ++ ++ if (!ata_id_has_trim(ata_dev->id)) ++ mode = "unsupported"; ++ else if (ata_dev->horkage & ATA_HORKAGE_NOTRIM) ++ mode = "forced_unsupported"; ++ else if (ata_dev->horkage & ATA_HORKAGE_NO_NCQ_TRIM) ++ mode = "forced_unqueued"; ++ else if (ata_fpdma_dsm_supported(ata_dev)) ++ mode = "queued"; ++ else ++ mode = "unqueued"; ++ ++ return snprintf(buf, 20, "%s\n", mode); ++} ++ ++static DEVICE_ATTR(trim, S_IRUGO, show_ata_dev_trim, NULL); ++ + static DECLARE_TRANSPORT_CLASS(ata_dev_class, + "ata_device", NULL, NULL, NULL); + +@@ -733,6 +756,7 @@ struct scsi_transport_template *ata_attach_transport(void) + SETUP_DEV_ATTRIBUTE(ering); + SETUP_DEV_ATTRIBUTE(id); + SETUP_DEV_ATTRIBUTE(gscr); ++ SETUP_DEV_ATTRIBUTE(trim); + BUG_ON(count > ATA_DEV_ATTRS); + i->dev_attrs[count] = NULL; + +diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c +index 171841a..4d1d9de 100644 +--- a/drivers/base/firmware_class.c ++++ b/drivers/base/firmware_class.c +@@ -544,10 +544,8 @@ static void fw_dev_release(struct device *dev) + kfree(fw_priv); + } + +-static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env) ++static int do_firmware_uevent(struct firmware_priv *fw_priv, struct kobj_uevent_env *env) + { +- struct firmware_priv *fw_priv = to_firmware_priv(dev); +- + if (add_uevent_var(env, "FIRMWARE=%s", fw_priv->buf->fw_id)) + return -ENOMEM; + if (add_uevent_var(env, "TIMEOUT=%i", loading_timeout)) +@@ -558,6 +556,18 @@ static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env) + return 0; + } + ++static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env) ++{ ++ struct firmware_priv *fw_priv = to_firmware_priv(dev); ++ int err = 0; ++ ++ mutex_lock(&fw_lock); ++ if (fw_priv->buf) ++ err = do_firmware_uevent(fw_priv, env); ++ mutex_unlock(&fw_lock); ++ return err; ++} ++ + static struct class firmware_class = { + .name = "firmware", + .class_attrs = firmware_class_attrs, +diff --git a/drivers/base/power/clock_ops.c b/drivers/base/power/clock_ops.c +index 7fdd017..c7b0fce 100644 +--- a/drivers/base/power/clock_ops.c ++++ b/drivers/base/power/clock_ops.c +@@ -93,7 +93,7 @@ static int __pm_clk_add(struct device *dev, const char *con_id, + return -ENOMEM; + } + } else { +- if (IS_ERR(ce->clk) || !__clk_get(clk)) { ++ if (IS_ERR(clk) || !__clk_get(clk)) { + kfree(ce); + return -ENOENT; + } +diff --git a/drivers/block/loop.c b/drivers/block/loop.c +index d7173cb..cef6fa8 100644 +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -86,8 +86,6 @@ static DEFINE_MUTEX(loop_index_mutex); + static int max_part; + static int part_shift; + +-static struct workqueue_struct *loop_wq; +- + static int transfer_xor(struct loop_device *lo, int cmd, + struct page *raw_page, unsigned raw_off, + struct page *loop_page, unsigned loop_off, +@@ -725,6 +723,12 @@ static int loop_set_fd(struct loop_device *lo, fmode_t mode, + size = get_loop_size(lo, file); + if ((loff_t)(sector_t)size != size) + goto out_putf; ++ error = -ENOMEM; ++ lo->wq = alloc_workqueue("kloopd%d", ++ WQ_MEM_RECLAIM | WQ_HIGHPRI | WQ_UNBOUND, 16, ++ lo->lo_number); ++ if (!lo->wq) ++ goto out_putf; + + error = 0; + +@@ -872,6 +876,8 @@ static int loop_clr_fd(struct loop_device *lo) + lo->lo_flags = 0; + if (!part_shift) + lo->lo_disk->flags |= GENHD_FL_NO_PART_SCAN; ++ destroy_workqueue(lo->wq); ++ lo->wq = NULL; + mutex_unlock(&lo->lo_ctl_mutex); + /* + * Need not hold lo_ctl_mutex to fput backing file. +@@ -1425,9 +1431,13 @@ static int loop_queue_rq(struct blk_mq_hw_ctx *hctx, + const struct blk_mq_queue_data *bd) + { + struct loop_cmd *cmd = blk_mq_rq_to_pdu(bd->rq); ++ struct loop_device *lo = cmd->rq->q->queuedata; + + blk_mq_start_request(bd->rq); + ++ if (lo->lo_state != Lo_bound) ++ return -EIO; ++ + if (cmd->rq->cmd_flags & REQ_WRITE) { + struct loop_device *lo = cmd->rq->q->queuedata; + bool need_sched = true; +@@ -1441,9 +1451,9 @@ static int loop_queue_rq(struct blk_mq_hw_ctx *hctx, + spin_unlock_irq(&lo->lo_lock); + + if (need_sched) +- queue_work(loop_wq, &lo->write_work); ++ queue_work(lo->wq, &lo->write_work); + } else { +- queue_work(loop_wq, &cmd->read_work); ++ queue_work(lo->wq, &cmd->read_work); + } + + return BLK_MQ_RQ_QUEUE_OK; +@@ -1455,9 +1465,6 @@ static void loop_handle_cmd(struct loop_cmd *cmd) + struct loop_device *lo = cmd->rq->q->queuedata; + int ret = -EIO; + +- if (lo->lo_state != Lo_bound) +- goto failed; +- + if (write && (lo->lo_flags & LO_FLAGS_READ_ONLY)) + goto failed; + +@@ -1806,13 +1813,6 @@ static int __init loop_init(void) + goto misc_out; + } + +- loop_wq = alloc_workqueue("kloopd", +- WQ_MEM_RECLAIM | WQ_HIGHPRI | WQ_UNBOUND, 0); +- if (!loop_wq) { +- err = -ENOMEM; +- goto misc_out; +- } +- + blk_register_region(MKDEV(LOOP_MAJOR, 0), range, + THIS_MODULE, loop_probe, NULL, NULL); + +@@ -1850,8 +1850,6 @@ static void __exit loop_exit(void) + blk_unregister_region(MKDEV(LOOP_MAJOR, 0), range); + unregister_blkdev(LOOP_MAJOR, "loop"); + +- destroy_workqueue(loop_wq); +- + misc_deregister(&loop_misc); + } + +diff --git a/drivers/block/loop.h b/drivers/block/loop.h +index 301c27f..49564ed 100644 +--- a/drivers/block/loop.h ++++ b/drivers/block/loop.h +@@ -54,6 +54,7 @@ struct loop_device { + gfp_t old_gfp_mask; + + spinlock_t lo_lock; ++ struct workqueue_struct *wq; + struct list_head write_cmd_head; + struct work_struct write_work; + bool write_started; +diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c +index ec6c5c6..53f2535 100644 +--- a/drivers/block/rbd.c ++++ b/drivers/block/rbd.c +@@ -2001,11 +2001,11 @@ static struct rbd_obj_request *rbd_obj_request_create(const char *object_name, + rbd_assert(obj_request_type_valid(type)); + + size = strlen(object_name) + 1; +- name = kmalloc(size, GFP_KERNEL); ++ name = kmalloc(size, GFP_NOIO); + if (!name) + return NULL; + +- obj_request = kmem_cache_zalloc(rbd_obj_request_cache, GFP_KERNEL); ++ obj_request = kmem_cache_zalloc(rbd_obj_request_cache, GFP_NOIO); + if (!obj_request) { + kfree(name); + return NULL; +diff --git a/drivers/bluetooth/btbcm.c b/drivers/bluetooth/btbcm.c +index 4bba866..3f146c9 100644 +--- a/drivers/bluetooth/btbcm.c ++++ b/drivers/bluetooth/btbcm.c +@@ -378,12 +378,11 @@ int btbcm_setup_apple(struct hci_dev *hdev) + + /* Read Verbose Config Version Info */ + skb = btbcm_read_verbose_config(hdev); +- if (IS_ERR(skb)) +- return PTR_ERR(skb); +- +- BT_INFO("%s: BCM: chip id %u build %4.4u", hdev->name, skb->data[1], +- get_unaligned_le16(skb->data + 5)); +- kfree_skb(skb); ++ if (!IS_ERR(skb)) { ++ BT_INFO("%s: BCM: chip id %u build %4.4u", hdev->name, skb->data[1], ++ get_unaligned_le16(skb->data + 5)); ++ kfree_skb(skb); ++ } + + set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 420cc9f..c655015 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -268,7 +268,7 @@ static const struct usb_device_id blacklist_table[] = { + { USB_DEVICE(0x0e5e, 0x6622), .driver_info = BTUSB_BROKEN_ISOC }, + + /* Roper Class 1 Bluetooth Dongle (Silicon Wave based) */ +- { USB_DEVICE(0x1300, 0x0001), .driver_info = BTUSB_SWAVE }, ++ { USB_DEVICE(0x1310, 0x0001), .driver_info = BTUSB_SWAVE }, + + /* Digianswer devices */ + { USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER }, +@@ -1993,6 +1993,8 @@ static int btusb_setup_intel(struct hci_dev *hdev) + } + fw_ptr = fw->data; + ++ kfree_skb(skb); ++ + /* This Intel specific command enables the manufacturer mode of the + * controller. + * +@@ -2334,6 +2336,7 @@ static int btusb_setup_intel_new(struct hci_dev *hdev) + struct intel_boot_params *params; + const struct firmware *fw; + const u8 *fw_ptr; ++ u32 frag_len; + char fwname[64]; + ktime_t calltime, delta, rettime; + unsigned long long duration; +@@ -2540,24 +2543,33 @@ static int btusb_setup_intel_new(struct hci_dev *hdev) + } + + fw_ptr = fw->data + 644; ++ frag_len = 0; + + while (fw_ptr - fw->data < fw->size) { +- struct hci_command_hdr *cmd = (void *)fw_ptr; +- u8 cmd_len; ++ struct hci_command_hdr *cmd = (void *)(fw_ptr + frag_len); + +- cmd_len = sizeof(*cmd) + cmd->plen; ++ frag_len += sizeof(*cmd) + cmd->plen; + +- /* Send each command from the firmware data buffer as +- * a single Data fragment. ++ /* The paramter length of the secure send command requires ++ * a 4 byte alignment. It happens so that the firmware file ++ * contains proper Intel_NOP commands to align the fragments ++ * as needed. ++ * ++ * Send set of commands with 4 byte alignment from the ++ * firmware data buffer as a single Data fragement. + */ +- err = btusb_intel_secure_send(hdev, 0x01, cmd_len, fw_ptr); +- if (err < 0) { +- BT_ERR("%s: Failed to send firmware data (%d)", +- hdev->name, err); +- goto done; +- } ++ if (!(frag_len % 4)) { ++ err = btusb_intel_secure_send(hdev, 0x01, frag_len, ++ fw_ptr); ++ if (err < 0) { ++ BT_ERR("%s: Failed to send firmware data (%d)", ++ hdev->name, err); ++ goto done; ++ } + +- fw_ptr += cmd_len; ++ fw_ptr += frag_len; ++ frag_len = 0; ++ } + } + + set_bit(BTUSB_FIRMWARE_LOADED, &data->flags); +diff --git a/drivers/bus/arm-ccn.c b/drivers/bus/arm-ccn.c +index aaa0f2a..60397ec 100644 +--- a/drivers/bus/arm-ccn.c ++++ b/drivers/bus/arm-ccn.c +@@ -212,7 +212,7 @@ static int arm_ccn_node_to_xp_port(int node) + + static void arm_ccn_pmu_config_set(u64 *config, u32 node_xp, u32 type, u32 port) + { +- *config &= ~((0xff << 0) | (0xff << 8) | (0xff << 24)); ++ *config &= ~((0xff << 0) | (0xff << 8) | (0x3 << 24)); + *config |= (node_xp << 0) | (type << 8) | (port << 24); + } + +diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c +index 0b4188b..c6dea3f 100644 +--- a/drivers/char/agp/intel-gtt.c ++++ b/drivers/char/agp/intel-gtt.c +@@ -581,7 +581,7 @@ static inline int needs_ilk_vtd_wa(void) + /* Query intel_iommu to see if we need the workaround. Presumably that + * was loaded first. + */ +- if ((gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB || ++ if ((gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_D_IG || + gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_M_IG) && + intel_iommu_gfx_mapped) + return 1; +diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c +index 283f00a..1082d4b 100644 +--- a/drivers/char/tpm/tpm-chip.c ++++ b/drivers/char/tpm/tpm-chip.c +@@ -129,8 +129,9 @@ struct tpm_chip *tpmm_chip_alloc(struct device *dev, + + device_initialize(&chip->dev); + +- chip->cdev.owner = chip->pdev->driver->owner; + cdev_init(&chip->cdev, &tpm_fops); ++ chip->cdev.owner = chip->pdev->driver->owner; ++ chip->cdev.kobj.parent = &chip->dev.kobj; + + return chip; + } +diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c +index b26ceee..1267322 100644 +--- a/drivers/char/tpm/tpm_crb.c ++++ b/drivers/char/tpm/tpm_crb.c +@@ -233,6 +233,14 @@ static int crb_acpi_add(struct acpi_device *device) + return -ENODEV; + } + ++ /* At least some versions of AMI BIOS have a bug that TPM2 table has ++ * zero address for the control area and therefore we must fail. ++ */ ++ if (!buf->control_area_pa) { ++ dev_err(dev, "TPM2 ACPI table has a zero address for the control area\n"); ++ return -EINVAL; ++ } ++ + if (buf->hdr.length < sizeof(struct acpi_tpm2)) { + dev_err(dev, "TPM2 ACPI table has wrong size"); + return -EINVAL; +@@ -267,7 +275,7 @@ static int crb_acpi_add(struct acpi_device *device) + + memcpy_fromio(&pa, &priv->cca->cmd_pa, 8); + pa = le64_to_cpu(pa); +- priv->cmd = devm_ioremap_nocache(dev, le64_to_cpu(pa), ++ priv->cmd = devm_ioremap_nocache(dev, pa, + ioread32(&priv->cca->cmd_size)); + if (!priv->cmd) { + dev_err(dev, "ioremap of the command buffer failed\n"); +@@ -276,7 +284,7 @@ static int crb_acpi_add(struct acpi_device *device) + + memcpy_fromio(&pa, &priv->cca->rsp_pa, 8); + pa = le64_to_cpu(pa); +- priv->rsp = devm_ioremap_nocache(dev, le64_to_cpu(pa), ++ priv->rsp = devm_ioremap_nocache(dev, pa, + ioread32(&priv->cca->rsp_size)); + if (!priv->rsp) { + dev_err(dev, "ioremap of the response buffer failed\n"); +diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c +index 42ffa5e..27ebf95 100644 +--- a/drivers/char/tpm/tpm_ibmvtpm.c ++++ b/drivers/char/tpm/tpm_ibmvtpm.c +@@ -578,6 +578,9 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev, + goto cleanup; + } + ++ ibmvtpm->dev = dev; ++ ibmvtpm->vdev = vio_dev; ++ + crq_q = &ibmvtpm->crq_queue; + crq_q->crq_addr = (struct ibmvtpm_crq *)get_zeroed_page(GFP_KERNEL); + if (!crq_q->crq_addr) { +@@ -622,8 +625,6 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev, + + crq_q->index = 0; + +- ibmvtpm->dev = dev; +- ibmvtpm->vdev = vio_dev; + TPM_VPRIV(chip) = (void *)ibmvtpm; + + spin_lock_init(&ibmvtpm->rtce_lock); +diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c +index 5b0f418..9f9cadd 100644 +--- a/drivers/clk/clk.c ++++ b/drivers/clk/clk.c +@@ -230,11 +230,12 @@ static void clk_dump_one(struct seq_file *s, struct clk_core *c, int level) + if (!c) + return; + ++ /* This should be JSON format, i.e. elements separated with a comma */ + seq_printf(s, "\"%s\": { ", c->name); + seq_printf(s, "\"enable_count\": %d,", c->enable_count); + seq_printf(s, "\"prepare_count\": %d,", c->prepare_count); +- seq_printf(s, "\"rate\": %lu", clk_core_get_rate(c)); +- seq_printf(s, "\"accuracy\": %lu", clk_core_get_accuracy(c)); ++ seq_printf(s, "\"rate\": %lu,", clk_core_get_rate(c)); ++ seq_printf(s, "\"accuracy\": %lu,", clk_core_get_accuracy(c)); + seq_printf(s, "\"phase\": %d", clk_core_get_phase(c)); + } + +diff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c +index b95d17f..92936f0 100644 +--- a/drivers/clk/qcom/clk-rcg2.c ++++ b/drivers/clk/qcom/clk-rcg2.c +@@ -530,19 +530,16 @@ static int clk_pixel_set_rate(struct clk_hw *hw, unsigned long rate, + struct clk_rcg2 *rcg = to_clk_rcg2(hw); + struct freq_tbl f = *rcg->freq_tbl; + const struct frac_entry *frac = frac_table_pixel; +- unsigned long request, src_rate; ++ unsigned long request; + int delta = 100000; + u32 mask = BIT(rcg->hid_width) - 1; + u32 hid_div; +- int index = qcom_find_src_index(hw, rcg->parent_map, f.src); +- struct clk *parent = clk_get_parent_by_index(hw->clk, index); + + for (; frac->num; frac++) { + request = (rate * frac->den) / frac->num; + +- src_rate = __clk_round_rate(parent, request); +- if ((src_rate < (request - delta)) || +- (src_rate > (request + delta))) ++ if ((parent_rate < (request - delta)) || ++ (parent_rate > (request + delta))) + continue; + + regmap_read(rcg->clkr.regmap, rcg->cmd_rcgr + CFG_REG, +diff --git a/drivers/clk/ti/clk-dra7-atl.c b/drivers/clk/ti/clk-dra7-atl.c +index d86bc46..0a1df82 100644 +--- a/drivers/clk/ti/clk-dra7-atl.c ++++ b/drivers/clk/ti/clk-dra7-atl.c +@@ -252,6 +252,11 @@ static int of_dra7_atl_clk_probe(struct platform_device *pdev) + } + + clk = of_clk_get_from_provider(&clkspec); ++ if (IS_ERR(clk)) { ++ pr_err("%s: failed to get atl clock %d from provider\n", ++ __func__, i); ++ return PTR_ERR(clk); ++ } + + cdesc = to_atl_desc(__clk_get_hw(clk)); + cdesc->cinfo = cinfo; +diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c +index 83564c9..c844616 100644 +--- a/drivers/clocksource/exynos_mct.c ++++ b/drivers/clocksource/exynos_mct.c +@@ -466,15 +466,12 @@ static int exynos4_local_timer_setup(struct clock_event_device *evt) + exynos4_mct_write(TICK_BASE_CNT, mevt->base + MCT_L_TCNTB_OFFSET); + + if (mct_int_type == MCT_INT_SPI) { +- evt->irq = mct_irqs[MCT_L0_IRQ + cpu]; +- if (request_irq(evt->irq, exynos4_mct_tick_isr, +- IRQF_TIMER | IRQF_NOBALANCING, +- evt->name, mevt)) { +- pr_err("exynos-mct: cannot register IRQ %d\n", +- evt->irq); ++ ++ if (evt->irq == -1) + return -EIO; +- } +- irq_force_affinity(mct_irqs[MCT_L0_IRQ + cpu], cpumask_of(cpu)); ++ ++ irq_force_affinity(evt->irq, cpumask_of(cpu)); ++ enable_irq(evt->irq); + } else { + enable_percpu_irq(mct_irqs[MCT_L0_IRQ], 0); + } +@@ -487,10 +484,12 @@ static int exynos4_local_timer_setup(struct clock_event_device *evt) + static void exynos4_local_timer_stop(struct clock_event_device *evt) + { + evt->set_mode(CLOCK_EVT_MODE_UNUSED, evt); +- if (mct_int_type == MCT_INT_SPI) +- free_irq(evt->irq, this_cpu_ptr(&percpu_mct_tick)); +- else ++ if (mct_int_type == MCT_INT_SPI) { ++ if (evt->irq != -1) ++ disable_irq_nosync(evt->irq); ++ } else { + disable_percpu_irq(mct_irqs[MCT_L0_IRQ]); ++ } + } + + static int exynos4_mct_cpu_notify(struct notifier_block *self, +@@ -522,7 +521,7 @@ static struct notifier_block exynos4_mct_cpu_nb = { + + static void __init exynos4_timer_resources(struct device_node *np, void __iomem *base) + { +- int err; ++ int err, cpu; + struct mct_clock_event_device *mevt = this_cpu_ptr(&percpu_mct_tick); + struct clk *mct_clk, *tick_clk; + +@@ -549,7 +548,25 @@ static void __init exynos4_timer_resources(struct device_node *np, void __iomem + WARN(err, "MCT: can't request IRQ %d (%d)\n", + mct_irqs[MCT_L0_IRQ], err); + } else { +- irq_set_affinity(mct_irqs[MCT_L0_IRQ], cpumask_of(0)); ++ for_each_possible_cpu(cpu) { ++ int mct_irq = mct_irqs[MCT_L0_IRQ + cpu]; ++ struct mct_clock_event_device *pcpu_mevt = ++ per_cpu_ptr(&percpu_mct_tick, cpu); ++ ++ pcpu_mevt->evt.irq = -1; ++ ++ irq_set_status_flags(mct_irq, IRQ_NOAUTOEN); ++ if (request_irq(mct_irq, ++ exynos4_mct_tick_isr, ++ IRQF_TIMER | IRQF_NOBALANCING, ++ pcpu_mevt->name, pcpu_mevt)) { ++ pr_err("exynos-mct: cannot register IRQ (cpu%d)\n", ++ cpu); ++ ++ continue; ++ } ++ pcpu_mevt->evt.irq = mct_irq; ++ } + } + + err = register_cpu_notifier(&exynos4_mct_cpu_nb); +diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c +index 1c56001..50f1b42 100644 +--- a/drivers/dma/mv_xor.c ++++ b/drivers/dma/mv_xor.c +@@ -273,7 +273,8 @@ static void mv_xor_slot_cleanup(struct mv_xor_chan *mv_chan) + dma_cookie_t cookie = 0; + int busy = mv_chan_is_busy(mv_chan); + u32 current_desc = mv_chan_get_current_desc(mv_chan); +- int seen_current = 0; ++ int current_cleaned = 0; ++ struct mv_xor_desc *hw_desc; + + dev_dbg(mv_chan_to_devp(mv_chan), "%s %d\n", __func__, __LINE__); + dev_dbg(mv_chan_to_devp(mv_chan), "current_desc %x\n", current_desc); +@@ -285,38 +286,57 @@ static void mv_xor_slot_cleanup(struct mv_xor_chan *mv_chan) + + list_for_each_entry_safe(iter, _iter, &mv_chan->chain, + chain_node) { +- prefetch(_iter); +- prefetch(&_iter->async_tx); + +- /* do not advance past the current descriptor loaded into the +- * hardware channel, subsequent descriptors are either in +- * process or have not been submitted +- */ +- if (seen_current) +- break; ++ /* clean finished descriptors */ ++ hw_desc = iter->hw_desc; ++ if (hw_desc->status & XOR_DESC_SUCCESS) { ++ cookie = mv_xor_run_tx_complete_actions(iter, mv_chan, ++ cookie); + +- /* stop the search if we reach the current descriptor and the +- * channel is busy +- */ +- if (iter->async_tx.phys == current_desc) { +- seen_current = 1; +- if (busy) ++ /* done processing desc, clean slot */ ++ mv_xor_clean_slot(iter, mv_chan); ++ ++ /* break if we did cleaned the current */ ++ if (iter->async_tx.phys == current_desc) { ++ current_cleaned = 1; ++ break; ++ } ++ } else { ++ if (iter->async_tx.phys == current_desc) { ++ current_cleaned = 0; + break; ++ } + } +- +- cookie = mv_xor_run_tx_complete_actions(iter, mv_chan, cookie); +- +- if (mv_xor_clean_slot(iter, mv_chan)) +- break; + } + + if ((busy == 0) && !list_empty(&mv_chan->chain)) { +- struct mv_xor_desc_slot *chain_head; +- chain_head = list_entry(mv_chan->chain.next, +- struct mv_xor_desc_slot, +- chain_node); +- +- mv_xor_start_new_chain(mv_chan, chain_head); ++ if (current_cleaned) { ++ /* ++ * current descriptor cleaned and removed, run ++ * from list head ++ */ ++ iter = list_entry(mv_chan->chain.next, ++ struct mv_xor_desc_slot, ++ chain_node); ++ mv_xor_start_new_chain(mv_chan, iter); ++ } else { ++ if (!list_is_last(&iter->chain_node, &mv_chan->chain)) { ++ /* ++ * descriptors are still waiting after ++ * current, trigger them ++ */ ++ iter = list_entry(iter->chain_node.next, ++ struct mv_xor_desc_slot, ++ chain_node); ++ mv_xor_start_new_chain(mv_chan, iter); ++ } else { ++ /* ++ * some descriptors are still waiting ++ * to be cleaned ++ */ ++ tasklet_schedule(&mv_chan->irq_tasklet); ++ } ++ } + } + + if (cookie > 0) +diff --git a/drivers/dma/mv_xor.h b/drivers/dma/mv_xor.h +index 91958db..0e302b3 100644 +--- a/drivers/dma/mv_xor.h ++++ b/drivers/dma/mv_xor.h +@@ -31,6 +31,7 @@ + #define XOR_OPERATION_MODE_XOR 0 + #define XOR_OPERATION_MODE_MEMCPY 2 + #define XOR_DESCRIPTOR_SWAP BIT(14) ++#define XOR_DESC_SUCCESS 0x40000000 + + #define XOR_DESC_DMA_OWNED BIT(31) + #define XOR_DESC_EOD_INT_EN BIT(31) +diff --git a/drivers/edac/octeon_edac-l2c.c b/drivers/edac/octeon_edac-l2c.c +index 7e98084..afea7fc 100644 +--- a/drivers/edac/octeon_edac-l2c.c ++++ b/drivers/edac/octeon_edac-l2c.c +@@ -151,7 +151,7 @@ static int octeon_l2c_probe(struct platform_device *pdev) + l2c->ctl_name = "octeon_l2c_err"; + + +- if (OCTEON_IS_MODEL(OCTEON_FAM_1_PLUS)) { ++ if (OCTEON_IS_OCTEON1PLUS()) { + union cvmx_l2t_err l2t_err; + union cvmx_l2d_err l2d_err; + +diff --git a/drivers/edac/octeon_edac-lmc.c b/drivers/edac/octeon_edac-lmc.c +index bb19e07..cda6dab 100644 +--- a/drivers/edac/octeon_edac-lmc.c ++++ b/drivers/edac/octeon_edac-lmc.c +@@ -234,7 +234,7 @@ static int octeon_lmc_edac_probe(struct platform_device *pdev) + layers[0].size = 1; + layers[0].is_virt_csrow = false; + +- if (OCTEON_IS_MODEL(OCTEON_FAM_1_PLUS)) { ++ if (OCTEON_IS_OCTEON1PLUS()) { + union cvmx_lmcx_mem_cfg0 cfg0; + + cfg0.u64 = cvmx_read_csr(CVMX_LMCX_MEM_CFG0(0)); +diff --git a/drivers/edac/octeon_edac-pc.c b/drivers/edac/octeon_edac-pc.c +index 0f83c33..2ab6cf2 100644 +--- a/drivers/edac/octeon_edac-pc.c ++++ b/drivers/edac/octeon_edac-pc.c +@@ -73,7 +73,7 @@ static int co_cache_error_event(struct notifier_block *this, + edac_device_handle_ce(p->ed, cpu, 0, "dcache"); + + /* Clear the error indication */ +- if (OCTEON_IS_MODEL(OCTEON_FAM_2)) ++ if (OCTEON_IS_OCTEON2()) + write_octeon_c0_dcacheerr(1); + else + write_octeon_c0_dcacheerr(0); +diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c +index 97b1616..bba843c 100644 +--- a/drivers/firmware/dmi_scan.c ++++ b/drivers/firmware/dmi_scan.c +@@ -89,9 +89,9 @@ static void dmi_table(u8 *buf, + + /* + * Stop when we have seen all the items the table claimed to have +- * (SMBIOS < 3.0 only) OR we reach an end-of-table marker OR we run +- * off the end of the table (should never happen but sometimes does +- * on bogus implementations.) ++ * (SMBIOS < 3.0 only) OR we reach an end-of-table marker (SMBIOS ++ * >= 3.0 only) OR we run off the end of the table (should never ++ * happen but sometimes does on bogus implementations.) + */ + while ((!dmi_num || i < dmi_num) && + (data - buf + sizeof(struct dmi_header)) <= dmi_len) { +@@ -110,8 +110,13 @@ static void dmi_table(u8 *buf, + + /* + * 7.45 End-of-Table (Type 127) [SMBIOS reference spec v3.0.0] ++ * For tables behind a 64-bit entry point, we have no item ++ * count and no exact table length, so stop on end-of-table ++ * marker. For tables behind a 32-bit entry point, we have ++ * seen OEM structures behind the end-of-table marker on ++ * some systems, so don't trust it. + */ +- if (dm->type == DMI_ENTRY_END_OF_TABLE) ++ if (!dmi_num && dm->type == DMI_ENTRY_END_OF_TABLE) + break; + + data += 2; +diff --git a/drivers/gpu/drm/bridge/ptn3460.c b/drivers/gpu/drm/bridge/ptn3460.c +index 9d2f053..63a09e4 100644 +--- a/drivers/gpu/drm/bridge/ptn3460.c ++++ b/drivers/gpu/drm/bridge/ptn3460.c +@@ -15,6 +15,7 @@ + + #include <linux/delay.h> + #include <linux/gpio.h> ++#include <linux/gpio/consumer.h> + #include <linux/i2c.h> + #include <linux/module.h> + #include <linux/of.h> +diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c +index 3007b44..800a025 100644 +--- a/drivers/gpu/drm/drm_crtc.c ++++ b/drivers/gpu/drm/drm_crtc.c +@@ -2749,8 +2749,11 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, + if (!drm_core_check_feature(dev, DRIVER_MODESET)) + return -EINVAL; + +- /* For some reason crtc x/y offsets are signed internally. */ +- if (crtc_req->x > INT_MAX || crtc_req->y > INT_MAX) ++ /* ++ * Universal plane src offsets are only 16.16, prevent havoc for ++ * drivers using universal plane code internally. ++ */ ++ if (crtc_req->x & 0xffff0000 || crtc_req->y & 0xffff0000) + return -ERANGE; + + drm_modeset_lock_all(dev); +@@ -5048,12 +5051,9 @@ void drm_mode_config_reset(struct drm_device *dev) + if (encoder->funcs->reset) + encoder->funcs->reset(encoder); + +- list_for_each_entry(connector, &dev->mode_config.connector_list, head) { +- connector->status = connector_status_unknown; +- ++ list_for_each_entry(connector, &dev->mode_config.connector_list, head) + if (connector->funcs->reset) + connector->funcs->reset(connector); +- } + } + EXPORT_SYMBOL(drm_mode_config_reset); + +diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c +index 132581c..778bbb6 100644 +--- a/drivers/gpu/drm/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/drm_dp_mst_topology.c +@@ -867,8 +867,16 @@ static void drm_dp_destroy_port(struct kref *kref) + port->vcpi.num_slots = 0; + + kfree(port->cached_edid); +- if (port->connector) +- (*port->mgr->cbs->destroy_connector)(mgr, port->connector); ++ ++ /* we can't destroy the connector here, as ++ we might be holding the mode_config.mutex ++ from an EDID retrieval */ ++ if (port->connector) { ++ mutex_lock(&mgr->destroy_connector_lock); ++ list_add(&port->connector->destroy_list, &mgr->destroy_connector_list); ++ mutex_unlock(&mgr->destroy_connector_lock); ++ schedule_work(&mgr->destroy_connector_work); ++ } + drm_dp_port_teardown_pdt(port, port->pdt); + + if (!port->input && port->vcpi.vcpi > 0) +@@ -1163,6 +1171,8 @@ static struct drm_dp_mst_branch *drm_dp_get_mst_branch_device(struct drm_dp_mst_ + struct drm_dp_mst_port *port; + int i; + /* find the port by iterating down */ ++ ++ mutex_lock(&mgr->lock); + mstb = mgr->mst_primary; + + for (i = 0; i < lct - 1; i++) { +@@ -1182,6 +1192,7 @@ static struct drm_dp_mst_branch *drm_dp_get_mst_branch_device(struct drm_dp_mst_ + } + } + kref_get(&mstb->kref); ++ mutex_unlock(&mgr->lock); + return mstb; + } + +@@ -1189,7 +1200,7 @@ static void drm_dp_check_and_send_link_address(struct drm_dp_mst_topology_mgr *m + struct drm_dp_mst_branch *mstb) + { + struct drm_dp_mst_port *port; +- ++ struct drm_dp_mst_branch *mstb_child; + if (!mstb->link_address_sent) { + drm_dp_send_link_address(mgr, mstb); + mstb->link_address_sent = true; +@@ -1204,17 +1215,31 @@ static void drm_dp_check_and_send_link_address(struct drm_dp_mst_topology_mgr *m + if (!port->available_pbn) + drm_dp_send_enum_path_resources(mgr, mstb, port); + +- if (port->mstb) +- drm_dp_check_and_send_link_address(mgr, port->mstb); ++ if (port->mstb) { ++ mstb_child = drm_dp_get_validated_mstb_ref(mgr, port->mstb); ++ if (mstb_child) { ++ drm_dp_check_and_send_link_address(mgr, mstb_child); ++ drm_dp_put_mst_branch_device(mstb_child); ++ } ++ } + } + } + + static void drm_dp_mst_link_probe_work(struct work_struct *work) + { + struct drm_dp_mst_topology_mgr *mgr = container_of(work, struct drm_dp_mst_topology_mgr, work); ++ struct drm_dp_mst_branch *mstb; + +- drm_dp_check_and_send_link_address(mgr, mgr->mst_primary); +- ++ mutex_lock(&mgr->lock); ++ mstb = mgr->mst_primary; ++ if (mstb) { ++ kref_get(&mstb->kref); ++ } ++ mutex_unlock(&mgr->lock); ++ if (mstb) { ++ drm_dp_check_and_send_link_address(mgr, mstb); ++ drm_dp_put_mst_branch_device(mstb); ++ } + } + + static bool drm_dp_validate_guid(struct drm_dp_mst_topology_mgr *mgr, +@@ -2632,6 +2657,30 @@ static void drm_dp_tx_work(struct work_struct *work) + mutex_unlock(&mgr->qlock); + } + ++static void drm_dp_destroy_connector_work(struct work_struct *work) ++{ ++ struct drm_dp_mst_topology_mgr *mgr = container_of(work, struct drm_dp_mst_topology_mgr, destroy_connector_work); ++ struct drm_connector *connector; ++ ++ /* ++ * Not a regular list traverse as we have to drop the destroy ++ * connector lock before destroying the connector, to avoid AB->BA ++ * ordering between this lock and the config mutex. ++ */ ++ for (;;) { ++ mutex_lock(&mgr->destroy_connector_lock); ++ connector = list_first_entry_or_null(&mgr->destroy_connector_list, struct drm_connector, destroy_list); ++ if (!connector) { ++ mutex_unlock(&mgr->destroy_connector_lock); ++ break; ++ } ++ list_del(&connector->destroy_list); ++ mutex_unlock(&mgr->destroy_connector_lock); ++ ++ mgr->cbs->destroy_connector(mgr, connector); ++ } ++} ++ + /** + * drm_dp_mst_topology_mgr_init - initialise a topology manager + * @mgr: manager struct to initialise +@@ -2651,10 +2700,13 @@ int drm_dp_mst_topology_mgr_init(struct drm_dp_mst_topology_mgr *mgr, + mutex_init(&mgr->lock); + mutex_init(&mgr->qlock); + mutex_init(&mgr->payload_lock); ++ mutex_init(&mgr->destroy_connector_lock); + INIT_LIST_HEAD(&mgr->tx_msg_upq); + INIT_LIST_HEAD(&mgr->tx_msg_downq); ++ INIT_LIST_HEAD(&mgr->destroy_connector_list); + INIT_WORK(&mgr->work, drm_dp_mst_link_probe_work); + INIT_WORK(&mgr->tx_work, drm_dp_tx_work); ++ INIT_WORK(&mgr->destroy_connector_work, drm_dp_destroy_connector_work); + init_waitqueue_head(&mgr->tx_waitq); + mgr->dev = dev; + mgr->aux = aux; +@@ -2679,6 +2731,7 @@ EXPORT_SYMBOL(drm_dp_mst_topology_mgr_init); + */ + void drm_dp_mst_topology_mgr_destroy(struct drm_dp_mst_topology_mgr *mgr) + { ++ flush_work(&mgr->destroy_connector_work); + mutex_lock(&mgr->payload_lock); + kfree(mgr->payloads); + mgr->payloads = NULL; +diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c +index aa8bbb4..9cfcd0a 100644 +--- a/drivers/gpu/drm/drm_ioc32.c ++++ b/drivers/gpu/drm/drm_ioc32.c +@@ -70,6 +70,8 @@ + + #define DRM_IOCTL_WAIT_VBLANK32 DRM_IOWR(0x3a, drm_wait_vblank32_t) + ++#define DRM_IOCTL_MODE_ADDFB232 DRM_IOWR(0xb8, drm_mode_fb_cmd232_t) ++ + typedef struct drm_version_32 { + int version_major; /**< Major version */ + int version_minor; /**< Minor version */ +@@ -1016,6 +1018,63 @@ static int compat_drm_wait_vblank(struct file *file, unsigned int cmd, + return 0; + } + ++typedef struct drm_mode_fb_cmd232 { ++ u32 fb_id; ++ u32 width; ++ u32 height; ++ u32 pixel_format; ++ u32 flags; ++ u32 handles[4]; ++ u32 pitches[4]; ++ u32 offsets[4]; ++ u64 modifier[4]; ++} __attribute__((packed)) drm_mode_fb_cmd232_t; ++ ++static int compat_drm_mode_addfb2(struct file *file, unsigned int cmd, ++ unsigned long arg) ++{ ++ struct drm_mode_fb_cmd232 __user *argp = (void __user *)arg; ++ struct drm_mode_fb_cmd232 req32; ++ struct drm_mode_fb_cmd2 __user *req64; ++ int i; ++ int err; ++ ++ if (copy_from_user(&req32, argp, sizeof(req32))) ++ return -EFAULT; ++ ++ req64 = compat_alloc_user_space(sizeof(*req64)); ++ ++ if (!access_ok(VERIFY_WRITE, req64, sizeof(*req64)) ++ || __put_user(req32.width, &req64->width) ++ || __put_user(req32.height, &req64->height) ++ || __put_user(req32.pixel_format, &req64->pixel_format) ++ || __put_user(req32.flags, &req64->flags)) ++ return -EFAULT; ++ ++ for (i = 0; i < 4; i++) { ++ if (__put_user(req32.handles[i], &req64->handles[i])) ++ return -EFAULT; ++ if (__put_user(req32.pitches[i], &req64->pitches[i])) ++ return -EFAULT; ++ if (__put_user(req32.offsets[i], &req64->offsets[i])) ++ return -EFAULT; ++ if (__put_user(req32.modifier[i], &req64->modifier[i])) ++ return -EFAULT; ++ } ++ ++ err = drm_ioctl(file, DRM_IOCTL_MODE_ADDFB2, (unsigned long)req64); ++ if (err) ++ return err; ++ ++ if (__get_user(req32.fb_id, &req64->fb_id)) ++ return -EFAULT; ++ ++ if (copy_to_user(argp, &req32, sizeof(req32))) ++ return -EFAULT; ++ ++ return 0; ++} ++ + static drm_ioctl_compat_t *drm_compat_ioctls[] = { + [DRM_IOCTL_NR(DRM_IOCTL_VERSION32)] = compat_drm_version, + [DRM_IOCTL_NR(DRM_IOCTL_GET_UNIQUE32)] = compat_drm_getunique, +@@ -1048,6 +1107,7 @@ static drm_ioctl_compat_t *drm_compat_ioctls[] = { + [DRM_IOCTL_NR(DRM_IOCTL_UPDATE_DRAW32)] = compat_drm_update_draw, + #endif + [DRM_IOCTL_NR(DRM_IOCTL_WAIT_VBLANK32)] = compat_drm_wait_vblank, ++ [DRM_IOCTL_NR(DRM_IOCTL_MODE_ADDFB232)] = compat_drm_mode_addfb2, + }; + + /** +diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c +index 2d0995e..596bce5 100644 +--- a/drivers/gpu/drm/i915/i915_gem.c ++++ b/drivers/gpu/drm/i915/i915_gem.c +@@ -2401,6 +2401,7 @@ int __i915_add_request(struct intel_engine_cs *ring, + } + + request->emitted_jiffies = jiffies; ++ ring->last_submitted_seqno = request->seqno; + list_add_tail(&request->list, &ring->request_list); + request->file_priv = NULL; + +diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c +index 0239fbf..ad90fa3 100644 +--- a/drivers/gpu/drm/i915/i915_gem_gtt.c ++++ b/drivers/gpu/drm/i915/i915_gem_gtt.c +@@ -502,17 +502,17 @@ static void gen8_ppgtt_clear_range(struct i915_address_space *vm, + struct page *page_table; + + if (WARN_ON(!ppgtt->pdp.page_directory[pdpe])) +- continue; ++ break; + + pd = ppgtt->pdp.page_directory[pdpe]; + + if (WARN_ON(!pd->page_table[pde])) +- continue; ++ break; + + pt = pd->page_table[pde]; + + if (WARN_ON(!pt->page)) +- continue; ++ break; + + page_table = pt->page; + +diff --git a/drivers/gpu/drm/i915/i915_ioc32.c b/drivers/gpu/drm/i915/i915_ioc32.c +index 176de63..23aa04c 100644 +--- a/drivers/gpu/drm/i915/i915_ioc32.c ++++ b/drivers/gpu/drm/i915/i915_ioc32.c +@@ -204,7 +204,7 @@ long i915_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) + drm_ioctl_compat_t *fn = NULL; + int ret; + +- if (nr < DRM_COMMAND_BASE) ++ if (nr < DRM_COMMAND_BASE || nr >= DRM_COMMAND_END) + return drm_compat_ioctl(filp, cmd, arg); + + if (nr < DRM_COMMAND_BASE + ARRAY_SIZE(i915_compat_ioctls)) +diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c +index 6d49443..b0df8d1 100644 +--- a/drivers/gpu/drm/i915/i915_irq.c ++++ b/drivers/gpu/drm/i915/i915_irq.c +@@ -2650,18 +2650,11 @@ static void gen8_disable_vblank(struct drm_device *dev, int pipe) + spin_unlock_irqrestore(&dev_priv->irq_lock, irqflags); + } + +-static struct drm_i915_gem_request * +-ring_last_request(struct intel_engine_cs *ring) +-{ +- return list_entry(ring->request_list.prev, +- struct drm_i915_gem_request, list); +-} +- + static bool +-ring_idle(struct intel_engine_cs *ring) ++ring_idle(struct intel_engine_cs *ring, u32 seqno) + { + return (list_empty(&ring->request_list) || +- i915_gem_request_completed(ring_last_request(ring), false)); ++ i915_seqno_passed(seqno, ring->last_submitted_seqno)); + } + + static bool +@@ -2883,7 +2876,7 @@ static void i915_hangcheck_elapsed(struct work_struct *work) + acthd = intel_ring_get_active_head(ring); + + if (ring->hangcheck.seqno == seqno) { +- if (ring_idle(ring)) { ++ if (ring_idle(ring, seqno)) { + ring->hangcheck.action = HANGCHECK_IDLE; + + if (waitqueue_active(&ring->irq_queue)) { +diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h +index 773d1d2..a30db4b 100644 +--- a/drivers/gpu/drm/i915/i915_reg.h ++++ b/drivers/gpu/drm/i915/i915_reg.h +@@ -3209,6 +3209,7 @@ enum skl_disp_power_wells { + #define BLM_POLARITY_PNV (1 << 0) /* pnv only */ + + #define BLC_HIST_CTL (dev_priv->info.display_mmio_offset + 0x61260) ++#define BLM_HISTOGRAM_ENABLE (1 << 31) + + /* New registers for PCH-split platforms. Safe where new bits show up, the + * register layout machtes with gen4 BLC_PWM_CTL[12]. */ +diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c +index d0f3cbc..57c8878 100644 +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -12499,6 +12499,16 @@ intel_check_primary_plane(struct drm_plane *plane, + intel_crtc->atomic.wait_vblank = true; + } + ++ /* ++ * FIXME: Actually if we will still have any other plane enabled ++ * on the pipe we could let IPS enabled still, but for ++ * now lets consider that when we make primary invisible ++ * by setting DSPCNTR to 0 on update_primary_plane function ++ * IPS needs to be disable. ++ */ ++ if (!state->visible || !fb) ++ intel_crtc->atomic.disable_ips = true; ++ + intel_crtc->atomic.fb_bits |= + INTEL_FRONTBUFFER_PRIMARY(intel_crtc->pipe); + +@@ -12590,6 +12600,9 @@ static void intel_begin_crtc_commit(struct drm_crtc *crtc) + if (intel_crtc->atomic.disable_fbc) + intel_fbc_disable(dev); + ++ if (intel_crtc->atomic.disable_ips) ++ hsw_disable_ips(intel_crtc); ++ + if (intel_crtc->atomic.pre_disable_primary) + intel_pre_disable_primary(crtc); + +diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h +index 897f17d..68d1f74 100644 +--- a/drivers/gpu/drm/i915/intel_drv.h ++++ b/drivers/gpu/drm/i915/intel_drv.h +@@ -424,6 +424,7 @@ struct intel_crtc_atomic_commit { + /* Sleepable operations to perform before commit */ + bool wait_for_flips; + bool disable_fbc; ++ bool disable_ips; + bool pre_disable_primary; + bool update_wm; + unsigned disabled_planes; +diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c +index 08532d4..2bf92cb 100644 +--- a/drivers/gpu/drm/i915/intel_panel.c ++++ b/drivers/gpu/drm/i915/intel_panel.c +@@ -879,6 +879,14 @@ static void i9xx_enable_backlight(struct intel_connector *connector) + + /* XXX: combine this into above write? */ + intel_panel_actually_set_backlight(connector, panel->backlight.level); ++ ++ /* ++ * Needed to enable backlight on some 855gm models. BLC_HIST_CTL is ++ * 855gm only, but checking for gen2 is safe, as 855gm is the only gen2 ++ * that has backlight. ++ */ ++ if (IS_GEN2(dev)) ++ I915_WRITE(BLC_HIST_CTL, BLM_HISTOGRAM_ENABLE); + } + + static void i965_enable_backlight(struct intel_connector *connector) +diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.h b/drivers/gpu/drm/i915/intel_ringbuffer.h +index c761fe0..94514d3 100644 +--- a/drivers/gpu/drm/i915/intel_ringbuffer.h ++++ b/drivers/gpu/drm/i915/intel_ringbuffer.h +@@ -266,6 +266,13 @@ struct intel_engine_cs { + * Do we have some not yet emitted requests outstanding? + */ + struct drm_i915_gem_request *outstanding_lazy_request; ++ /** ++ * Seqno of request most recently submitted to request_list. ++ * Used exclusively by hang checker to avoid grabbing lock while ++ * inspecting request list. ++ */ ++ u32 last_submitted_seqno; ++ + bool gpu_caches_dirty; + + wait_queue_head_t irq_queue; +diff --git a/drivers/gpu/drm/i915/intel_uncore.c b/drivers/gpu/drm/i915/intel_uncore.c +index ff2a746..a18807e 100644 +--- a/drivers/gpu/drm/i915/intel_uncore.c ++++ b/drivers/gpu/drm/i915/intel_uncore.c +@@ -1220,10 +1220,12 @@ int i915_reg_read_ioctl(struct drm_device *dev, + struct drm_i915_private *dev_priv = dev->dev_private; + struct drm_i915_reg_read *reg = data; + struct register_whitelist const *entry = whitelist; ++ unsigned size; ++ u64 offset; + int i, ret = 0; + + for (i = 0; i < ARRAY_SIZE(whitelist); i++, entry++) { +- if (entry->offset == reg->offset && ++ if (entry->offset == (reg->offset & -entry->size) && + (1 << INTEL_INFO(dev)->gen & entry->gen_bitmask)) + break; + } +@@ -1231,23 +1233,33 @@ int i915_reg_read_ioctl(struct drm_device *dev, + if (i == ARRAY_SIZE(whitelist)) + return -EINVAL; + ++ /* We use the low bits to encode extra flags as the register should ++ * be naturally aligned (and those that are not so aligned merely ++ * limit the available flags for that register). ++ */ ++ offset = entry->offset; ++ size = entry->size; ++ size |= reg->offset ^ offset; ++ + intel_runtime_pm_get(dev_priv); + +- switch (entry->size) { ++ switch (size) { ++ case 8 | 1: ++ reg->val = I915_READ64_2x32(offset, offset+4); ++ break; + case 8: +- reg->val = I915_READ64(reg->offset); ++ reg->val = I915_READ64(offset); + break; + case 4: +- reg->val = I915_READ(reg->offset); ++ reg->val = I915_READ(offset); + break; + case 2: +- reg->val = I915_READ16(reg->offset); ++ reg->val = I915_READ16(offset); + break; + case 1: +- reg->val = I915_READ8(reg->offset); ++ reg->val = I915_READ8(offset); + break; + default: +- MISSING_CASE(entry->size); + ret = -EINVAL; + goto out; + } +diff --git a/drivers/gpu/drm/qxl/qxl_cmd.c b/drivers/gpu/drm/qxl/qxl_cmd.c +index 9782364..f33251d 100644 +--- a/drivers/gpu/drm/qxl/qxl_cmd.c ++++ b/drivers/gpu/drm/qxl/qxl_cmd.c +@@ -505,6 +505,7 @@ int qxl_hw_surface_alloc(struct qxl_device *qdev, + + cmd = (struct qxl_surface_cmd *)qxl_release_map(qdev, release); + cmd->type = QXL_SURFACE_CMD_CREATE; ++ cmd->flags = QXL_SURF_FLAG_KEEP_DATA; + cmd->u.surface_create.format = surf->surf.format; + cmd->u.surface_create.width = surf->surf.width; + cmd->u.surface_create.height = surf->surf.height; +diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c +index b110883..7354a4c 100644 +--- a/drivers/gpu/drm/qxl/qxl_ioctl.c ++++ b/drivers/gpu/drm/qxl/qxl_ioctl.c +@@ -122,8 +122,10 @@ static struct qxl_bo *qxlhw_handle_to_bo(struct qxl_device *qdev, + qobj = gem_to_qxl_bo(gobj); + + ret = qxl_release_list_add(release, qobj); +- if (ret) ++ if (ret) { ++ drm_gem_object_unreference_unlocked(gobj); + return NULL; ++ } + + return qobj; + } +diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c +index 8730562..4a09947 100644 +--- a/drivers/gpu/drm/radeon/ci_dpm.c ++++ b/drivers/gpu/drm/radeon/ci_dpm.c +@@ -5818,7 +5818,7 @@ int ci_dpm_init(struct radeon_device *rdev) + tmp |= DPM_ENABLED; + break; + default: +- DRM_ERROR("Invalid PCC GPIO: %u!\n", gpio.shift); ++ DRM_DEBUG("Invalid PCC GPIO: %u!\n", gpio.shift); + break; + } + WREG32_SMC(CNB_PWRMGT_CNTL, tmp); +diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c +index ba50f3c..8456653 100644 +--- a/drivers/gpu/drm/radeon/cik.c ++++ b/drivers/gpu/drm/radeon/cik.c +@@ -4579,6 +4579,31 @@ void cik_compute_set_wptr(struct radeon_device *rdev, + WDOORBELL32(ring->doorbell_index, ring->wptr); + } + ++static void cik_compute_stop(struct radeon_device *rdev, ++ struct radeon_ring *ring) ++{ ++ u32 j, tmp; ++ ++ cik_srbm_select(rdev, ring->me, ring->pipe, ring->queue, 0); ++ /* Disable wptr polling. */ ++ tmp = RREG32(CP_PQ_WPTR_POLL_CNTL); ++ tmp &= ~WPTR_POLL_EN; ++ WREG32(CP_PQ_WPTR_POLL_CNTL, tmp); ++ /* Disable HQD. */ ++ if (RREG32(CP_HQD_ACTIVE) & 1) { ++ WREG32(CP_HQD_DEQUEUE_REQUEST, 1); ++ for (j = 0; j < rdev->usec_timeout; j++) { ++ if (!(RREG32(CP_HQD_ACTIVE) & 1)) ++ break; ++ udelay(1); ++ } ++ WREG32(CP_HQD_DEQUEUE_REQUEST, 0); ++ WREG32(CP_HQD_PQ_RPTR, 0); ++ WREG32(CP_HQD_PQ_WPTR, 0); ++ } ++ cik_srbm_select(rdev, 0, 0, 0, 0); ++} ++ + /** + * cik_cp_compute_enable - enable/disable the compute CP MEs + * +@@ -4592,6 +4617,15 @@ static void cik_cp_compute_enable(struct radeon_device *rdev, bool enable) + if (enable) + WREG32(CP_MEC_CNTL, 0); + else { ++ /* ++ * To make hibernation reliable we need to clear compute ring ++ * configuration before halting the compute ring. ++ */ ++ mutex_lock(&rdev->srbm_mutex); ++ cik_compute_stop(rdev,&rdev->ring[CAYMAN_RING_TYPE_CP1_INDEX]); ++ cik_compute_stop(rdev,&rdev->ring[CAYMAN_RING_TYPE_CP2_INDEX]); ++ mutex_unlock(&rdev->srbm_mutex); ++ + WREG32(CP_MEC_CNTL, (MEC_ME1_HALT | MEC_ME2_HALT)); + rdev->ring[CAYMAN_RING_TYPE_CP1_INDEX].ready = false; + rdev->ring[CAYMAN_RING_TYPE_CP2_INDEX].ready = false; +@@ -7905,23 +7939,27 @@ restart_ih: + case 1: /* D1 vblank/vline */ + switch (src_data) { + case 0: /* D1 vblank */ +- if (rdev->irq.stat_regs.cik.disp_int & LB_D1_VBLANK_INTERRUPT) { +- if (rdev->irq.crtc_vblank_int[0]) { +- drm_handle_vblank(rdev->ddev, 0); +- rdev->pm.vblank_sync = true; +- wake_up(&rdev->irq.vblank_queue); +- } +- if (atomic_read(&rdev->irq.pflip[0])) +- radeon_crtc_handle_vblank(rdev, 0); +- rdev->irq.stat_regs.cik.disp_int &= ~LB_D1_VBLANK_INTERRUPT; +- DRM_DEBUG("IH: D1 vblank\n"); ++ if (!(rdev->irq.stat_regs.cik.disp_int & LB_D1_VBLANK_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ if (rdev->irq.crtc_vblank_int[0]) { ++ drm_handle_vblank(rdev->ddev, 0); ++ rdev->pm.vblank_sync = true; ++ wake_up(&rdev->irq.vblank_queue); + } ++ if (atomic_read(&rdev->irq.pflip[0])) ++ radeon_crtc_handle_vblank(rdev, 0); ++ rdev->irq.stat_regs.cik.disp_int &= ~LB_D1_VBLANK_INTERRUPT; ++ DRM_DEBUG("IH: D1 vblank\n"); ++ + break; + case 1: /* D1 vline */ +- if (rdev->irq.stat_regs.cik.disp_int & LB_D1_VLINE_INTERRUPT) { +- rdev->irq.stat_regs.cik.disp_int &= ~LB_D1_VLINE_INTERRUPT; +- DRM_DEBUG("IH: D1 vline\n"); +- } ++ if (!(rdev->irq.stat_regs.cik.disp_int & LB_D1_VLINE_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.cik.disp_int &= ~LB_D1_VLINE_INTERRUPT; ++ DRM_DEBUG("IH: D1 vline\n"); ++ + break; + default: + DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data); +@@ -7931,23 +7969,27 @@ restart_ih: + case 2: /* D2 vblank/vline */ + switch (src_data) { + case 0: /* D2 vblank */ +- if (rdev->irq.stat_regs.cik.disp_int_cont & LB_D2_VBLANK_INTERRUPT) { +- if (rdev->irq.crtc_vblank_int[1]) { +- drm_handle_vblank(rdev->ddev, 1); +- rdev->pm.vblank_sync = true; +- wake_up(&rdev->irq.vblank_queue); +- } +- if (atomic_read(&rdev->irq.pflip[1])) +- radeon_crtc_handle_vblank(rdev, 1); +- rdev->irq.stat_regs.cik.disp_int_cont &= ~LB_D2_VBLANK_INTERRUPT; +- DRM_DEBUG("IH: D2 vblank\n"); ++ if (!(rdev->irq.stat_regs.cik.disp_int_cont & LB_D2_VBLANK_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ if (rdev->irq.crtc_vblank_int[1]) { ++ drm_handle_vblank(rdev->ddev, 1); ++ rdev->pm.vblank_sync = true; ++ wake_up(&rdev->irq.vblank_queue); + } ++ if (atomic_read(&rdev->irq.pflip[1])) ++ radeon_crtc_handle_vblank(rdev, 1); ++ rdev->irq.stat_regs.cik.disp_int_cont &= ~LB_D2_VBLANK_INTERRUPT; ++ DRM_DEBUG("IH: D2 vblank\n"); ++ + break; + case 1: /* D2 vline */ +- if (rdev->irq.stat_regs.cik.disp_int_cont & LB_D2_VLINE_INTERRUPT) { +- rdev->irq.stat_regs.cik.disp_int_cont &= ~LB_D2_VLINE_INTERRUPT; +- DRM_DEBUG("IH: D2 vline\n"); +- } ++ if (!(rdev->irq.stat_regs.cik.disp_int_cont & LB_D2_VLINE_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.cik.disp_int_cont &= ~LB_D2_VLINE_INTERRUPT; ++ DRM_DEBUG("IH: D2 vline\n"); ++ + break; + default: + DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data); +@@ -7957,23 +7999,27 @@ restart_ih: + case 3: /* D3 vblank/vline */ + switch (src_data) { + case 0: /* D3 vblank */ +- if (rdev->irq.stat_regs.cik.disp_int_cont2 & LB_D3_VBLANK_INTERRUPT) { +- if (rdev->irq.crtc_vblank_int[2]) { +- drm_handle_vblank(rdev->ddev, 2); +- rdev->pm.vblank_sync = true; +- wake_up(&rdev->irq.vblank_queue); +- } +- if (atomic_read(&rdev->irq.pflip[2])) +- radeon_crtc_handle_vblank(rdev, 2); +- rdev->irq.stat_regs.cik.disp_int_cont2 &= ~LB_D3_VBLANK_INTERRUPT; +- DRM_DEBUG("IH: D3 vblank\n"); ++ if (!(rdev->irq.stat_regs.cik.disp_int_cont2 & LB_D3_VBLANK_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ if (rdev->irq.crtc_vblank_int[2]) { ++ drm_handle_vblank(rdev->ddev, 2); ++ rdev->pm.vblank_sync = true; ++ wake_up(&rdev->irq.vblank_queue); + } ++ if (atomic_read(&rdev->irq.pflip[2])) ++ radeon_crtc_handle_vblank(rdev, 2); ++ rdev->irq.stat_regs.cik.disp_int_cont2 &= ~LB_D3_VBLANK_INTERRUPT; ++ DRM_DEBUG("IH: D3 vblank\n"); ++ + break; + case 1: /* D3 vline */ +- if (rdev->irq.stat_regs.cik.disp_int_cont2 & LB_D3_VLINE_INTERRUPT) { +- rdev->irq.stat_regs.cik.disp_int_cont2 &= ~LB_D3_VLINE_INTERRUPT; +- DRM_DEBUG("IH: D3 vline\n"); +- } ++ if (!(rdev->irq.stat_regs.cik.disp_int_cont2 & LB_D3_VLINE_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.cik.disp_int_cont2 &= ~LB_D3_VLINE_INTERRUPT; ++ DRM_DEBUG("IH: D3 vline\n"); ++ + break; + default: + DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data); +@@ -7983,23 +8029,27 @@ restart_ih: + case 4: /* D4 vblank/vline */ + switch (src_data) { + case 0: /* D4 vblank */ +- if (rdev->irq.stat_regs.cik.disp_int_cont3 & LB_D4_VBLANK_INTERRUPT) { +- if (rdev->irq.crtc_vblank_int[3]) { +- drm_handle_vblank(rdev->ddev, 3); +- rdev->pm.vblank_sync = true; +- wake_up(&rdev->irq.vblank_queue); +- } +- if (atomic_read(&rdev->irq.pflip[3])) +- radeon_crtc_handle_vblank(rdev, 3); +- rdev->irq.stat_regs.cik.disp_int_cont3 &= ~LB_D4_VBLANK_INTERRUPT; +- DRM_DEBUG("IH: D4 vblank\n"); ++ if (!(rdev->irq.stat_regs.cik.disp_int_cont3 & LB_D4_VBLANK_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ if (rdev->irq.crtc_vblank_int[3]) { ++ drm_handle_vblank(rdev->ddev, 3); ++ rdev->pm.vblank_sync = true; ++ wake_up(&rdev->irq.vblank_queue); + } ++ if (atomic_read(&rdev->irq.pflip[3])) ++ radeon_crtc_handle_vblank(rdev, 3); ++ rdev->irq.stat_regs.cik.disp_int_cont3 &= ~LB_D4_VBLANK_INTERRUPT; ++ DRM_DEBUG("IH: D4 vblank\n"); ++ + break; + case 1: /* D4 vline */ +- if (rdev->irq.stat_regs.cik.disp_int_cont3 & LB_D4_VLINE_INTERRUPT) { +- rdev->irq.stat_regs.cik.disp_int_cont3 &= ~LB_D4_VLINE_INTERRUPT; +- DRM_DEBUG("IH: D4 vline\n"); +- } ++ if (!(rdev->irq.stat_regs.cik.disp_int_cont3 & LB_D4_VLINE_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.cik.disp_int_cont3 &= ~LB_D4_VLINE_INTERRUPT; ++ DRM_DEBUG("IH: D4 vline\n"); ++ + break; + default: + DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data); +@@ -8009,23 +8059,27 @@ restart_ih: + case 5: /* D5 vblank/vline */ + switch (src_data) { + case 0: /* D5 vblank */ +- if (rdev->irq.stat_regs.cik.disp_int_cont4 & LB_D5_VBLANK_INTERRUPT) { +- if (rdev->irq.crtc_vblank_int[4]) { +- drm_handle_vblank(rdev->ddev, 4); +- rdev->pm.vblank_sync = true; +- wake_up(&rdev->irq.vblank_queue); +- } +- if (atomic_read(&rdev->irq.pflip[4])) +- radeon_crtc_handle_vblank(rdev, 4); +- rdev->irq.stat_regs.cik.disp_int_cont4 &= ~LB_D5_VBLANK_INTERRUPT; +- DRM_DEBUG("IH: D5 vblank\n"); ++ if (!(rdev->irq.stat_regs.cik.disp_int_cont4 & LB_D5_VBLANK_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ if (rdev->irq.crtc_vblank_int[4]) { ++ drm_handle_vblank(rdev->ddev, 4); ++ rdev->pm.vblank_sync = true; ++ wake_up(&rdev->irq.vblank_queue); + } ++ if (atomic_read(&rdev->irq.pflip[4])) ++ radeon_crtc_handle_vblank(rdev, 4); ++ rdev->irq.stat_regs.cik.disp_int_cont4 &= ~LB_D5_VBLANK_INTERRUPT; ++ DRM_DEBUG("IH: D5 vblank\n"); ++ + break; + case 1: /* D5 vline */ +- if (rdev->irq.stat_regs.cik.disp_int_cont4 & LB_D5_VLINE_INTERRUPT) { +- rdev->irq.stat_regs.cik.disp_int_cont4 &= ~LB_D5_VLINE_INTERRUPT; +- DRM_DEBUG("IH: D5 vline\n"); +- } ++ if (!(rdev->irq.stat_regs.cik.disp_int_cont4 & LB_D5_VLINE_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.cik.disp_int_cont4 &= ~LB_D5_VLINE_INTERRUPT; ++ DRM_DEBUG("IH: D5 vline\n"); ++ + break; + default: + DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data); +@@ -8035,23 +8089,27 @@ restart_ih: + case 6: /* D6 vblank/vline */ + switch (src_data) { + case 0: /* D6 vblank */ +- if (rdev->irq.stat_regs.cik.disp_int_cont5 & LB_D6_VBLANK_INTERRUPT) { +- if (rdev->irq.crtc_vblank_int[5]) { +- drm_handle_vblank(rdev->ddev, 5); +- rdev->pm.vblank_sync = true; +- wake_up(&rdev->irq.vblank_queue); +- } +- if (atomic_read(&rdev->irq.pflip[5])) +- radeon_crtc_handle_vblank(rdev, 5); +- rdev->irq.stat_regs.cik.disp_int_cont5 &= ~LB_D6_VBLANK_INTERRUPT; +- DRM_DEBUG("IH: D6 vblank\n"); ++ if (!(rdev->irq.stat_regs.cik.disp_int_cont5 & LB_D6_VBLANK_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ if (rdev->irq.crtc_vblank_int[5]) { ++ drm_handle_vblank(rdev->ddev, 5); ++ rdev->pm.vblank_sync = true; ++ wake_up(&rdev->irq.vblank_queue); + } ++ if (atomic_read(&rdev->irq.pflip[5])) ++ radeon_crtc_handle_vblank(rdev, 5); ++ rdev->irq.stat_regs.cik.disp_int_cont5 &= ~LB_D6_VBLANK_INTERRUPT; ++ DRM_DEBUG("IH: D6 vblank\n"); ++ + break; + case 1: /* D6 vline */ +- if (rdev->irq.stat_regs.cik.disp_int_cont5 & LB_D6_VLINE_INTERRUPT) { +- rdev->irq.stat_regs.cik.disp_int_cont5 &= ~LB_D6_VLINE_INTERRUPT; +- DRM_DEBUG("IH: D6 vline\n"); +- } ++ if (!(rdev->irq.stat_regs.cik.disp_int_cont5 & LB_D6_VLINE_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.cik.disp_int_cont5 &= ~LB_D6_VLINE_INTERRUPT; ++ DRM_DEBUG("IH: D6 vline\n"); ++ + break; + default: + DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data); +@@ -8071,88 +8129,112 @@ restart_ih: + case 42: /* HPD hotplug */ + switch (src_data) { + case 0: +- if (rdev->irq.stat_regs.cik.disp_int & DC_HPD1_INTERRUPT) { +- rdev->irq.stat_regs.cik.disp_int &= ~DC_HPD1_INTERRUPT; +- queue_hotplug = true; +- DRM_DEBUG("IH: HPD1\n"); +- } ++ if (!(rdev->irq.stat_regs.cik.disp_int & DC_HPD1_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.cik.disp_int &= ~DC_HPD1_INTERRUPT; ++ queue_hotplug = true; ++ DRM_DEBUG("IH: HPD1\n"); ++ + break; + case 1: +- if (rdev->irq.stat_regs.cik.disp_int_cont & DC_HPD2_INTERRUPT) { +- rdev->irq.stat_regs.cik.disp_int_cont &= ~DC_HPD2_INTERRUPT; +- queue_hotplug = true; +- DRM_DEBUG("IH: HPD2\n"); +- } ++ if (!(rdev->irq.stat_regs.cik.disp_int_cont & DC_HPD2_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.cik.disp_int_cont &= ~DC_HPD2_INTERRUPT; ++ queue_hotplug = true; ++ DRM_DEBUG("IH: HPD2\n"); ++ + break; + case 2: +- if (rdev->irq.stat_regs.cik.disp_int_cont2 & DC_HPD3_INTERRUPT) { +- rdev->irq.stat_regs.cik.disp_int_cont2 &= ~DC_HPD3_INTERRUPT; +- queue_hotplug = true; +- DRM_DEBUG("IH: HPD3\n"); +- } ++ if (!(rdev->irq.stat_regs.cik.disp_int_cont2 & DC_HPD3_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.cik.disp_int_cont2 &= ~DC_HPD3_INTERRUPT; ++ queue_hotplug = true; ++ DRM_DEBUG("IH: HPD3\n"); ++ + break; + case 3: +- if (rdev->irq.stat_regs.cik.disp_int_cont3 & DC_HPD4_INTERRUPT) { +- rdev->irq.stat_regs.cik.disp_int_cont3 &= ~DC_HPD4_INTERRUPT; +- queue_hotplug = true; +- DRM_DEBUG("IH: HPD4\n"); +- } ++ if (!(rdev->irq.stat_regs.cik.disp_int_cont3 & DC_HPD4_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.cik.disp_int_cont3 &= ~DC_HPD4_INTERRUPT; ++ queue_hotplug = true; ++ DRM_DEBUG("IH: HPD4\n"); ++ + break; + case 4: +- if (rdev->irq.stat_regs.cik.disp_int_cont4 & DC_HPD5_INTERRUPT) { +- rdev->irq.stat_regs.cik.disp_int_cont4 &= ~DC_HPD5_INTERRUPT; +- queue_hotplug = true; +- DRM_DEBUG("IH: HPD5\n"); +- } ++ if (!(rdev->irq.stat_regs.cik.disp_int_cont4 & DC_HPD5_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.cik.disp_int_cont4 &= ~DC_HPD5_INTERRUPT; ++ queue_hotplug = true; ++ DRM_DEBUG("IH: HPD5\n"); ++ + break; + case 5: +- if (rdev->irq.stat_regs.cik.disp_int_cont5 & DC_HPD6_INTERRUPT) { +- rdev->irq.stat_regs.cik.disp_int_cont5 &= ~DC_HPD6_INTERRUPT; +- queue_hotplug = true; +- DRM_DEBUG("IH: HPD6\n"); +- } ++ if (!(rdev->irq.stat_regs.cik.disp_int_cont5 & DC_HPD6_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.cik.disp_int_cont5 &= ~DC_HPD6_INTERRUPT; ++ queue_hotplug = true; ++ DRM_DEBUG("IH: HPD6\n"); ++ + break; + case 6: +- if (rdev->irq.stat_regs.cik.disp_int & DC_HPD1_RX_INTERRUPT) { +- rdev->irq.stat_regs.cik.disp_int &= ~DC_HPD1_RX_INTERRUPT; +- queue_dp = true; +- DRM_DEBUG("IH: HPD_RX 1\n"); +- } ++ if (!(rdev->irq.stat_regs.cik.disp_int & DC_HPD1_RX_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.cik.disp_int &= ~DC_HPD1_RX_INTERRUPT; ++ queue_dp = true; ++ DRM_DEBUG("IH: HPD_RX 1\n"); ++ + break; + case 7: +- if (rdev->irq.stat_regs.cik.disp_int_cont & DC_HPD2_RX_INTERRUPT) { +- rdev->irq.stat_regs.cik.disp_int_cont &= ~DC_HPD2_RX_INTERRUPT; +- queue_dp = true; +- DRM_DEBUG("IH: HPD_RX 2\n"); +- } ++ if (!(rdev->irq.stat_regs.cik.disp_int_cont & DC_HPD2_RX_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.cik.disp_int_cont &= ~DC_HPD2_RX_INTERRUPT; ++ queue_dp = true; ++ DRM_DEBUG("IH: HPD_RX 2\n"); ++ + break; + case 8: +- if (rdev->irq.stat_regs.cik.disp_int_cont2 & DC_HPD3_RX_INTERRUPT) { +- rdev->irq.stat_regs.cik.disp_int_cont2 &= ~DC_HPD3_RX_INTERRUPT; +- queue_dp = true; +- DRM_DEBUG("IH: HPD_RX 3\n"); +- } ++ if (!(rdev->irq.stat_regs.cik.disp_int_cont2 & DC_HPD3_RX_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.cik.disp_int_cont2 &= ~DC_HPD3_RX_INTERRUPT; ++ queue_dp = true; ++ DRM_DEBUG("IH: HPD_RX 3\n"); ++ + break; + case 9: +- if (rdev->irq.stat_regs.cik.disp_int_cont3 & DC_HPD4_RX_INTERRUPT) { +- rdev->irq.stat_regs.cik.disp_int_cont3 &= ~DC_HPD4_RX_INTERRUPT; +- queue_dp = true; +- DRM_DEBUG("IH: HPD_RX 4\n"); +- } ++ if (!(rdev->irq.stat_regs.cik.disp_int_cont3 & DC_HPD4_RX_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.cik.disp_int_cont3 &= ~DC_HPD4_RX_INTERRUPT; ++ queue_dp = true; ++ DRM_DEBUG("IH: HPD_RX 4\n"); ++ + break; + case 10: +- if (rdev->irq.stat_regs.cik.disp_int_cont4 & DC_HPD5_RX_INTERRUPT) { +- rdev->irq.stat_regs.cik.disp_int_cont4 &= ~DC_HPD5_RX_INTERRUPT; +- queue_dp = true; +- DRM_DEBUG("IH: HPD_RX 5\n"); +- } ++ if (!(rdev->irq.stat_regs.cik.disp_int_cont4 & DC_HPD5_RX_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.cik.disp_int_cont4 &= ~DC_HPD5_RX_INTERRUPT; ++ queue_dp = true; ++ DRM_DEBUG("IH: HPD_RX 5\n"); ++ + break; + case 11: +- if (rdev->irq.stat_regs.cik.disp_int_cont5 & DC_HPD6_RX_INTERRUPT) { +- rdev->irq.stat_regs.cik.disp_int_cont5 &= ~DC_HPD6_RX_INTERRUPT; +- queue_dp = true; +- DRM_DEBUG("IH: HPD_RX 6\n"); +- } ++ if (!(rdev->irq.stat_regs.cik.disp_int_cont5 & DC_HPD6_RX_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.cik.disp_int_cont5 &= ~DC_HPD6_RX_INTERRUPT; ++ queue_dp = true; ++ DRM_DEBUG("IH: HPD_RX 6\n"); ++ + break; + default: + DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data); +diff --git a/drivers/gpu/drm/radeon/cik_sdma.c b/drivers/gpu/drm/radeon/cik_sdma.c +index f86eb54..d16f2ee 100644 +--- a/drivers/gpu/drm/radeon/cik_sdma.c ++++ b/drivers/gpu/drm/radeon/cik_sdma.c +@@ -268,6 +268,17 @@ static void cik_sdma_gfx_stop(struct radeon_device *rdev) + } + rdev->ring[R600_RING_TYPE_DMA_INDEX].ready = false; + rdev->ring[CAYMAN_RING_TYPE_DMA1_INDEX].ready = false; ++ ++ /* FIXME use something else than big hammer but after few days can not ++ * seem to find good combination so reset SDMA blocks as it seems we ++ * do not shut them down properly. This fix hibernation and does not ++ * affect suspend to ram. ++ */ ++ WREG32(SRBM_SOFT_RESET, SOFT_RESET_SDMA | SOFT_RESET_SDMA1); ++ (void)RREG32(SRBM_SOFT_RESET); ++ udelay(50); ++ WREG32(SRBM_SOFT_RESET, 0); ++ (void)RREG32(SRBM_SOFT_RESET); + } + + /** +diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c +index f848acf..feef136 100644 +--- a/drivers/gpu/drm/radeon/evergreen.c ++++ b/drivers/gpu/drm/radeon/evergreen.c +@@ -4855,7 +4855,7 @@ restart_ih: + return IRQ_NONE; + + rptr = rdev->ih.rptr; +- DRM_DEBUG("r600_irq_process start: rptr %d, wptr %d\n", rptr, wptr); ++ DRM_DEBUG("evergreen_irq_process start: rptr %d, wptr %d\n", rptr, wptr); + + /* Order reading of wptr vs. reading of IH ring data */ + rmb(); +@@ -4873,23 +4873,27 @@ restart_ih: + case 1: /* D1 vblank/vline */ + switch (src_data) { + case 0: /* D1 vblank */ +- if (rdev->irq.stat_regs.evergreen.disp_int & LB_D1_VBLANK_INTERRUPT) { +- if (rdev->irq.crtc_vblank_int[0]) { +- drm_handle_vblank(rdev->ddev, 0); +- rdev->pm.vblank_sync = true; +- wake_up(&rdev->irq.vblank_queue); +- } +- if (atomic_read(&rdev->irq.pflip[0])) +- radeon_crtc_handle_vblank(rdev, 0); +- rdev->irq.stat_regs.evergreen.disp_int &= ~LB_D1_VBLANK_INTERRUPT; +- DRM_DEBUG("IH: D1 vblank\n"); ++ if (!(rdev->irq.stat_regs.evergreen.disp_int & LB_D1_VBLANK_INTERRUPT)) ++ DRM_DEBUG("IH: D1 vblank - IH event w/o asserted irq bit?\n"); ++ ++ if (rdev->irq.crtc_vblank_int[0]) { ++ drm_handle_vblank(rdev->ddev, 0); ++ rdev->pm.vblank_sync = true; ++ wake_up(&rdev->irq.vblank_queue); + } ++ if (atomic_read(&rdev->irq.pflip[0])) ++ radeon_crtc_handle_vblank(rdev, 0); ++ rdev->irq.stat_regs.evergreen.disp_int &= ~LB_D1_VBLANK_INTERRUPT; ++ DRM_DEBUG("IH: D1 vblank\n"); ++ + break; + case 1: /* D1 vline */ +- if (rdev->irq.stat_regs.evergreen.disp_int & LB_D1_VLINE_INTERRUPT) { +- rdev->irq.stat_regs.evergreen.disp_int &= ~LB_D1_VLINE_INTERRUPT; +- DRM_DEBUG("IH: D1 vline\n"); +- } ++ if (!(rdev->irq.stat_regs.evergreen.disp_int & LB_D1_VLINE_INTERRUPT)) ++ DRM_DEBUG("IH: D1 vline - IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.evergreen.disp_int &= ~LB_D1_VLINE_INTERRUPT; ++ DRM_DEBUG("IH: D1 vline\n"); ++ + break; + default: + DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data); +@@ -4899,23 +4903,27 @@ restart_ih: + case 2: /* D2 vblank/vline */ + switch (src_data) { + case 0: /* D2 vblank */ +- if (rdev->irq.stat_regs.evergreen.disp_int_cont & LB_D2_VBLANK_INTERRUPT) { +- if (rdev->irq.crtc_vblank_int[1]) { +- drm_handle_vblank(rdev->ddev, 1); +- rdev->pm.vblank_sync = true; +- wake_up(&rdev->irq.vblank_queue); +- } +- if (atomic_read(&rdev->irq.pflip[1])) +- radeon_crtc_handle_vblank(rdev, 1); +- rdev->irq.stat_regs.evergreen.disp_int_cont &= ~LB_D2_VBLANK_INTERRUPT; +- DRM_DEBUG("IH: D2 vblank\n"); ++ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont & LB_D2_VBLANK_INTERRUPT)) ++ DRM_DEBUG("IH: D2 vblank - IH event w/o asserted irq bit?\n"); ++ ++ if (rdev->irq.crtc_vblank_int[1]) { ++ drm_handle_vblank(rdev->ddev, 1); ++ rdev->pm.vblank_sync = true; ++ wake_up(&rdev->irq.vblank_queue); + } ++ if (atomic_read(&rdev->irq.pflip[1])) ++ radeon_crtc_handle_vblank(rdev, 1); ++ rdev->irq.stat_regs.evergreen.disp_int_cont &= ~LB_D2_VBLANK_INTERRUPT; ++ DRM_DEBUG("IH: D2 vblank\n"); ++ + break; + case 1: /* D2 vline */ +- if (rdev->irq.stat_regs.evergreen.disp_int_cont & LB_D2_VLINE_INTERRUPT) { +- rdev->irq.stat_regs.evergreen.disp_int_cont &= ~LB_D2_VLINE_INTERRUPT; +- DRM_DEBUG("IH: D2 vline\n"); +- } ++ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont & LB_D2_VLINE_INTERRUPT)) ++ DRM_DEBUG("IH: D2 vline - IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.evergreen.disp_int_cont &= ~LB_D2_VLINE_INTERRUPT; ++ DRM_DEBUG("IH: D2 vline\n"); ++ + break; + default: + DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data); +@@ -4925,23 +4933,27 @@ restart_ih: + case 3: /* D3 vblank/vline */ + switch (src_data) { + case 0: /* D3 vblank */ +- if (rdev->irq.stat_regs.evergreen.disp_int_cont2 & LB_D3_VBLANK_INTERRUPT) { +- if (rdev->irq.crtc_vblank_int[2]) { +- drm_handle_vblank(rdev->ddev, 2); +- rdev->pm.vblank_sync = true; +- wake_up(&rdev->irq.vblank_queue); +- } +- if (atomic_read(&rdev->irq.pflip[2])) +- radeon_crtc_handle_vblank(rdev, 2); +- rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~LB_D3_VBLANK_INTERRUPT; +- DRM_DEBUG("IH: D3 vblank\n"); ++ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont2 & LB_D3_VBLANK_INTERRUPT)) ++ DRM_DEBUG("IH: D3 vblank - IH event w/o asserted irq bit?\n"); ++ ++ if (rdev->irq.crtc_vblank_int[2]) { ++ drm_handle_vblank(rdev->ddev, 2); ++ rdev->pm.vblank_sync = true; ++ wake_up(&rdev->irq.vblank_queue); + } ++ if (atomic_read(&rdev->irq.pflip[2])) ++ radeon_crtc_handle_vblank(rdev, 2); ++ rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~LB_D3_VBLANK_INTERRUPT; ++ DRM_DEBUG("IH: D3 vblank\n"); ++ + break; + case 1: /* D3 vline */ +- if (rdev->irq.stat_regs.evergreen.disp_int_cont2 & LB_D3_VLINE_INTERRUPT) { +- rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~LB_D3_VLINE_INTERRUPT; +- DRM_DEBUG("IH: D3 vline\n"); +- } ++ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont2 & LB_D3_VLINE_INTERRUPT)) ++ DRM_DEBUG("IH: D3 vline - IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~LB_D3_VLINE_INTERRUPT; ++ DRM_DEBUG("IH: D3 vline\n"); ++ + break; + default: + DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data); +@@ -4951,23 +4963,27 @@ restart_ih: + case 4: /* D4 vblank/vline */ + switch (src_data) { + case 0: /* D4 vblank */ +- if (rdev->irq.stat_regs.evergreen.disp_int_cont3 & LB_D4_VBLANK_INTERRUPT) { +- if (rdev->irq.crtc_vblank_int[3]) { +- drm_handle_vblank(rdev->ddev, 3); +- rdev->pm.vblank_sync = true; +- wake_up(&rdev->irq.vblank_queue); +- } +- if (atomic_read(&rdev->irq.pflip[3])) +- radeon_crtc_handle_vblank(rdev, 3); +- rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~LB_D4_VBLANK_INTERRUPT; +- DRM_DEBUG("IH: D4 vblank\n"); ++ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont3 & LB_D4_VBLANK_INTERRUPT)) ++ DRM_DEBUG("IH: D4 vblank - IH event w/o asserted irq bit?\n"); ++ ++ if (rdev->irq.crtc_vblank_int[3]) { ++ drm_handle_vblank(rdev->ddev, 3); ++ rdev->pm.vblank_sync = true; ++ wake_up(&rdev->irq.vblank_queue); + } ++ if (atomic_read(&rdev->irq.pflip[3])) ++ radeon_crtc_handle_vblank(rdev, 3); ++ rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~LB_D4_VBLANK_INTERRUPT; ++ DRM_DEBUG("IH: D4 vblank\n"); ++ + break; + case 1: /* D4 vline */ +- if (rdev->irq.stat_regs.evergreen.disp_int_cont3 & LB_D4_VLINE_INTERRUPT) { +- rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~LB_D4_VLINE_INTERRUPT; +- DRM_DEBUG("IH: D4 vline\n"); +- } ++ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont3 & LB_D4_VLINE_INTERRUPT)) ++ DRM_DEBUG("IH: D4 vline - IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~LB_D4_VLINE_INTERRUPT; ++ DRM_DEBUG("IH: D4 vline\n"); ++ + break; + default: + DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data); +@@ -4977,23 +4993,27 @@ restart_ih: + case 5: /* D5 vblank/vline */ + switch (src_data) { + case 0: /* D5 vblank */ +- if (rdev->irq.stat_regs.evergreen.disp_int_cont4 & LB_D5_VBLANK_INTERRUPT) { +- if (rdev->irq.crtc_vblank_int[4]) { +- drm_handle_vblank(rdev->ddev, 4); +- rdev->pm.vblank_sync = true; +- wake_up(&rdev->irq.vblank_queue); +- } +- if (atomic_read(&rdev->irq.pflip[4])) +- radeon_crtc_handle_vblank(rdev, 4); +- rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~LB_D5_VBLANK_INTERRUPT; +- DRM_DEBUG("IH: D5 vblank\n"); ++ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont4 & LB_D5_VBLANK_INTERRUPT)) ++ DRM_DEBUG("IH: D5 vblank - IH event w/o asserted irq bit?\n"); ++ ++ if (rdev->irq.crtc_vblank_int[4]) { ++ drm_handle_vblank(rdev->ddev, 4); ++ rdev->pm.vblank_sync = true; ++ wake_up(&rdev->irq.vblank_queue); + } ++ if (atomic_read(&rdev->irq.pflip[4])) ++ radeon_crtc_handle_vblank(rdev, 4); ++ rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~LB_D5_VBLANK_INTERRUPT; ++ DRM_DEBUG("IH: D5 vblank\n"); ++ + break; + case 1: /* D5 vline */ +- if (rdev->irq.stat_regs.evergreen.disp_int_cont4 & LB_D5_VLINE_INTERRUPT) { +- rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~LB_D5_VLINE_INTERRUPT; +- DRM_DEBUG("IH: D5 vline\n"); +- } ++ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont4 & LB_D5_VLINE_INTERRUPT)) ++ DRM_DEBUG("IH: D5 vline - IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~LB_D5_VLINE_INTERRUPT; ++ DRM_DEBUG("IH: D5 vline\n"); ++ + break; + default: + DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data); +@@ -5003,23 +5023,27 @@ restart_ih: + case 6: /* D6 vblank/vline */ + switch (src_data) { + case 0: /* D6 vblank */ +- if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & LB_D6_VBLANK_INTERRUPT) { +- if (rdev->irq.crtc_vblank_int[5]) { +- drm_handle_vblank(rdev->ddev, 5); +- rdev->pm.vblank_sync = true; +- wake_up(&rdev->irq.vblank_queue); +- } +- if (atomic_read(&rdev->irq.pflip[5])) +- radeon_crtc_handle_vblank(rdev, 5); +- rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~LB_D6_VBLANK_INTERRUPT; +- DRM_DEBUG("IH: D6 vblank\n"); ++ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont5 & LB_D6_VBLANK_INTERRUPT)) ++ DRM_DEBUG("IH: D6 vblank - IH event w/o asserted irq bit?\n"); ++ ++ if (rdev->irq.crtc_vblank_int[5]) { ++ drm_handle_vblank(rdev->ddev, 5); ++ rdev->pm.vblank_sync = true; ++ wake_up(&rdev->irq.vblank_queue); + } ++ if (atomic_read(&rdev->irq.pflip[5])) ++ radeon_crtc_handle_vblank(rdev, 5); ++ rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~LB_D6_VBLANK_INTERRUPT; ++ DRM_DEBUG("IH: D6 vblank\n"); ++ + break; + case 1: /* D6 vline */ +- if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & LB_D6_VLINE_INTERRUPT) { +- rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~LB_D6_VLINE_INTERRUPT; +- DRM_DEBUG("IH: D6 vline\n"); +- } ++ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont5 & LB_D6_VLINE_INTERRUPT)) ++ DRM_DEBUG("IH: D6 vline - IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~LB_D6_VLINE_INTERRUPT; ++ DRM_DEBUG("IH: D6 vline\n"); ++ + break; + default: + DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data); +@@ -5039,88 +5063,100 @@ restart_ih: + case 42: /* HPD hotplug */ + switch (src_data) { + case 0: +- if (rdev->irq.stat_regs.evergreen.disp_int & DC_HPD1_INTERRUPT) { +- rdev->irq.stat_regs.evergreen.disp_int &= ~DC_HPD1_INTERRUPT; +- queue_hotplug = true; +- DRM_DEBUG("IH: HPD1\n"); +- } ++ if (!(rdev->irq.stat_regs.evergreen.disp_int & DC_HPD1_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.evergreen.disp_int &= ~DC_HPD1_INTERRUPT; ++ queue_hotplug = true; ++ DRM_DEBUG("IH: HPD1\n"); + break; + case 1: +- if (rdev->irq.stat_regs.evergreen.disp_int_cont & DC_HPD2_INTERRUPT) { +- rdev->irq.stat_regs.evergreen.disp_int_cont &= ~DC_HPD2_INTERRUPT; +- queue_hotplug = true; +- DRM_DEBUG("IH: HPD2\n"); +- } ++ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont & DC_HPD2_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.evergreen.disp_int_cont &= ~DC_HPD2_INTERRUPT; ++ queue_hotplug = true; ++ DRM_DEBUG("IH: HPD2\n"); + break; + case 2: +- if (rdev->irq.stat_regs.evergreen.disp_int_cont2 & DC_HPD3_INTERRUPT) { +- rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~DC_HPD3_INTERRUPT; +- queue_hotplug = true; +- DRM_DEBUG("IH: HPD3\n"); +- } ++ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont2 & DC_HPD3_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~DC_HPD3_INTERRUPT; ++ queue_hotplug = true; ++ DRM_DEBUG("IH: HPD3\n"); + break; + case 3: +- if (rdev->irq.stat_regs.evergreen.disp_int_cont3 & DC_HPD4_INTERRUPT) { +- rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~DC_HPD4_INTERRUPT; +- queue_hotplug = true; +- DRM_DEBUG("IH: HPD4\n"); +- } ++ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont3 & DC_HPD4_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~DC_HPD4_INTERRUPT; ++ queue_hotplug = true; ++ DRM_DEBUG("IH: HPD4\n"); + break; + case 4: +- if (rdev->irq.stat_regs.evergreen.disp_int_cont4 & DC_HPD5_INTERRUPT) { +- rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~DC_HPD5_INTERRUPT; +- queue_hotplug = true; +- DRM_DEBUG("IH: HPD5\n"); +- } ++ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont4 & DC_HPD5_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~DC_HPD5_INTERRUPT; ++ queue_hotplug = true; ++ DRM_DEBUG("IH: HPD5\n"); + break; + case 5: +- if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_INTERRUPT) { +- rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~DC_HPD6_INTERRUPT; +- queue_hotplug = true; +- DRM_DEBUG("IH: HPD6\n"); +- } ++ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~DC_HPD6_INTERRUPT; ++ queue_hotplug = true; ++ DRM_DEBUG("IH: HPD6\n"); + break; + case 6: +- if (rdev->irq.stat_regs.evergreen.disp_int & DC_HPD1_RX_INTERRUPT) { +- rdev->irq.stat_regs.evergreen.disp_int &= ~DC_HPD1_RX_INTERRUPT; +- queue_dp = true; +- DRM_DEBUG("IH: HPD_RX 1\n"); +- } ++ if (!(rdev->irq.stat_regs.evergreen.disp_int & DC_HPD1_RX_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.evergreen.disp_int &= ~DC_HPD1_RX_INTERRUPT; ++ queue_dp = true; ++ DRM_DEBUG("IH: HPD_RX 1\n"); + break; + case 7: +- if (rdev->irq.stat_regs.evergreen.disp_int_cont & DC_HPD2_RX_INTERRUPT) { +- rdev->irq.stat_regs.evergreen.disp_int_cont &= ~DC_HPD2_RX_INTERRUPT; +- queue_dp = true; +- DRM_DEBUG("IH: HPD_RX 2\n"); +- } ++ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont & DC_HPD2_RX_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.evergreen.disp_int_cont &= ~DC_HPD2_RX_INTERRUPT; ++ queue_dp = true; ++ DRM_DEBUG("IH: HPD_RX 2\n"); + break; + case 8: +- if (rdev->irq.stat_regs.evergreen.disp_int_cont2 & DC_HPD3_RX_INTERRUPT) { +- rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~DC_HPD3_RX_INTERRUPT; +- queue_dp = true; +- DRM_DEBUG("IH: HPD_RX 3\n"); +- } ++ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont2 & DC_HPD3_RX_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~DC_HPD3_RX_INTERRUPT; ++ queue_dp = true; ++ DRM_DEBUG("IH: HPD_RX 3\n"); + break; + case 9: +- if (rdev->irq.stat_regs.evergreen.disp_int_cont3 & DC_HPD4_RX_INTERRUPT) { +- rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~DC_HPD4_RX_INTERRUPT; +- queue_dp = true; +- DRM_DEBUG("IH: HPD_RX 4\n"); +- } ++ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont3 & DC_HPD4_RX_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~DC_HPD4_RX_INTERRUPT; ++ queue_dp = true; ++ DRM_DEBUG("IH: HPD_RX 4\n"); + break; + case 10: +- if (rdev->irq.stat_regs.evergreen.disp_int_cont4 & DC_HPD5_RX_INTERRUPT) { +- rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~DC_HPD5_RX_INTERRUPT; +- queue_dp = true; +- DRM_DEBUG("IH: HPD_RX 5\n"); +- } ++ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont4 & DC_HPD5_RX_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~DC_HPD5_RX_INTERRUPT; ++ queue_dp = true; ++ DRM_DEBUG("IH: HPD_RX 5\n"); + break; + case 11: +- if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_RX_INTERRUPT) { +- rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~DC_HPD6_RX_INTERRUPT; +- queue_dp = true; +- DRM_DEBUG("IH: HPD_RX 6\n"); +- } ++ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_RX_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~DC_HPD6_RX_INTERRUPT; ++ queue_dp = true; ++ DRM_DEBUG("IH: HPD_RX 6\n"); + break; + default: + DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data); +@@ -5130,46 +5166,52 @@ restart_ih: + case 44: /* hdmi */ + switch (src_data) { + case 0: +- if (rdev->irq.stat_regs.evergreen.afmt_status1 & AFMT_AZ_FORMAT_WTRIG) { +- rdev->irq.stat_regs.evergreen.afmt_status1 &= ~AFMT_AZ_FORMAT_WTRIG; +- queue_hdmi = true; +- DRM_DEBUG("IH: HDMI0\n"); +- } ++ if (!(rdev->irq.stat_regs.evergreen.afmt_status1 & AFMT_AZ_FORMAT_WTRIG)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.evergreen.afmt_status1 &= ~AFMT_AZ_FORMAT_WTRIG; ++ queue_hdmi = true; ++ DRM_DEBUG("IH: HDMI0\n"); + break; + case 1: +- if (rdev->irq.stat_regs.evergreen.afmt_status2 & AFMT_AZ_FORMAT_WTRIG) { +- rdev->irq.stat_regs.evergreen.afmt_status2 &= ~AFMT_AZ_FORMAT_WTRIG; +- queue_hdmi = true; +- DRM_DEBUG("IH: HDMI1\n"); +- } ++ if (!(rdev->irq.stat_regs.evergreen.afmt_status2 & AFMT_AZ_FORMAT_WTRIG)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.evergreen.afmt_status2 &= ~AFMT_AZ_FORMAT_WTRIG; ++ queue_hdmi = true; ++ DRM_DEBUG("IH: HDMI1\n"); + break; + case 2: +- if (rdev->irq.stat_regs.evergreen.afmt_status3 & AFMT_AZ_FORMAT_WTRIG) { +- rdev->irq.stat_regs.evergreen.afmt_status3 &= ~AFMT_AZ_FORMAT_WTRIG; +- queue_hdmi = true; +- DRM_DEBUG("IH: HDMI2\n"); +- } ++ if (!(rdev->irq.stat_regs.evergreen.afmt_status3 & AFMT_AZ_FORMAT_WTRIG)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.evergreen.afmt_status3 &= ~AFMT_AZ_FORMAT_WTRIG; ++ queue_hdmi = true; ++ DRM_DEBUG("IH: HDMI2\n"); + break; + case 3: +- if (rdev->irq.stat_regs.evergreen.afmt_status4 & AFMT_AZ_FORMAT_WTRIG) { +- rdev->irq.stat_regs.evergreen.afmt_status4 &= ~AFMT_AZ_FORMAT_WTRIG; +- queue_hdmi = true; +- DRM_DEBUG("IH: HDMI3\n"); +- } ++ if (!(rdev->irq.stat_regs.evergreen.afmt_status4 & AFMT_AZ_FORMAT_WTRIG)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.evergreen.afmt_status4 &= ~AFMT_AZ_FORMAT_WTRIG; ++ queue_hdmi = true; ++ DRM_DEBUG("IH: HDMI3\n"); + break; + case 4: +- if (rdev->irq.stat_regs.evergreen.afmt_status5 & AFMT_AZ_FORMAT_WTRIG) { +- rdev->irq.stat_regs.evergreen.afmt_status5 &= ~AFMT_AZ_FORMAT_WTRIG; +- queue_hdmi = true; +- DRM_DEBUG("IH: HDMI4\n"); +- } ++ if (!(rdev->irq.stat_regs.evergreen.afmt_status5 & AFMT_AZ_FORMAT_WTRIG)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.evergreen.afmt_status5 &= ~AFMT_AZ_FORMAT_WTRIG; ++ queue_hdmi = true; ++ DRM_DEBUG("IH: HDMI4\n"); + break; + case 5: +- if (rdev->irq.stat_regs.evergreen.afmt_status6 & AFMT_AZ_FORMAT_WTRIG) { +- rdev->irq.stat_regs.evergreen.afmt_status6 &= ~AFMT_AZ_FORMAT_WTRIG; +- queue_hdmi = true; +- DRM_DEBUG("IH: HDMI5\n"); +- } ++ if (!(rdev->irq.stat_regs.evergreen.afmt_status6 & AFMT_AZ_FORMAT_WTRIG)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.evergreen.afmt_status6 &= ~AFMT_AZ_FORMAT_WTRIG; ++ queue_hdmi = true; ++ DRM_DEBUG("IH: HDMI5\n"); + break; + default: + DRM_ERROR("Unhandled interrupt: %d %d\n", src_id, src_data); +diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c +index 8f6d862..21e479f 100644 +--- a/drivers/gpu/drm/radeon/r600.c ++++ b/drivers/gpu/drm/radeon/r600.c +@@ -4039,23 +4039,27 @@ restart_ih: + case 1: /* D1 vblank/vline */ + switch (src_data) { + case 0: /* D1 vblank */ +- if (rdev->irq.stat_regs.r600.disp_int & LB_D1_VBLANK_INTERRUPT) { +- if (rdev->irq.crtc_vblank_int[0]) { +- drm_handle_vblank(rdev->ddev, 0); +- rdev->pm.vblank_sync = true; +- wake_up(&rdev->irq.vblank_queue); +- } +- if (atomic_read(&rdev->irq.pflip[0])) +- radeon_crtc_handle_vblank(rdev, 0); +- rdev->irq.stat_regs.r600.disp_int &= ~LB_D1_VBLANK_INTERRUPT; +- DRM_DEBUG("IH: D1 vblank\n"); ++ if (!(rdev->irq.stat_regs.r600.disp_int & LB_D1_VBLANK_INTERRUPT)) ++ DRM_DEBUG("IH: D1 vblank - IH event w/o asserted irq bit?\n"); ++ ++ if (rdev->irq.crtc_vblank_int[0]) { ++ drm_handle_vblank(rdev->ddev, 0); ++ rdev->pm.vblank_sync = true; ++ wake_up(&rdev->irq.vblank_queue); + } ++ if (atomic_read(&rdev->irq.pflip[0])) ++ radeon_crtc_handle_vblank(rdev, 0); ++ rdev->irq.stat_regs.r600.disp_int &= ~LB_D1_VBLANK_INTERRUPT; ++ DRM_DEBUG("IH: D1 vblank\n"); ++ + break; + case 1: /* D1 vline */ +- if (rdev->irq.stat_regs.r600.disp_int & LB_D1_VLINE_INTERRUPT) { +- rdev->irq.stat_regs.r600.disp_int &= ~LB_D1_VLINE_INTERRUPT; +- DRM_DEBUG("IH: D1 vline\n"); +- } ++ if (!(rdev->irq.stat_regs.r600.disp_int & LB_D1_VLINE_INTERRUPT)) ++ DRM_DEBUG("IH: D1 vline - IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.r600.disp_int &= ~LB_D1_VLINE_INTERRUPT; ++ DRM_DEBUG("IH: D1 vline\n"); ++ + break; + default: + DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data); +@@ -4065,23 +4069,27 @@ restart_ih: + case 5: /* D2 vblank/vline */ + switch (src_data) { + case 0: /* D2 vblank */ +- if (rdev->irq.stat_regs.r600.disp_int & LB_D2_VBLANK_INTERRUPT) { +- if (rdev->irq.crtc_vblank_int[1]) { +- drm_handle_vblank(rdev->ddev, 1); +- rdev->pm.vblank_sync = true; +- wake_up(&rdev->irq.vblank_queue); +- } +- if (atomic_read(&rdev->irq.pflip[1])) +- radeon_crtc_handle_vblank(rdev, 1); +- rdev->irq.stat_regs.r600.disp_int &= ~LB_D2_VBLANK_INTERRUPT; +- DRM_DEBUG("IH: D2 vblank\n"); ++ if (!(rdev->irq.stat_regs.r600.disp_int & LB_D2_VBLANK_INTERRUPT)) ++ DRM_DEBUG("IH: D2 vblank - IH event w/o asserted irq bit?\n"); ++ ++ if (rdev->irq.crtc_vblank_int[1]) { ++ drm_handle_vblank(rdev->ddev, 1); ++ rdev->pm.vblank_sync = true; ++ wake_up(&rdev->irq.vblank_queue); + } ++ if (atomic_read(&rdev->irq.pflip[1])) ++ radeon_crtc_handle_vblank(rdev, 1); ++ rdev->irq.stat_regs.r600.disp_int &= ~LB_D2_VBLANK_INTERRUPT; ++ DRM_DEBUG("IH: D2 vblank\n"); ++ + break; + case 1: /* D1 vline */ +- if (rdev->irq.stat_regs.r600.disp_int & LB_D2_VLINE_INTERRUPT) { +- rdev->irq.stat_regs.r600.disp_int &= ~LB_D2_VLINE_INTERRUPT; +- DRM_DEBUG("IH: D2 vline\n"); +- } ++ if (!(rdev->irq.stat_regs.r600.disp_int & LB_D2_VLINE_INTERRUPT)) ++ DRM_DEBUG("IH: D2 vline - IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.r600.disp_int &= ~LB_D2_VLINE_INTERRUPT; ++ DRM_DEBUG("IH: D2 vline\n"); ++ + break; + default: + DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data); +@@ -4101,46 +4109,53 @@ restart_ih: + case 19: /* HPD/DAC hotplug */ + switch (src_data) { + case 0: +- if (rdev->irq.stat_regs.r600.disp_int & DC_HPD1_INTERRUPT) { +- rdev->irq.stat_regs.r600.disp_int &= ~DC_HPD1_INTERRUPT; +- queue_hotplug = true; +- DRM_DEBUG("IH: HPD1\n"); +- } ++ if (!(rdev->irq.stat_regs.r600.disp_int & DC_HPD1_INTERRUPT)) ++ DRM_DEBUG("IH: HPD1 - IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.r600.disp_int &= ~DC_HPD1_INTERRUPT; ++ queue_hotplug = true; ++ DRM_DEBUG("IH: HPD1\n"); + break; + case 1: +- if (rdev->irq.stat_regs.r600.disp_int & DC_HPD2_INTERRUPT) { +- rdev->irq.stat_regs.r600.disp_int &= ~DC_HPD2_INTERRUPT; +- queue_hotplug = true; +- DRM_DEBUG("IH: HPD2\n"); +- } ++ if (!(rdev->irq.stat_regs.r600.disp_int & DC_HPD2_INTERRUPT)) ++ DRM_DEBUG("IH: HPD2 - IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.r600.disp_int &= ~DC_HPD2_INTERRUPT; ++ queue_hotplug = true; ++ DRM_DEBUG("IH: HPD2\n"); + break; + case 4: +- if (rdev->irq.stat_regs.r600.disp_int_cont & DC_HPD3_INTERRUPT) { +- rdev->irq.stat_regs.r600.disp_int_cont &= ~DC_HPD3_INTERRUPT; +- queue_hotplug = true; +- DRM_DEBUG("IH: HPD3\n"); +- } ++ if (!(rdev->irq.stat_regs.r600.disp_int_cont & DC_HPD3_INTERRUPT)) ++ DRM_DEBUG("IH: HPD3 - IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.r600.disp_int_cont &= ~DC_HPD3_INTERRUPT; ++ queue_hotplug = true; ++ DRM_DEBUG("IH: HPD3\n"); + break; + case 5: +- if (rdev->irq.stat_regs.r600.disp_int_cont & DC_HPD4_INTERRUPT) { +- rdev->irq.stat_regs.r600.disp_int_cont &= ~DC_HPD4_INTERRUPT; +- queue_hotplug = true; +- DRM_DEBUG("IH: HPD4\n"); +- } ++ if (!(rdev->irq.stat_regs.r600.disp_int_cont & DC_HPD4_INTERRUPT)) ++ DRM_DEBUG("IH: HPD4 - IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.r600.disp_int_cont &= ~DC_HPD4_INTERRUPT; ++ queue_hotplug = true; ++ DRM_DEBUG("IH: HPD4\n"); + break; + case 10: +- if (rdev->irq.stat_regs.r600.disp_int_cont2 & DC_HPD5_INTERRUPT) { +- rdev->irq.stat_regs.r600.disp_int_cont2 &= ~DC_HPD5_INTERRUPT; +- queue_hotplug = true; +- DRM_DEBUG("IH: HPD5\n"); +- } ++ if (!(rdev->irq.stat_regs.r600.disp_int_cont2 & DC_HPD5_INTERRUPT)) ++ DRM_DEBUG("IH: HPD5 - IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.r600.disp_int_cont2 &= ~DC_HPD5_INTERRUPT; ++ queue_hotplug = true; ++ DRM_DEBUG("IH: HPD5\n"); + break; + case 12: +- if (rdev->irq.stat_regs.r600.disp_int_cont2 & DC_HPD6_INTERRUPT) { +- rdev->irq.stat_regs.r600.disp_int_cont2 &= ~DC_HPD6_INTERRUPT; +- queue_hotplug = true; +- DRM_DEBUG("IH: HPD6\n"); +- } ++ if (!(rdev->irq.stat_regs.r600.disp_int_cont2 & DC_HPD6_INTERRUPT)) ++ DRM_DEBUG("IH: HPD6 - IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.r600.disp_int_cont2 &= ~DC_HPD6_INTERRUPT; ++ queue_hotplug = true; ++ DRM_DEBUG("IH: HPD6\n"); ++ + break; + default: + DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data); +@@ -4150,18 +4165,22 @@ restart_ih: + case 21: /* hdmi */ + switch (src_data) { + case 4: +- if (rdev->irq.stat_regs.r600.hdmi0_status & HDMI0_AZ_FORMAT_WTRIG) { +- rdev->irq.stat_regs.r600.hdmi0_status &= ~HDMI0_AZ_FORMAT_WTRIG; +- queue_hdmi = true; +- DRM_DEBUG("IH: HDMI0\n"); +- } ++ if (!(rdev->irq.stat_regs.r600.hdmi0_status & HDMI0_AZ_FORMAT_WTRIG)) ++ DRM_DEBUG("IH: HDMI0 - IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.r600.hdmi0_status &= ~HDMI0_AZ_FORMAT_WTRIG; ++ queue_hdmi = true; ++ DRM_DEBUG("IH: HDMI0\n"); ++ + break; + case 5: +- if (rdev->irq.stat_regs.r600.hdmi1_status & HDMI0_AZ_FORMAT_WTRIG) { +- rdev->irq.stat_regs.r600.hdmi1_status &= ~HDMI0_AZ_FORMAT_WTRIG; +- queue_hdmi = true; +- DRM_DEBUG("IH: HDMI1\n"); +- } ++ if (!(rdev->irq.stat_regs.r600.hdmi1_status & HDMI0_AZ_FORMAT_WTRIG)) ++ DRM_DEBUG("IH: HDMI1 - IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.r600.hdmi1_status &= ~HDMI0_AZ_FORMAT_WTRIG; ++ queue_hdmi = true; ++ DRM_DEBUG("IH: HDMI1\n"); ++ + break; + default: + DRM_ERROR("Unhandled interrupt: %d %d\n", src_id, src_data); +diff --git a/drivers/gpu/drm/radeon/radeon_audio.c b/drivers/gpu/drm/radeon/radeon_audio.c +index 25191f1..fa719c5 100644 +--- a/drivers/gpu/drm/radeon/radeon_audio.c ++++ b/drivers/gpu/drm/radeon/radeon_audio.c +@@ -242,6 +242,13 @@ static struct radeon_audio_funcs dce6_dp_funcs = { + .dpms = evergreen_dp_enable, + }; + ++static void radeon_audio_enable(struct radeon_device *rdev, ++ struct r600_audio_pin *pin, u8 enable_mask) ++{ ++ if (rdev->audio.funcs->enable) ++ rdev->audio.funcs->enable(rdev, pin, enable_mask); ++} ++ + static void radeon_audio_interface_init(struct radeon_device *rdev) + { + if (ASIC_IS_DCE6(rdev)) { +@@ -307,7 +314,7 @@ int radeon_audio_init(struct radeon_device *rdev) + + /* disable audio. it will be set up later */ + for (i = 0; i < rdev->audio.num_pins; i++) +- radeon_audio_enable(rdev, &rdev->audio.pin[i], false); ++ radeon_audio_enable(rdev, &rdev->audio.pin[i], 0); + + return 0; + } +@@ -443,13 +450,6 @@ static void radeon_audio_select_pin(struct drm_encoder *encoder) + radeon_encoder->audio->select_pin(encoder); + } + +-void radeon_audio_enable(struct radeon_device *rdev, +- struct r600_audio_pin *pin, u8 enable_mask) +-{ +- if (rdev->audio.funcs->enable) +- rdev->audio.funcs->enable(rdev, pin, enable_mask); +-} +- + void radeon_audio_detect(struct drm_connector *connector, + enum drm_connector_status status) + { +@@ -469,22 +469,22 @@ void radeon_audio_detect(struct drm_connector *connector, + dig = radeon_encoder->enc_priv; + + if (status == connector_status_connected) { +- struct radeon_connector *radeon_connector; +- int sink_type; +- + if (!drm_detect_monitor_audio(radeon_connector_edid(connector))) { + radeon_encoder->audio = NULL; + return; + } + +- radeon_connector = to_radeon_connector(connector); +- sink_type = radeon_dp_getsinktype(radeon_connector); ++ if (connector->connector_type == DRM_MODE_CONNECTOR_DisplayPort) { ++ struct radeon_connector *radeon_connector = to_radeon_connector(connector); + +- if (connector->connector_type == DRM_MODE_CONNECTOR_DisplayPort && +- sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT) +- radeon_encoder->audio = rdev->audio.dp_funcs; +- else ++ if (radeon_dp_getsinktype(radeon_connector) == ++ CONNECTOR_OBJECT_ID_DISPLAYPORT) ++ radeon_encoder->audio = rdev->audio.dp_funcs; ++ else ++ radeon_encoder->audio = rdev->audio.hdmi_funcs; ++ } else { + radeon_encoder->audio = rdev->audio.hdmi_funcs; ++ } + + dig->afmt->pin = radeon_audio_get_pin(connector->encoder); + radeon_audio_enable(rdev, dig->afmt->pin, 0xf); +@@ -502,7 +502,7 @@ void radeon_audio_fini(struct radeon_device *rdev) + return; + + for (i = 0; i < rdev->audio.num_pins; i++) +- radeon_audio_enable(rdev, &rdev->audio.pin[i], false); ++ radeon_audio_enable(rdev, &rdev->audio.pin[i], 0); + + rdev->audio.enabled = false; + } +diff --git a/drivers/gpu/drm/radeon/radeon_audio.h b/drivers/gpu/drm/radeon/radeon_audio.h +index c92d059..8438304 100644 +--- a/drivers/gpu/drm/radeon/radeon_audio.h ++++ b/drivers/gpu/drm/radeon/radeon_audio.h +@@ -74,8 +74,6 @@ u32 radeon_audio_endpoint_rreg(struct radeon_device *rdev, + void radeon_audio_endpoint_wreg(struct radeon_device *rdev, + u32 offset, u32 reg, u32 v); + struct r600_audio_pin *radeon_audio_get_pin(struct drm_encoder *encoder); +-void radeon_audio_enable(struct radeon_device *rdev, +- struct r600_audio_pin *pin, u8 enable_mask); + void radeon_audio_fini(struct radeon_device *rdev); + void radeon_audio_mode_set(struct drm_encoder *encoder, + struct drm_display_mode *mode); +diff --git a/drivers/gpu/drm/radeon/radeon_cursor.c b/drivers/gpu/drm/radeon/radeon_cursor.c +index 45e5406..fa66174 100644 +--- a/drivers/gpu/drm/radeon/radeon_cursor.c ++++ b/drivers/gpu/drm/radeon/radeon_cursor.c +@@ -205,8 +205,9 @@ static int radeon_cursor_move_locked(struct drm_crtc *crtc, int x, int y) + | (x << 16) + | y)); + /* offset is from DISP(2)_BASE_ADDRESS */ +- WREG32(RADEON_CUR_OFFSET + radeon_crtc->crtc_offset, (radeon_crtc->legacy_cursor_offset + +- (yorigin * 256))); ++ WREG32(RADEON_CUR_OFFSET + radeon_crtc->crtc_offset, ++ radeon_crtc->cursor_addr - radeon_crtc->legacy_display_base_addr + ++ yorigin * 256); + } + + radeon_crtc->cursor_x = x; +@@ -227,51 +228,32 @@ int radeon_crtc_cursor_move(struct drm_crtc *crtc, + return ret; + } + +-static int radeon_set_cursor(struct drm_crtc *crtc, struct drm_gem_object *obj) ++static void radeon_set_cursor(struct drm_crtc *crtc) + { + struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc); + struct radeon_device *rdev = crtc->dev->dev_private; +- struct radeon_bo *robj = gem_to_radeon_bo(obj); +- uint64_t gpu_addr; +- int ret; +- +- ret = radeon_bo_reserve(robj, false); +- if (unlikely(ret != 0)) +- goto fail; +- /* Only 27 bit offset for legacy cursor */ +- ret = radeon_bo_pin_restricted(robj, RADEON_GEM_DOMAIN_VRAM, +- ASIC_IS_AVIVO(rdev) ? 0 : 1 << 27, +- &gpu_addr); +- radeon_bo_unreserve(robj); +- if (ret) +- goto fail; + + if (ASIC_IS_DCE4(rdev)) { + WREG32(EVERGREEN_CUR_SURFACE_ADDRESS_HIGH + radeon_crtc->crtc_offset, +- upper_32_bits(gpu_addr)); ++ upper_32_bits(radeon_crtc->cursor_addr)); + WREG32(EVERGREEN_CUR_SURFACE_ADDRESS + radeon_crtc->crtc_offset, +- gpu_addr & 0xffffffff); ++ lower_32_bits(radeon_crtc->cursor_addr)); + } else if (ASIC_IS_AVIVO(rdev)) { + if (rdev->family >= CHIP_RV770) { + if (radeon_crtc->crtc_id) +- WREG32(R700_D2CUR_SURFACE_ADDRESS_HIGH, upper_32_bits(gpu_addr)); ++ WREG32(R700_D2CUR_SURFACE_ADDRESS_HIGH, ++ upper_32_bits(radeon_crtc->cursor_addr)); + else +- WREG32(R700_D1CUR_SURFACE_ADDRESS_HIGH, upper_32_bits(gpu_addr)); ++ WREG32(R700_D1CUR_SURFACE_ADDRESS_HIGH, ++ upper_32_bits(radeon_crtc->cursor_addr)); + } + WREG32(AVIVO_D1CUR_SURFACE_ADDRESS + radeon_crtc->crtc_offset, +- gpu_addr & 0xffffffff); ++ lower_32_bits(radeon_crtc->cursor_addr)); + } else { +- radeon_crtc->legacy_cursor_offset = gpu_addr - radeon_crtc->legacy_display_base_addr; + /* offset is from DISP(2)_BASE_ADDRESS */ +- WREG32(RADEON_CUR_OFFSET + radeon_crtc->crtc_offset, radeon_crtc->legacy_cursor_offset); ++ WREG32(RADEON_CUR_OFFSET + radeon_crtc->crtc_offset, ++ radeon_crtc->cursor_addr - radeon_crtc->legacy_display_base_addr); + } +- +- return 0; +- +-fail: +- drm_gem_object_unreference_unlocked(obj); +- +- return ret; + } + + int radeon_crtc_cursor_set2(struct drm_crtc *crtc, +@@ -283,7 +265,9 @@ int radeon_crtc_cursor_set2(struct drm_crtc *crtc, + int32_t hot_y) + { + struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc); ++ struct radeon_device *rdev = crtc->dev->dev_private; + struct drm_gem_object *obj; ++ struct radeon_bo *robj; + int ret; + + if (!handle) { +@@ -305,6 +289,23 @@ int radeon_crtc_cursor_set2(struct drm_crtc *crtc, + return -ENOENT; + } + ++ robj = gem_to_radeon_bo(obj); ++ ret = radeon_bo_reserve(robj, false); ++ if (ret != 0) { ++ drm_gem_object_unreference_unlocked(obj); ++ return ret; ++ } ++ /* Only 27 bit offset for legacy cursor */ ++ ret = radeon_bo_pin_restricted(robj, RADEON_GEM_DOMAIN_VRAM, ++ ASIC_IS_AVIVO(rdev) ? 0 : 1 << 27, ++ &radeon_crtc->cursor_addr); ++ radeon_bo_unreserve(robj); ++ if (ret) { ++ DRM_ERROR("Failed to pin new cursor BO (%d)\n", ret); ++ drm_gem_object_unreference_unlocked(obj); ++ return ret; ++ } ++ + radeon_crtc->cursor_width = width; + radeon_crtc->cursor_height = height; + +@@ -323,13 +324,8 @@ int radeon_crtc_cursor_set2(struct drm_crtc *crtc, + radeon_crtc->cursor_hot_y = hot_y; + } + +- ret = radeon_set_cursor(crtc, obj); +- +- if (ret) +- DRM_ERROR("radeon_set_cursor returned %d, not changing cursor\n", +- ret); +- else +- radeon_show_cursor(crtc); ++ radeon_set_cursor(crtc); ++ radeon_show_cursor(crtc); + + radeon_lock_cursor(crtc, false); + +@@ -341,8 +337,7 @@ unpin: + radeon_bo_unpin(robj); + radeon_bo_unreserve(robj); + } +- if (radeon_crtc->cursor_bo != obj) +- drm_gem_object_unreference_unlocked(radeon_crtc->cursor_bo); ++ drm_gem_object_unreference_unlocked(radeon_crtc->cursor_bo); + } + + radeon_crtc->cursor_bo = obj; +@@ -360,7 +355,6 @@ unpin: + void radeon_cursor_reset(struct drm_crtc *crtc) + { + struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc); +- int ret; + + if (radeon_crtc->cursor_bo) { + radeon_lock_cursor(crtc, true); +@@ -368,12 +362,8 @@ void radeon_cursor_reset(struct drm_crtc *crtc) + radeon_cursor_move_locked(crtc, radeon_crtc->cursor_x, + radeon_crtc->cursor_y); + +- ret = radeon_set_cursor(crtc, radeon_crtc->cursor_bo); +- if (ret) +- DRM_ERROR("radeon_set_cursor returned %d, not showing " +- "cursor\n", ret); +- else +- radeon_show_cursor(crtc); ++ radeon_set_cursor(crtc); ++ radeon_show_cursor(crtc); + + radeon_lock_cursor(crtc, false); + } +diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c +index a7fdfa4..604c44d 100644 +--- a/drivers/gpu/drm/radeon/radeon_device.c ++++ b/drivers/gpu/drm/radeon/radeon_device.c +@@ -1572,11 +1572,21 @@ int radeon_suspend_kms(struct drm_device *dev, bool suspend, bool fbcon) + drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF); + } + +- /* unpin the front buffers */ ++ /* unpin the front buffers and cursors */ + list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) { ++ struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc); + struct radeon_framebuffer *rfb = to_radeon_framebuffer(crtc->primary->fb); + struct radeon_bo *robj; + ++ if (radeon_crtc->cursor_bo) { ++ struct radeon_bo *robj = gem_to_radeon_bo(radeon_crtc->cursor_bo); ++ r = radeon_bo_reserve(robj, false); ++ if (r == 0) { ++ radeon_bo_unpin(robj); ++ radeon_bo_unreserve(robj); ++ } ++ } ++ + if (rfb == NULL || rfb->obj == NULL) { + continue; + } +@@ -1639,6 +1649,7 @@ int radeon_resume_kms(struct drm_device *dev, bool resume, bool fbcon) + { + struct drm_connector *connector; + struct radeon_device *rdev = dev->dev_private; ++ struct drm_crtc *crtc; + int r; + + if (dev->switch_power_state == DRM_SWITCH_POWER_OFF) +@@ -1678,6 +1689,27 @@ int radeon_resume_kms(struct drm_device *dev, bool resume, bool fbcon) + + radeon_restore_bios_scratch_regs(rdev); + ++ /* pin cursors */ ++ list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) { ++ struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc); ++ ++ if (radeon_crtc->cursor_bo) { ++ struct radeon_bo *robj = gem_to_radeon_bo(radeon_crtc->cursor_bo); ++ r = radeon_bo_reserve(robj, false); ++ if (r == 0) { ++ /* Only 27 bit offset for legacy cursor */ ++ r = radeon_bo_pin_restricted(robj, ++ RADEON_GEM_DOMAIN_VRAM, ++ ASIC_IS_AVIVO(rdev) ? ++ 0 : 1 << 27, ++ &radeon_crtc->cursor_addr); ++ if (r != 0) ++ DRM_ERROR("Failed to pin cursor BO (%d)\n", r); ++ radeon_bo_unreserve(robj); ++ } ++ } ++ } ++ + /* init dig PHYs, disp eng pll */ + if (rdev->is_atom_bios) { + radeon_atom_encoder_init(rdev); +diff --git a/drivers/gpu/drm/radeon/radeon_fb.c b/drivers/gpu/drm/radeon/radeon_fb.c +index aeb6767..634793e 100644 +--- a/drivers/gpu/drm/radeon/radeon_fb.c ++++ b/drivers/gpu/drm/radeon/radeon_fb.c +@@ -257,7 +257,6 @@ static int radeonfb_create(struct drm_fb_helper *helper, + } + + info->par = rfbdev; +- info->skip_vt_switch = true; + + ret = radeon_framebuffer_init(rdev->ddev, &rfbdev->rfb, &mode_cmd, gobj); + if (ret) { +diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c +index 5450fa9..c4777c8 100644 +--- a/drivers/gpu/drm/radeon/radeon_gart.c ++++ b/drivers/gpu/drm/radeon/radeon_gart.c +@@ -260,8 +260,10 @@ void radeon_gart_unbind(struct radeon_device *rdev, unsigned offset, + } + } + } +- mb(); +- radeon_gart_tlb_flush(rdev); ++ if (rdev->gart.ptr) { ++ mb(); ++ radeon_gart_tlb_flush(rdev); ++ } + } + + /** +@@ -306,8 +308,10 @@ int radeon_gart_bind(struct radeon_device *rdev, unsigned offset, + page_base += RADEON_GPU_PAGE_SIZE; + } + } +- mb(); +- radeon_gart_tlb_flush(rdev); ++ if (rdev->gart.ptr) { ++ mb(); ++ radeon_gart_tlb_flush(rdev); ++ } + return 0; + } + +diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c +index ac3c131..186d0b7 100644 +--- a/drivers/gpu/drm/radeon/radeon_gem.c ++++ b/drivers/gpu/drm/radeon/radeon_gem.c +@@ -36,6 +36,7 @@ void radeon_gem_object_free(struct drm_gem_object *gobj) + if (robj) { + if (robj->gem_base.import_attach) + drm_prime_gem_destroy(&robj->gem_base, robj->tbo.sg); ++ radeon_mn_unregister(robj); + radeon_bo_unref(&robj); + } + } +@@ -471,6 +472,7 @@ int radeon_gem_wait_idle_ioctl(struct drm_device *dev, void *data, + r = ret; + + /* Flush HDP cache via MMIO if necessary */ ++ cur_placement = ACCESS_ONCE(robj->tbo.mem.mem_type); + if (rdev->asic->mmio_hdp_flush && + radeon_mem_type_to_domain(cur_placement) == RADEON_GEM_DOMAIN_VRAM) + robj->rdev->asic->mmio_hdp_flush(rdev); +diff --git a/drivers/gpu/drm/radeon/radeon_irq_kms.c b/drivers/gpu/drm/radeon/radeon_irq_kms.c +index 7162c93..f682e53 100644 +--- a/drivers/gpu/drm/radeon/radeon_irq_kms.c ++++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c +@@ -79,10 +79,12 @@ static void radeon_hotplug_work_func(struct work_struct *work) + struct drm_mode_config *mode_config = &dev->mode_config; + struct drm_connector *connector; + ++ mutex_lock(&mode_config->mutex); + if (mode_config->num_connector) { + list_for_each_entry(connector, &mode_config->connector_list, head) + radeon_connector_hotplug(connector); + } ++ mutex_unlock(&mode_config->mutex); + /* Just fire off a uevent and let userspace tell us what to do */ + drm_helper_hpd_irq_event(dev); + } +diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h +index fa91a17..f01c797 100644 +--- a/drivers/gpu/drm/radeon/radeon_mode.h ++++ b/drivers/gpu/drm/radeon/radeon_mode.h +@@ -343,7 +343,6 @@ struct radeon_crtc { + int max_cursor_width; + int max_cursor_height; + uint32_t legacy_display_base_addr; +- uint32_t legacy_cursor_offset; + enum radeon_rmx_type rmx_type; + u8 h_border; + u8 v_border; +diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c +index 318165d..6763627 100644 +--- a/drivers/gpu/drm/radeon/radeon_object.c ++++ b/drivers/gpu/drm/radeon/radeon_object.c +@@ -75,7 +75,6 @@ static void radeon_ttm_bo_destroy(struct ttm_buffer_object *tbo) + bo = container_of(tbo, struct radeon_bo, tbo); + + radeon_update_memory_usage(bo, bo->tbo.mem.mem_type, -1); +- radeon_mn_unregister(bo); + + mutex_lock(&bo->rdev->gem.mutex); + list_del_init(&bo->list); +diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c +index 4c679b8..e15185b 100644 +--- a/drivers/gpu/drm/radeon/si.c ++++ b/drivers/gpu/drm/radeon/si.c +@@ -6466,23 +6466,27 @@ restart_ih: + case 1: /* D1 vblank/vline */ + switch (src_data) { + case 0: /* D1 vblank */ +- if (rdev->irq.stat_regs.evergreen.disp_int & LB_D1_VBLANK_INTERRUPT) { +- if (rdev->irq.crtc_vblank_int[0]) { +- drm_handle_vblank(rdev->ddev, 0); +- rdev->pm.vblank_sync = true; +- wake_up(&rdev->irq.vblank_queue); +- } +- if (atomic_read(&rdev->irq.pflip[0])) +- radeon_crtc_handle_vblank(rdev, 0); +- rdev->irq.stat_regs.evergreen.disp_int &= ~LB_D1_VBLANK_INTERRUPT; +- DRM_DEBUG("IH: D1 vblank\n"); ++ if (!(rdev->irq.stat_regs.evergreen.disp_int & LB_D1_VBLANK_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ if (rdev->irq.crtc_vblank_int[0]) { ++ drm_handle_vblank(rdev->ddev, 0); ++ rdev->pm.vblank_sync = true; ++ wake_up(&rdev->irq.vblank_queue); + } ++ if (atomic_read(&rdev->irq.pflip[0])) ++ radeon_crtc_handle_vblank(rdev, 0); ++ rdev->irq.stat_regs.evergreen.disp_int &= ~LB_D1_VBLANK_INTERRUPT; ++ DRM_DEBUG("IH: D1 vblank\n"); ++ + break; + case 1: /* D1 vline */ +- if (rdev->irq.stat_regs.evergreen.disp_int & LB_D1_VLINE_INTERRUPT) { +- rdev->irq.stat_regs.evergreen.disp_int &= ~LB_D1_VLINE_INTERRUPT; +- DRM_DEBUG("IH: D1 vline\n"); +- } ++ if (!(rdev->irq.stat_regs.evergreen.disp_int & LB_D1_VLINE_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.evergreen.disp_int &= ~LB_D1_VLINE_INTERRUPT; ++ DRM_DEBUG("IH: D1 vline\n"); ++ + break; + default: + DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data); +@@ -6492,23 +6496,27 @@ restart_ih: + case 2: /* D2 vblank/vline */ + switch (src_data) { + case 0: /* D2 vblank */ +- if (rdev->irq.stat_regs.evergreen.disp_int_cont & LB_D2_VBLANK_INTERRUPT) { +- if (rdev->irq.crtc_vblank_int[1]) { +- drm_handle_vblank(rdev->ddev, 1); +- rdev->pm.vblank_sync = true; +- wake_up(&rdev->irq.vblank_queue); +- } +- if (atomic_read(&rdev->irq.pflip[1])) +- radeon_crtc_handle_vblank(rdev, 1); +- rdev->irq.stat_regs.evergreen.disp_int_cont &= ~LB_D2_VBLANK_INTERRUPT; +- DRM_DEBUG("IH: D2 vblank\n"); ++ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont & LB_D2_VBLANK_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ if (rdev->irq.crtc_vblank_int[1]) { ++ drm_handle_vblank(rdev->ddev, 1); ++ rdev->pm.vblank_sync = true; ++ wake_up(&rdev->irq.vblank_queue); + } ++ if (atomic_read(&rdev->irq.pflip[1])) ++ radeon_crtc_handle_vblank(rdev, 1); ++ rdev->irq.stat_regs.evergreen.disp_int_cont &= ~LB_D2_VBLANK_INTERRUPT; ++ DRM_DEBUG("IH: D2 vblank\n"); ++ + break; + case 1: /* D2 vline */ +- if (rdev->irq.stat_regs.evergreen.disp_int_cont & LB_D2_VLINE_INTERRUPT) { +- rdev->irq.stat_regs.evergreen.disp_int_cont &= ~LB_D2_VLINE_INTERRUPT; +- DRM_DEBUG("IH: D2 vline\n"); +- } ++ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont & LB_D2_VLINE_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.evergreen.disp_int_cont &= ~LB_D2_VLINE_INTERRUPT; ++ DRM_DEBUG("IH: D2 vline\n"); ++ + break; + default: + DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data); +@@ -6518,23 +6526,27 @@ restart_ih: + case 3: /* D3 vblank/vline */ + switch (src_data) { + case 0: /* D3 vblank */ +- if (rdev->irq.stat_regs.evergreen.disp_int_cont2 & LB_D3_VBLANK_INTERRUPT) { +- if (rdev->irq.crtc_vblank_int[2]) { +- drm_handle_vblank(rdev->ddev, 2); +- rdev->pm.vblank_sync = true; +- wake_up(&rdev->irq.vblank_queue); +- } +- if (atomic_read(&rdev->irq.pflip[2])) +- radeon_crtc_handle_vblank(rdev, 2); +- rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~LB_D3_VBLANK_INTERRUPT; +- DRM_DEBUG("IH: D3 vblank\n"); ++ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont2 & LB_D3_VBLANK_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ if (rdev->irq.crtc_vblank_int[2]) { ++ drm_handle_vblank(rdev->ddev, 2); ++ rdev->pm.vblank_sync = true; ++ wake_up(&rdev->irq.vblank_queue); + } ++ if (atomic_read(&rdev->irq.pflip[2])) ++ radeon_crtc_handle_vblank(rdev, 2); ++ rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~LB_D3_VBLANK_INTERRUPT; ++ DRM_DEBUG("IH: D3 vblank\n"); ++ + break; + case 1: /* D3 vline */ +- if (rdev->irq.stat_regs.evergreen.disp_int_cont2 & LB_D3_VLINE_INTERRUPT) { +- rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~LB_D3_VLINE_INTERRUPT; +- DRM_DEBUG("IH: D3 vline\n"); +- } ++ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont2 & LB_D3_VLINE_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~LB_D3_VLINE_INTERRUPT; ++ DRM_DEBUG("IH: D3 vline\n"); ++ + break; + default: + DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data); +@@ -6544,23 +6556,27 @@ restart_ih: + case 4: /* D4 vblank/vline */ + switch (src_data) { + case 0: /* D4 vblank */ +- if (rdev->irq.stat_regs.evergreen.disp_int_cont3 & LB_D4_VBLANK_INTERRUPT) { +- if (rdev->irq.crtc_vblank_int[3]) { +- drm_handle_vblank(rdev->ddev, 3); +- rdev->pm.vblank_sync = true; +- wake_up(&rdev->irq.vblank_queue); +- } +- if (atomic_read(&rdev->irq.pflip[3])) +- radeon_crtc_handle_vblank(rdev, 3); +- rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~LB_D4_VBLANK_INTERRUPT; +- DRM_DEBUG("IH: D4 vblank\n"); ++ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont3 & LB_D4_VBLANK_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ if (rdev->irq.crtc_vblank_int[3]) { ++ drm_handle_vblank(rdev->ddev, 3); ++ rdev->pm.vblank_sync = true; ++ wake_up(&rdev->irq.vblank_queue); + } ++ if (atomic_read(&rdev->irq.pflip[3])) ++ radeon_crtc_handle_vblank(rdev, 3); ++ rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~LB_D4_VBLANK_INTERRUPT; ++ DRM_DEBUG("IH: D4 vblank\n"); ++ + break; + case 1: /* D4 vline */ +- if (rdev->irq.stat_regs.evergreen.disp_int_cont3 & LB_D4_VLINE_INTERRUPT) { +- rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~LB_D4_VLINE_INTERRUPT; +- DRM_DEBUG("IH: D4 vline\n"); +- } ++ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont3 & LB_D4_VLINE_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~LB_D4_VLINE_INTERRUPT; ++ DRM_DEBUG("IH: D4 vline\n"); ++ + break; + default: + DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data); +@@ -6570,23 +6586,27 @@ restart_ih: + case 5: /* D5 vblank/vline */ + switch (src_data) { + case 0: /* D5 vblank */ +- if (rdev->irq.stat_regs.evergreen.disp_int_cont4 & LB_D5_VBLANK_INTERRUPT) { +- if (rdev->irq.crtc_vblank_int[4]) { +- drm_handle_vblank(rdev->ddev, 4); +- rdev->pm.vblank_sync = true; +- wake_up(&rdev->irq.vblank_queue); +- } +- if (atomic_read(&rdev->irq.pflip[4])) +- radeon_crtc_handle_vblank(rdev, 4); +- rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~LB_D5_VBLANK_INTERRUPT; +- DRM_DEBUG("IH: D5 vblank\n"); ++ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont4 & LB_D5_VBLANK_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ if (rdev->irq.crtc_vblank_int[4]) { ++ drm_handle_vblank(rdev->ddev, 4); ++ rdev->pm.vblank_sync = true; ++ wake_up(&rdev->irq.vblank_queue); + } ++ if (atomic_read(&rdev->irq.pflip[4])) ++ radeon_crtc_handle_vblank(rdev, 4); ++ rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~LB_D5_VBLANK_INTERRUPT; ++ DRM_DEBUG("IH: D5 vblank\n"); ++ + break; + case 1: /* D5 vline */ +- if (rdev->irq.stat_regs.evergreen.disp_int_cont4 & LB_D5_VLINE_INTERRUPT) { +- rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~LB_D5_VLINE_INTERRUPT; +- DRM_DEBUG("IH: D5 vline\n"); +- } ++ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont4 & LB_D5_VLINE_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~LB_D5_VLINE_INTERRUPT; ++ DRM_DEBUG("IH: D5 vline\n"); ++ + break; + default: + DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data); +@@ -6596,23 +6616,27 @@ restart_ih: + case 6: /* D6 vblank/vline */ + switch (src_data) { + case 0: /* D6 vblank */ +- if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & LB_D6_VBLANK_INTERRUPT) { +- if (rdev->irq.crtc_vblank_int[5]) { +- drm_handle_vblank(rdev->ddev, 5); +- rdev->pm.vblank_sync = true; +- wake_up(&rdev->irq.vblank_queue); +- } +- if (atomic_read(&rdev->irq.pflip[5])) +- radeon_crtc_handle_vblank(rdev, 5); +- rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~LB_D6_VBLANK_INTERRUPT; +- DRM_DEBUG("IH: D6 vblank\n"); ++ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont5 & LB_D6_VBLANK_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ if (rdev->irq.crtc_vblank_int[5]) { ++ drm_handle_vblank(rdev->ddev, 5); ++ rdev->pm.vblank_sync = true; ++ wake_up(&rdev->irq.vblank_queue); + } ++ if (atomic_read(&rdev->irq.pflip[5])) ++ radeon_crtc_handle_vblank(rdev, 5); ++ rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~LB_D6_VBLANK_INTERRUPT; ++ DRM_DEBUG("IH: D6 vblank\n"); ++ + break; + case 1: /* D6 vline */ +- if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & LB_D6_VLINE_INTERRUPT) { +- rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~LB_D6_VLINE_INTERRUPT; +- DRM_DEBUG("IH: D6 vline\n"); +- } ++ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont5 & LB_D6_VLINE_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~LB_D6_VLINE_INTERRUPT; ++ DRM_DEBUG("IH: D6 vline\n"); ++ + break; + default: + DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data); +@@ -6632,88 +6656,112 @@ restart_ih: + case 42: /* HPD hotplug */ + switch (src_data) { + case 0: +- if (rdev->irq.stat_regs.evergreen.disp_int & DC_HPD1_INTERRUPT) { +- rdev->irq.stat_regs.evergreen.disp_int &= ~DC_HPD1_INTERRUPT; +- queue_hotplug = true; +- DRM_DEBUG("IH: HPD1\n"); +- } ++ if (!(rdev->irq.stat_regs.evergreen.disp_int & DC_HPD1_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.evergreen.disp_int &= ~DC_HPD1_INTERRUPT; ++ queue_hotplug = true; ++ DRM_DEBUG("IH: HPD1\n"); ++ + break; + case 1: +- if (rdev->irq.stat_regs.evergreen.disp_int_cont & DC_HPD2_INTERRUPT) { +- rdev->irq.stat_regs.evergreen.disp_int_cont &= ~DC_HPD2_INTERRUPT; +- queue_hotplug = true; +- DRM_DEBUG("IH: HPD2\n"); +- } ++ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont & DC_HPD2_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.evergreen.disp_int_cont &= ~DC_HPD2_INTERRUPT; ++ queue_hotplug = true; ++ DRM_DEBUG("IH: HPD2\n"); ++ + break; + case 2: +- if (rdev->irq.stat_regs.evergreen.disp_int_cont2 & DC_HPD3_INTERRUPT) { +- rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~DC_HPD3_INTERRUPT; +- queue_hotplug = true; +- DRM_DEBUG("IH: HPD3\n"); +- } ++ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont2 & DC_HPD3_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~DC_HPD3_INTERRUPT; ++ queue_hotplug = true; ++ DRM_DEBUG("IH: HPD3\n"); ++ + break; + case 3: +- if (rdev->irq.stat_regs.evergreen.disp_int_cont3 & DC_HPD4_INTERRUPT) { +- rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~DC_HPD4_INTERRUPT; +- queue_hotplug = true; +- DRM_DEBUG("IH: HPD4\n"); +- } ++ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont3 & DC_HPD4_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~DC_HPD4_INTERRUPT; ++ queue_hotplug = true; ++ DRM_DEBUG("IH: HPD4\n"); ++ + break; + case 4: +- if (rdev->irq.stat_regs.evergreen.disp_int_cont4 & DC_HPD5_INTERRUPT) { +- rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~DC_HPD5_INTERRUPT; +- queue_hotplug = true; +- DRM_DEBUG("IH: HPD5\n"); +- } ++ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont4 & DC_HPD5_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~DC_HPD5_INTERRUPT; ++ queue_hotplug = true; ++ DRM_DEBUG("IH: HPD5\n"); ++ + break; + case 5: +- if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_INTERRUPT) { +- rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~DC_HPD6_INTERRUPT; +- queue_hotplug = true; +- DRM_DEBUG("IH: HPD6\n"); +- } ++ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~DC_HPD6_INTERRUPT; ++ queue_hotplug = true; ++ DRM_DEBUG("IH: HPD6\n"); ++ + break; + case 6: +- if (rdev->irq.stat_regs.evergreen.disp_int & DC_HPD1_RX_INTERRUPT) { +- rdev->irq.stat_regs.evergreen.disp_int &= ~DC_HPD1_RX_INTERRUPT; +- queue_dp = true; +- DRM_DEBUG("IH: HPD_RX 1\n"); +- } ++ if (!(rdev->irq.stat_regs.evergreen.disp_int & DC_HPD1_RX_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.evergreen.disp_int &= ~DC_HPD1_RX_INTERRUPT; ++ queue_dp = true; ++ DRM_DEBUG("IH: HPD_RX 1\n"); ++ + break; + case 7: +- if (rdev->irq.stat_regs.evergreen.disp_int_cont & DC_HPD2_RX_INTERRUPT) { +- rdev->irq.stat_regs.evergreen.disp_int_cont &= ~DC_HPD2_RX_INTERRUPT; +- queue_dp = true; +- DRM_DEBUG("IH: HPD_RX 2\n"); +- } ++ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont & DC_HPD2_RX_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.evergreen.disp_int_cont &= ~DC_HPD2_RX_INTERRUPT; ++ queue_dp = true; ++ DRM_DEBUG("IH: HPD_RX 2\n"); ++ + break; + case 8: +- if (rdev->irq.stat_regs.evergreen.disp_int_cont2 & DC_HPD3_RX_INTERRUPT) { +- rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~DC_HPD3_RX_INTERRUPT; +- queue_dp = true; +- DRM_DEBUG("IH: HPD_RX 3\n"); +- } ++ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont2 & DC_HPD3_RX_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~DC_HPD3_RX_INTERRUPT; ++ queue_dp = true; ++ DRM_DEBUG("IH: HPD_RX 3\n"); ++ + break; + case 9: +- if (rdev->irq.stat_regs.evergreen.disp_int_cont3 & DC_HPD4_RX_INTERRUPT) { +- rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~DC_HPD4_RX_INTERRUPT; +- queue_dp = true; +- DRM_DEBUG("IH: HPD_RX 4\n"); +- } ++ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont3 & DC_HPD4_RX_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~DC_HPD4_RX_INTERRUPT; ++ queue_dp = true; ++ DRM_DEBUG("IH: HPD_RX 4\n"); ++ + break; + case 10: +- if (rdev->irq.stat_regs.evergreen.disp_int_cont4 & DC_HPD5_RX_INTERRUPT) { +- rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~DC_HPD5_RX_INTERRUPT; +- queue_dp = true; +- DRM_DEBUG("IH: HPD_RX 5\n"); +- } ++ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont4 & DC_HPD5_RX_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~DC_HPD5_RX_INTERRUPT; ++ queue_dp = true; ++ DRM_DEBUG("IH: HPD_RX 5\n"); ++ + break; + case 11: +- if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_RX_INTERRUPT) { +- rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~DC_HPD6_RX_INTERRUPT; +- queue_dp = true; +- DRM_DEBUG("IH: HPD_RX 6\n"); +- } ++ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_RX_INTERRUPT)) ++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); ++ ++ rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~DC_HPD6_RX_INTERRUPT; ++ queue_dp = true; ++ DRM_DEBUG("IH: HPD_RX 6\n"); ++ + break; + default: + DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data); +diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c +index ff8b83f..9dfcede 100644 +--- a/drivers/gpu/drm/radeon/si_dpm.c ++++ b/drivers/gpu/drm/radeon/si_dpm.c +@@ -2925,6 +2925,7 @@ static struct si_dpm_quirk si_dpm_quirk_list[] = { + /* PITCAIRN - https://bugs.freedesktop.org/show_bug.cgi?id=76490 */ + { PCI_VENDOR_ID_ATI, 0x6810, 0x1462, 0x3036, 0, 120000 }, + { PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0xe271, 0, 120000 }, ++ { PCI_VENDOR_ID_ATI, 0x6810, 0x174b, 0xe271, 85000, 90000 }, + { 0, 0, 0, 0 }, + }; + +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c +index eb2282c..eba5f8a 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c +@@ -54,55 +54,56 @@ static void rockchip_gem_free_buf(struct rockchip_gem_object *rk_obj) + &rk_obj->dma_attrs); + } + +-int rockchip_gem_mmap_buf(struct drm_gem_object *obj, +- struct vm_area_struct *vma) ++static int rockchip_drm_gem_object_mmap(struct drm_gem_object *obj, ++ struct vm_area_struct *vma) ++ + { ++ int ret; + struct rockchip_gem_object *rk_obj = to_rockchip_obj(obj); + struct drm_device *drm = obj->dev; +- unsigned long vm_size; + +- vma->vm_flags |= VM_IO | VM_DONTEXPAND | VM_DONTDUMP; +- vm_size = vma->vm_end - vma->vm_start; +- +- if (vm_size > obj->size) +- return -EINVAL; ++ /* ++ * dma_alloc_attrs() allocated a struct page table for rk_obj, so clear ++ * VM_PFNMAP flag that was set by drm_gem_mmap_obj()/drm_gem_mmap(). ++ */ ++ vma->vm_flags &= ~VM_PFNMAP; + +- return dma_mmap_attrs(drm->dev, vma, rk_obj->kvaddr, rk_obj->dma_addr, ++ ret = dma_mmap_attrs(drm->dev, vma, rk_obj->kvaddr, rk_obj->dma_addr, + obj->size, &rk_obj->dma_attrs); ++ if (ret) ++ drm_gem_vm_close(vma); ++ ++ return ret; + } + +-/* drm driver mmap file operations */ +-int rockchip_gem_mmap(struct file *filp, struct vm_area_struct *vma) ++int rockchip_gem_mmap_buf(struct drm_gem_object *obj, ++ struct vm_area_struct *vma) + { +- struct drm_file *priv = filp->private_data; +- struct drm_device *dev = priv->minor->dev; +- struct drm_gem_object *obj; +- struct drm_vma_offset_node *node; ++ struct drm_device *drm = obj->dev; + int ret; + +- if (drm_device_is_unplugged(dev)) +- return -ENODEV; ++ mutex_lock(&drm->struct_mutex); ++ ret = drm_gem_mmap_obj(obj, obj->size, vma); ++ mutex_unlock(&drm->struct_mutex); ++ if (ret) ++ return ret; + +- mutex_lock(&dev->struct_mutex); ++ return rockchip_drm_gem_object_mmap(obj, vma); ++} + +- node = drm_vma_offset_exact_lookup(dev->vma_offset_manager, +- vma->vm_pgoff, +- vma_pages(vma)); +- if (!node) { +- mutex_unlock(&dev->struct_mutex); +- DRM_ERROR("failed to find vma node.\n"); +- return -EINVAL; +- } else if (!drm_vma_node_is_allowed(node, filp)) { +- mutex_unlock(&dev->struct_mutex); +- return -EACCES; +- } ++/* drm driver mmap file operations */ ++int rockchip_gem_mmap(struct file *filp, struct vm_area_struct *vma) ++{ ++ struct drm_gem_object *obj; ++ int ret; + +- obj = container_of(node, struct drm_gem_object, vma_node); +- ret = rockchip_gem_mmap_buf(obj, vma); ++ ret = drm_gem_mmap(filp, vma); ++ if (ret) ++ return ret; + +- mutex_unlock(&dev->struct_mutex); ++ obj = vma->vm_private_data; + +- return ret; ++ return rockchip_drm_gem_object_mmap(obj, vma); + } + + struct rockchip_gem_object * +diff --git a/drivers/gpu/drm/tegra/dpaux.c b/drivers/gpu/drm/tegra/dpaux.c +index d6b55e3..a43a836 100644 +--- a/drivers/gpu/drm/tegra/dpaux.c ++++ b/drivers/gpu/drm/tegra/dpaux.c +@@ -72,34 +72,32 @@ static inline void tegra_dpaux_writel(struct tegra_dpaux *dpaux, + static void tegra_dpaux_write_fifo(struct tegra_dpaux *dpaux, const u8 *buffer, + size_t size) + { +- unsigned long offset = DPAUX_DP_AUXDATA_WRITE(0); + size_t i, j; + +- for (i = 0; i < size; i += 4) { +- size_t num = min_t(size_t, size - i, 4); ++ for (i = 0; i < DIV_ROUND_UP(size, 4); i++) { ++ size_t num = min_t(size_t, size - i * 4, 4); + unsigned long value = 0; + + for (j = 0; j < num; j++) +- value |= buffer[i + j] << (j * 8); ++ value |= buffer[i * 4 + j] << (j * 8); + +- tegra_dpaux_writel(dpaux, value, offset++); ++ tegra_dpaux_writel(dpaux, value, DPAUX_DP_AUXDATA_WRITE(i)); + } + } + + static void tegra_dpaux_read_fifo(struct tegra_dpaux *dpaux, u8 *buffer, + size_t size) + { +- unsigned long offset = DPAUX_DP_AUXDATA_READ(0); + size_t i, j; + +- for (i = 0; i < size; i += 4) { +- size_t num = min_t(size_t, size - i, 4); ++ for (i = 0; i < DIV_ROUND_UP(size, 4); i++) { ++ size_t num = min_t(size_t, size - i * 4, 4); + unsigned long value; + +- value = tegra_dpaux_readl(dpaux, offset++); ++ value = tegra_dpaux_readl(dpaux, DPAUX_DP_AUXDATA_READ(i)); + + for (j = 0; j < num; j++) +- buffer[i + j] = value >> (j * 8); ++ buffer[i * 4 + j] = value >> (j * 8); + } + } + +diff --git a/drivers/gpu/drm/vgem/vgem_drv.c b/drivers/gpu/drm/vgem/vgem_drv.c +index 7a207ca..6394547 100644 +--- a/drivers/gpu/drm/vgem/vgem_drv.c ++++ b/drivers/gpu/drm/vgem/vgem_drv.c +@@ -328,6 +328,8 @@ static int __init vgem_init(void) + goto out; + } + ++ drm_dev_set_unique(vgem_device, "vgem"); ++ + ret = drm_dev_register(vgem_device, 0); + + if (ret) +diff --git a/drivers/hwmon/mcp3021.c b/drivers/hwmon/mcp3021.c +index d219c06..972444a 100644 +--- a/drivers/hwmon/mcp3021.c ++++ b/drivers/hwmon/mcp3021.c +@@ -31,14 +31,11 @@ + /* output format */ + #define MCP3021_SAR_SHIFT 2 + #define MCP3021_SAR_MASK 0x3ff +- + #define MCP3021_OUTPUT_RES 10 /* 10-bit resolution */ +-#define MCP3021_OUTPUT_SCALE 4 + + #define MCP3221_SAR_SHIFT 0 + #define MCP3221_SAR_MASK 0xfff + #define MCP3221_OUTPUT_RES 12 /* 12-bit resolution */ +-#define MCP3221_OUTPUT_SCALE 1 + + enum chips { + mcp3021, +@@ -54,7 +51,6 @@ struct mcp3021_data { + u16 sar_shift; + u16 sar_mask; + u8 output_res; +- u8 output_scale; + }; + + static int mcp3021_read16(struct i2c_client *client) +@@ -84,13 +80,7 @@ static int mcp3021_read16(struct i2c_client *client) + + static inline u16 volts_from_reg(struct mcp3021_data *data, u16 val) + { +- if (val == 0) +- return 0; +- +- val = val * data->output_scale - data->output_scale / 2; +- +- return val * DIV_ROUND_CLOSEST(data->vdd, +- (1 << data->output_res) * data->output_scale); ++ return DIV_ROUND_CLOSEST(data->vdd * val, 1 << data->output_res); + } + + static ssize_t show_in_input(struct device *dev, struct device_attribute *attr, +@@ -132,14 +122,12 @@ static int mcp3021_probe(struct i2c_client *client, + data->sar_shift = MCP3021_SAR_SHIFT; + data->sar_mask = MCP3021_SAR_MASK; + data->output_res = MCP3021_OUTPUT_RES; +- data->output_scale = MCP3021_OUTPUT_SCALE; + break; + + case mcp3221: + data->sar_shift = MCP3221_SAR_SHIFT; + data->sar_mask = MCP3221_SAR_MASK; + data->output_res = MCP3221_OUTPUT_RES; +- data->output_scale = MCP3221_OUTPUT_SCALE; + break; + } + +diff --git a/drivers/hwmon/nct7802.c b/drivers/hwmon/nct7802.c +index 5576579..28fcb2e 100644 +--- a/drivers/hwmon/nct7802.c ++++ b/drivers/hwmon/nct7802.c +@@ -547,7 +547,7 @@ static umode_t nct7802_temp_is_visible(struct kobject *kobj, + if (index >= 9 && index < 18 && + (reg & 0x0c) != 0x04 && (reg & 0x0c) != 0x08) /* RD2 */ + return 0; +- if (index >= 18 && index < 27 && (reg & 0x30) != 0x10) /* RD3 */ ++ if (index >= 18 && index < 27 && (reg & 0x30) != 0x20) /* RD3 */ + return 0; + if (index >= 27 && index < 35) /* local */ + return attr->mode; +diff --git a/drivers/i2c/busses/i2c-at91.c b/drivers/i2c/busses/i2c-at91.c +index ff23d1b..9bd10a9 100644 +--- a/drivers/i2c/busses/i2c-at91.c ++++ b/drivers/i2c/busses/i2c-at91.c +@@ -65,6 +65,9 @@ + #define AT91_TWI_UNRE 0x0080 /* Underrun Error */ + #define AT91_TWI_NACK 0x0100 /* Not Acknowledged */ + ++#define AT91_TWI_INT_MASK \ ++ (AT91_TWI_TXCOMP | AT91_TWI_RXRDY | AT91_TWI_TXRDY | AT91_TWI_NACK) ++ + #define AT91_TWI_IER 0x0024 /* Interrupt Enable Register */ + #define AT91_TWI_IDR 0x0028 /* Interrupt Disable Register */ + #define AT91_TWI_IMR 0x002c /* Interrupt Mask Register */ +@@ -119,13 +122,12 @@ static void at91_twi_write(struct at91_twi_dev *dev, unsigned reg, unsigned val) + + static void at91_disable_twi_interrupts(struct at91_twi_dev *dev) + { +- at91_twi_write(dev, AT91_TWI_IDR, +- AT91_TWI_TXCOMP | AT91_TWI_RXRDY | AT91_TWI_TXRDY); ++ at91_twi_write(dev, AT91_TWI_IDR, AT91_TWI_INT_MASK); + } + + static void at91_twi_irq_save(struct at91_twi_dev *dev) + { +- dev->imr = at91_twi_read(dev, AT91_TWI_IMR) & 0x7; ++ dev->imr = at91_twi_read(dev, AT91_TWI_IMR) & AT91_TWI_INT_MASK; + at91_disable_twi_interrupts(dev); + } + +@@ -215,6 +217,14 @@ static void at91_twi_write_data_dma_callback(void *data) + dma_unmap_single(dev->dev, sg_dma_address(&dev->dma.sg), + dev->buf_len, DMA_TO_DEVICE); + ++ /* ++ * When this callback is called, THR/TX FIFO is likely not to be empty ++ * yet. So we have to wait for TXCOMP or NACK bits to be set into the ++ * Status Register to be sure that the STOP bit has been sent and the ++ * transfer is completed. The NACK interrupt has already been enabled, ++ * we just have to enable TXCOMP one. ++ */ ++ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_TXCOMP); + at91_twi_write(dev, AT91_TWI_CR, AT91_TWI_STOP); + } + +@@ -309,7 +319,7 @@ static void at91_twi_read_data_dma_callback(void *data) + /* The last two bytes have to be read without using dma */ + dev->buf += dev->buf_len - 2; + dev->buf_len = 2; +- at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_RXRDY); ++ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_RXRDY | AT91_TWI_TXCOMP); + } + + static void at91_twi_read_data_dma(struct at91_twi_dev *dev) +@@ -370,7 +380,7 @@ static irqreturn_t atmel_twi_interrupt(int irq, void *dev_id) + /* catch error flags */ + dev->transfer_status |= status; + +- if (irqstatus & AT91_TWI_TXCOMP) { ++ if (irqstatus & (AT91_TWI_TXCOMP | AT91_TWI_NACK)) { + at91_disable_twi_interrupts(dev); + complete(&dev->cmd_complete); + } +@@ -384,6 +394,34 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev) + unsigned long time_left; + bool has_unre_flag = dev->pdata->has_unre_flag; + ++ /* ++ * WARNING: the TXCOMP bit in the Status Register is NOT a clear on ++ * read flag but shows the state of the transmission at the time the ++ * Status Register is read. According to the programmer datasheet, ++ * TXCOMP is set when both holding register and internal shifter are ++ * empty and STOP condition has been sent. ++ * Consequently, we should enable NACK interrupt rather than TXCOMP to ++ * detect transmission failure. ++ * ++ * Besides, the TXCOMP bit is already set before the i2c transaction ++ * has been started. For read transactions, this bit is cleared when ++ * writing the START bit into the Control Register. So the ++ * corresponding interrupt can safely be enabled just after. ++ * However for write transactions managed by the CPU, we first write ++ * into THR, so TXCOMP is cleared. Then we can safely enable TXCOMP ++ * interrupt. If TXCOMP interrupt were enabled before writing into THR, ++ * the interrupt handler would be called immediately and the i2c command ++ * would be reported as completed. ++ * Also when a write transaction is managed by the DMA controller, ++ * enabling the TXCOMP interrupt in this function may lead to a race ++ * condition since we don't know whether the TXCOMP interrupt is enabled ++ * before or after the DMA has started to write into THR. So the TXCOMP ++ * interrupt is enabled later by at91_twi_write_data_dma_callback(). ++ * Immediately after in that DMA callback, we still need to send the ++ * STOP condition manually writing the corresponding bit into the ++ * Control Register. ++ */ ++ + dev_dbg(dev->dev, "transfer: %s %d bytes.\n", + (dev->msg->flags & I2C_M_RD) ? "read" : "write", dev->buf_len); + +@@ -414,26 +452,24 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev) + * seems to be the best solution. + */ + if (dev->use_dma && (dev->buf_len > AT91_I2C_DMA_THRESHOLD)) { ++ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_NACK); + at91_twi_read_data_dma(dev); +- /* +- * It is important to enable TXCOMP irq here because +- * doing it only when transferring the last two bytes +- * will mask NACK errors since TXCOMP is set when a +- * NACK occurs. +- */ +- at91_twi_write(dev, AT91_TWI_IER, +- AT91_TWI_TXCOMP); +- } else ++ } else { + at91_twi_write(dev, AT91_TWI_IER, +- AT91_TWI_TXCOMP | AT91_TWI_RXRDY); ++ AT91_TWI_TXCOMP | ++ AT91_TWI_NACK | ++ AT91_TWI_RXRDY); ++ } + } else { + if (dev->use_dma && (dev->buf_len > AT91_I2C_DMA_THRESHOLD)) { ++ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_NACK); + at91_twi_write_data_dma(dev); +- at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_TXCOMP); + } else { + at91_twi_write_next_byte(dev); + at91_twi_write(dev, AT91_TWI_IER, +- AT91_TWI_TXCOMP | AT91_TWI_TXRDY); ++ AT91_TWI_TXCOMP | ++ AT91_TWI_NACK | ++ AT91_TWI_TXRDY); + } + } + +diff --git a/drivers/i2c/i2c-mux.c b/drivers/i2c/i2c-mux.c +index 06cc1ff..2ba7c0f 100644 +--- a/drivers/i2c/i2c-mux.c ++++ b/drivers/i2c/i2c-mux.c +@@ -51,7 +51,7 @@ static int i2c_mux_master_xfer(struct i2c_adapter *adap, + + ret = priv->select(parent, priv->mux_priv, priv->chan_id); + if (ret >= 0) +- ret = parent->algo->master_xfer(parent, msgs, num); ++ ret = __i2c_transfer(parent, msgs, num); + if (priv->deselect) + priv->deselect(parent, priv->mux_priv, priv->chan_id); + +@@ -144,6 +144,7 @@ struct i2c_adapter *i2c_add_mux_adapter(struct i2c_adapter *parent, + priv->adap.dev.parent = &parent->dev; + priv->adap.retries = parent->retries; + priv->adap.timeout = parent->timeout; ++ priv->adap.quirks = parent->quirks; + + /* Sanity check on class */ + if (i2c_mux_parent_classes(parent) & class) +diff --git a/drivers/i2c/muxes/i2c-mux-pca9541.c b/drivers/i2c/muxes/i2c-mux-pca9541.c +index cb77277..0c8d4d2 100644 +--- a/drivers/i2c/muxes/i2c-mux-pca9541.c ++++ b/drivers/i2c/muxes/i2c-mux-pca9541.c +@@ -104,7 +104,7 @@ static int pca9541_reg_write(struct i2c_client *client, u8 command, u8 val) + buf[0] = command; + buf[1] = val; + msg.buf = buf; +- ret = adap->algo->master_xfer(adap, &msg, 1); ++ ret = __i2c_transfer(adap, &msg, 1); + } else { + union i2c_smbus_data data; + +@@ -144,7 +144,7 @@ static int pca9541_reg_read(struct i2c_client *client, u8 command) + .buf = &val + } + }; +- ret = adap->algo->master_xfer(adap, msg, 2); ++ ret = __i2c_transfer(adap, msg, 2); + if (ret == 2) + ret = val; + else if (ret >= 0) +diff --git a/drivers/i2c/muxes/i2c-mux-pca954x.c b/drivers/i2c/muxes/i2c-mux-pca954x.c +index bea0d2d..ea4aa9d 100644 +--- a/drivers/i2c/muxes/i2c-mux-pca954x.c ++++ b/drivers/i2c/muxes/i2c-mux-pca954x.c +@@ -134,7 +134,7 @@ static int pca954x_reg_write(struct i2c_adapter *adap, + msg.len = 1; + buf[0] = val; + msg.buf = buf; +- ret = adap->algo->master_xfer(adap, &msg, 1); ++ ret = __i2c_transfer(adap, &msg, 1); + } else { + union i2c_smbus_data data; + ret = adap->algo->smbus_xfer(adap, client->addr, +diff --git a/drivers/iio/accel/bmc150-accel.c b/drivers/iio/accel/bmc150-accel.c +index 73e8773..bf827d0 100644 +--- a/drivers/iio/accel/bmc150-accel.c ++++ b/drivers/iio/accel/bmc150-accel.c +@@ -1465,7 +1465,7 @@ static void bmc150_accel_unregister_triggers(struct bmc150_accel_data *data, + { + int i; + +- for (i = from; i >= 0; i++) { ++ for (i = from; i >= 0; i--) { + if (data->triggers[i].indio_trig) { + iio_trigger_unregister(data->triggers[i].indio_trig); + data->triggers[i].indio_trig = NULL; +diff --git a/drivers/iio/adc/Kconfig b/drivers/iio/adc/Kconfig +index e36a73e..1bcb65b 100644 +--- a/drivers/iio/adc/Kconfig ++++ b/drivers/iio/adc/Kconfig +@@ -146,8 +146,7 @@ config DA9150_GPADC + + config CC10001_ADC + tristate "Cosmic Circuits 10001 ADC driver" +- depends on HAVE_CLK || REGULATOR +- depends on HAS_IOMEM ++ depends on HAS_IOMEM && HAVE_CLK && REGULATOR + select IIO_BUFFER + select IIO_TRIGGERED_BUFFER + help +diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c +index 8a0eb4a..7b40925 100644 +--- a/drivers/iio/adc/at91_adc.c ++++ b/drivers/iio/adc/at91_adc.c +@@ -182,7 +182,7 @@ struct at91_adc_caps { + u8 ts_pen_detect_sensitivity; + + /* startup time calculate function */ +- u32 (*calc_startup_ticks)(u8 startup_time, u32 adc_clk_khz); ++ u32 (*calc_startup_ticks)(u32 startup_time, u32 adc_clk_khz); + + u8 num_channels; + struct at91_adc_reg_desc registers; +@@ -201,7 +201,7 @@ struct at91_adc_state { + u8 num_channels; + void __iomem *reg_base; + struct at91_adc_reg_desc *registers; +- u8 startup_time; ++ u32 startup_time; + u8 sample_hold_time; + bool sleep_mode; + struct iio_trigger **trig; +@@ -779,7 +779,7 @@ ret: + return ret; + } + +-static u32 calc_startup_ticks_9260(u8 startup_time, u32 adc_clk_khz) ++static u32 calc_startup_ticks_9260(u32 startup_time, u32 adc_clk_khz) + { + /* + * Number of ticks needed to cover the startup time of the ADC +@@ -790,7 +790,7 @@ static u32 calc_startup_ticks_9260(u8 startup_time, u32 adc_clk_khz) + return round_up((startup_time * adc_clk_khz / 1000) - 1, 8) / 8; + } + +-static u32 calc_startup_ticks_9x5(u8 startup_time, u32 adc_clk_khz) ++static u32 calc_startup_ticks_9x5(u32 startup_time, u32 adc_clk_khz) + { + /* + * For sama5d3x and at91sam9x5, the formula changes to: +diff --git a/drivers/iio/adc/rockchip_saradc.c b/drivers/iio/adc/rockchip_saradc.c +index 8d4e019..9c311c1 100644 +--- a/drivers/iio/adc/rockchip_saradc.c ++++ b/drivers/iio/adc/rockchip_saradc.c +@@ -349,3 +349,7 @@ static struct platform_driver rockchip_saradc_driver = { + }; + + module_platform_driver(rockchip_saradc_driver); ++ ++MODULE_AUTHOR("Heiko Stuebner <heiko@sntech.de>"); ++MODULE_DESCRIPTION("Rockchip SARADC driver"); ++MODULE_LICENSE("GPL v2"); +diff --git a/drivers/iio/adc/twl4030-madc.c b/drivers/iio/adc/twl4030-madc.c +index 94c5f05..4caecbe 100644 +--- a/drivers/iio/adc/twl4030-madc.c ++++ b/drivers/iio/adc/twl4030-madc.c +@@ -835,7 +835,8 @@ static int twl4030_madc_probe(struct platform_device *pdev) + irq = platform_get_irq(pdev, 0); + ret = devm_request_threaded_irq(&pdev->dev, irq, NULL, + twl4030_madc_threaded_irq_handler, +- IRQF_TRIGGER_RISING, "twl4030_madc", madc); ++ IRQF_TRIGGER_RISING | IRQF_ONESHOT, ++ "twl4030_madc", madc); + if (ret) { + dev_err(&pdev->dev, "could not request irq\n"); + goto err_i2c; +diff --git a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c +index 610fc98..5955110 100644 +--- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c ++++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c +@@ -36,6 +36,8 @@ static int _hid_sensor_power_state(struct hid_sensor_common *st, bool state) + s32 poll_value = 0; + + if (state) { ++ if (!atomic_read(&st->user_requested_state)) ++ return 0; + if (sensor_hub_device_open(st->hsdev)) + return -EIO; + +@@ -52,8 +54,12 @@ static int _hid_sensor_power_state(struct hid_sensor_common *st, bool state) + + poll_value = hid_sensor_read_poll_value(st); + } else { +- if (!atomic_dec_and_test(&st->data_ready)) ++ int val; ++ ++ val = atomic_dec_if_positive(&st->data_ready); ++ if (val < 0) + return 0; ++ + sensor_hub_device_close(st->hsdev); + state_val = hid_sensor_get_usage_index(st->hsdev, + st->power_state.report_id, +@@ -92,9 +98,11 @@ EXPORT_SYMBOL(hid_sensor_power_state); + + int hid_sensor_power_state(struct hid_sensor_common *st, bool state) + { ++ + #ifdef CONFIG_PM + int ret; + ++ atomic_set(&st->user_requested_state, state); + if (state) + ret = pm_runtime_get_sync(&st->pdev->dev); + else { +@@ -109,6 +117,7 @@ int hid_sensor_power_state(struct hid_sensor_common *st, bool state) + + return 0; + #else ++ atomic_set(&st->user_requested_state, state); + return _hid_sensor_power_state(st, state); + #endif + } +diff --git a/drivers/iio/dac/ad5624r_spi.c b/drivers/iio/dac/ad5624r_spi.c +index 61bb9d4..e98428d 100644 +--- a/drivers/iio/dac/ad5624r_spi.c ++++ b/drivers/iio/dac/ad5624r_spi.c +@@ -22,7 +22,7 @@ + #include "ad5624r.h" + + static int ad5624r_spi_write(struct spi_device *spi, +- u8 cmd, u8 addr, u16 val, u8 len) ++ u8 cmd, u8 addr, u16 val, u8 shift) + { + u32 data; + u8 msg[3]; +@@ -35,7 +35,7 @@ static int ad5624r_spi_write(struct spi_device *spi, + * 14-, 12-bit input code followed by 0, 2, or 4 don't care bits, + * for the AD5664R, AD5644R, and AD5624R, respectively. + */ +- data = (0 << 22) | (cmd << 19) | (addr << 16) | (val << (16 - len)); ++ data = (0 << 22) | (cmd << 19) | (addr << 16) | (val << shift); + msg[0] = data >> 16; + msg[1] = data >> 8; + msg[2] = data; +diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c +index 17d4bb1..65ce868 100644 +--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c ++++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c +@@ -431,6 +431,23 @@ static int inv_mpu6050_write_gyro_scale(struct inv_mpu6050_state *st, int val) + return -EINVAL; + } + ++static int inv_write_raw_get_fmt(struct iio_dev *indio_dev, ++ struct iio_chan_spec const *chan, long mask) ++{ ++ switch (mask) { ++ case IIO_CHAN_INFO_SCALE: ++ switch (chan->type) { ++ case IIO_ANGL_VEL: ++ return IIO_VAL_INT_PLUS_NANO; ++ default: ++ return IIO_VAL_INT_PLUS_MICRO; ++ } ++ default: ++ return IIO_VAL_INT_PLUS_MICRO; ++ } ++ ++ return -EINVAL; ++} + static int inv_mpu6050_write_accel_scale(struct inv_mpu6050_state *st, int val) + { + int result, i; +@@ -696,6 +713,7 @@ static const struct iio_info mpu_info = { + .driver_module = THIS_MODULE, + .read_raw = &inv_mpu6050_read_raw, + .write_raw = &inv_mpu6050_write_raw, ++ .write_raw_get_fmt = &inv_write_raw_get_fmt, + .attrs = &inv_attribute_group, + .validate_trigger = inv_mpu6050_validate_trigger, + }; +diff --git a/drivers/iio/light/cm3323.c b/drivers/iio/light/cm3323.c +index 869033e..a1d4905 100644 +--- a/drivers/iio/light/cm3323.c ++++ b/drivers/iio/light/cm3323.c +@@ -123,7 +123,7 @@ static int cm3323_set_it_bits(struct cm3323_data *data, int val, int val2) + for (i = 0; i < ARRAY_SIZE(cm3323_int_time); i++) { + if (val == cm3323_int_time[i].val && + val2 == cm3323_int_time[i].val2) { +- reg_conf = data->reg_conf; ++ reg_conf = data->reg_conf & ~CM3323_CONF_IT_MASK; + reg_conf |= i << CM3323_CONF_IT_SHIFT; + + ret = i2c_smbus_write_word_data(data->client, +diff --git a/drivers/iio/light/tcs3414.c b/drivers/iio/light/tcs3414.c +index 71c2bde..f8b1df0 100644 +--- a/drivers/iio/light/tcs3414.c ++++ b/drivers/iio/light/tcs3414.c +@@ -185,7 +185,7 @@ static int tcs3414_write_raw(struct iio_dev *indio_dev, + if (val != 0) + return -EINVAL; + for (i = 0; i < ARRAY_SIZE(tcs3414_times); i++) { +- if (val == tcs3414_times[i] * 1000) { ++ if (val2 == tcs3414_times[i] * 1000) { + data->timing &= ~TCS3414_INTEG_MASK; + data->timing |= i; + return i2c_smbus_write_byte_data( +diff --git a/drivers/iio/proximity/sx9500.c b/drivers/iio/proximity/sx9500.c +index fa40f6d..bd26a48 100644 +--- a/drivers/iio/proximity/sx9500.c ++++ b/drivers/iio/proximity/sx9500.c +@@ -206,7 +206,7 @@ static int sx9500_read_proximity(struct sx9500_data *data, + if (ret < 0) + return ret; + +- *val = 32767 - (s16)be16_to_cpu(regval); ++ *val = be16_to_cpu(regval); + + return IIO_VAL_INT; + } +diff --git a/drivers/iio/temperature/tmp006.c b/drivers/iio/temperature/tmp006.c +index 84a0789..7a80509 100644 +--- a/drivers/iio/temperature/tmp006.c ++++ b/drivers/iio/temperature/tmp006.c +@@ -132,6 +132,9 @@ static int tmp006_write_raw(struct iio_dev *indio_dev, + struct tmp006_data *data = iio_priv(indio_dev); + int i; + ++ if (mask != IIO_CHAN_INFO_SAMP_FREQ) ++ return -EINVAL; ++ + for (i = 0; i < ARRAY_SIZE(tmp006_freqs); i++) + if ((val == tmp006_freqs[i][0]) && + (val2 == tmp006_freqs[i][1])) { +diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c +index 9dcb660..219f212 100644 +--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c ++++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c +@@ -679,7 +679,6 @@ err: + ocrdma_release_ucontext_pd(uctx); + } else { + status = _ocrdma_dealloc_pd(dev, pd); +- kfree(pd); + } + exit: + return ERR_PTR(status); +diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c +index 135a090..c90118e 100644 +--- a/drivers/md/bitmap.c ++++ b/drivers/md/bitmap.c +@@ -494,7 +494,7 @@ static int bitmap_new_disk_sb(struct bitmap *bitmap) + bitmap_super_t *sb; + unsigned long chunksize, daemon_sleep, write_behind; + +- bitmap->storage.sb_page = alloc_page(GFP_KERNEL); ++ bitmap->storage.sb_page = alloc_page(GFP_KERNEL | __GFP_ZERO); + if (bitmap->storage.sb_page == NULL) + return -ENOMEM; + bitmap->storage.sb_page->index = 0; +@@ -541,6 +541,7 @@ static int bitmap_new_disk_sb(struct bitmap *bitmap) + sb->state = cpu_to_le32(bitmap->flags); + bitmap->events_cleared = bitmap->mddev->events; + sb->events_cleared = cpu_to_le64(bitmap->mddev->events); ++ bitmap->mddev->bitmap_info.nodes = 0; + + kunmap_atomic(sb); + +@@ -611,8 +612,16 @@ re_read: + daemon_sleep = le32_to_cpu(sb->daemon_sleep) * HZ; + write_behind = le32_to_cpu(sb->write_behind); + sectors_reserved = le32_to_cpu(sb->sectors_reserved); +- nodes = le32_to_cpu(sb->nodes); +- strlcpy(bitmap->mddev->bitmap_info.cluster_name, sb->cluster_name, 64); ++ /* XXX: This is a hack to ensure that we don't use clustering ++ * in case: ++ * - dm-raid is in use and ++ * - the nodes written in bitmap_sb is erroneous. ++ */ ++ if (!bitmap->mddev->sync_super) { ++ nodes = le32_to_cpu(sb->nodes); ++ strlcpy(bitmap->mddev->bitmap_info.cluster_name, ++ sb->cluster_name, 64); ++ } + + /* verify that the bitmap-specific fields are valid */ + if (sb->magic != cpu_to_le32(BITMAP_MAGIC)) +diff --git a/drivers/md/dm-cache-policy-cleaner.c b/drivers/md/dm-cache-policy-cleaner.c +index b04d1f9..004e463 100644 +--- a/drivers/md/dm-cache-policy-cleaner.c ++++ b/drivers/md/dm-cache-policy-cleaner.c +@@ -171,7 +171,8 @@ static void remove_cache_hash_entry(struct wb_cache_entry *e) + /* Public interface (see dm-cache-policy.h */ + static int wb_map(struct dm_cache_policy *pe, dm_oblock_t oblock, + bool can_block, bool can_migrate, bool discarded_oblock, +- struct bio *bio, struct policy_result *result) ++ struct bio *bio, struct policy_locker *locker, ++ struct policy_result *result) + { + struct policy *p = to_policy(pe); + struct wb_cache_entry *e; +diff --git a/drivers/md/dm-cache-policy-internal.h b/drivers/md/dm-cache-policy-internal.h +index 2256a1f..c198e6d 100644 +--- a/drivers/md/dm-cache-policy-internal.h ++++ b/drivers/md/dm-cache-policy-internal.h +@@ -16,9 +16,10 @@ + */ + static inline int policy_map(struct dm_cache_policy *p, dm_oblock_t oblock, + bool can_block, bool can_migrate, bool discarded_oblock, +- struct bio *bio, struct policy_result *result) ++ struct bio *bio, struct policy_locker *locker, ++ struct policy_result *result) + { +- return p->map(p, oblock, can_block, can_migrate, discarded_oblock, bio, result); ++ return p->map(p, oblock, can_block, can_migrate, discarded_oblock, bio, locker, result); + } + + static inline int policy_lookup(struct dm_cache_policy *p, dm_oblock_t oblock, dm_cblock_t *cblock) +diff --git a/drivers/md/dm-cache-policy-mq.c b/drivers/md/dm-cache-policy-mq.c +index 3ddd116..515d44b 100644 +--- a/drivers/md/dm-cache-policy-mq.c ++++ b/drivers/md/dm-cache-policy-mq.c +@@ -693,9 +693,10 @@ static void requeue(struct mq_policy *mq, struct entry *e) + * - set the hit count to a hard coded value other than 1, eg, is it better + * if it goes in at level 2? + */ +-static int demote_cblock(struct mq_policy *mq, dm_oblock_t *oblock) ++static int demote_cblock(struct mq_policy *mq, ++ struct policy_locker *locker, dm_oblock_t *oblock) + { +- struct entry *demoted = pop(mq, &mq->cache_clean); ++ struct entry *demoted = peek(&mq->cache_clean); + + if (!demoted) + /* +@@ -707,6 +708,13 @@ static int demote_cblock(struct mq_policy *mq, dm_oblock_t *oblock) + */ + return -ENOSPC; + ++ if (locker->fn(locker, demoted->oblock)) ++ /* ++ * We couldn't lock the demoted block. ++ */ ++ return -EBUSY; ++ ++ del(mq, demoted); + *oblock = demoted->oblock; + free_entry(&mq->cache_pool, demoted); + +@@ -795,6 +803,7 @@ static int cache_entry_found(struct mq_policy *mq, + * finding which cache block to use. + */ + static int pre_cache_to_cache(struct mq_policy *mq, struct entry *e, ++ struct policy_locker *locker, + struct policy_result *result) + { + int r; +@@ -803,11 +812,12 @@ static int pre_cache_to_cache(struct mq_policy *mq, struct entry *e, + /* Ensure there's a free cblock in the cache */ + if (epool_empty(&mq->cache_pool)) { + result->op = POLICY_REPLACE; +- r = demote_cblock(mq, &result->old_oblock); ++ r = demote_cblock(mq, locker, &result->old_oblock); + if (r) { + result->op = POLICY_MISS; + return 0; + } ++ + } else + result->op = POLICY_NEW; + +@@ -829,7 +839,8 @@ static int pre_cache_to_cache(struct mq_policy *mq, struct entry *e, + + static int pre_cache_entry_found(struct mq_policy *mq, struct entry *e, + bool can_migrate, bool discarded_oblock, +- int data_dir, struct policy_result *result) ++ int data_dir, struct policy_locker *locker, ++ struct policy_result *result) + { + int r = 0; + +@@ -842,7 +853,7 @@ static int pre_cache_entry_found(struct mq_policy *mq, struct entry *e, + + else { + requeue(mq, e); +- r = pre_cache_to_cache(mq, e, result); ++ r = pre_cache_to_cache(mq, e, locker, result); + } + + return r; +@@ -872,6 +883,7 @@ static void insert_in_pre_cache(struct mq_policy *mq, + } + + static void insert_in_cache(struct mq_policy *mq, dm_oblock_t oblock, ++ struct policy_locker *locker, + struct policy_result *result) + { + int r; +@@ -879,7 +891,7 @@ static void insert_in_cache(struct mq_policy *mq, dm_oblock_t oblock, + + if (epool_empty(&mq->cache_pool)) { + result->op = POLICY_REPLACE; +- r = demote_cblock(mq, &result->old_oblock); ++ r = demote_cblock(mq, locker, &result->old_oblock); + if (unlikely(r)) { + result->op = POLICY_MISS; + insert_in_pre_cache(mq, oblock); +@@ -907,11 +919,12 @@ static void insert_in_cache(struct mq_policy *mq, dm_oblock_t oblock, + + static int no_entry_found(struct mq_policy *mq, dm_oblock_t oblock, + bool can_migrate, bool discarded_oblock, +- int data_dir, struct policy_result *result) ++ int data_dir, struct policy_locker *locker, ++ struct policy_result *result) + { + if (adjusted_promote_threshold(mq, discarded_oblock, data_dir) <= 1) { + if (can_migrate) +- insert_in_cache(mq, oblock, result); ++ insert_in_cache(mq, oblock, locker, result); + else + return -EWOULDBLOCK; + } else { +@@ -928,7 +941,8 @@ static int no_entry_found(struct mq_policy *mq, dm_oblock_t oblock, + */ + static int map(struct mq_policy *mq, dm_oblock_t oblock, + bool can_migrate, bool discarded_oblock, +- int data_dir, struct policy_result *result) ++ int data_dir, struct policy_locker *locker, ++ struct policy_result *result) + { + int r = 0; + struct entry *e = hash_lookup(mq, oblock); +@@ -942,11 +956,11 @@ static int map(struct mq_policy *mq, dm_oblock_t oblock, + + else if (e) + r = pre_cache_entry_found(mq, e, can_migrate, discarded_oblock, +- data_dir, result); ++ data_dir, locker, result); + + else + r = no_entry_found(mq, oblock, can_migrate, discarded_oblock, +- data_dir, result); ++ data_dir, locker, result); + + if (r == -EWOULDBLOCK) + result->op = POLICY_MISS; +@@ -1012,7 +1026,8 @@ static void copy_tick(struct mq_policy *mq) + + static int mq_map(struct dm_cache_policy *p, dm_oblock_t oblock, + bool can_block, bool can_migrate, bool discarded_oblock, +- struct bio *bio, struct policy_result *result) ++ struct bio *bio, struct policy_locker *locker, ++ struct policy_result *result) + { + int r; + struct mq_policy *mq = to_mq_policy(p); +@@ -1028,7 +1043,7 @@ static int mq_map(struct dm_cache_policy *p, dm_oblock_t oblock, + + iot_examine_bio(&mq->tracker, bio); + r = map(mq, oblock, can_migrate, discarded_oblock, +- bio_data_dir(bio), result); ++ bio_data_dir(bio), locker, result); + + mutex_unlock(&mq->lock); + +diff --git a/drivers/md/dm-cache-policy.h b/drivers/md/dm-cache-policy.h +index f50fe36..5524e21 100644 +--- a/drivers/md/dm-cache-policy.h ++++ b/drivers/md/dm-cache-policy.h +@@ -70,6 +70,18 @@ enum policy_operation { + }; + + /* ++ * When issuing a POLICY_REPLACE the policy needs to make a callback to ++ * lock the block being demoted. This doesn't need to occur during a ++ * writeback operation since the block remains in the cache. ++ */ ++struct policy_locker; ++typedef int (*policy_lock_fn)(struct policy_locker *l, dm_oblock_t oblock); ++ ++struct policy_locker { ++ policy_lock_fn fn; ++}; ++ ++/* + * This is the instruction passed back to the core target. + */ + struct policy_result { +@@ -122,7 +134,8 @@ struct dm_cache_policy { + */ + int (*map)(struct dm_cache_policy *p, dm_oblock_t oblock, + bool can_block, bool can_migrate, bool discarded_oblock, +- struct bio *bio, struct policy_result *result); ++ struct bio *bio, struct policy_locker *locker, ++ struct policy_result *result); + + /* + * Sometimes we want to see if a block is in the cache, without +diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c +index 7755af3..e049bec 100644 +--- a/drivers/md/dm-cache-target.c ++++ b/drivers/md/dm-cache-target.c +@@ -1445,16 +1445,43 @@ static void inc_miss_counter(struct cache *cache, struct bio *bio) + &cache->stats.read_miss : &cache->stats.write_miss); + } + ++/*----------------------------------------------------------------*/ ++ ++struct old_oblock_lock { ++ struct policy_locker locker; ++ struct cache *cache; ++ struct prealloc *structs; ++ struct dm_bio_prison_cell *cell; ++}; ++ ++static int null_locker(struct policy_locker *locker, dm_oblock_t b) ++{ ++ /* This should never be called */ ++ BUG(); ++ return 0; ++} ++ ++static int cell_locker(struct policy_locker *locker, dm_oblock_t b) ++{ ++ struct old_oblock_lock *l = container_of(locker, struct old_oblock_lock, locker); ++ struct dm_bio_prison_cell *cell_prealloc = prealloc_get_cell(l->structs); ++ ++ return bio_detain(l->cache, b, NULL, cell_prealloc, ++ (cell_free_fn) prealloc_put_cell, ++ l->structs, &l->cell); ++} ++ + static void process_bio(struct cache *cache, struct prealloc *structs, + struct bio *bio) + { + int r; + bool release_cell = true; + dm_oblock_t block = get_bio_block(cache, bio); +- struct dm_bio_prison_cell *cell_prealloc, *old_ocell, *new_ocell; ++ struct dm_bio_prison_cell *cell_prealloc, *new_ocell; + struct policy_result lookup_result; + bool passthrough = passthrough_mode(&cache->features); + bool discarded_block, can_migrate; ++ struct old_oblock_lock ool; + + /* + * Check to see if that block is currently migrating. +@@ -1469,8 +1496,12 @@ static void process_bio(struct cache *cache, struct prealloc *structs, + discarded_block = is_discarded_oblock(cache, block); + can_migrate = !passthrough && (discarded_block || spare_migration_bandwidth(cache)); + ++ ool.locker.fn = cell_locker; ++ ool.cache = cache; ++ ool.structs = structs; ++ ool.cell = NULL; + r = policy_map(cache->policy, block, true, can_migrate, discarded_block, +- bio, &lookup_result); ++ bio, &ool.locker, &lookup_result); + + if (r == -EWOULDBLOCK) + /* migration has been denied */ +@@ -1527,27 +1558,11 @@ static void process_bio(struct cache *cache, struct prealloc *structs, + break; + + case POLICY_REPLACE: +- cell_prealloc = prealloc_get_cell(structs); +- r = bio_detain(cache, lookup_result.old_oblock, bio, cell_prealloc, +- (cell_free_fn) prealloc_put_cell, +- structs, &old_ocell); +- if (r > 0) { +- /* +- * We have to be careful to avoid lock inversion of +- * the cells. So we back off, and wait for the +- * old_ocell to become free. +- */ +- policy_force_mapping(cache->policy, block, +- lookup_result.old_oblock); +- atomic_inc(&cache->stats.cache_cell_clash); +- break; +- } + atomic_inc(&cache->stats.demotion); + atomic_inc(&cache->stats.promotion); +- + demote_then_promote(cache, structs, lookup_result.old_oblock, + block, lookup_result.cblock, +- old_ocell, new_ocell); ++ ool.cell, new_ocell); + release_cell = false; + break; + +@@ -2595,6 +2610,9 @@ static int __cache_map(struct cache *cache, struct bio *bio, struct dm_bio_priso + bool discarded_block; + struct policy_result lookup_result; + struct per_bio_data *pb = init_per_bio_data(bio, pb_data_size); ++ struct old_oblock_lock ool; ++ ++ ool.locker.fn = null_locker; + + if (unlikely(from_oblock(block) >= from_oblock(cache->origin_blocks))) { + /* +@@ -2633,7 +2651,7 @@ static int __cache_map(struct cache *cache, struct bio *bio, struct dm_bio_priso + discarded_block = is_discarded_oblock(cache, block); + + r = policy_map(cache->policy, block, false, can_migrate, discarded_block, +- bio, &lookup_result); ++ bio, &ool.locker, &lookup_result); + if (r == -EWOULDBLOCK) { + cell_defer(cache, *cell, true); + return DM_MAPIO_SUBMITTED; +diff --git a/drivers/md/dm-stats.c b/drivers/md/dm-stats.c +index f478a4c..419bdd4 100644 +--- a/drivers/md/dm-stats.c ++++ b/drivers/md/dm-stats.c +@@ -795,6 +795,8 @@ static int message_stats_create(struct mapped_device *md, + return -EINVAL; + + if (sscanf(argv[2], "/%u%c", &divisor, &dummy) == 1) { ++ if (!divisor) ++ return -EINVAL; + step = end - start; + if (do_div(step, divisor)) + step++; +diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c +index 921aafd..e22e6c8 100644 +--- a/drivers/md/dm-thin.c ++++ b/drivers/md/dm-thin.c +@@ -18,6 +18,7 @@ + #include <linux/init.h> + #include <linux/module.h> + #include <linux/slab.h> ++#include <linux/vmalloc.h> + #include <linux/sort.h> + #include <linux/rbtree.h> + +@@ -260,7 +261,7 @@ struct pool { + process_mapping_fn process_prepared_mapping; + process_mapping_fn process_prepared_discard; + +- struct dm_bio_prison_cell *cell_sort_array[CELL_SORT_ARRAY_SIZE]; ++ struct dm_bio_prison_cell **cell_sort_array; + }; + + static enum pool_mode get_pool_mode(struct pool *pool); +@@ -2499,6 +2500,7 @@ static void __pool_destroy(struct pool *pool) + { + __pool_table_remove(pool); + ++ vfree(pool->cell_sort_array); + if (dm_pool_metadata_close(pool->pmd) < 0) + DMWARN("%s: dm_pool_metadata_close() failed.", __func__); + +@@ -2611,6 +2613,13 @@ static struct pool *pool_create(struct mapped_device *pool_md, + goto bad_mapping_pool; + } + ++ pool->cell_sort_array = vmalloc(sizeof(*pool->cell_sort_array) * CELL_SORT_ARRAY_SIZE); ++ if (!pool->cell_sort_array) { ++ *error = "Error allocating cell sort array"; ++ err_p = ERR_PTR(-ENOMEM); ++ goto bad_sort_array; ++ } ++ + pool->ref_count = 1; + pool->last_commit_jiffies = jiffies; + pool->pool_md = pool_md; +@@ -2619,6 +2628,8 @@ static struct pool *pool_create(struct mapped_device *pool_md, + + return pool; + ++bad_sort_array: ++ mempool_destroy(pool->mapping_pool); + bad_mapping_pool: + dm_deferred_set_destroy(pool->all_io_ds); + bad_all_io_ds: +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 4dbed4a..b920028 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -4005,8 +4005,10 @@ new_dev_store(struct mddev *mddev, const char *buf, size_t len) + else + rdev = md_import_device(dev, -1, -1); + +- if (IS_ERR(rdev)) ++ if (IS_ERR(rdev)) { ++ mddev_unlock(mddev); + return PTR_ERR(rdev); ++ } + err = bind_rdev_to_array(rdev, mddev); + out: + if (err) +@@ -5159,6 +5161,7 @@ int md_run(struct mddev *mddev) + mddev_detach(mddev); + if (mddev->private) + pers->free(mddev, mddev->private); ++ mddev->private = NULL; + module_put(pers->owner); + bitmap_destroy(mddev); + return err; +@@ -5294,6 +5297,7 @@ static void md_clean(struct mddev *mddev) + mddev->changed = 0; + mddev->degraded = 0; + mddev->safemode = 0; ++ mddev->private = NULL; + mddev->merge_check_needed = 0; + mddev->bitmap_info.offset = 0; + mddev->bitmap_info.default_offset = 0; +@@ -5366,6 +5370,7 @@ static void __md_stop(struct mddev *mddev) + mddev->pers = NULL; + spin_unlock(&mddev->lock); + pers->free(mddev, mddev->private); ++ mddev->private = NULL; + if (pers->sync_request && mddev->to_remove == NULL) + mddev->to_remove = &md_redundancy_group; + module_put(pers->owner); +@@ -6375,7 +6380,7 @@ static int update_array_info(struct mddev *mddev, mdu_array_info_t *info) + mddev->ctime != info->ctime || + mddev->level != info->level || + /* mddev->layout != info->layout || */ +- !mddev->persistent != info->not_persistent|| ++ mddev->persistent != !info->not_persistent || + mddev->chunk_sectors != info->chunk_size >> 9 || + /* ignore bottom 8 bits of state, and allow SB_BITMAP_PRESENT to change */ + ((state^info->state) & 0xfffffe00) +diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c +index b88757c..a03178e 100644 +--- a/drivers/md/persistent-data/dm-btree-remove.c ++++ b/drivers/md/persistent-data/dm-btree-remove.c +@@ -309,8 +309,8 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent, + + if (s < 0 && nr_center < -s) { + /* not enough in central node */ +- shift(left, center, nr_center); +- s = nr_center - target; ++ shift(left, center, -nr_center); ++ s += nr_center; + shift(left, right, s); + nr_right += s; + } else +@@ -323,7 +323,7 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent, + if (s > 0 && nr_center < s) { + /* not enough in central node */ + shift(center, right, nr_center); +- s = target - nr_center; ++ s -= nr_center; + shift(left, right, s); + nr_left -= s; + } else +diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c +index 200ac12..fdd3793 100644 +--- a/drivers/md/persistent-data/dm-btree.c ++++ b/drivers/md/persistent-data/dm-btree.c +@@ -255,7 +255,7 @@ int dm_btree_del(struct dm_btree_info *info, dm_block_t root) + int r; + struct del_stack *s; + +- s = kmalloc(sizeof(*s), GFP_KERNEL); ++ s = kmalloc(sizeof(*s), GFP_NOIO); + if (!s) + return -ENOMEM; + s->info = info; +diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c +index e8a9042..5309129 100644 +--- a/drivers/md/persistent-data/dm-space-map-metadata.c ++++ b/drivers/md/persistent-data/dm-space-map-metadata.c +@@ -204,6 +204,27 @@ static void in(struct sm_metadata *smm) + smm->recursion_count++; + } + ++static int apply_bops(struct sm_metadata *smm) ++{ ++ int r = 0; ++ ++ while (!brb_empty(&smm->uncommitted)) { ++ struct block_op bop; ++ ++ r = brb_pop(&smm->uncommitted, &bop); ++ if (r) { ++ DMERR("bug in bop ring buffer"); ++ break; ++ } ++ ++ r = commit_bop(smm, &bop); ++ if (r) ++ break; ++ } ++ ++ return r; ++} ++ + static int out(struct sm_metadata *smm) + { + int r = 0; +@@ -216,21 +237,8 @@ static int out(struct sm_metadata *smm) + return -ENOMEM; + } + +- if (smm->recursion_count == 1) { +- while (!brb_empty(&smm->uncommitted)) { +- struct block_op bop; +- +- r = brb_pop(&smm->uncommitted, &bop); +- if (r) { +- DMERR("bug in bop ring buffer"); +- break; +- } +- +- r = commit_bop(smm, &bop); +- if (r) +- break; +- } +- } ++ if (smm->recursion_count == 1) ++ apply_bops(smm); + + smm->recursion_count--; + +@@ -704,6 +712,12 @@ static int sm_metadata_extend(struct dm_space_map *sm, dm_block_t extra_blocks) + } + old_len = smm->begin; + ++ r = apply_bops(smm); ++ if (r) { ++ DMERR("%s: apply_bops failed", __func__); ++ goto out; ++ } ++ + r = sm_ll_commit(&smm->ll); + if (r) + goto out; +@@ -773,6 +787,12 @@ int dm_sm_metadata_create(struct dm_space_map *sm, + if (r) + return r; + ++ r = apply_bops(smm); ++ if (r) { ++ DMERR("%s: apply_bops failed", __func__); ++ return r; ++ } ++ + return sm_metadata_commit(sm); + } + +diff --git a/drivers/media/dvb-frontends/af9013.c b/drivers/media/dvb-frontends/af9013.c +index 8001690..ba6c8f6 100644 +--- a/drivers/media/dvb-frontends/af9013.c ++++ b/drivers/media/dvb-frontends/af9013.c +@@ -605,6 +605,10 @@ static int af9013_set_frontend(struct dvb_frontend *fe) + } + } + ++ /* Return an error if can't find bandwidth or the right clock */ ++ if (i == ARRAY_SIZE(coeff_lut)) ++ return -EINVAL; ++ + ret = af9013_wr_regs(state, 0xae00, coeff_lut[i].val, + sizeof(coeff_lut[i].val)); + } +diff --git a/drivers/media/dvb-frontends/cx24116.c b/drivers/media/dvb-frontends/cx24116.c +index 2916d7c..7bc68b3 100644 +--- a/drivers/media/dvb-frontends/cx24116.c ++++ b/drivers/media/dvb-frontends/cx24116.c +@@ -963,6 +963,10 @@ static int cx24116_send_diseqc_msg(struct dvb_frontend *fe, + struct cx24116_state *state = fe->demodulator_priv; + int i, ret; + ++ /* Validate length */ ++ if (d->msg_len > sizeof(d->msg)) ++ return -EINVAL; ++ + /* Dump DiSEqC message */ + if (debug) { + printk(KERN_INFO "cx24116: %s(", __func__); +@@ -974,10 +978,6 @@ static int cx24116_send_diseqc_msg(struct dvb_frontend *fe, + printk(") toneburst=%d\n", toneburst); + } + +- /* Validate length */ +- if (d->msg_len > (CX24116_ARGLEN - CX24116_DISEQC_MSGOFS)) +- return -EINVAL; +- + /* DiSEqC message */ + for (i = 0; i < d->msg_len; i++) + state->dsec_cmd.args[CX24116_DISEQC_MSGOFS + i] = d->msg[i]; +diff --git a/drivers/media/dvb-frontends/cx24117.c b/drivers/media/dvb-frontends/cx24117.c +index acb965c..af63635 100644 +--- a/drivers/media/dvb-frontends/cx24117.c ++++ b/drivers/media/dvb-frontends/cx24117.c +@@ -1043,7 +1043,7 @@ static int cx24117_send_diseqc_msg(struct dvb_frontend *fe, + dev_dbg(&state->priv->i2c->dev, ")\n"); + + /* Validate length */ +- if (d->msg_len > 15) ++ if (d->msg_len > sizeof(d->msg)) + return -EINVAL; + + /* DiSEqC message */ +diff --git a/drivers/media/dvb-frontends/s5h1420.c b/drivers/media/dvb-frontends/s5h1420.c +index 93eeaf7..0b4f8fe 100644 +--- a/drivers/media/dvb-frontends/s5h1420.c ++++ b/drivers/media/dvb-frontends/s5h1420.c +@@ -180,7 +180,7 @@ static int s5h1420_send_master_cmd (struct dvb_frontend* fe, + int result = 0; + + dprintk("enter %s\n", __func__); +- if (cmd->msg_len > 8) ++ if (cmd->msg_len > sizeof(cmd->msg)) + return -EINVAL; + + /* setup for DISEQC */ +diff --git a/drivers/media/pci/cx18/cx18-streams.c b/drivers/media/pci/cx18/cx18-streams.c +index c82d25d..c986084 100644 +--- a/drivers/media/pci/cx18/cx18-streams.c ++++ b/drivers/media/pci/cx18/cx18-streams.c +@@ -90,6 +90,7 @@ static struct { + "encoder PCM audio", + VFL_TYPE_GRABBER, CX18_V4L2_ENC_PCM_OFFSET, + PCI_DMA_FROMDEVICE, ++ V4L2_CAP_TUNER | V4L2_CAP_AUDIO | V4L2_CAP_READWRITE, + }, + { /* CX18_ENC_STREAM_TYPE_IDX */ + "encoder IDX", +diff --git a/drivers/media/pci/saa7164/saa7164-encoder.c b/drivers/media/pci/saa7164/saa7164-encoder.c +index 9266965..7a0a651 100644 +--- a/drivers/media/pci/saa7164/saa7164-encoder.c ++++ b/drivers/media/pci/saa7164/saa7164-encoder.c +@@ -721,13 +721,14 @@ static int vidioc_querycap(struct file *file, void *priv, + sizeof(cap->card)); + sprintf(cap->bus_info, "PCI:%s", pci_name(dev->pci)); + +- cap->capabilities = ++ cap->device_caps = + V4L2_CAP_VIDEO_CAPTURE | +- V4L2_CAP_READWRITE | +- 0; ++ V4L2_CAP_READWRITE | ++ V4L2_CAP_TUNER; + +- cap->capabilities |= V4L2_CAP_TUNER; +- cap->version = 0; ++ cap->capabilities = cap->device_caps | ++ V4L2_CAP_VBI_CAPTURE | ++ V4L2_CAP_DEVICE_CAPS; + + return 0; + } +diff --git a/drivers/media/pci/saa7164/saa7164-vbi.c b/drivers/media/pci/saa7164/saa7164-vbi.c +index 6e025fe..06117e6 100644 +--- a/drivers/media/pci/saa7164/saa7164-vbi.c ++++ b/drivers/media/pci/saa7164/saa7164-vbi.c +@@ -660,13 +660,14 @@ static int vidioc_querycap(struct file *file, void *priv, + sizeof(cap->card)); + sprintf(cap->bus_info, "PCI:%s", pci_name(dev->pci)); + +- cap->capabilities = ++ cap->device_caps = + V4L2_CAP_VBI_CAPTURE | +- V4L2_CAP_READWRITE | +- 0; ++ V4L2_CAP_READWRITE | ++ V4L2_CAP_TUNER; + +- cap->capabilities |= V4L2_CAP_TUNER; +- cap->version = 0; ++ cap->capabilities = cap->device_caps | ++ V4L2_CAP_VIDEO_CAPTURE | ++ V4L2_CAP_DEVICE_CAPS; + + return 0; + } +diff --git a/drivers/media/usb/dvb-usb/dib0700_core.c b/drivers/media/usb/dvb-usb/dib0700_core.c +index 2b40393..0d248ce 100644 +--- a/drivers/media/usb/dvb-usb/dib0700_core.c ++++ b/drivers/media/usb/dvb-usb/dib0700_core.c +@@ -655,10 +655,20 @@ out: + struct dib0700_rc_response { + u8 report_id; + u8 data_state; +- u8 system; +- u8 not_system; +- u8 data; +- u8 not_data; ++ union { ++ struct { ++ u8 system; ++ u8 not_system; ++ u8 data; ++ u8 not_data; ++ } nec; ++ struct { ++ u8 not_used; ++ u8 system; ++ u8 data; ++ u8 not_data; ++ } rc5; ++ }; + }; + #define RC_MSG_SIZE_V1_20 6 + +@@ -694,8 +704,8 @@ static void dib0700_rc_urb_completion(struct urb *purb) + + deb_data("IR ID = %02X state = %02X System = %02X %02X Cmd = %02X %02X (len %d)\n", + poll_reply->report_id, poll_reply->data_state, +- poll_reply->system, poll_reply->not_system, +- poll_reply->data, poll_reply->not_data, ++ poll_reply->nec.system, poll_reply->nec.not_system, ++ poll_reply->nec.data, poll_reply->nec.not_data, + purb->actual_length); + + switch (d->props.rc.core.protocol) { +@@ -704,30 +714,30 @@ static void dib0700_rc_urb_completion(struct urb *purb) + toggle = 0; + + /* NEC protocol sends repeat code as 0 0 0 FF */ +- if (poll_reply->system == 0x00 && +- poll_reply->not_system == 0x00 && +- poll_reply->data == 0x00 && +- poll_reply->not_data == 0xff) { ++ if (poll_reply->nec.system == 0x00 && ++ poll_reply->nec.not_system == 0x00 && ++ poll_reply->nec.data == 0x00 && ++ poll_reply->nec.not_data == 0xff) { + poll_reply->data_state = 2; + break; + } + +- if ((poll_reply->data ^ poll_reply->not_data) != 0xff) { ++ if ((poll_reply->nec.data ^ poll_reply->nec.not_data) != 0xff) { + deb_data("NEC32 protocol\n"); +- keycode = RC_SCANCODE_NEC32(poll_reply->system << 24 | +- poll_reply->not_system << 16 | +- poll_reply->data << 8 | +- poll_reply->not_data); +- } else if ((poll_reply->system ^ poll_reply->not_system) != 0xff) { ++ keycode = RC_SCANCODE_NEC32(poll_reply->nec.system << 24 | ++ poll_reply->nec.not_system << 16 | ++ poll_reply->nec.data << 8 | ++ poll_reply->nec.not_data); ++ } else if ((poll_reply->nec.system ^ poll_reply->nec.not_system) != 0xff) { + deb_data("NEC extended protocol\n"); +- keycode = RC_SCANCODE_NECX(poll_reply->system << 8 | +- poll_reply->not_system, +- poll_reply->data); ++ keycode = RC_SCANCODE_NECX(poll_reply->nec.system << 8 | ++ poll_reply->nec.not_system, ++ poll_reply->nec.data); + + } else { + deb_data("NEC normal protocol\n"); +- keycode = RC_SCANCODE_NEC(poll_reply->system, +- poll_reply->data); ++ keycode = RC_SCANCODE_NEC(poll_reply->nec.system, ++ poll_reply->nec.data); + } + + break; +@@ -735,19 +745,19 @@ static void dib0700_rc_urb_completion(struct urb *purb) + deb_data("RC5 protocol\n"); + protocol = RC_TYPE_RC5; + toggle = poll_reply->report_id; +- keycode = RC_SCANCODE_RC5(poll_reply->system, poll_reply->data); ++ keycode = RC_SCANCODE_RC5(poll_reply->rc5.system, poll_reply->rc5.data); ++ ++ if ((poll_reply->rc5.data ^ poll_reply->rc5.not_data) != 0xff) { ++ /* Key failed integrity check */ ++ err("key failed integrity check: %02x %02x %02x %02x", ++ poll_reply->rc5.not_used, poll_reply->rc5.system, ++ poll_reply->rc5.data, poll_reply->rc5.not_data); ++ goto resubmit; ++ } + + break; + } + +- if ((poll_reply->data + poll_reply->not_data) != 0xff) { +- /* Key failed integrity check */ +- err("key failed integrity check: %02x %02x %02x %02x", +- poll_reply->system, poll_reply->not_system, +- poll_reply->data, poll_reply->not_data); +- goto resubmit; +- } +- + rc_keydown(d->rc_dev, protocol, keycode, toggle); + + resubmit: +diff --git a/drivers/media/usb/dvb-usb/dib0700_devices.c b/drivers/media/usb/dvb-usb/dib0700_devices.c +index d7d55a2..c170523 100644 +--- a/drivers/media/usb/dvb-usb/dib0700_devices.c ++++ b/drivers/media/usb/dvb-usb/dib0700_devices.c +@@ -3944,6 +3944,8 @@ struct dvb_usb_device_properties dib0700_devices[] = { + + DIB0700_DEFAULT_STREAMING_CONFIG(0x02), + }}, ++ .size_of_priv = sizeof(struct ++ dib0700_adapter_state), + }, { + .num_frontends = 1, + .fe = {{ +@@ -3956,6 +3958,8 @@ struct dvb_usb_device_properties dib0700_devices[] = { + + DIB0700_DEFAULT_STREAMING_CONFIG(0x03), + }}, ++ .size_of_priv = sizeof(struct ++ dib0700_adapter_state), + } + }, + +@@ -4009,6 +4013,8 @@ struct dvb_usb_device_properties dib0700_devices[] = { + + DIB0700_DEFAULT_STREAMING_CONFIG(0x02), + }}, ++ .size_of_priv = sizeof(struct ++ dib0700_adapter_state), + }, + }, + +diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c +index 66ada01..cf9d644 100644 +--- a/drivers/media/v4l2-core/videobuf2-core.c ++++ b/drivers/media/v4l2-core/videobuf2-core.c +@@ -1237,6 +1237,23 @@ void vb2_discard_done(struct vb2_queue *q) + } + EXPORT_SYMBOL_GPL(vb2_discard_done); + ++static void vb2_warn_zero_bytesused(struct vb2_buffer *vb) ++{ ++ static bool __check_once __read_mostly; ++ ++ if (__check_once) ++ return; ++ ++ __check_once = true; ++ __WARN(); ++ ++ pr_warn_once("use of bytesused == 0 is deprecated and will be removed in the future,\n"); ++ if (vb->vb2_queue->allow_zero_bytesused) ++ pr_warn_once("use VIDIOC_DECODER_CMD(V4L2_DEC_CMD_STOP) instead.\n"); ++ else ++ pr_warn_once("use the actual size instead.\n"); ++} ++ + /** + * __fill_vb2_buffer() - fill a vb2_buffer with information provided in a + * v4l2_buffer by the userspace. The caller has already verified that struct +@@ -1247,16 +1264,6 @@ static void __fill_vb2_buffer(struct vb2_buffer *vb, const struct v4l2_buffer *b + { + unsigned int plane; + +- if (V4L2_TYPE_IS_OUTPUT(b->type)) { +- if (WARN_ON_ONCE(b->bytesused == 0)) { +- pr_warn_once("use of bytesused == 0 is deprecated and will be removed in the future,\n"); +- if (vb->vb2_queue->allow_zero_bytesused) +- pr_warn_once("use VIDIOC_DECODER_CMD(V4L2_DEC_CMD_STOP) instead.\n"); +- else +- pr_warn_once("use the actual size instead.\n"); +- } +- } +- + if (V4L2_TYPE_IS_MULTIPLANAR(b->type)) { + if (b->memory == V4L2_MEMORY_USERPTR) { + for (plane = 0; plane < vb->num_planes; ++plane) { +@@ -1297,6 +1304,9 @@ static void __fill_vb2_buffer(struct vb2_buffer *vb, const struct v4l2_buffer *b + struct v4l2_plane *pdst = &v4l2_planes[plane]; + struct v4l2_plane *psrc = &b->m.planes[plane]; + ++ if (psrc->bytesused == 0) ++ vb2_warn_zero_bytesused(vb); ++ + if (vb->vb2_queue->allow_zero_bytesused) + pdst->bytesused = psrc->bytesused; + else +@@ -1331,6 +1341,9 @@ static void __fill_vb2_buffer(struct vb2_buffer *vb, const struct v4l2_buffer *b + } + + if (V4L2_TYPE_IS_OUTPUT(b->type)) { ++ if (b->bytesused == 0) ++ vb2_warn_zero_bytesused(vb); ++ + if (vb->vb2_queue->allow_zero_bytesused) + v4l2_planes[0].bytesused = b->bytesused; + else +diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c +index 60f7141..31d2627 100644 +--- a/drivers/mmc/card/block.c ++++ b/drivers/mmc/card/block.c +@@ -208,6 +208,8 @@ static ssize_t power_ro_lock_show(struct device *dev, + + ret = snprintf(buf, PAGE_SIZE, "%d\n", locked); + ++ mmc_blk_put(md); ++ + return ret; + } + +@@ -1910,9 +1912,11 @@ static int mmc_blk_issue_rw_rq(struct mmc_queue *mq, struct request *rqc) + break; + case MMC_BLK_CMD_ERR: + ret = mmc_blk_cmd_err(md, card, brq, req, ret); +- if (!mmc_blk_reset(md, card->host, type)) +- break; +- goto cmd_abort; ++ if (mmc_blk_reset(md, card->host, type)) ++ goto cmd_abort; ++ if (!ret) ++ goto start_new_req; ++ break; + case MMC_BLK_RETRY: + if (retry++ < 5) + break; +diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c +index 9231cdf..d3dbb28 100644 +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -3315,13 +3315,14 @@ int sdhci_add_host(struct sdhci_host *host) + SDHCI_MAX_CURRENT_MULTIPLIER; + } + +- /* If OCR set by external regulators, use it instead */ ++ /* If OCR set by host, use it instead. */ ++ if (host->ocr_mask) ++ ocr_avail = host->ocr_mask; ++ ++ /* If OCR set by external regulators, give it highest prio. */ + if (mmc->ocr_avail) + ocr_avail = mmc->ocr_avail; + +- if (host->ocr_mask) +- ocr_avail &= host->ocr_mask; +- + mmc->ocr_avail = ocr_avail; + mmc->ocr_avail_sdio = ocr_avail; + if (host->ocr_avail_sdio) +diff --git a/drivers/net/ethernet/intel/e1000e/82571.c b/drivers/net/ethernet/intel/e1000e/82571.c +index dc79ed8..32e7775 100644 +--- a/drivers/net/ethernet/intel/e1000e/82571.c ++++ b/drivers/net/ethernet/intel/e1000e/82571.c +@@ -2010,7 +2010,7 @@ const struct e1000_info e1000_82573_info = { + .flags2 = FLAG2_DISABLE_ASPM_L1 + | FLAG2_DISABLE_ASPM_L0S, + .pba = 20, +- .max_hw_frame_size = ETH_FRAME_LEN + ETH_FCS_LEN, ++ .max_hw_frame_size = VLAN_ETH_FRAME_LEN + ETH_FCS_LEN, + .get_variants = e1000_get_variants_82571, + .mac_ops = &e82571_mac_ops, + .phy_ops = &e82_phy_ops_m88, +diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c +index 9d81c03..e2498db 100644 +--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c ++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c +@@ -1563,7 +1563,7 @@ static s32 e1000_get_variants_ich8lan(struct e1000_adapter *adapter) + ((adapter->hw.mac.type >= e1000_pch2lan) && + (!(er32(CTRL_EXT) & E1000_CTRL_EXT_LSECCK)))) { + adapter->flags &= ~FLAG_HAS_JUMBO_FRAMES; +- adapter->max_hw_frame_size = ETH_FRAME_LEN + ETH_FCS_LEN; ++ adapter->max_hw_frame_size = VLAN_ETH_FRAME_LEN + ETH_FCS_LEN; + + hw->mac.ops.blink_led = NULL; + } +@@ -5681,7 +5681,7 @@ const struct e1000_info e1000_ich8_info = { + | FLAG_HAS_FLASH + | FLAG_APME_IN_WUC, + .pba = 8, +- .max_hw_frame_size = ETH_FRAME_LEN + ETH_FCS_LEN, ++ .max_hw_frame_size = VLAN_ETH_FRAME_LEN + ETH_FCS_LEN, + .get_variants = e1000_get_variants_ich8lan, + .mac_ops = &ich8_mac_ops, + .phy_ops = &ich8_phy_ops, +@@ -5754,7 +5754,7 @@ const struct e1000_info e1000_pch2_info = { + .flags2 = FLAG2_HAS_PHY_STATS + | FLAG2_HAS_EEE, + .pba = 26, +- .max_hw_frame_size = 9018, ++ .max_hw_frame_size = 9022, + .get_variants = e1000_get_variants_ich8lan, + .mac_ops = &ich8_mac_ops, + .phy_ops = &ich8_phy_ops, +@@ -5774,7 +5774,7 @@ const struct e1000_info e1000_pch_lpt_info = { + .flags2 = FLAG2_HAS_PHY_STATS + | FLAG2_HAS_EEE, + .pba = 26, +- .max_hw_frame_size = 9018, ++ .max_hw_frame_size = 9022, + .get_variants = e1000_get_variants_ich8lan, + .mac_ops = &ich8_mac_ops, + .phy_ops = &ich8_phy_ops, +@@ -5794,7 +5794,7 @@ const struct e1000_info e1000_pch_spt_info = { + .flags2 = FLAG2_HAS_PHY_STATS + | FLAG2_HAS_EEE, + .pba = 26, +- .max_hw_frame_size = 9018, ++ .max_hw_frame_size = 9022, + .get_variants = e1000_get_variants_ich8lan, + .mac_ops = &ich8_mac_ops, + .phy_ops = &ich8_phy_ops, +diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c +index c509a5c..68913d1 100644 +--- a/drivers/net/ethernet/intel/e1000e/netdev.c ++++ b/drivers/net/ethernet/intel/e1000e/netdev.c +@@ -3807,7 +3807,7 @@ void e1000e_reset(struct e1000_adapter *adapter) + /* reset Packet Buffer Allocation to default */ + ew32(PBA, pba); + +- if (adapter->max_frame_size > ETH_FRAME_LEN + ETH_FCS_LEN) { ++ if (adapter->max_frame_size > (VLAN_ETH_FRAME_LEN + ETH_FCS_LEN)) { + /* To maintain wire speed transmits, the Tx FIFO should be + * large enough to accommodate two full transmit packets, + * rounded up to the next 1KB and expressed in KB. Likewise, +@@ -4196,9 +4196,9 @@ static int e1000_sw_init(struct e1000_adapter *adapter) + { + struct net_device *netdev = adapter->netdev; + +- adapter->rx_buffer_len = ETH_FRAME_LEN + VLAN_HLEN + ETH_FCS_LEN; ++ adapter->rx_buffer_len = VLAN_ETH_FRAME_LEN + ETH_FCS_LEN; + adapter->rx_ps_bsize0 = 128; +- adapter->max_frame_size = netdev->mtu + ETH_HLEN + ETH_FCS_LEN; ++ adapter->max_frame_size = netdev->mtu + VLAN_ETH_HLEN + ETH_FCS_LEN; + adapter->min_frame_size = ETH_ZLEN + ETH_FCS_LEN; + adapter->tx_ring_count = E1000_DEFAULT_TXD; + adapter->rx_ring_count = E1000_DEFAULT_RXD; +@@ -5781,17 +5781,17 @@ struct rtnl_link_stats64 *e1000e_get_stats64(struct net_device *netdev, + static int e1000_change_mtu(struct net_device *netdev, int new_mtu) + { + struct e1000_adapter *adapter = netdev_priv(netdev); +- int max_frame = new_mtu + VLAN_HLEN + ETH_HLEN + ETH_FCS_LEN; ++ int max_frame = new_mtu + VLAN_ETH_HLEN + ETH_FCS_LEN; + + /* Jumbo frame support */ +- if ((max_frame > ETH_FRAME_LEN + ETH_FCS_LEN) && ++ if ((max_frame > (VLAN_ETH_FRAME_LEN + ETH_FCS_LEN)) && + !(adapter->flags & FLAG_HAS_JUMBO_FRAMES)) { + e_err("Jumbo Frames not supported.\n"); + return -EINVAL; + } + + /* Supported frame sizes */ +- if ((new_mtu < ETH_ZLEN + ETH_FCS_LEN + VLAN_HLEN) || ++ if ((new_mtu < (VLAN_ETH_ZLEN + ETH_FCS_LEN)) || + (max_frame > adapter->max_hw_frame_size)) { + e_err("Unsupported MTU setting\n"); + return -EINVAL; +@@ -5831,10 +5831,8 @@ static int e1000_change_mtu(struct net_device *netdev, int new_mtu) + adapter->rx_buffer_len = 4096; + + /* adjust allocation if LPE protects us, and we aren't using SBP */ +- if ((max_frame == ETH_FRAME_LEN + ETH_FCS_LEN) || +- (max_frame == ETH_FRAME_LEN + VLAN_HLEN + ETH_FCS_LEN)) +- adapter->rx_buffer_len = ETH_FRAME_LEN + VLAN_HLEN +- + ETH_FCS_LEN; ++ if (max_frame <= (VLAN_ETH_FRAME_LEN + ETH_FCS_LEN)) ++ adapter->rx_buffer_len = VLAN_ETH_FRAME_LEN + ETH_FCS_LEN; + + if (netif_running(netdev)) + e1000e_up(adapter); +diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h +index e82a0d4..5dbc617 100644 +--- a/drivers/net/wireless/ath/ath9k/htc.h ++++ b/drivers/net/wireless/ath/ath9k/htc.h +@@ -440,9 +440,9 @@ static inline void ath9k_htc_stop_btcoex(struct ath9k_htc_priv *priv) + } + #endif /* CONFIG_ATH9K_BTCOEX_SUPPORT */ + +-#define OP_BT_PRIORITY_DETECTED BIT(3) +-#define OP_BT_SCAN BIT(4) +-#define OP_TSF_RESET BIT(6) ++#define OP_BT_PRIORITY_DETECTED 3 ++#define OP_BT_SCAN 4 ++#define OP_TSF_RESET 6 + + enum htc_op_flags { + HTC_FWFLAG_NO_RMW, +diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c +index b0badef..d5f2fbf 100644 +--- a/drivers/net/wireless/ath/ath9k/main.c ++++ b/drivers/net/wireless/ath/ath9k/main.c +@@ -216,11 +216,13 @@ static bool ath_prepare_reset(struct ath_softc *sc) + ath_stop_ani(sc); + ath9k_hw_disable_interrupts(ah); + +- if (!ath_drain_all_txq(sc)) +- ret = false; +- +- if (!ath_stoprecv(sc)) +- ret = false; ++ if (AR_SREV_9300_20_OR_LATER(ah)) { ++ ret &= ath_stoprecv(sc); ++ ret &= ath_drain_all_txq(sc); ++ } else { ++ ret &= ath_drain_all_txq(sc); ++ ret &= ath_stoprecv(sc); ++ } + + return ret; + } +diff --git a/drivers/net/wireless/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/iwlwifi/mvm/debugfs.c +index 9ac04c1..8c17b94 100644 +--- a/drivers/net/wireless/iwlwifi/mvm/debugfs.c ++++ b/drivers/net/wireless/iwlwifi/mvm/debugfs.c +@@ -6,7 +6,7 @@ + * GPL LICENSE SUMMARY + * + * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved. +- * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH ++ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of version 2 of the GNU General Public License as +@@ -32,7 +32,7 @@ + * BSD LICENSE + * + * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved. +- * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH ++ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without +@@ -1356,6 +1356,7 @@ static ssize_t iwl_dbgfs_d0i3_refs_read(struct file *file, + PRINT_MVM_REF(IWL_MVM_REF_UCODE_DOWN); + PRINT_MVM_REF(IWL_MVM_REF_SCAN); + PRINT_MVM_REF(IWL_MVM_REF_ROC); ++ PRINT_MVM_REF(IWL_MVM_REF_ROC_AUX); + PRINT_MVM_REF(IWL_MVM_REF_P2P_CLIENT); + PRINT_MVM_REF(IWL_MVM_REF_AP_IBSS); + PRINT_MVM_REF(IWL_MVM_REF_USER); +diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c +index dda9f7b..60c138a 100644 +--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c ++++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c +@@ -1404,7 +1404,7 @@ void __iwl_mvm_mac_stop(struct iwl_mvm *mvm) + * The work item could be running or queued if the + * ROC time event stops just as we get here. + */ +- cancel_work_sync(&mvm->roc_done_wk); ++ flush_work(&mvm->roc_done_wk); + + iwl_trans_stop_device(mvm->trans); + +diff --git a/drivers/net/wireless/iwlwifi/mvm/mvm.h b/drivers/net/wireless/iwlwifi/mvm/mvm.h +index cf70f68..6af21da 100644 +--- a/drivers/net/wireless/iwlwifi/mvm/mvm.h ++++ b/drivers/net/wireless/iwlwifi/mvm/mvm.h +@@ -275,6 +275,7 @@ enum iwl_mvm_ref_type { + IWL_MVM_REF_UCODE_DOWN, + IWL_MVM_REF_SCAN, + IWL_MVM_REF_ROC, ++ IWL_MVM_REF_ROC_AUX, + IWL_MVM_REF_P2P_CLIENT, + IWL_MVM_REF_AP_IBSS, + IWL_MVM_REF_USER, +diff --git a/drivers/net/wireless/iwlwifi/mvm/time-event.c b/drivers/net/wireless/iwlwifi/mvm/time-event.c +index fd7b0d3..a7448cf 100644 +--- a/drivers/net/wireless/iwlwifi/mvm/time-event.c ++++ b/drivers/net/wireless/iwlwifi/mvm/time-event.c +@@ -6,7 +6,7 @@ + * GPL LICENSE SUMMARY + * + * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved. +- * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH ++ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of version 2 of the GNU General Public License as +@@ -32,7 +32,7 @@ + * BSD LICENSE + * + * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved. +- * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH ++ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without +@@ -108,12 +108,14 @@ void iwl_mvm_roc_done_wk(struct work_struct *wk) + * in the case that the time event actually completed in the firmware + * (which is handled in iwl_mvm_te_handle_notif). + */ +- if (test_and_clear_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status)) ++ if (test_and_clear_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status)) { + queues |= BIT(IWL_MVM_OFFCHANNEL_QUEUE); +- if (test_and_clear_bit(IWL_MVM_STATUS_ROC_AUX_RUNNING, &mvm->status)) ++ iwl_mvm_unref(mvm, IWL_MVM_REF_ROC); ++ } ++ if (test_and_clear_bit(IWL_MVM_STATUS_ROC_AUX_RUNNING, &mvm->status)) { + queues |= BIT(mvm->aux_queue); +- +- iwl_mvm_unref(mvm, IWL_MVM_REF_ROC); ++ iwl_mvm_unref(mvm, IWL_MVM_REF_ROC_AUX); ++ } + + synchronize_net(); + +@@ -393,6 +395,7 @@ static int iwl_mvm_aux_roc_te_handle_notif(struct iwl_mvm *mvm, + } else if (le32_to_cpu(notif->action) == TE_V2_NOTIF_HOST_EVENT_START) { + set_bit(IWL_MVM_STATUS_ROC_AUX_RUNNING, &mvm->status); + te_data->running = true; ++ iwl_mvm_ref(mvm, IWL_MVM_REF_ROC_AUX); + ieee80211_ready_on_channel(mvm->hw); /* Start TE */ + } else { + IWL_DEBUG_TE(mvm, +diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c b/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c +index 86ce5b1..e5d8108f 100644 +--- a/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c +@@ -1354,27 +1354,11 @@ void rtl88ee_set_qos(struct ieee80211_hw *hw, int aci) + } + } + +-static void rtl88ee_clear_interrupt(struct ieee80211_hw *hw) +-{ +- struct rtl_priv *rtlpriv = rtl_priv(hw); +- u32 tmp; +- +- tmp = rtl_read_dword(rtlpriv, REG_HISR); +- rtl_write_dword(rtlpriv, REG_HISR, tmp); +- +- tmp = rtl_read_dword(rtlpriv, REG_HISRE); +- rtl_write_dword(rtlpriv, REG_HISRE, tmp); +- +- tmp = rtl_read_dword(rtlpriv, REG_HSISR); +- rtl_write_dword(rtlpriv, REG_HSISR, tmp); +-} +- + void rtl88ee_enable_interrupt(struct ieee80211_hw *hw) + { + struct rtl_priv *rtlpriv = rtl_priv(hw); + struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw)); + +- rtl88ee_clear_interrupt(hw);/*clear it here first*/ + rtl_write_dword(rtlpriv, REG_HIMR, + rtlpci->irq_mask[0] & 0xFFFFFFFF); + rtl_write_dword(rtlpriv, REG_HIMRE, +diff --git a/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c b/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c +index da0a612..cbf2ca7 100644 +--- a/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c +@@ -1584,28 +1584,11 @@ void rtl92ee_set_qos(struct ieee80211_hw *hw, int aci) + } + } + +-static void rtl92ee_clear_interrupt(struct ieee80211_hw *hw) +-{ +- struct rtl_priv *rtlpriv = rtl_priv(hw); +- u32 tmp; +- +- tmp = rtl_read_dword(rtlpriv, REG_HISR); +- rtl_write_dword(rtlpriv, REG_HISR, tmp); +- +- tmp = rtl_read_dword(rtlpriv, REG_HISRE); +- rtl_write_dword(rtlpriv, REG_HISRE, tmp); +- +- tmp = rtl_read_dword(rtlpriv, REG_HSISR); +- rtl_write_dword(rtlpriv, REG_HSISR, tmp); +-} +- + void rtl92ee_enable_interrupt(struct ieee80211_hw *hw) + { + struct rtl_priv *rtlpriv = rtl_priv(hw); + struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw)); + +- rtl92ee_clear_interrupt(hw);/*clear it here first*/ +- + rtl_write_dword(rtlpriv, REG_HIMR, rtlpci->irq_mask[0] & 0xFFFFFFFF); + rtl_write_dword(rtlpriv, REG_HIMRE, rtlpci->irq_mask[1] & 0xFFFFFFFF); + rtlpci->irq_enabled = true; +diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c b/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c +index 67bb47d..a4b7eac 100644 +--- a/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c +@@ -1258,18 +1258,6 @@ void rtl8723e_set_qos(struct ieee80211_hw *hw, int aci) + } + } + +-static void rtl8723e_clear_interrupt(struct ieee80211_hw *hw) +-{ +- struct rtl_priv *rtlpriv = rtl_priv(hw); +- u32 tmp; +- +- tmp = rtl_read_dword(rtlpriv, REG_HISR); +- rtl_write_dword(rtlpriv, REG_HISR, tmp); +- +- tmp = rtl_read_dword(rtlpriv, REG_HISRE); +- rtl_write_dword(rtlpriv, REG_HISRE, tmp); +-} +- + void rtl8723e_enable_interrupt(struct ieee80211_hw *hw) + { + struct rtl_priv *rtlpriv = rtl_priv(hw); +@@ -1284,7 +1272,6 @@ void rtl8723e_disable_interrupt(struct ieee80211_hw *hw) + { + struct rtl_priv *rtlpriv = rtl_priv(hw); + struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw)); +- rtl8723e_clear_interrupt(hw);/*clear it here first*/ + rtl_write_dword(rtlpriv, 0x3a8, IMR8190_DISABLED); + rtl_write_dword(rtlpriv, 0x3ac, IMR8190_DISABLED); + rtlpci->irq_enabled = false; +diff --git a/drivers/net/wireless/rtlwifi/rtl8723be/hw.c b/drivers/net/wireless/rtlwifi/rtl8723be/hw.c +index b681af3..b941726 100644 +--- a/drivers/net/wireless/rtlwifi/rtl8723be/hw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8723be/hw.c +@@ -1634,28 +1634,11 @@ void rtl8723be_set_qos(struct ieee80211_hw *hw, int aci) + } + } + +-static void rtl8723be_clear_interrupt(struct ieee80211_hw *hw) +-{ +- struct rtl_priv *rtlpriv = rtl_priv(hw); +- u32 tmp; +- +- tmp = rtl_read_dword(rtlpriv, REG_HISR); +- rtl_write_dword(rtlpriv, REG_HISR, tmp); +- +- tmp = rtl_read_dword(rtlpriv, REG_HISRE); +- rtl_write_dword(rtlpriv, REG_HISRE, tmp); +- +- tmp = rtl_read_dword(rtlpriv, REG_HSISR); +- rtl_write_dword(rtlpriv, REG_HSISR, tmp); +-} +- + void rtl8723be_enable_interrupt(struct ieee80211_hw *hw) + { + struct rtl_priv *rtlpriv = rtl_priv(hw); + struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw)); + +- rtl8723be_clear_interrupt(hw);/*clear it here first*/ +- + rtl_write_dword(rtlpriv, REG_HIMR, rtlpci->irq_mask[0] & 0xFFFFFFFF); + rtl_write_dword(rtlpriv, REG_HIMRE, rtlpci->irq_mask[1] & 0xFFFFFFFF); + rtlpci->irq_enabled = true; +diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c b/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c +index 8704eee..57966e3 100644 +--- a/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c +@@ -2253,31 +2253,11 @@ void rtl8821ae_set_qos(struct ieee80211_hw *hw, int aci) + } + } + +-static void rtl8821ae_clear_interrupt(struct ieee80211_hw *hw) +-{ +- struct rtl_priv *rtlpriv = rtl_priv(hw); +- u32 tmp; +- tmp = rtl_read_dword(rtlpriv, REG_HISR); +- /*printk("clear interrupt first:\n"); +- printk("0x%x = 0x%08x\n",REG_HISR, tmp);*/ +- rtl_write_dword(rtlpriv, REG_HISR, tmp); +- +- tmp = rtl_read_dword(rtlpriv, REG_HISRE); +- /*printk("0x%x = 0x%08x\n",REG_HISRE, tmp);*/ +- rtl_write_dword(rtlpriv, REG_HISRE, tmp); +- +- tmp = rtl_read_dword(rtlpriv, REG_HSISR); +- /*printk("0x%x = 0x%08x\n",REG_HSISR, tmp);*/ +- rtl_write_dword(rtlpriv, REG_HSISR, tmp); +-} +- + void rtl8821ae_enable_interrupt(struct ieee80211_hw *hw) + { + struct rtl_priv *rtlpriv = rtl_priv(hw); + struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw)); + +- rtl8821ae_clear_interrupt(hw);/*clear it here first*/ +- + rtl_write_dword(rtlpriv, REG_HIMR, rtlpci->irq_mask[0] & 0xFFFFFFFF); + rtl_write_dword(rtlpriv, REG_HIMRE, rtlpci->irq_mask[1] & 0xFFFFFFFF); + rtlpci->irq_enabled = true; +diff --git a/drivers/nfc/st21nfcb/i2c.c b/drivers/nfc/st21nfcb/i2c.c +index 76a4cad..c44f8cf 100644 +--- a/drivers/nfc/st21nfcb/i2c.c ++++ b/drivers/nfc/st21nfcb/i2c.c +@@ -87,11 +87,6 @@ static void st21nfcb_nci_i2c_disable(void *phy_id) + gpio_set_value(phy->gpio_reset, 1); + } + +-static void st21nfcb_nci_remove_header(struct sk_buff *skb) +-{ +- skb_pull(skb, ST21NFCB_FRAME_HEADROOM); +-} +- + /* + * Writing a frame must not return the number of written bytes. + * It must return either zero for success, or <0 for error. +@@ -121,8 +116,6 @@ static int st21nfcb_nci_i2c_write(void *phy_id, struct sk_buff *skb) + r = 0; + } + +- st21nfcb_nci_remove_header(skb); +- + return r; + } + +@@ -366,9 +359,6 @@ static int st21nfcb_nci_i2c_remove(struct i2c_client *client) + + ndlc_remove(phy->ndlc); + +- if (phy->powered) +- st21nfcb_nci_i2c_disable(phy); +- + return 0; + } + +diff --git a/drivers/nfc/st21nfcb/st21nfcb.c b/drivers/nfc/st21nfcb/st21nfcb.c +index ca9871a..c7dc282 100644 +--- a/drivers/nfc/st21nfcb/st21nfcb.c ++++ b/drivers/nfc/st21nfcb/st21nfcb.c +@@ -131,11 +131,8 @@ EXPORT_SYMBOL_GPL(st21nfcb_nci_probe); + + void st21nfcb_nci_remove(struct nci_dev *ndev) + { +- struct st21nfcb_nci_info *info = nci_get_drvdata(ndev); +- + nci_unregister_device(ndev); + nci_free_device(ndev); +- kfree(info); + } + EXPORT_SYMBOL_GPL(st21nfcb_nci_remove); + +diff --git a/drivers/of/address.c b/drivers/of/address.c +index 6906a3f..8bfda6a 100644 +--- a/drivers/of/address.c ++++ b/drivers/of/address.c +@@ -712,7 +712,7 @@ int __weak pci_register_io_range(phys_addr_t addr, resource_size_t size) + } + + /* add the range to the list */ +- range = kzalloc(sizeof(*range), GFP_KERNEL); ++ range = kzalloc(sizeof(*range), GFP_ATOMIC); + if (!range) { + err = -ENOMEM; + goto end_register; +diff --git a/drivers/of/base.c b/drivers/of/base.c +index f065026..5ed9724 100644 +--- a/drivers/of/base.c ++++ b/drivers/of/base.c +@@ -89,7 +89,7 @@ EXPORT_SYMBOL(of_n_size_cells); + #ifdef CONFIG_NUMA + int __weak of_node_to_nid(struct device_node *np) + { +- return numa_node_id(); ++ return NUMA_NO_NODE; + } + #endif + +diff --git a/drivers/phy/phy-berlin-usb.c b/drivers/phy/phy-berlin-usb.c +index c6fc95b..ab54f28 100644 +--- a/drivers/phy/phy-berlin-usb.c ++++ b/drivers/phy/phy-berlin-usb.c +@@ -106,8 +106,8 @@ + static const u32 phy_berlin_pll_dividers[] = { + /* Berlin 2 */ + CLK_REF_DIV(0xc) | FEEDBACK_CLK_DIV(0x54), +- /* Berlin 2CD */ +- CLK_REF_DIV(0x6) | FEEDBACK_CLK_DIV(0x55), ++ /* Berlin 2CD/Q */ ++ CLK_REF_DIV(0xc) | FEEDBACK_CLK_DIV(0x54), + }; + + struct phy_berlin_usb_priv { +diff --git a/drivers/phy/phy-twl4030-usb.c b/drivers/phy/phy-twl4030-usb.c +index bc42d6a..8882afb 100644 +--- a/drivers/phy/phy-twl4030-usb.c ++++ b/drivers/phy/phy-twl4030-usb.c +@@ -711,7 +711,6 @@ static int twl4030_usb_probe(struct platform_device *pdev) + pm_runtime_use_autosuspend(&pdev->dev); + pm_runtime_set_autosuspend_delay(&pdev->dev, 2000); + pm_runtime_enable(&pdev->dev); +- pm_runtime_get_sync(&pdev->dev); + + /* Our job is to use irqs and status from the power module + * to keep the transceiver disabled when nothing's connected. +diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-370.c b/drivers/pinctrl/mvebu/pinctrl-armada-370.c +index 03aa58c..1eb084c 100644 +--- a/drivers/pinctrl/mvebu/pinctrl-armada-370.c ++++ b/drivers/pinctrl/mvebu/pinctrl-armada-370.c +@@ -370,11 +370,11 @@ static struct mvebu_mpp_mode mv88f6710_mpp_modes[] = { + MPP_MODE(64, + MPP_FUNCTION(0x0, "gpio", NULL), + MPP_FUNCTION(0x1, "spi0", "miso"), +- MPP_FUNCTION(0x2, "spi0-1", "cs1")), ++ MPP_FUNCTION(0x2, "spi0", "cs1")), + MPP_MODE(65, + MPP_FUNCTION(0x0, "gpio", NULL), + MPP_FUNCTION(0x1, "spi0", "mosi"), +- MPP_FUNCTION(0x2, "spi0-1", "cs2")), ++ MPP_FUNCTION(0x2, "spi0", "cs2")), + }; + + static struct mvebu_pinctrl_soc_info armada_370_pinctrl_info; +diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-375.c b/drivers/pinctrl/mvebu/pinctrl-armada-375.c +index ca1e757..203291b 100644 +--- a/drivers/pinctrl/mvebu/pinctrl-armada-375.c ++++ b/drivers/pinctrl/mvebu/pinctrl-armada-375.c +@@ -92,19 +92,17 @@ static struct mvebu_mpp_mode mv88f6720_mpp_modes[] = { + MPP_FUNCTION(0x5, "nand", "io1")), + MPP_MODE(8, + MPP_FUNCTION(0x0, "gpio", NULL), +- MPP_FUNCTION(0x1, "dev ", "bootcs"), ++ MPP_FUNCTION(0x1, "dev", "bootcs"), + MPP_FUNCTION(0x2, "spi0", "cs0"), + MPP_FUNCTION(0x3, "spi1", "cs0"), + MPP_FUNCTION(0x5, "nand", "ce")), + MPP_MODE(9, + MPP_FUNCTION(0x0, "gpio", NULL), +- MPP_FUNCTION(0x1, "nf", "wen"), + MPP_FUNCTION(0x2, "spi0", "sck"), + MPP_FUNCTION(0x3, "spi1", "sck"), + MPP_FUNCTION(0x5, "nand", "we")), + MPP_MODE(10, + MPP_FUNCTION(0x0, "gpio", NULL), +- MPP_FUNCTION(0x1, "nf", "ren"), + MPP_FUNCTION(0x2, "dram", "vttctrl"), + MPP_FUNCTION(0x3, "led", "c1"), + MPP_FUNCTION(0x5, "nand", "re"), +diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-38x.c b/drivers/pinctrl/mvebu/pinctrl-armada-38x.c +index 83bbcc7..ff411a5 100644 +--- a/drivers/pinctrl/mvebu/pinctrl-armada-38x.c ++++ b/drivers/pinctrl/mvebu/pinctrl-armada-38x.c +@@ -94,37 +94,39 @@ static struct mvebu_mpp_mode armada_38x_mpp_modes[] = { + MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS), + MPP_VAR_FUNCTION(1, "ge0", "rxd0", V_88F6810_PLUS), + MPP_VAR_FUNCTION(2, "pcie0", "rstout", V_88F6810_PLUS), +- MPP_VAR_FUNCTION(3, "pcie1", "rstout", V_88F6820_PLUS), + MPP_VAR_FUNCTION(4, "spi0", "cs1", V_88F6810_PLUS), +- MPP_VAR_FUNCTION(5, "dev", "ad14", V_88F6810_PLUS)), ++ MPP_VAR_FUNCTION(5, "dev", "ad14", V_88F6810_PLUS), ++ MPP_VAR_FUNCTION(6, "pcie3", "clkreq", V_88F6810_PLUS)), + MPP_MODE(13, + MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS), + MPP_VAR_FUNCTION(1, "ge0", "rxd1", V_88F6810_PLUS), + MPP_VAR_FUNCTION(2, "pcie0", "clkreq", V_88F6810_PLUS), + MPP_VAR_FUNCTION(3, "pcie1", "clkreq", V_88F6820_PLUS), + MPP_VAR_FUNCTION(4, "spi0", "cs2", V_88F6810_PLUS), +- MPP_VAR_FUNCTION(5, "dev", "ad15", V_88F6810_PLUS)), ++ MPP_VAR_FUNCTION(5, "dev", "ad15", V_88F6810_PLUS), ++ MPP_VAR_FUNCTION(6, "pcie2", "clkreq", V_88F6810_PLUS)), + MPP_MODE(14, + MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS), + MPP_VAR_FUNCTION(1, "ge0", "rxd2", V_88F6810_PLUS), + MPP_VAR_FUNCTION(2, "ptp", "clk", V_88F6810_PLUS), + MPP_VAR_FUNCTION(3, "m", "vtt_ctrl", V_88F6810_PLUS), + MPP_VAR_FUNCTION(4, "spi0", "cs3", V_88F6810_PLUS), +- MPP_VAR_FUNCTION(5, "dev", "wen1", V_88F6810_PLUS)), ++ MPP_VAR_FUNCTION(5, "dev", "wen1", V_88F6810_PLUS), ++ MPP_VAR_FUNCTION(6, "pcie3", "clkreq", V_88F6810_PLUS)), + MPP_MODE(15, + MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS), + MPP_VAR_FUNCTION(1, "ge0", "rxd3", V_88F6810_PLUS), + MPP_VAR_FUNCTION(2, "ge", "mdc slave", V_88F6810_PLUS), + MPP_VAR_FUNCTION(3, "pcie0", "rstout", V_88F6810_PLUS), +- MPP_VAR_FUNCTION(4, "spi0", "mosi", V_88F6810_PLUS), +- MPP_VAR_FUNCTION(5, "pcie1", "rstout", V_88F6820_PLUS)), ++ MPP_VAR_FUNCTION(4, "spi0", "mosi", V_88F6810_PLUS)), + MPP_MODE(16, + MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS), + MPP_VAR_FUNCTION(1, "ge0", "rxctl", V_88F6810_PLUS), + MPP_VAR_FUNCTION(2, "ge", "mdio slave", V_88F6810_PLUS), + MPP_VAR_FUNCTION(3, "m", "decc_err", V_88F6810_PLUS), + MPP_VAR_FUNCTION(4, "spi0", "miso", V_88F6810_PLUS), +- MPP_VAR_FUNCTION(5, "pcie0", "clkreq", V_88F6810_PLUS)), ++ MPP_VAR_FUNCTION(5, "pcie0", "clkreq", V_88F6810_PLUS), ++ MPP_VAR_FUNCTION(6, "pcie1", "clkreq", V_88F6820_PLUS)), + MPP_MODE(17, + MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS), + MPP_VAR_FUNCTION(1, "ge0", "rxclk", V_88F6810_PLUS), +@@ -137,13 +139,12 @@ static struct mvebu_mpp_mode armada_38x_mpp_modes[] = { + MPP_VAR_FUNCTION(1, "ge0", "rxerr", V_88F6810_PLUS), + MPP_VAR_FUNCTION(2, "ptp", "trig_gen", V_88F6810_PLUS), + MPP_VAR_FUNCTION(3, "ua1", "txd", V_88F6810_PLUS), +- MPP_VAR_FUNCTION(4, "spi0", "cs0", V_88F6810_PLUS), +- MPP_VAR_FUNCTION(5, "pcie1", "rstout", V_88F6820_PLUS)), ++ MPP_VAR_FUNCTION(4, "spi0", "cs0", V_88F6810_PLUS)), + MPP_MODE(19, + MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS), + MPP_VAR_FUNCTION(1, "ge0", "col", V_88F6810_PLUS), + MPP_VAR_FUNCTION(2, "ptp", "event_req", V_88F6810_PLUS), +- MPP_VAR_FUNCTION(3, "pcie0", "clkreq", V_88F6810_PLUS), ++ MPP_VAR_FUNCTION(3, "ge0", "txerr", V_88F6810_PLUS), + MPP_VAR_FUNCTION(4, "sata1", "prsnt", V_88F6810_PLUS), + MPP_VAR_FUNCTION(5, "ua0", "cts", V_88F6810_PLUS), + MPP_VAR_FUNCTION(6, "ua1", "rxd", V_88F6810_PLUS)), +@@ -151,7 +152,6 @@ static struct mvebu_mpp_mode armada_38x_mpp_modes[] = { + MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS), + MPP_VAR_FUNCTION(1, "ge0", "txclk", V_88F6810_PLUS), + MPP_VAR_FUNCTION(2, "ptp", "clk", V_88F6810_PLUS), +- MPP_VAR_FUNCTION(3, "pcie1", "rstout", V_88F6820_PLUS), + MPP_VAR_FUNCTION(4, "sata0", "prsnt", V_88F6810_PLUS), + MPP_VAR_FUNCTION(5, "ua0", "rts", V_88F6810_PLUS), + MPP_VAR_FUNCTION(6, "ua1", "txd", V_88F6810_PLUS)), +@@ -277,35 +277,27 @@ static struct mvebu_mpp_mode armada_38x_mpp_modes[] = { + MPP_VAR_FUNCTION(1, "pcie0", "clkreq", V_88F6810_PLUS), + MPP_VAR_FUNCTION(2, "m", "vtt_ctrl", V_88F6810_PLUS), + MPP_VAR_FUNCTION(3, "m", "decc_err", V_88F6810_PLUS), +- MPP_VAR_FUNCTION(4, "pcie0", "rstout", V_88F6810_PLUS), ++ MPP_VAR_FUNCTION(4, "spi1", "cs2", V_88F6810_PLUS), + MPP_VAR_FUNCTION(5, "dev", "clkout", V_88F6810_PLUS)), + MPP_MODE(44, + MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS), + MPP_VAR_FUNCTION(1, "sata0", "prsnt", V_88F6810_PLUS), + MPP_VAR_FUNCTION(2, "sata1", "prsnt", V_88F6810_PLUS), + MPP_VAR_FUNCTION(3, "sata2", "prsnt", V_88F6828), +- MPP_VAR_FUNCTION(4, "sata3", "prsnt", V_88F6828), +- MPP_VAR_FUNCTION(5, "pcie0", "rstout", V_88F6810_PLUS)), ++ MPP_VAR_FUNCTION(4, "sata3", "prsnt", V_88F6828)), + MPP_MODE(45, + MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS), + MPP_VAR_FUNCTION(1, "ref", "clk_out0", V_88F6810_PLUS), +- MPP_VAR_FUNCTION(2, "pcie0", "rstout", V_88F6810_PLUS), +- MPP_VAR_FUNCTION(3, "pcie1", "rstout", V_88F6820_PLUS), +- MPP_VAR_FUNCTION(4, "pcie2", "rstout", V_88F6810_PLUS), +- MPP_VAR_FUNCTION(5, "pcie3", "rstout", V_88F6810_PLUS)), ++ MPP_VAR_FUNCTION(2, "pcie0", "rstout", V_88F6810_PLUS)), + MPP_MODE(46, + MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS), + MPP_VAR_FUNCTION(1, "ref", "clk_out1", V_88F6810_PLUS), +- MPP_VAR_FUNCTION(2, "pcie0", "rstout", V_88F6810_PLUS), +- MPP_VAR_FUNCTION(3, "pcie1", "rstout", V_88F6820_PLUS), +- MPP_VAR_FUNCTION(4, "pcie2", "rstout", V_88F6810_PLUS), +- MPP_VAR_FUNCTION(5, "pcie3", "rstout", V_88F6810_PLUS)), ++ MPP_VAR_FUNCTION(2, "pcie0", "rstout", V_88F6810_PLUS)), + MPP_MODE(47, + MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS), + MPP_VAR_FUNCTION(1, "sata0", "prsnt", V_88F6810_PLUS), + MPP_VAR_FUNCTION(2, "sata1", "prsnt", V_88F6810_PLUS), + MPP_VAR_FUNCTION(3, "sata2", "prsnt", V_88F6828), +- MPP_VAR_FUNCTION(4, "spi1", "cs2", V_88F6810_PLUS), + MPP_VAR_FUNCTION(5, "sata3", "prsnt", V_88F6828)), + MPP_MODE(48, + MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS), +@@ -313,18 +305,19 @@ static struct mvebu_mpp_mode armada_38x_mpp_modes[] = { + MPP_VAR_FUNCTION(2, "m", "vtt_ctrl", V_88F6810_PLUS), + MPP_VAR_FUNCTION(3, "tdm2c", "pclk", V_88F6810_PLUS), + MPP_VAR_FUNCTION(4, "audio", "mclk", V_88F6810_PLUS), +- MPP_VAR_FUNCTION(5, "sd0", "d4", V_88F6810_PLUS)), ++ MPP_VAR_FUNCTION(5, "sd0", "d4", V_88F6810_PLUS), ++ MPP_VAR_FUNCTION(6, "pcie0", "clkreq", V_88F6810_PLUS)), + MPP_MODE(49, + MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS), + MPP_VAR_FUNCTION(1, "sata2", "prsnt", V_88F6828), + MPP_VAR_FUNCTION(2, "sata3", "prsnt", V_88F6828), + MPP_VAR_FUNCTION(3, "tdm2c", "fsync", V_88F6810_PLUS), + MPP_VAR_FUNCTION(4, "audio", "lrclk", V_88F6810_PLUS), +- MPP_VAR_FUNCTION(5, "sd0", "d5", V_88F6810_PLUS)), ++ MPP_VAR_FUNCTION(5, "sd0", "d5", V_88F6810_PLUS), ++ MPP_VAR_FUNCTION(6, "pcie1", "clkreq", V_88F6820_PLUS)), + MPP_MODE(50, + MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS), + MPP_VAR_FUNCTION(1, "pcie0", "rstout", V_88F6810_PLUS), +- MPP_VAR_FUNCTION(2, "pcie1", "rstout", V_88F6820_PLUS), + MPP_VAR_FUNCTION(3, "tdm2c", "drx", V_88F6810_PLUS), + MPP_VAR_FUNCTION(4, "audio", "extclk", V_88F6810_PLUS), + MPP_VAR_FUNCTION(5, "sd0", "cmd", V_88F6810_PLUS)), +@@ -336,7 +329,6 @@ static struct mvebu_mpp_mode armada_38x_mpp_modes[] = { + MPP_MODE(52, + MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS), + MPP_VAR_FUNCTION(1, "pcie0", "rstout", V_88F6810_PLUS), +- MPP_VAR_FUNCTION(2, "pcie1", "rstout", V_88F6820_PLUS), + MPP_VAR_FUNCTION(3, "tdm2c", "intn", V_88F6810_PLUS), + MPP_VAR_FUNCTION(4, "audio", "sdi", V_88F6810_PLUS), + MPP_VAR_FUNCTION(5, "sd0", "d6", V_88F6810_PLUS)), +@@ -352,7 +344,7 @@ static struct mvebu_mpp_mode armada_38x_mpp_modes[] = { + MPP_VAR_FUNCTION(1, "sata0", "prsnt", V_88F6810_PLUS), + MPP_VAR_FUNCTION(2, "sata1", "prsnt", V_88F6810_PLUS), + MPP_VAR_FUNCTION(3, "pcie0", "rstout", V_88F6810_PLUS), +- MPP_VAR_FUNCTION(4, "pcie1", "rstout", V_88F6820_PLUS), ++ MPP_VAR_FUNCTION(4, "ge0", "txerr", V_88F6810_PLUS), + MPP_VAR_FUNCTION(5, "sd0", "d3", V_88F6810_PLUS)), + MPP_MODE(55, + MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS), +@@ -382,7 +374,6 @@ static struct mvebu_mpp_mode armada_38x_mpp_modes[] = { + MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS), + MPP_VAR_FUNCTION(1, "pcie0", "rstout", V_88F6810_PLUS), + MPP_VAR_FUNCTION(2, "i2c1", "sda", V_88F6810_PLUS), +- MPP_VAR_FUNCTION(3, "pcie1", "rstout", V_88F6820_PLUS), + MPP_VAR_FUNCTION(4, "spi1", "cs0", V_88F6810_PLUS), + MPP_VAR_FUNCTION(5, "sd0", "d2", V_88F6810_PLUS)), + }; +@@ -411,7 +402,7 @@ static struct mvebu_mpp_ctrl armada_38x_mpp_controls[] = { + + static struct pinctrl_gpio_range armada_38x_mpp_gpio_ranges[] = { + MPP_GPIO_RANGE(0, 0, 0, 32), +- MPP_GPIO_RANGE(1, 32, 32, 27), ++ MPP_GPIO_RANGE(1, 32, 32, 28), + }; + + static int armada_38x_pinctrl_probe(struct platform_device *pdev) +diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-39x.c b/drivers/pinctrl/mvebu/pinctrl-armada-39x.c +index 4249162..2dcf9b4 100644 +--- a/drivers/pinctrl/mvebu/pinctrl-armada-39x.c ++++ b/drivers/pinctrl/mvebu/pinctrl-armada-39x.c +@@ -380,7 +380,7 @@ static struct mvebu_mpp_ctrl armada_39x_mpp_controls[] = { + + static struct pinctrl_gpio_range armada_39x_mpp_gpio_ranges[] = { + MPP_GPIO_RANGE(0, 0, 0, 32), +- MPP_GPIO_RANGE(1, 32, 32, 27), ++ MPP_GPIO_RANGE(1, 32, 32, 28), + }; + + static int armada_39x_pinctrl_probe(struct platform_device *pdev) +diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-xp.c b/drivers/pinctrl/mvebu/pinctrl-armada-xp.c +index 578db9f..d7cdb14 100644 +--- a/drivers/pinctrl/mvebu/pinctrl-armada-xp.c ++++ b/drivers/pinctrl/mvebu/pinctrl-armada-xp.c +@@ -14,10 +14,7 @@ + * available: mv78230, mv78260 and mv78460. From a pin muxing + * perspective, the mv78230 has 49 MPP pins. The mv78260 and mv78460 + * both have 67 MPP pins (more GPIOs and address lines for the memory +- * bus mainly). The only difference between the mv78260 and the +- * mv78460 in terms of pin muxing is the addition of two functions on +- * pins 43 and 56 to access the VDD of the CPU2 and 3 (mv78260 has two +- * cores, mv78460 has four cores). ++ * bus mainly). + */ + + #include <linux/err.h> +@@ -172,20 +169,17 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = { + MPP_MODE(24, + MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x1, "sata1", "prsnt", V_MV78230_PLUS), +- MPP_VAR_FUNCTION(0x2, "nf", "bootcs-re", V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x3, "tdm", "rst", V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x4, "lcd", "hsync", V_MV78230_PLUS)), + MPP_MODE(25, + MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x1, "sata0", "prsnt", V_MV78230_PLUS), +- MPP_VAR_FUNCTION(0x2, "nf", "bootcs-we", V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x3, "tdm", "pclk", V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x4, "lcd", "vsync", V_MV78230_PLUS)), + MPP_MODE(26, + MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x3, "tdm", "fsync", V_MV78230_PLUS), +- MPP_VAR_FUNCTION(0x4, "lcd", "clk", V_MV78230_PLUS), +- MPP_VAR_FUNCTION(0x5, "vdd", "cpu1-pd", V_MV78230_PLUS)), ++ MPP_VAR_FUNCTION(0x4, "lcd", "clk", V_MV78230_PLUS)), + MPP_MODE(27, + MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x1, "ptp", "trig", V_MV78230_PLUS), +@@ -200,8 +194,7 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = { + MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x1, "ptp", "clk", V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x3, "tdm", "int0", V_MV78230_PLUS), +- MPP_VAR_FUNCTION(0x4, "lcd", "ref-clk", V_MV78230_PLUS), +- MPP_VAR_FUNCTION(0x5, "vdd", "cpu0-pd", V_MV78230_PLUS)), ++ MPP_VAR_FUNCTION(0x4, "lcd", "ref-clk", V_MV78230_PLUS)), + MPP_MODE(30, + MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x1, "sd0", "clk", V_MV78230_PLUS), +@@ -209,13 +202,11 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = { + MPP_MODE(31, + MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x1, "sd0", "cmd", V_MV78230_PLUS), +- MPP_VAR_FUNCTION(0x3, "tdm", "int2", V_MV78230_PLUS), +- MPP_VAR_FUNCTION(0x5, "vdd", "cpu0-pd", V_MV78230_PLUS)), ++ MPP_VAR_FUNCTION(0x3, "tdm", "int2", V_MV78230_PLUS)), + MPP_MODE(32, + MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x1, "sd0", "d0", V_MV78230_PLUS), +- MPP_VAR_FUNCTION(0x3, "tdm", "int3", V_MV78230_PLUS), +- MPP_VAR_FUNCTION(0x5, "vdd", "cpu1-pd", V_MV78230_PLUS)), ++ MPP_VAR_FUNCTION(0x3, "tdm", "int3", V_MV78230_PLUS)), + MPP_MODE(33, + MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x1, "sd0", "d1", V_MV78230_PLUS), +@@ -247,7 +238,6 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = { + MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x1, "spi", "cs1", V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x2, "uart2", "cts", V_MV78230_PLUS), +- MPP_VAR_FUNCTION(0x3, "vdd", "cpu1-pd", V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x4, "lcd", "vga-hsync", V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x5, "pcie", "clkreq0", V_MV78230_PLUS)), + MPP_MODE(41, +@@ -262,15 +252,13 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = { + MPP_VAR_FUNCTION(0x1, "uart2", "rxd", V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x2, "uart0", "cts", V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x3, "tdm", "int7", V_MV78230_PLUS), +- MPP_VAR_FUNCTION(0x4, "tdm-1", "timer", V_MV78230_PLUS), +- MPP_VAR_FUNCTION(0x5, "vdd", "cpu0-pd", V_MV78230_PLUS)), ++ MPP_VAR_FUNCTION(0x4, "tdm-1", "timer", V_MV78230_PLUS)), + MPP_MODE(43, + MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x1, "uart2", "txd", V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x2, "uart0", "rts", V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x3, "spi", "cs3", V_MV78230_PLUS), +- MPP_VAR_FUNCTION(0x4, "pcie", "rstout", V_MV78230_PLUS), +- MPP_VAR_FUNCTION(0x5, "vdd", "cpu2-3-pd", V_MV78460)), ++ MPP_VAR_FUNCTION(0x4, "pcie", "rstout", V_MV78230_PLUS)), + MPP_MODE(44, + MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x1, "uart2", "cts", V_MV78230_PLUS), +@@ -299,7 +287,7 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = { + MPP_VAR_FUNCTION(0x5, "pcie", "clkreq3", V_MV78230_PLUS)), + MPP_MODE(48, + MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), +- MPP_VAR_FUNCTION(0x1, "tclk", NULL, V_MV78230_PLUS), ++ MPP_VAR_FUNCTION(0x1, "dev", "clkout", V_MV78230_PLUS), + MPP_VAR_FUNCTION(0x2, "dev", "burst/last", V_MV78230_PLUS)), + MPP_MODE(49, + MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS), +@@ -321,16 +309,13 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = { + MPP_VAR_FUNCTION(0x1, "dev", "ad19", V_MV78260_PLUS)), + MPP_MODE(55, + MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS), +- MPP_VAR_FUNCTION(0x1, "dev", "ad20", V_MV78260_PLUS), +- MPP_VAR_FUNCTION(0x2, "vdd", "cpu0-pd", V_MV78260_PLUS)), ++ MPP_VAR_FUNCTION(0x1, "dev", "ad20", V_MV78260_PLUS)), + MPP_MODE(56, + MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS), +- MPP_VAR_FUNCTION(0x1, "dev", "ad21", V_MV78260_PLUS), +- MPP_VAR_FUNCTION(0x2, "vdd", "cpu1-pd", V_MV78260_PLUS)), ++ MPP_VAR_FUNCTION(0x1, "dev", "ad21", V_MV78260_PLUS)), + MPP_MODE(57, + MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS), +- MPP_VAR_FUNCTION(0x1, "dev", "ad22", V_MV78260_PLUS), +- MPP_VAR_FUNCTION(0x2, "vdd", "cpu2-3-pd", V_MV78460)), ++ MPP_VAR_FUNCTION(0x1, "dev", "ad22", V_MV78260_PLUS)), + MPP_MODE(58, + MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS), + MPP_VAR_FUNCTION(0x1, "dev", "ad23", V_MV78260_PLUS)), +diff --git a/drivers/pinctrl/pinctrl-zynq.c b/drivers/pinctrl/pinctrl-zynq.c +index 22280bd..8c51a3c 100644 +--- a/drivers/pinctrl/pinctrl-zynq.c ++++ b/drivers/pinctrl/pinctrl-zynq.c +@@ -714,12 +714,13 @@ static const char * const gpio0_groups[] = {"gpio0_0_grp", + .mux_val = mval, \ + } + +-#define DEFINE_ZYNQ_PINMUX_FUNCTION_MUX(fname, mval, mux, mask, shift) \ ++#define DEFINE_ZYNQ_PINMUX_FUNCTION_MUX(fname, mval, offset, mask, shift)\ + [ZYNQ_PMUX_##fname] = { \ + .name = #fname, \ + .groups = fname##_groups, \ + .ngroups = ARRAY_SIZE(fname##_groups), \ + .mux_val = mval, \ ++ .mux = offset, \ + .mux_mask = mask, \ + .mux_shift = shift, \ + } +@@ -744,15 +745,15 @@ static const struct zynq_pinmux_function zynq_pmux_functions[] = { + DEFINE_ZYNQ_PINMUX_FUNCTION(spi1, 0x50), + DEFINE_ZYNQ_PINMUX_FUNCTION(sdio0, 0x40), + DEFINE_ZYNQ_PINMUX_FUNCTION(sdio0_pc, 0xc), +- DEFINE_ZYNQ_PINMUX_FUNCTION_MUX(sdio0_wp, 0, 130, ZYNQ_SDIO_WP_MASK, ++ DEFINE_ZYNQ_PINMUX_FUNCTION_MUX(sdio0_wp, 0, 0x130, ZYNQ_SDIO_WP_MASK, + ZYNQ_SDIO_WP_SHIFT), +- DEFINE_ZYNQ_PINMUX_FUNCTION_MUX(sdio0_cd, 0, 130, ZYNQ_SDIO_CD_MASK, ++ DEFINE_ZYNQ_PINMUX_FUNCTION_MUX(sdio0_cd, 0, 0x130, ZYNQ_SDIO_CD_MASK, + ZYNQ_SDIO_CD_SHIFT), + DEFINE_ZYNQ_PINMUX_FUNCTION(sdio1, 0x40), + DEFINE_ZYNQ_PINMUX_FUNCTION(sdio1_pc, 0xc), +- DEFINE_ZYNQ_PINMUX_FUNCTION_MUX(sdio1_wp, 0, 134, ZYNQ_SDIO_WP_MASK, ++ DEFINE_ZYNQ_PINMUX_FUNCTION_MUX(sdio1_wp, 0, 0x134, ZYNQ_SDIO_WP_MASK, + ZYNQ_SDIO_WP_SHIFT), +- DEFINE_ZYNQ_PINMUX_FUNCTION_MUX(sdio1_cd, 0, 134, ZYNQ_SDIO_CD_MASK, ++ DEFINE_ZYNQ_PINMUX_FUNCTION_MUX(sdio1_cd, 0, 0x134, ZYNQ_SDIO_CD_MASK, + ZYNQ_SDIO_CD_SHIFT), + DEFINE_ZYNQ_PINMUX_FUNCTION(smc0_nor, 4), + DEFINE_ZYNQ_PINMUX_FUNCTION(smc0_nor_cs1, 8), +diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c +index d688d80..2c1d5f5 100644 +--- a/drivers/platform/x86/dell-laptop.c ++++ b/drivers/platform/x86/dell-laptop.c +@@ -305,7 +305,6 @@ static const struct dmi_system_id dell_quirks[] __initconst = { + }; + + static struct calling_interface_buffer *buffer; +-static struct page *bufferpage; + static DEFINE_MUTEX(buffer_mutex); + + static int hwswitch_state; +@@ -1896,12 +1895,11 @@ static int __init dell_init(void) + * Allocate buffer below 4GB for SMI data--only 32-bit physical addr + * is passed to SMI handler. + */ +- bufferpage = alloc_page(GFP_KERNEL | GFP_DMA32); +- if (!bufferpage) { ++ buffer = (void *)__get_free_page(GFP_KERNEL | GFP_DMA32); ++ if (!buffer) { + ret = -ENOMEM; + goto fail_buffer; + } +- buffer = page_address(bufferpage); + + ret = dell_setup_rfkill(); + +@@ -1965,7 +1963,7 @@ fail_backlight: + cancel_delayed_work_sync(&dell_rfkill_work); + dell_cleanup_rfkill(); + fail_rfkill: +- free_page((unsigned long)bufferpage); ++ free_page((unsigned long)buffer); + fail_buffer: + platform_device_del(platform_device); + fail_platform_device2: +diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c +index b496db8..cb7cd8d 100644 +--- a/drivers/platform/x86/ideapad-laptop.c ++++ b/drivers/platform/x86/ideapad-laptop.c +@@ -464,8 +464,9 @@ static const struct ideapad_rfk_data ideapad_rfk_data[] = { + static int ideapad_rfk_set(void *data, bool blocked) + { + struct ideapad_rfk_priv *priv = data; ++ int opcode = ideapad_rfk_data[priv->dev].opcode; + +- return write_ec_cmd(priv->priv->adev->handle, priv->dev, !blocked); ++ return write_ec_cmd(priv->priv->adev->handle, opcode, !blocked); + } + + static struct rfkill_ops ideapad_rfk_ops = { +@@ -837,6 +838,13 @@ static const struct dmi_system_id no_hw_rfkill_list[] = { + }, + }, + { ++ .ident = "Lenovo G50-30", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo G50-30"), ++ }, ++ }, ++ { + .ident = "Lenovo Yoga 2 11 / 13 / Pro", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), +diff --git a/drivers/pnp/system.c b/drivers/pnp/system.c +index 515f338..49c1720 100644 +--- a/drivers/pnp/system.c ++++ b/drivers/pnp/system.c +@@ -7,7 +7,6 @@ + * Bjorn Helgaas <bjorn.helgaas@hp.com> + */ + +-#include <linux/acpi.h> + #include <linux/pnp.h> + #include <linux/device.h> + #include <linux/init.h> +@@ -23,41 +22,25 @@ static const struct pnp_device_id pnp_dev_table[] = { + {"", 0} + }; + +-#ifdef CONFIG_ACPI +-static bool __reserve_range(u64 start, unsigned int length, bool io, char *desc) +-{ +- u8 space_id = io ? ACPI_ADR_SPACE_SYSTEM_IO : ACPI_ADR_SPACE_SYSTEM_MEMORY; +- return !acpi_reserve_region(start, length, space_id, IORESOURCE_BUSY, desc); +-} +-#else +-static bool __reserve_range(u64 start, unsigned int length, bool io, char *desc) +-{ +- struct resource *res; +- +- res = io ? request_region(start, length, desc) : +- request_mem_region(start, length, desc); +- if (res) { +- res->flags &= ~IORESOURCE_BUSY; +- return true; +- } +- return false; +-} +-#endif +- + static void reserve_range(struct pnp_dev *dev, struct resource *r, int port) + { + char *regionid; + const char *pnpid = dev_name(&dev->dev); + resource_size_t start = r->start, end = r->end; +- bool reserved; ++ struct resource *res; + + regionid = kmalloc(16, GFP_KERNEL); + if (!regionid) + return; + + snprintf(regionid, 16, "pnp %s", pnpid); +- reserved = __reserve_range(start, end - start + 1, !!port, regionid); +- if (!reserved) ++ if (port) ++ res = request_region(start, end - start + 1, regionid); ++ else ++ res = request_mem_region(start, end - start + 1, regionid); ++ if (res) ++ res->flags &= ~IORESOURCE_BUSY; ++ else + kfree(regionid); + + /* +@@ -66,7 +49,7 @@ static void reserve_range(struct pnp_dev *dev, struct resource *r, int port) + * have double reservations. + */ + dev_info(&dev->dev, "%pR %s reserved\n", r, +- reserved ? "has been" : "could not be"); ++ res ? "has been" : "could not be"); + } + + static void reserve_resources_of_dev(struct pnp_dev *dev) +diff --git a/drivers/rtc/rtc-snvs.c b/drivers/rtc/rtc-snvs.c +index 0479e80..d87a85c 100644 +--- a/drivers/rtc/rtc-snvs.c ++++ b/drivers/rtc/rtc-snvs.c +@@ -322,6 +322,13 @@ static int snvs_rtc_suspend(struct device *dev) + if (device_may_wakeup(dev)) + enable_irq_wake(data->irq); + ++ return 0; ++} ++ ++static int snvs_rtc_suspend_noirq(struct device *dev) ++{ ++ struct snvs_rtc_data *data = dev_get_drvdata(dev); ++ + if (data->clk) + clk_disable_unprepare(data->clk); + +@@ -331,23 +338,28 @@ static int snvs_rtc_suspend(struct device *dev) + static int snvs_rtc_resume(struct device *dev) + { + struct snvs_rtc_data *data = dev_get_drvdata(dev); +- int ret; + + if (device_may_wakeup(dev)) +- disable_irq_wake(data->irq); ++ return disable_irq_wake(data->irq); + +- if (data->clk) { +- ret = clk_prepare_enable(data->clk); +- if (ret) +- return ret; +- } ++ return 0; ++} ++ ++static int snvs_rtc_resume_noirq(struct device *dev) ++{ ++ struct snvs_rtc_data *data = dev_get_drvdata(dev); ++ ++ if (data->clk) ++ return clk_prepare_enable(data->clk); + + return 0; + } + + static const struct dev_pm_ops snvs_rtc_pm_ops = { +- .suspend_noirq = snvs_rtc_suspend, +- .resume_noirq = snvs_rtc_resume, ++ .suspend = snvs_rtc_suspend, ++ .suspend_noirq = snvs_rtc_suspend_noirq, ++ .resume = snvs_rtc_resume, ++ .resume_noirq = snvs_rtc_resume_noirq, + }; + + #define SNVS_RTC_PM_OPS (&snvs_rtc_pm_ops) +diff --git a/drivers/staging/comedi/drivers/cb_pcimdas.c b/drivers/staging/comedi/drivers/cb_pcimdas.c +index c458e50..4ebf5aa 100644 +--- a/drivers/staging/comedi/drivers/cb_pcimdas.c ++++ b/drivers/staging/comedi/drivers/cb_pcimdas.c +@@ -243,7 +243,7 @@ static int cb_pcimdas_ao_insn_write(struct comedi_device *dev, + return insn->n; + } + +-static int cb_pcimdas_di_insn_read(struct comedi_device *dev, ++static int cb_pcimdas_di_insn_bits(struct comedi_device *dev, + struct comedi_subdevice *s, + struct comedi_insn *insn, + unsigned int *data) +@@ -258,7 +258,7 @@ static int cb_pcimdas_di_insn_read(struct comedi_device *dev, + return insn->n; + } + +-static int cb_pcimdas_do_insn_write(struct comedi_device *dev, ++static int cb_pcimdas_do_insn_bits(struct comedi_device *dev, + struct comedi_subdevice *s, + struct comedi_insn *insn, + unsigned int *data) +@@ -424,7 +424,7 @@ static int cb_pcimdas_auto_attach(struct comedi_device *dev, + s->n_chan = 4; + s->maxdata = 1; + s->range_table = &range_digital; +- s->insn_read = cb_pcimdas_di_insn_read; ++ s->insn_bits = cb_pcimdas_di_insn_bits; + + /* Digital Output subdevice (main connector) */ + s = &dev->subdevices[4]; +@@ -433,7 +433,7 @@ static int cb_pcimdas_auto_attach(struct comedi_device *dev, + s->n_chan = 4; + s->maxdata = 1; + s->range_table = &range_digital; +- s->insn_write = cb_pcimdas_do_insn_write; ++ s->insn_bits = cb_pcimdas_do_insn_bits; + + /* Counter subdevice (8254) */ + s = &dev->subdevices[5]; +diff --git a/drivers/staging/rtl8712/rtl8712_recv.c b/drivers/staging/rtl8712/rtl8712_recv.c +index 50227b5..fcb8c61 100644 +--- a/drivers/staging/rtl8712/rtl8712_recv.c ++++ b/drivers/staging/rtl8712/rtl8712_recv.c +@@ -1056,7 +1056,8 @@ static int recvbuf2recvframe(struct _adapter *padapter, struct sk_buff *pskb) + /* for first fragment packet, driver need allocate 1536 + + * drvinfo_sz + RXDESC_SIZE to defrag packet. */ + if ((mf == 1) && (frag == 0)) +- alloc_sz = 1658;/*1658+6=1664, 1664 is 128 alignment.*/ ++ /*1658+6=1664, 1664 is 128 alignment.*/ ++ alloc_sz = max_t(u16, tmp_len, 1658); + else + alloc_sz = tmp_len; + /* 2 is for IP header 4 bytes alignment in QoS packet case. +diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c +index 0343ae3..15baacb 100644 +--- a/drivers/staging/vt6655/device_main.c ++++ b/drivers/staging/vt6655/device_main.c +@@ -807,6 +807,10 @@ static int device_rx_srv(struct vnt_private *pDevice, unsigned int uIdx) + pRD = pRD->next) { + if (works++ > 15) + break; ++ ++ if (!pRD->pRDInfo->skb) ++ break; ++ + if (vnt_receive_frame(pDevice, pRD)) { + if (!device_alloc_rx_buf(pDevice, pRD)) { + dev_err(&pDevice->pcid->dev, +@@ -1417,7 +1421,7 @@ static void vnt_bss_info_changed(struct ieee80211_hw *hw, + + priv->current_aid = conf->aid; + +- if (changed & BSS_CHANGED_BSSID) { ++ if (changed & BSS_CHANGED_BSSID && conf->bssid) { + unsigned long flags; + + spin_lock_irqsave(&priv->lock, flags); +diff --git a/drivers/staging/vt6656/main_usb.c b/drivers/staging/vt6656/main_usb.c +index ab3ab84..766fdce 100644 +--- a/drivers/staging/vt6656/main_usb.c ++++ b/drivers/staging/vt6656/main_usb.c +@@ -701,7 +701,7 @@ static void vnt_bss_info_changed(struct ieee80211_hw *hw, + + priv->current_aid = conf->aid; + +- if (changed & BSS_CHANGED_BSSID) ++ if (changed & BSS_CHANGED_BSSID && conf->bssid) + vnt_mac_set_bssid_addr(priv, (u8 *)conf->bssid); + + +diff --git a/drivers/tty/serial/Kconfig b/drivers/tty/serial/Kconfig +index f8120c1..8cd3534 100644 +--- a/drivers/tty/serial/Kconfig ++++ b/drivers/tty/serial/Kconfig +@@ -241,7 +241,6 @@ config SERIAL_SAMSUNG + tristate "Samsung SoC serial support" + depends on PLAT_SAMSUNG || ARCH_EXYNOS + select SERIAL_CORE +- select SERIAL_EARLYCON + help + Support for the on-chip UARTs on the Samsung S3C24XX series CPUs, + providing /dev/ttySAC0, 1 and 2 (note, some machines may not +@@ -277,6 +276,7 @@ config SERIAL_SAMSUNG_CONSOLE + bool "Support for console on Samsung SoC serial port" + depends on SERIAL_SAMSUNG=y + select SERIAL_CORE_CONSOLE ++ select SERIAL_EARLYCON + help + Allow selection of the S3C24XX on-board serial ports for use as + an virtual console. +diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c +index 27dade2..5ca1dfb 100644 +--- a/drivers/tty/serial/atmel_serial.c ++++ b/drivers/tty/serial/atmel_serial.c +@@ -315,8 +315,7 @@ static int atmel_config_rs485(struct uart_port *port, + if (rs485conf->flags & SER_RS485_ENABLED) { + dev_dbg(port->dev, "Setting UART to RS485\n"); + atmel_port->tx_done_mask = ATMEL_US_TXEMPTY; +- if ((rs485conf->delay_rts_after_send) > 0) +- UART_PUT_TTGR(port, rs485conf->delay_rts_after_send); ++ UART_PUT_TTGR(port, rs485conf->delay_rts_after_send); + mode |= ATMEL_US_USMODE_RS485; + } else { + dev_dbg(port->dev, "Setting UART to RS232\n"); +@@ -354,8 +353,7 @@ static void atmel_set_mctrl(struct uart_port *port, u_int mctrl) + + /* override mode to RS485 if needed, otherwise keep the current mode */ + if (port->rs485.flags & SER_RS485_ENABLED) { +- if ((port->rs485.delay_rts_after_send) > 0) +- UART_PUT_TTGR(port, port->rs485.delay_rts_after_send); ++ UART_PUT_TTGR(port, port->rs485.delay_rts_after_send); + mode &= ~ATMEL_US_USMODE; + mode |= ATMEL_US_USMODE_RS485; + } +@@ -2061,8 +2059,7 @@ static void atmel_set_termios(struct uart_port *port, struct ktermios *termios, + + /* mode */ + if (port->rs485.flags & SER_RS485_ENABLED) { +- if ((port->rs485.delay_rts_after_send) > 0) +- UART_PUT_TTGR(port, port->rs485.delay_rts_after_send); ++ UART_PUT_TTGR(port, port->rs485.delay_rts_after_send); + mode |= ATMEL_US_USMODE_RS485; + } else if (termios->c_cflag & CRTSCTS) { + /* RS232 with hardware handshake (RTS/CTS) */ +diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c +index 843f2cd..9ffdfcf 100644 +--- a/drivers/tty/sysrq.c ++++ b/drivers/tty/sysrq.c +@@ -55,9 +55,6 @@ + static int __read_mostly sysrq_enabled = CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE; + static bool __read_mostly sysrq_always_enabled; + +-unsigned short platform_sysrq_reset_seq[] __weak = { KEY_RESERVED }; +-int sysrq_reset_downtime_ms __weak; +- + static bool sysrq_on(void) + { + return sysrq_enabled || sysrq_always_enabled; +@@ -569,6 +566,7 @@ void handle_sysrq(int key) + EXPORT_SYMBOL(handle_sysrq); + + #ifdef CONFIG_INPUT ++static int sysrq_reset_downtime_ms; + + /* Simple translation table for the SysRq keys */ + static const unsigned char sysrq_xlate[KEY_CNT] = +@@ -949,23 +947,8 @@ static bool sysrq_handler_registered; + + static inline void sysrq_register_handler(void) + { +- unsigned short key; + int error; +- int i; +- +- /* First check if a __weak interface was instantiated. */ +- for (i = 0; i < ARRAY_SIZE(sysrq_reset_seq); i++) { +- key = platform_sysrq_reset_seq[i]; +- if (key == KEY_RESERVED || key > KEY_MAX) +- break; +- +- sysrq_reset_seq[sysrq_reset_seq_len++] = key; +- } + +- /* +- * DT configuration takes precedence over anything that would +- * have been defined via the __weak interface. +- */ + sysrq_of_get_keyreset_config(); + + error = input_register_handler(&sysrq_handler); +diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c +index 4b0448c..986abde 100644 +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -513,7 +513,7 @@ static void async_completed(struct urb *urb) + snoop(&urb->dev->dev, "urb complete\n"); + snoop_urb(urb->dev, as->userurb, urb->pipe, urb->actual_length, + as->status, COMPLETE, NULL, 0); +- if ((urb->transfer_flags & URB_DIR_MASK) == USB_DIR_IN) ++ if ((urb->transfer_flags & URB_DIR_MASK) == URB_DIR_IN) + snoop_urb_data(urb, urb->actual_length); + + if (as->status < 0 && as->bulk_addr && as->status != -ECONNRESET && +diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c +index 45a915c..1c1385e 100644 +--- a/drivers/usb/core/hcd.c ++++ b/drivers/usb/core/hcd.c +@@ -1022,9 +1022,12 @@ static int register_root_hub(struct usb_hcd *hcd) + dev_name(&usb_dev->dev), retval); + return (retval < 0) ? retval : -EMSGSIZE; + } +- if (usb_dev->speed == USB_SPEED_SUPER) { ++ ++ if (le16_to_cpu(usb_dev->descriptor.bcdUSB) >= 0x0201) { + retval = usb_get_bos_descriptor(usb_dev); +- if (retval < 0) { ++ if (!retval) { ++ usb_dev->lpm_capable = usb_device_supports_lpm(usb_dev); ++ } else if (usb_dev->speed == USB_SPEED_SUPER) { + mutex_unlock(&usb_bus_list_lock); + dev_dbg(parent_dev, "can't read %s bos descriptor %d\n", + dev_name(&usb_dev->dev), retval); +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index 3b71516..1e9a8c9 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -122,7 +122,7 @@ struct usb_hub *usb_hub_to_struct_hub(struct usb_device *hdev) + return usb_get_intfdata(hdev->actconfig->interface[0]); + } + +-static int usb_device_supports_lpm(struct usb_device *udev) ++int usb_device_supports_lpm(struct usb_device *udev) + { + /* USB 2.1 (and greater) devices indicate LPM support through + * their USB 2.0 Extended Capabilities BOS descriptor. +@@ -2616,9 +2616,6 @@ static bool use_new_scheme(struct usb_device *udev, int retry) + return USE_NEW_SCHEME(retry); + } + +-static int hub_port_reset(struct usb_hub *hub, int port1, +- struct usb_device *udev, unsigned int delay, bool warm); +- + /* Is a USB 3.0 port in the Inactive or Compliance Mode state? + * Port worm reset is required to recover + */ +@@ -2706,44 +2703,6 @@ static int hub_port_wait_reset(struct usb_hub *hub, int port1, + return 0; + } + +-static void hub_port_finish_reset(struct usb_hub *hub, int port1, +- struct usb_device *udev, int *status) +-{ +- switch (*status) { +- case 0: +- /* TRSTRCY = 10 ms; plus some extra */ +- msleep(10 + 40); +- if (udev) { +- struct usb_hcd *hcd = bus_to_hcd(udev->bus); +- +- update_devnum(udev, 0); +- /* The xHC may think the device is already reset, +- * so ignore the status. +- */ +- if (hcd->driver->reset_device) +- hcd->driver->reset_device(hcd, udev); +- } +- /* FALL THROUGH */ +- case -ENOTCONN: +- case -ENODEV: +- usb_clear_port_feature(hub->hdev, +- port1, USB_PORT_FEAT_C_RESET); +- if (hub_is_superspeed(hub->hdev)) { +- usb_clear_port_feature(hub->hdev, port1, +- USB_PORT_FEAT_C_BH_PORT_RESET); +- usb_clear_port_feature(hub->hdev, port1, +- USB_PORT_FEAT_C_PORT_LINK_STATE); +- usb_clear_port_feature(hub->hdev, port1, +- USB_PORT_FEAT_C_CONNECTION); +- } +- if (udev) +- usb_set_device_state(udev, *status +- ? USB_STATE_NOTATTACHED +- : USB_STATE_DEFAULT); +- break; +- } +-} +- + /* Handle port reset and port warm(BH) reset (for USB3 protocol ports) */ + static int hub_port_reset(struct usb_hub *hub, int port1, + struct usb_device *udev, unsigned int delay, bool warm) +@@ -2767,13 +2726,10 @@ static int hub_port_reset(struct usb_hub *hub, int port1, + * If the caller hasn't explicitly requested a warm reset, + * double check and see if one is needed. + */ +- status = hub_port_status(hub, port1, +- &portstatus, &portchange); +- if (status < 0) +- goto done; +- +- if (hub_port_warm_reset_required(hub, port1, portstatus)) +- warm = true; ++ if (hub_port_status(hub, port1, &portstatus, &portchange) == 0) ++ if (hub_port_warm_reset_required(hub, port1, ++ portstatus)) ++ warm = true; + } + clear_bit(port1, hub->warm_reset_bits); + +@@ -2799,11 +2755,19 @@ static int hub_port_reset(struct usb_hub *hub, int port1, + + /* Check for disconnect or reset */ + if (status == 0 || status == -ENOTCONN || status == -ENODEV) { +- hub_port_finish_reset(hub, port1, udev, &status); ++ usb_clear_port_feature(hub->hdev, port1, ++ USB_PORT_FEAT_C_RESET); + + if (!hub_is_superspeed(hub->hdev)) + goto done; + ++ usb_clear_port_feature(hub->hdev, port1, ++ USB_PORT_FEAT_C_BH_PORT_RESET); ++ usb_clear_port_feature(hub->hdev, port1, ++ USB_PORT_FEAT_C_PORT_LINK_STATE); ++ usb_clear_port_feature(hub->hdev, port1, ++ USB_PORT_FEAT_C_CONNECTION); ++ + /* + * If a USB 3.0 device migrates from reset to an error + * state, re-issue the warm reset. +@@ -2836,6 +2800,26 @@ static int hub_port_reset(struct usb_hub *hub, int port1, + dev_err(&port_dev->dev, "Cannot enable. Maybe the USB cable is bad?\n"); + + done: ++ if (status == 0) { ++ /* TRSTRCY = 10 ms; plus some extra */ ++ msleep(10 + 40); ++ if (udev) { ++ struct usb_hcd *hcd = bus_to_hcd(udev->bus); ++ ++ update_devnum(udev, 0); ++ /* The xHC may think the device is already reset, ++ * so ignore the status. ++ */ ++ if (hcd->driver->reset_device) ++ hcd->driver->reset_device(hcd, udev); ++ ++ usb_set_device_state(udev, USB_STATE_DEFAULT); ++ } ++ } else { ++ if (udev) ++ usb_set_device_state(udev, USB_STATE_NOTATTACHED); ++ } ++ + if (!hub_is_superspeed(hub->hdev)) + up_read(&ehci_cf_port_reset_rwsem); + +diff --git a/drivers/usb/core/usb.h b/drivers/usb/core/usb.h +index 7eb1e26..457255a 100644 +--- a/drivers/usb/core/usb.h ++++ b/drivers/usb/core/usb.h +@@ -65,6 +65,7 @@ extern int usb_hub_init(void); + extern void usb_hub_cleanup(void); + extern int usb_major_init(void); + extern void usb_major_cleanup(void); ++extern int usb_device_supports_lpm(struct usb_device *udev); + + #ifdef CONFIG_PM + +diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c +index 2ef3c8d..69e769c 100644 +--- a/drivers/usb/dwc3/ep0.c ++++ b/drivers/usb/dwc3/ep0.c +@@ -727,6 +727,10 @@ static int dwc3_ep0_std_request(struct dwc3 *dwc, struct usb_ctrlrequest *ctrl) + dwc3_trace(trace_dwc3_ep0, "USB_REQ_SET_ISOCH_DELAY"); + ret = dwc3_ep0_set_isoch_delay(dwc, ctrl); + break; ++ case USB_REQ_SET_INTERFACE: ++ dwc3_trace(trace_dwc3_ep0, "USB_REQ_SET_INTERFACE"); ++ dwc->start_config_issued = false; ++ /* Fall through */ + default: + dwc3_trace(trace_dwc3_ep0, "Forwarding to gadget driver"); + ret = dwc3_ep0_delegate_req(dwc, ctrl); +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index 8946c32..333a7c0 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -291,6 +291,8 @@ int dwc3_send_gadget_generic_command(struct dwc3 *dwc, unsigned cmd, u32 param) + dwc3_trace(trace_dwc3_gadget, + "Command Complete --> %d", + DWC3_DGCMD_STATUS(reg)); ++ if (DWC3_DGCMD_STATUS(reg)) ++ return -EINVAL; + return 0; + } + +@@ -328,6 +330,8 @@ int dwc3_send_gadget_ep_cmd(struct dwc3 *dwc, unsigned ep, + dwc3_trace(trace_dwc3_gadget, + "Command Complete --> %d", + DWC3_DEPCMD_STATUS(reg)); ++ if (DWC3_DEPCMD_STATUS(reg)) ++ return -EINVAL; + return 0; + } + +@@ -1902,12 +1906,16 @@ static void dwc3_endpoint_transfer_complete(struct dwc3 *dwc, + { + unsigned status = 0; + int clean_busy; ++ u32 is_xfer_complete; ++ ++ is_xfer_complete = (event->endpoint_event == DWC3_DEPEVT_XFERCOMPLETE); + + if (event->status & DEPEVT_STATUS_BUSERR) + status = -ECONNRESET; + + clean_busy = dwc3_cleanup_done_reqs(dwc, dep, event, status); +- if (clean_busy) ++ if (clean_busy && (is_xfer_complete || ++ usb_endpoint_xfer_isoc(dep->endpoint.desc))) + dep->flags &= ~DWC3_EP_BUSY; + + /* +diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c +index 4e3447b..58b4657 100644 +--- a/drivers/usb/gadget/composite.c ++++ b/drivers/usb/gadget/composite.c +@@ -1758,10 +1758,13 @@ unknown: + * take such requests too, if that's ever needed: to work + * in config 0, etc. + */ +- list_for_each_entry(f, &cdev->config->functions, list) +- if (f->req_match && f->req_match(f, ctrl)) +- goto try_fun_setup; +- f = NULL; ++ if (cdev->config) { ++ list_for_each_entry(f, &cdev->config->functions, list) ++ if (f->req_match && f->req_match(f, ctrl)) ++ goto try_fun_setup; ++ f = NULL; ++ } ++ + switch (ctrl->bRequestType & USB_RECIP_MASK) { + case USB_RECIP_INTERFACE: + if (!cdev->config || intf >= MAX_CONFIG_INTERFACES) +diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c +index 45b8c8b..6e7be91 100644 +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -924,7 +924,8 @@ static ssize_t ffs_epfile_write_iter(struct kiocb *kiocb, struct iov_iter *from) + + kiocb->private = p; + +- kiocb_set_cancel_fn(kiocb, ffs_aio_cancel); ++ if (p->aio) ++ kiocb_set_cancel_fn(kiocb, ffs_aio_cancel); + + res = ffs_epfile_io(kiocb->ki_filp, p); + if (res == -EIOCBQUEUED) +@@ -968,7 +969,8 @@ static ssize_t ffs_epfile_read_iter(struct kiocb *kiocb, struct iov_iter *to) + + kiocb->private = p; + +- kiocb_set_cancel_fn(kiocb, ffs_aio_cancel); ++ if (p->aio) ++ kiocb_set_cancel_fn(kiocb, ffs_aio_cancel); + + res = ffs_epfile_io(kiocb->ki_filp, p); + if (res == -EIOCBQUEUED) +diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c +index 3cc109f..15c3071 100644 +--- a/drivers/usb/gadget/function/f_mass_storage.c ++++ b/drivers/usb/gadget/function/f_mass_storage.c +@@ -2786,7 +2786,7 @@ int fsg_common_set_nluns(struct fsg_common *common, int nluns) + return -EINVAL; + } + +- curlun = kcalloc(nluns, sizeof(*curlun), GFP_KERNEL); ++ curlun = kcalloc(FSG_MAX_LUNS, sizeof(*curlun), GFP_KERNEL); + if (unlikely(!curlun)) + return -ENOMEM; + +@@ -2796,8 +2796,6 @@ int fsg_common_set_nluns(struct fsg_common *common, int nluns) + common->luns = curlun; + common->nluns = nluns; + +- pr_info("Number of LUNs=%d\n", common->nluns); +- + return 0; + } + EXPORT_SYMBOL_GPL(fsg_common_set_nluns); +@@ -3563,14 +3561,26 @@ static struct usb_function *fsg_alloc(struct usb_function_instance *fi) + struct fsg_opts *opts = fsg_opts_from_func_inst(fi); + struct fsg_common *common = opts->common; + struct fsg_dev *fsg; ++ unsigned nluns, i; + + fsg = kzalloc(sizeof(*fsg), GFP_KERNEL); + if (unlikely(!fsg)) + return ERR_PTR(-ENOMEM); + + mutex_lock(&opts->lock); ++ if (!opts->refcnt) { ++ for (nluns = i = 0; i < FSG_MAX_LUNS; ++i) ++ if (common->luns[i]) ++ nluns = i + 1; ++ if (!nluns) ++ pr_warn("No LUNS defined, continuing anyway\n"); ++ else ++ common->nluns = nluns; ++ pr_info("Number of LUNs=%u\n", common->nluns); ++ } + opts->refcnt++; + mutex_unlock(&opts->lock); ++ + fsg->function.name = FSG_DRIVER_DESC; + fsg->function.bind = fsg_bind; + fsg->function.unbind = fsg_unbind; +diff --git a/drivers/usb/gadget/udc/mv_udc_core.c b/drivers/usb/gadget/udc/mv_udc_core.c +index d32160d..5da37c9 100644 +--- a/drivers/usb/gadget/udc/mv_udc_core.c ++++ b/drivers/usb/gadget/udc/mv_udc_core.c +@@ -2167,7 +2167,7 @@ static int mv_udc_probe(struct platform_device *pdev) + return -ENODEV; + } + +- udc->phy_regs = ioremap(r->start, resource_size(r)); ++ udc->phy_regs = devm_ioremap(&pdev->dev, r->start, resource_size(r)); + if (udc->phy_regs == NULL) { + dev_err(&pdev->dev, "failed to map phy I/O memory\n"); + return -EBUSY; +diff --git a/drivers/usb/host/ohci-q.c b/drivers/usb/host/ohci-q.c +index 1463c39..fe1d5fc 100644 +--- a/drivers/usb/host/ohci-q.c ++++ b/drivers/usb/host/ohci-q.c +@@ -980,10 +980,6 @@ rescan_all: + int completed, modified; + __hc32 *prev; + +- /* Is this ED already invisible to the hardware? */ +- if (ed->state == ED_IDLE) +- goto ed_idle; +- + /* only take off EDs that the HC isn't using, accounting for + * frame counter wraps and EDs with partially retired TDs + */ +@@ -1011,12 +1007,10 @@ skip_ed: + } + + /* ED's now officially unlinked, hc doesn't see */ +- ed->state = ED_IDLE; + ed->hwHeadP &= ~cpu_to_hc32(ohci, ED_H); + ed->hwNextED = 0; + wmb(); + ed->hwINFO &= ~cpu_to_hc32(ohci, ED_SKIP | ED_DEQUEUE); +-ed_idle: + + /* reentrancy: if we drop the schedule lock, someone might + * have modified this list. normally it's just prepending +@@ -1087,6 +1081,7 @@ rescan_this: + if (list_empty(&ed->td_list)) { + *last = ed->ed_next; + ed->ed_next = NULL; ++ ed->state = ED_IDLE; + list_del(&ed->in_use_list); + } else if (ohci->rh_state == OHCI_RH_RUNNING) { + *last = ed->ed_next; +diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c +index f833640..3e442f7 100644 +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -1427,10 +1427,10 @@ int xhci_endpoint_init(struct xhci_hcd *xhci, + /* Attempt to use the ring cache */ + if (virt_dev->num_rings_cached == 0) + return -ENOMEM; ++ virt_dev->num_rings_cached--; + virt_dev->eps[ep_index].new_ring = + virt_dev->ring_cache[virt_dev->num_rings_cached]; + virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL; +- virt_dev->num_rings_cached--; + xhci_reinit_cached_ring(xhci, virt_dev->eps[ep_index].new_ring, + 1, type); + } +diff --git a/drivers/usb/musb/musb_virthub.c b/drivers/usb/musb/musb_virthub.c +index 86c4b53..4731bac 100644 +--- a/drivers/usb/musb/musb_virthub.c ++++ b/drivers/usb/musb/musb_virthub.c +@@ -273,9 +273,7 @@ static int musb_has_gadget(struct musb *musb) + #ifdef CONFIG_USB_MUSB_HOST + return 1; + #else +- if (musb->port_mode == MUSB_PORT_MODE_HOST) +- return 1; +- return musb->g.dev.driver != NULL; ++ return musb->port_mode == MUSB_PORT_MODE_HOST; + #endif + } + +diff --git a/drivers/usb/phy/phy-mxs-usb.c b/drivers/usb/phy/phy-mxs-usb.c +index 8f7cb06..3fcc048 100644 +--- a/drivers/usb/phy/phy-mxs-usb.c ++++ b/drivers/usb/phy/phy-mxs-usb.c +@@ -217,6 +217,9 @@ static bool mxs_phy_get_vbus_status(struct mxs_phy *mxs_phy) + { + unsigned int vbus_value; + ++ if (!mxs_phy->regmap_anatop) ++ return false; ++ + if (mxs_phy->port_id == 0) + regmap_read(mxs_phy->regmap_anatop, + ANADIG_USB1_VBUS_DET_STAT, +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index ffd739e..eac7cca 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -187,6 +187,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x1FB9, 0x0602) }, /* Lake Shore Model 648 Magnet Power Supply */ + { USB_DEVICE(0x1FB9, 0x0700) }, /* Lake Shore Model 737 VSM Controller */ + { USB_DEVICE(0x1FB9, 0x0701) }, /* Lake Shore Model 776 Hall Matrix */ ++ { USB_DEVICE(0x2626, 0xEA60) }, /* Aruba Networks 7xxx USB Serial Console */ + { USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */ + { USB_DEVICE(0x3195, 0xF280) }, /* Link Instruments MSO-28 */ + { USB_DEVICE(0x3195, 0xF281) }, /* Link Instruments MSO-28 */ +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index f0c0c53..19b85ee 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1765,6 +1765,7 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ ++ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */ + { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) }, + { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) }, + { } /* Terminating entry */ +diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c +index 529066b..46f1f13 100644 +--- a/drivers/usb/serial/usb-serial.c ++++ b/drivers/usb/serial/usb-serial.c +@@ -1306,6 +1306,7 @@ static void __exit usb_serial_exit(void) + tty_unregister_driver(usb_serial_tty_driver); + put_tty_driver(usb_serial_tty_driver); + bus_unregister(&usb_serial_bus_type); ++ idr_destroy(&serial_minors); + } + + +diff --git a/drivers/w1/slaves/w1_therm.c b/drivers/w1/slaves/w1_therm.c +index 1f11a20..55eb86c 100644 +--- a/drivers/w1/slaves/w1_therm.c ++++ b/drivers/w1/slaves/w1_therm.c +@@ -59,16 +59,32 @@ MODULE_ALIAS("w1-family-" __stringify(W1_THERM_DS28EA00)); + static int w1_strong_pullup = 1; + module_param_named(strong_pullup, w1_strong_pullup, int, 0); + ++struct w1_therm_family_data { ++ uint8_t rom[9]; ++ atomic_t refcnt; ++}; ++ ++/* return the address of the refcnt in the family data */ ++#define THERM_REFCNT(family_data) \ ++ (&((struct w1_therm_family_data*)family_data)->refcnt) ++ + static int w1_therm_add_slave(struct w1_slave *sl) + { +- sl->family_data = kzalloc(9, GFP_KERNEL); ++ sl->family_data = kzalloc(sizeof(struct w1_therm_family_data), ++ GFP_KERNEL); + if (!sl->family_data) + return -ENOMEM; ++ atomic_set(THERM_REFCNT(sl->family_data), 1); + return 0; + } + + static void w1_therm_remove_slave(struct w1_slave *sl) + { ++ int refcnt = atomic_sub_return(1, THERM_REFCNT(sl->family_data)); ++ while(refcnt) { ++ msleep(1000); ++ refcnt = atomic_read(THERM_REFCNT(sl->family_data)); ++ } + kfree(sl->family_data); + sl->family_data = NULL; + } +@@ -194,13 +210,22 @@ static ssize_t w1_slave_show(struct device *device, + struct w1_slave *sl = dev_to_w1_slave(device); + struct w1_master *dev = sl->master; + u8 rom[9], crc, verdict, external_power; +- int i, max_trying = 10; ++ int i, ret, max_trying = 10; + ssize_t c = PAGE_SIZE; ++ u8 *family_data = sl->family_data; ++ ++ ret = mutex_lock_interruptible(&dev->bus_mutex); ++ if (ret != 0) ++ goto post_unlock; + +- i = mutex_lock_interruptible(&dev->bus_mutex); +- if (i != 0) +- return i; ++ if(!sl->family_data) ++ { ++ ret = -ENODEV; ++ goto pre_unlock; ++ } + ++ /* prevent the slave from going away in sleep */ ++ atomic_inc(THERM_REFCNT(family_data)); + memset(rom, 0, sizeof(rom)); + + while (max_trying--) { +@@ -230,17 +255,19 @@ static ssize_t w1_slave_show(struct device *device, + mutex_unlock(&dev->bus_mutex); + + sleep_rem = msleep_interruptible(tm); +- if (sleep_rem != 0) +- return -EINTR; ++ if (sleep_rem != 0) { ++ ret = -EINTR; ++ goto post_unlock; ++ } + +- i = mutex_lock_interruptible(&dev->bus_mutex); +- if (i != 0) +- return i; ++ ret = mutex_lock_interruptible(&dev->bus_mutex); ++ if (ret != 0) ++ goto post_unlock; + } else if (!w1_strong_pullup) { + sleep_rem = msleep_interruptible(tm); + if (sleep_rem != 0) { +- mutex_unlock(&dev->bus_mutex); +- return -EINTR; ++ ret = -EINTR; ++ goto pre_unlock; + } + } + +@@ -269,19 +296,24 @@ static ssize_t w1_slave_show(struct device *device, + c -= snprintf(buf + PAGE_SIZE - c, c, ": crc=%02x %s\n", + crc, (verdict) ? "YES" : "NO"); + if (verdict) +- memcpy(sl->family_data, rom, sizeof(rom)); ++ memcpy(family_data, rom, sizeof(rom)); + else + dev_warn(device, "Read failed CRC check\n"); + + for (i = 0; i < 9; ++i) + c -= snprintf(buf + PAGE_SIZE - c, c, "%02x ", +- ((u8 *)sl->family_data)[i]); ++ ((u8 *)family_data)[i]); + + c -= snprintf(buf + PAGE_SIZE - c, c, "t=%d\n", + w1_convert_temp(rom, sl->family->fid)); ++ ret = PAGE_SIZE - c; ++ ++pre_unlock: + mutex_unlock(&dev->bus_mutex); + +- return PAGE_SIZE - c; ++post_unlock: ++ atomic_dec(THERM_REFCNT(family_data)); ++ return ret; + } + + static int __init w1_therm_init(void) +diff --git a/drivers/watchdog/omap_wdt.c b/drivers/watchdog/omap_wdt.c +index 1e6be9e..c9c97da 100644 +--- a/drivers/watchdog/omap_wdt.c ++++ b/drivers/watchdog/omap_wdt.c +@@ -132,6 +132,13 @@ static int omap_wdt_start(struct watchdog_device *wdog) + + pm_runtime_get_sync(wdev->dev); + ++ /* ++ * Make sure the watchdog is disabled. This is unfortunately required ++ * because writing to various registers with the watchdog running has no ++ * effect. ++ */ ++ omap_wdt_disable(wdev); ++ + /* initialize prescaler */ + while (readl_relaxed(base + OMAP_WATCHDOG_WPS) & 0x01) + cpu_relax(); +diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c +index 703342e..53f1e8a 100644 +--- a/fs/9p/vfs_inode.c ++++ b/fs/9p/vfs_inode.c +@@ -540,8 +540,7 @@ static struct inode *v9fs_qid_iget(struct super_block *sb, + unlock_new_inode(inode); + return inode; + error: +- unlock_new_inode(inode); +- iput(inode); ++ iget_failed(inode); + return ERR_PTR(retval); + + } +diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c +index 9861c7c..4d3ecfb 100644 +--- a/fs/9p/vfs_inode_dotl.c ++++ b/fs/9p/vfs_inode_dotl.c +@@ -149,8 +149,7 @@ static struct inode *v9fs_qid_iget_dotl(struct super_block *sb, + unlock_new_inode(inode); + return inode; + error: +- unlock_new_inode(inode); +- iput(inode); ++ iget_failed(inode); + return ERR_PTR(retval); + + } +diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c +index f6a596d..d4a582a 100644 +--- a/fs/btrfs/inode-map.c ++++ b/fs/btrfs/inode-map.c +@@ -246,6 +246,7 @@ void btrfs_unpin_free_ino(struct btrfs_root *root) + { + struct btrfs_free_space_ctl *ctl = root->free_ino_ctl; + struct rb_root *rbroot = &root->free_ino_pinned->free_space_offset; ++ spinlock_t *rbroot_lock = &root->free_ino_pinned->tree_lock; + struct btrfs_free_space *info; + struct rb_node *n; + u64 count; +@@ -254,24 +255,30 @@ void btrfs_unpin_free_ino(struct btrfs_root *root) + return; + + while (1) { ++ bool add_to_ctl = true; ++ ++ spin_lock(rbroot_lock); + n = rb_first(rbroot); +- if (!n) ++ if (!n) { ++ spin_unlock(rbroot_lock); + break; ++ } + + info = rb_entry(n, struct btrfs_free_space, offset_index); + BUG_ON(info->bitmap); /* Logic error */ + + if (info->offset > root->ino_cache_progress) +- goto free; ++ add_to_ctl = false; + else if (info->offset + info->bytes > root->ino_cache_progress) + count = root->ino_cache_progress - info->offset + 1; + else + count = info->bytes; + +- __btrfs_add_free_space(ctl, info->offset, count); +-free: + rb_erase(&info->offset_index, rbroot); +- kfree(info); ++ spin_unlock(rbroot_lock); ++ if (add_to_ctl) ++ __btrfs_add_free_space(ctl, info->offset, count); ++ kmem_cache_free(btrfs_free_space_cachep, info); + } + } + +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index 1c22c65..37d456a 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -2413,8 +2413,6 @@ static noinline int btrfs_ioctl_snap_destroy(struct file *file, + goto out_unlock_inode; + } + +- d_invalidate(dentry); +- + down_write(&root->fs_info->subvol_sem); + + err = may_destroy_subvol(dest); +@@ -2508,7 +2506,7 @@ out_up_write: + out_unlock_inode: + mutex_unlock(&inode->i_mutex); + if (!err) { +- shrink_dcache_sb(root->fs_info->sb); ++ d_invalidate(dentry); + btrfs_invalidate_inodes(dest); + d_delete(dentry); + ASSERT(dest->send_in_progress == 0); +@@ -2940,7 +2938,7 @@ out_unlock: + static long btrfs_ioctl_file_extent_same(struct file *file, + struct btrfs_ioctl_same_args __user *argp) + { +- struct btrfs_ioctl_same_args *same; ++ struct btrfs_ioctl_same_args *same = NULL; + struct btrfs_ioctl_same_extent_info *info; + struct inode *src = file_inode(file); + u64 off; +@@ -2970,6 +2968,7 @@ static long btrfs_ioctl_file_extent_same(struct file *file, + + if (IS_ERR(same)) { + ret = PTR_ERR(same); ++ same = NULL; + goto out; + } + +@@ -3040,6 +3039,7 @@ static long btrfs_ioctl_file_extent_same(struct file *file, + + out: + mnt_drop_write_file(file); ++ kfree(same); + return ret; + } + +@@ -3434,6 +3434,20 @@ process_slot: + u64 trim = 0; + u64 aligned_end = 0; + ++ /* ++ * Don't copy an inline extent into an offset ++ * greater than zero. Having an inline extent ++ * at such an offset results in chaos as btrfs ++ * isn't prepared for such cases. Just skip ++ * this case for the same reasons as commented ++ * at btrfs_ioctl_clone(). ++ */ ++ if (last_dest_end > 0) { ++ ret = -EOPNOTSUPP; ++ btrfs_end_transaction(trans, root); ++ goto out; ++ } ++ + if (off > key.offset) { + skip = off - key.offset; + new_key.offset += skip; +diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c +index 5628e25..94e909c 100644 +--- a/fs/btrfs/transaction.c ++++ b/fs/btrfs/transaction.c +@@ -758,7 +758,7 @@ static int __btrfs_end_transaction(struct btrfs_trans_handle *trans, + + if (!list_empty(&trans->ordered)) { + spin_lock(&info->trans_lock); +- list_splice(&trans->ordered, &cur_trans->pending_ordered); ++ list_splice_init(&trans->ordered, &cur_trans->pending_ordered); + spin_unlock(&info->trans_lock); + } + +@@ -1848,7 +1848,7 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans, + } + + spin_lock(&root->fs_info->trans_lock); +- list_splice(&trans->ordered, &cur_trans->pending_ordered); ++ list_splice_init(&trans->ordered, &cur_trans->pending_ordered); + if (cur_trans->state >= TRANS_STATE_COMMIT_START) { + spin_unlock(&root->fs_info->trans_lock); + atomic_inc(&cur_trans->use_count); +diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c +index d049683..4920fce 100644 +--- a/fs/btrfs/tree-log.c ++++ b/fs/btrfs/tree-log.c +@@ -4161,6 +4161,7 @@ static int btrfs_log_inode(struct btrfs_trans_handle *trans, + u64 ino = btrfs_ino(inode); + struct extent_map_tree *em_tree = &BTRFS_I(inode)->extent_tree; + u64 logged_isize = 0; ++ bool need_log_inode_item = true; + + path = btrfs_alloc_path(); + if (!path) +@@ -4269,11 +4270,6 @@ static int btrfs_log_inode(struct btrfs_trans_handle *trans, + } else { + if (inode_only == LOG_INODE_ALL) + fast_search = true; +- ret = log_inode_item(trans, log, dst_path, inode); +- if (ret) { +- err = ret; +- goto out_unlock; +- } + goto log_extents; + } + +@@ -4296,6 +4292,9 @@ again: + if (min_key.type > max_key.type) + break; + ++ if (min_key.type == BTRFS_INODE_ITEM_KEY) ++ need_log_inode_item = false; ++ + src = path->nodes[0]; + if (ins_nr && ins_start_slot + ins_nr == path->slots[0]) { + ins_nr++; +@@ -4366,6 +4365,11 @@ next_slot: + log_extents: + btrfs_release_path(path); + btrfs_release_path(dst_path); ++ if (need_log_inode_item) { ++ err = log_inode_item(trans, log, dst_path, inode); ++ if (err) ++ goto out_unlock; ++ } + if (fast_search) { + /* + * Some ordered extents started by fsync might have completed +diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c +index e003a1e..87ba10d 100644 +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -503,7 +503,7 @@ __read_extent_tree_block(const char *function, unsigned int line, + struct buffer_head *bh; + int err; + +- bh = sb_getblk(inode->i_sb, pblk); ++ bh = sb_getblk_gfp(inode->i_sb, pblk, __GFP_MOVABLE | GFP_NOFS); + if (unlikely(!bh)) + return ERR_PTR(-ENOMEM); + +@@ -1088,7 +1088,7 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode, + err = -EIO; + goto cleanup; + } +- bh = sb_getblk(inode->i_sb, newblock); ++ bh = sb_getblk_gfp(inode->i_sb, newblock, __GFP_MOVABLE | GFP_NOFS); + if (unlikely(!bh)) { + err = -ENOMEM; + goto cleanup; +@@ -1282,7 +1282,7 @@ static int ext4_ext_grow_indepth(handle_t *handle, struct inode *inode, + if (newblock == 0) + return err; + +- bh = sb_getblk(inode->i_sb, newblock); ++ bh = sb_getblk_gfp(inode->i_sb, newblock, __GFP_MOVABLE | GFP_NOFS); + if (unlikely(!bh)) + return -ENOMEM; + lock_buffer(bh); +diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c +index 9588240..94ae687 100644 +--- a/fs/ext4/indirect.c ++++ b/fs/ext4/indirect.c +@@ -565,7 +565,7 @@ int ext4_ind_map_blocks(handle_t *handle, struct inode *inode, + EXT4_FEATURE_RO_COMPAT_BIGALLOC)) { + EXT4_ERROR_INODE(inode, "Can't allocate blocks for " + "non-extent mapped inodes with bigalloc"); +- return -ENOSPC; ++ return -EUCLEAN; + } + + /* Set up for the direct block allocation */ +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index 0554b0b..966c614 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -1342,7 +1342,7 @@ static void ext4_da_page_release_reservation(struct page *page, + unsigned int offset, + unsigned int length) + { +- int to_release = 0; ++ int to_release = 0, contiguous_blks = 0; + struct buffer_head *head, *bh; + unsigned int curr_off = 0; + struct inode *inode = page->mapping->host; +@@ -1363,14 +1363,23 @@ static void ext4_da_page_release_reservation(struct page *page, + + if ((offset <= curr_off) && (buffer_delay(bh))) { + to_release++; ++ contiguous_blks++; + clear_buffer_delay(bh); ++ } else if (contiguous_blks) { ++ lblk = page->index << ++ (PAGE_CACHE_SHIFT - inode->i_blkbits); ++ lblk += (curr_off >> inode->i_blkbits) - ++ contiguous_blks; ++ ext4_es_remove_extent(inode, lblk, contiguous_blks); ++ contiguous_blks = 0; + } + curr_off = next_off; + } while ((bh = bh->b_this_page) != head); + +- if (to_release) { ++ if (contiguous_blks) { + lblk = page->index << (PAGE_CACHE_SHIFT - inode->i_blkbits); +- ext4_es_remove_extent(inode, lblk, to_release); ++ lblk += (curr_off >> inode->i_blkbits) - contiguous_blks; ++ ext4_es_remove_extent(inode, lblk, contiguous_blks); + } + + /* If we have released all the blocks belonging to a cluster, then we +@@ -1701,19 +1710,32 @@ static int __ext4_journalled_writepage(struct page *page, + ext4_walk_page_buffers(handle, page_bufs, 0, len, + NULL, bget_one); + } +- /* As soon as we unlock the page, it can go away, but we have +- * references to buffers so we are safe */ ++ /* ++ * We need to release the page lock before we start the ++ * journal, so grab a reference so the page won't disappear ++ * out from under us. ++ */ ++ get_page(page); + unlock_page(page); + + handle = ext4_journal_start(inode, EXT4_HT_WRITE_PAGE, + ext4_writepage_trans_blocks(inode)); + if (IS_ERR(handle)) { + ret = PTR_ERR(handle); +- goto out; ++ put_page(page); ++ goto out_no_pagelock; + } +- + BUG_ON(!ext4_handle_valid(handle)); + ++ lock_page(page); ++ put_page(page); ++ if (page->mapping != mapping) { ++ /* The page got truncated from under us */ ++ ext4_journal_stop(handle); ++ ret = 0; ++ goto out; ++ } ++ + if (inline_data) { + BUFFER_TRACE(inode_bh, "get write access"); + ret = ext4_journal_get_write_access(handle, inode_bh); +@@ -1739,6 +1761,8 @@ static int __ext4_journalled_writepage(struct page *page, + NULL, bput_one); + ext4_set_inode_state(inode, EXT4_STATE_JDATA); + out: ++ unlock_page(page); ++out_no_pagelock: + brelse(inode_bh); + return ret; + } +@@ -4345,7 +4369,12 @@ static void ext4_update_other_inodes_time(struct super_block *sb, + int inode_size = EXT4_INODE_SIZE(sb); + + oi.orig_ino = orig_ino; +- ino = (orig_ino & ~(inodes_per_block - 1)) + 1; ++ /* ++ * Calculate the first inode in the inode table block. Inode ++ * numbers are one-based. That is, the first inode in a block ++ * (assuming 4k blocks and 256 byte inodes) is (n*16 + 1). ++ */ ++ ino = ((orig_ino - 1) & ~(inodes_per_block - 1)) + 1; + for (i = 0; i < inodes_per_block; i++, ino++, buf += inode_size) { + if (ino == orig_ino) + continue; +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index 8d1e602..4126048 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -4800,18 +4800,12 @@ do_more: + /* + * blocks being freed are metadata. these blocks shouldn't + * be used until this transaction is committed ++ * ++ * We use __GFP_NOFAIL because ext4_free_blocks() is not allowed ++ * to fail. + */ +- retry: +- new_entry = kmem_cache_alloc(ext4_free_data_cachep, GFP_NOFS); +- if (!new_entry) { +- /* +- * We use a retry loop because +- * ext4_free_blocks() is not allowed to fail. +- */ +- cond_resched(); +- congestion_wait(BLK_RW_ASYNC, HZ/50); +- goto retry; +- } ++ new_entry = kmem_cache_alloc(ext4_free_data_cachep, ++ GFP_NOFS|__GFP_NOFAIL); + new_entry->efd_start_cluster = bit; + new_entry->efd_group = block_group; + new_entry->efd_count = count_clusters; +diff --git a/fs/ext4/migrate.c b/fs/ext4/migrate.c +index b52374e..6163ad2 100644 +--- a/fs/ext4/migrate.c ++++ b/fs/ext4/migrate.c +@@ -620,6 +620,7 @@ int ext4_ind_migrate(struct inode *inode) + struct ext4_inode_info *ei = EXT4_I(inode); + struct ext4_extent *ex; + unsigned int i, len; ++ ext4_lblk_t start, end; + ext4_fsblk_t blk; + handle_t *handle; + int ret; +@@ -633,6 +634,14 @@ int ext4_ind_migrate(struct inode *inode) + EXT4_FEATURE_RO_COMPAT_BIGALLOC)) + return -EOPNOTSUPP; + ++ /* ++ * In order to get correct extent info, force all delayed allocation ++ * blocks to be allocated, otherwise delayed allocation blocks may not ++ * be reflected and bypass the checks on extent header. ++ */ ++ if (test_opt(inode->i_sb, DELALLOC)) ++ ext4_alloc_da_blocks(inode); ++ + handle = ext4_journal_start(inode, EXT4_HT_MIGRATE, 1); + if (IS_ERR(handle)) + return PTR_ERR(handle); +@@ -650,11 +659,13 @@ int ext4_ind_migrate(struct inode *inode) + goto errout; + } + if (eh->eh_entries == 0) +- blk = len = 0; ++ blk = len = start = end = 0; + else { + len = le16_to_cpu(ex->ee_len); + blk = ext4_ext_pblock(ex); +- if (len > EXT4_NDIR_BLOCKS) { ++ start = le32_to_cpu(ex->ee_block); ++ end = start + len - 1; ++ if (end >= EXT4_NDIR_BLOCKS) { + ret = -EOPNOTSUPP; + goto errout; + } +@@ -662,7 +673,7 @@ int ext4_ind_migrate(struct inode *inode) + + ext4_clear_inode_flag(inode, EXT4_INODE_EXTENTS); + memset(ei->i_data, 0, sizeof(ei->i_data)); +- for (i=0; i < len; i++) ++ for (i = start; i <= end; i++) + ei->i_data[i] = cpu_to_le32(blk++); + ext4_mark_inode_dirty(handle, inode); + errout: +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index ca9d4a2..ca12affd 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -807,6 +807,7 @@ static void ext4_put_super(struct super_block *sb) + dump_orphan_list(sb, sbi); + J_ASSERT(list_empty(&sbi->s_orphan)); + ++ sync_blockdev(sb->s_bdev); + invalidate_bdev(sb->s_bdev); + if (sbi->journal_bdev && sbi->journal_bdev != sb->s_bdev) { + /* +@@ -4943,6 +4944,9 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) + set_task_ioprio(sbi->s_journal->j_task, journal_ioprio); + } + ++ if (*flags & MS_LAZYTIME) ++ sb->s_flags |= MS_LAZYTIME; ++ + if ((*flags & MS_RDONLY) != (sb->s_flags & MS_RDONLY)) { + if (sbi->s_mount_flags & EXT4_MF_FS_ABORTED) { + err = -EROFS; +diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c +index 18dacf9..708d697 100644 +--- a/fs/fuse/inode.c ++++ b/fs/fuse/inode.c +@@ -1026,6 +1026,7 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent) + goto err_fput; + + fuse_conn_init(fc); ++ fc->release = fuse_free_conn; + + fc->dev = sb->s_dev; + fc->sb = sb; +@@ -1040,7 +1041,6 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent) + fc->dont_mask = 1; + sb->s_flags |= MS_POSIXACL; + +- fc->release = fuse_free_conn; + fc->flags = d.flags; + fc->user_id = d.user_id; + fc->group_id = d.group_id; +diff --git a/fs/hpfs/super.c b/fs/hpfs/super.c +index 7cd00d3..8685c65 100644 +--- a/fs/hpfs/super.c ++++ b/fs/hpfs/super.c +@@ -52,17 +52,20 @@ static void unmark_dirty(struct super_block *s) + } + + /* Filesystem error... */ +-static char err_buf[1024]; +- + void hpfs_error(struct super_block *s, const char *fmt, ...) + { ++ struct va_format vaf; + va_list args; + + va_start(args, fmt); +- vsnprintf(err_buf, sizeof(err_buf), fmt, args); ++ ++ vaf.fmt = fmt; ++ vaf.va = &args; ++ ++ pr_err("filesystem error: %pV", &vaf); ++ + va_end(args); + +- pr_err("filesystem error: %s", err_buf); + if (!hpfs_sb(s)->sb_was_error) { + if (hpfs_sb(s)->sb_err == 2) { + pr_cont("; crashing the system because you wanted it\n"); +@@ -424,11 +427,14 @@ static int hpfs_remount_fs(struct super_block *s, int *flags, char *data) + int o; + struct hpfs_sb_info *sbi = hpfs_sb(s); + char *new_opts = kstrdup(data, GFP_KERNEL); +- ++ ++ if (!new_opts) ++ return -ENOMEM; ++ + sync_filesystem(s); + + *flags |= MS_NOATIME; +- ++ + hpfs_lock(s); + uid = sbi->sb_uid; gid = sbi->sb_gid; + umask = 0777 & ~sbi->sb_mode; +diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c +index 988b32e..4227dc4 100644 +--- a/fs/jbd2/checkpoint.c ++++ b/fs/jbd2/checkpoint.c +@@ -390,7 +390,7 @@ int jbd2_cleanup_journal_tail(journal_t *journal) + unsigned long blocknr; + + if (is_journal_aborted(journal)) +- return 1; ++ return -EIO; + + if (!jbd2_journal_get_log_tail(journal, &first_tid, &blocknr)) + return 1; +@@ -405,10 +405,9 @@ int jbd2_cleanup_journal_tail(journal_t *journal) + * jbd2_cleanup_journal_tail() doesn't get called all that often. + */ + if (journal->j_flags & JBD2_BARRIER) +- blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL); ++ blkdev_issue_flush(journal->j_fs_dev, GFP_NOFS, NULL); + +- __jbd2_update_log_tail(journal, first_tid, blocknr); +- return 0; ++ return __jbd2_update_log_tail(journal, first_tid, blocknr); + } + + +diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c +index b96bd80..112fad9 100644 +--- a/fs/jbd2/journal.c ++++ b/fs/jbd2/journal.c +@@ -885,9 +885,10 @@ int jbd2_journal_get_log_tail(journal_t *journal, tid_t *tid, + * + * Requires j_checkpoint_mutex + */ +-void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block) ++int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block) + { + unsigned long freed; ++ int ret; + + BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex)); + +@@ -897,7 +898,10 @@ void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block) + * space and if we lose sb update during power failure we'd replay + * old transaction with possibly newly overwritten data. + */ +- jbd2_journal_update_sb_log_tail(journal, tid, block, WRITE_FUA); ++ ret = jbd2_journal_update_sb_log_tail(journal, tid, block, WRITE_FUA); ++ if (ret) ++ goto out; ++ + write_lock(&journal->j_state_lock); + freed = block - journal->j_tail; + if (block < journal->j_tail) +@@ -913,6 +917,9 @@ void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block) + journal->j_tail_sequence = tid; + journal->j_tail = block; + write_unlock(&journal->j_state_lock); ++ ++out: ++ return ret; + } + + /* +@@ -1331,7 +1338,7 @@ static int journal_reset(journal_t *journal) + return jbd2_journal_start_thread(journal); + } + +-static void jbd2_write_superblock(journal_t *journal, int write_op) ++static int jbd2_write_superblock(journal_t *journal, int write_op) + { + struct buffer_head *bh = journal->j_sb_buffer; + journal_superblock_t *sb = journal->j_superblock; +@@ -1370,7 +1377,10 @@ static void jbd2_write_superblock(journal_t *journal, int write_op) + printk(KERN_ERR "JBD2: Error %d detected when updating " + "journal superblock for %s.\n", ret, + journal->j_devname); ++ jbd2_journal_abort(journal, ret); + } ++ ++ return ret; + } + + /** +@@ -1383,10 +1393,11 @@ static void jbd2_write_superblock(journal_t *journal, int write_op) + * Update a journal's superblock information about log tail and write it to + * disk, waiting for the IO to complete. + */ +-void jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid, ++int jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid, + unsigned long tail_block, int write_op) + { + journal_superblock_t *sb = journal->j_superblock; ++ int ret; + + BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex)); + jbd_debug(1, "JBD2: updating superblock (start %lu, seq %u)\n", +@@ -1395,13 +1406,18 @@ void jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid, + sb->s_sequence = cpu_to_be32(tail_tid); + sb->s_start = cpu_to_be32(tail_block); + +- jbd2_write_superblock(journal, write_op); ++ ret = jbd2_write_superblock(journal, write_op); ++ if (ret) ++ goto out; + + /* Log is no longer empty */ + write_lock(&journal->j_state_lock); + WARN_ON(!sb->s_sequence); + journal->j_flags &= ~JBD2_FLUSHED; + write_unlock(&journal->j_state_lock); ++ ++out: ++ return ret; + } + + /** +@@ -1950,7 +1966,14 @@ int jbd2_journal_flush(journal_t *journal) + return -EIO; + + mutex_lock(&journal->j_checkpoint_mutex); +- jbd2_cleanup_journal_tail(journal); ++ if (!err) { ++ err = jbd2_cleanup_journal_tail(journal); ++ if (err < 0) { ++ mutex_unlock(&journal->j_checkpoint_mutex); ++ goto out; ++ } ++ err = 0; ++ } + + /* Finally, mark the journal as really needing no recovery. + * This sets s_start==0 in the underlying superblock, which is +@@ -1966,7 +1989,8 @@ int jbd2_journal_flush(journal_t *journal) + J_ASSERT(journal->j_head == journal->j_tail); + J_ASSERT(journal->j_tail_sequence == journal->j_transaction_sequence); + write_unlock(&journal->j_state_lock); +- return 0; ++out: ++ return err; + } + + /** +diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c +index 7d05089..6f5f0f4 100644 +--- a/fs/nfs/flexfilelayout/flexfilelayout.c ++++ b/fs/nfs/flexfilelayout/flexfilelayout.c +@@ -631,7 +631,7 @@ static void ff_layout_reset_write(struct nfs_pgio_header *hdr, bool retry_pnfs) + nfs_direct_set_resched_writes(hdr->dreq); + /* fake unstable write to let common nfs resend pages */ + hdr->verf.committed = NFS_UNSTABLE; +- hdr->good_bytes = 0; ++ hdr->good_bytes = hdr->args.count; + } + return; + } +diff --git a/fs/nfs/flexfilelayout/flexfilelayoutdev.c b/fs/nfs/flexfilelayout/flexfilelayoutdev.c +index 77a2d02..f13e196 100644 +--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c ++++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c +@@ -324,7 +324,8 @@ static int ff_layout_update_mirror_cred(struct nfs4_ff_layout_mirror *mirror, + __func__, PTR_ERR(cred)); + return PTR_ERR(cred); + } else { +- mirror->cred = cred; ++ if (cmpxchg(&mirror->cred, NULL, cred)) ++ put_rpccred(cred); + } + } + return 0; +@@ -386,7 +387,7 @@ nfs4_ff_layout_prepare_ds(struct pnfs_layout_segment *lseg, u32 ds_idx, + /* matching smp_wmb() in _nfs4_pnfs_v3/4_ds_connect */ + smp_rmb(); + if (ds->ds_clp) +- goto out; ++ goto out_update_creds; + + flavor = nfs4_ff_layout_choose_authflavor(mirror); + +@@ -430,7 +431,7 @@ nfs4_ff_layout_prepare_ds(struct pnfs_layout_segment *lseg, u32 ds_idx, + } + } + } +- ++out_update_creds: + if (ff_layout_update_mirror_cred(mirror, ds)) + ds = NULL; + out: +diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c +index 53852a4..9b04c2e 100644 +--- a/fs/nfs/nfs3xdr.c ++++ b/fs/nfs/nfs3xdr.c +@@ -1342,7 +1342,7 @@ static void nfs3_xdr_enc_setacl3args(struct rpc_rqst *req, + if (args->npages != 0) + xdr_write_pages(xdr, args->pages, 0, args->len); + else +- xdr_reserve_space(xdr, NFS_ACL_INLINE_BUFSIZE); ++ xdr_reserve_space(xdr, args->len); + + error = nfsacl_encode(xdr->buf, base, args->inode, + (args->mask & NFS_ACL) ? +diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c +index 2782cfc..ddef1dc 100644 +--- a/fs/nfs/nfs4state.c ++++ b/fs/nfs/nfs4state.c +@@ -1482,6 +1482,8 @@ restart: + spin_unlock(&state->state_lock); + } + nfs4_put_open_state(state); ++ clear_bit(NFS4CLNT_RECLAIM_NOGRACE, ++ &state->flags); + spin_lock(&sp->so_lock); + goto restart; + } +diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c +index 2306062..d47c188 100644 +--- a/fs/nfs/pnfs.c ++++ b/fs/nfs/pnfs.c +@@ -1821,6 +1821,7 @@ int pnfs_write_done_resend_to_mds(struct nfs_pgio_header *hdr) + /* Resend all requests through the MDS */ + nfs_pageio_init_write(&pgio, hdr->inode, FLUSH_STABLE, true, + hdr->completion_ops); ++ set_bit(NFS_CONTEXT_RESEND_WRITES, &hdr->args.context->flags); + return nfs_pageio_resend(&pgio, hdr); + } + EXPORT_SYMBOL_GPL(pnfs_write_done_resend_to_mds); +@@ -1865,6 +1866,7 @@ pnfs_write_through_mds(struct nfs_pageio_descriptor *desc, + mirror->pg_recoalesce = 1; + } + nfs_pgio_data_destroy(hdr); ++ hdr->release(hdr); + } + + static enum pnfs_try_status +@@ -1979,6 +1981,7 @@ pnfs_read_through_mds(struct nfs_pageio_descriptor *desc, + mirror->pg_recoalesce = 1; + } + nfs_pgio_data_destroy(hdr); ++ hdr->release(hdr); + } + + /* +diff --git a/fs/nfs/write.c b/fs/nfs/write.c +index dfc19f1..daf3556 100644 +--- a/fs/nfs/write.c ++++ b/fs/nfs/write.c +@@ -1289,6 +1289,7 @@ static void nfs_initiate_write(struct nfs_pgio_header *hdr, + static void nfs_redirty_request(struct nfs_page *req) + { + nfs_mark_request_dirty(req); ++ set_bit(NFS_CONTEXT_RESEND_WRITES, &req->wb_context->flags); + nfs_unlock_request(req); + nfs_end_page_writeback(req); + nfs_release_request(req); +diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c +index 907870e..70e9af5 100644 +--- a/fs/overlayfs/readdir.c ++++ b/fs/overlayfs/readdir.c +@@ -23,6 +23,7 @@ struct ovl_cache_entry { + u64 ino; + struct list_head l_node; + struct rb_node node; ++ struct ovl_cache_entry *next_maybe_whiteout; + bool is_whiteout; + char name[]; + }; +@@ -39,7 +40,7 @@ struct ovl_readdir_data { + struct rb_root root; + struct list_head *list; + struct list_head middle; +- struct dentry *dir; ++ struct ovl_cache_entry *first_maybe_whiteout; + int count; + int err; + }; +@@ -79,7 +80,7 @@ static struct ovl_cache_entry *ovl_cache_entry_find(struct rb_root *root, + return NULL; + } + +-static struct ovl_cache_entry *ovl_cache_entry_new(struct dentry *dir, ++static struct ovl_cache_entry *ovl_cache_entry_new(struct ovl_readdir_data *rdd, + const char *name, int len, + u64 ino, unsigned int d_type) + { +@@ -98,29 +99,8 @@ static struct ovl_cache_entry *ovl_cache_entry_new(struct dentry *dir, + p->is_whiteout = false; + + if (d_type == DT_CHR) { +- struct dentry *dentry; +- const struct cred *old_cred; +- struct cred *override_cred; +- +- override_cred = prepare_creds(); +- if (!override_cred) { +- kfree(p); +- return NULL; +- } +- +- /* +- * CAP_DAC_OVERRIDE for lookup +- */ +- cap_raise(override_cred->cap_effective, CAP_DAC_OVERRIDE); +- old_cred = override_creds(override_cred); +- +- dentry = lookup_one_len(name, dir, len); +- if (!IS_ERR(dentry)) { +- p->is_whiteout = ovl_is_whiteout(dentry); +- dput(dentry); +- } +- revert_creds(old_cred); +- put_cred(override_cred); ++ p->next_maybe_whiteout = rdd->first_maybe_whiteout; ++ rdd->first_maybe_whiteout = p; + } + return p; + } +@@ -148,7 +128,7 @@ static int ovl_cache_entry_add_rb(struct ovl_readdir_data *rdd, + return 0; + } + +- p = ovl_cache_entry_new(rdd->dir, name, len, ino, d_type); ++ p = ovl_cache_entry_new(rdd, name, len, ino, d_type); + if (p == NULL) + return -ENOMEM; + +@@ -169,7 +149,7 @@ static int ovl_fill_lower(struct ovl_readdir_data *rdd, + if (p) { + list_move_tail(&p->l_node, &rdd->middle); + } else { +- p = ovl_cache_entry_new(rdd->dir, name, namelen, ino, d_type); ++ p = ovl_cache_entry_new(rdd, name, namelen, ino, d_type); + if (p == NULL) + rdd->err = -ENOMEM; + else +@@ -219,6 +199,43 @@ static int ovl_fill_merge(struct dir_context *ctx, const char *name, + return ovl_fill_lower(rdd, name, namelen, offset, ino, d_type); + } + ++static int ovl_check_whiteouts(struct dentry *dir, struct ovl_readdir_data *rdd) ++{ ++ int err; ++ struct ovl_cache_entry *p; ++ struct dentry *dentry; ++ const struct cred *old_cred; ++ struct cred *override_cred; ++ ++ override_cred = prepare_creds(); ++ if (!override_cred) ++ return -ENOMEM; ++ ++ /* ++ * CAP_DAC_OVERRIDE for lookup ++ */ ++ cap_raise(override_cred->cap_effective, CAP_DAC_OVERRIDE); ++ old_cred = override_creds(override_cred); ++ ++ err = mutex_lock_killable(&dir->d_inode->i_mutex); ++ if (!err) { ++ while (rdd->first_maybe_whiteout) { ++ p = rdd->first_maybe_whiteout; ++ rdd->first_maybe_whiteout = p->next_maybe_whiteout; ++ dentry = lookup_one_len(p->name, dir, p->len); ++ if (!IS_ERR(dentry)) { ++ p->is_whiteout = ovl_is_whiteout(dentry); ++ dput(dentry); ++ } ++ } ++ mutex_unlock(&dir->d_inode->i_mutex); ++ } ++ revert_creds(old_cred); ++ put_cred(override_cred); ++ ++ return err; ++} ++ + static inline int ovl_dir_read(struct path *realpath, + struct ovl_readdir_data *rdd) + { +@@ -229,7 +246,7 @@ static inline int ovl_dir_read(struct path *realpath, + if (IS_ERR(realfile)) + return PTR_ERR(realfile); + +- rdd->dir = realpath->dentry; ++ rdd->first_maybe_whiteout = NULL; + rdd->ctx.pos = 0; + do { + rdd->count = 0; +@@ -238,6 +255,10 @@ static inline int ovl_dir_read(struct path *realpath, + if (err >= 0) + err = rdd->err; + } while (!err && rdd->count); ++ ++ if (!err && rdd->first_maybe_whiteout) ++ err = ovl_check_whiteouts(realpath->dentry, rdd); ++ + fput(realfile); + + return err; +diff --git a/fs/xfs/xfs_attr_inactive.c b/fs/xfs/xfs_attr_inactive.c +index 3fbf167..73e75a8 100644 +--- a/fs/xfs/xfs_attr_inactive.c ++++ b/fs/xfs/xfs_attr_inactive.c +@@ -435,8 +435,14 @@ xfs_attr_inactive( + */ + xfs_trans_ijoin(trans, dp, 0); + +- /* invalidate and truncate the attribute fork extents */ +- if (dp->i_d.di_aformat != XFS_DINODE_FMT_LOCAL) { ++ /* ++ * Invalidate and truncate the attribute fork extents. Make sure the ++ * fork actually has attributes as otherwise the invalidation has no ++ * blocks to read and returns an error. In this case, just do the fork ++ * removal below. ++ */ ++ if (xfs_inode_hasattr(dp) && ++ dp->i_d.di_aformat != XFS_DINODE_FMT_LOCAL) { + error = xfs_attr3_root_inactive(&trans, dp); + if (error) + goto out_cancel; +diff --git a/fs/xfs/xfs_symlink.c b/fs/xfs/xfs_symlink.c +index 3df411e..40c0765 100644 +--- a/fs/xfs/xfs_symlink.c ++++ b/fs/xfs/xfs_symlink.c +@@ -104,7 +104,7 @@ xfs_readlink_bmap( + cur_chunk += sizeof(struct xfs_dsymlink_hdr); + } + +- memcpy(link + offset, bp->b_addr, byte_cnt); ++ memcpy(link + offset, cur_chunk, byte_cnt); + + pathlen -= byte_cnt; + offset += byte_cnt; +diff --git a/include/acpi/acpixf.h b/include/acpi/acpixf.h +index 08ef57b..f5ed1f1 100644 +--- a/include/acpi/acpixf.h ++++ b/include/acpi/acpixf.h +@@ -195,9 +195,18 @@ ACPI_INIT_GLOBAL(u8, acpi_gbl_do_not_use_xsdt, FALSE); + * address. Although ACPICA adheres to the ACPI specification which + * requires the use of the corresponding 64-bit address if it is non-zero, + * some machines have been found to have a corrupted non-zero 64-bit +- * address. Default is TRUE, favor the 32-bit addresses. ++ * address. Default is FALSE, do not favor the 32-bit addresses. + */ +-ACPI_INIT_GLOBAL(u8, acpi_gbl_use32_bit_fadt_addresses, TRUE); ++ACPI_INIT_GLOBAL(u8, acpi_gbl_use32_bit_fadt_addresses, FALSE); ++ ++/* ++ * Optionally use 32-bit FACS table addresses. ++ * It is reported that some platforms fail to resume from system suspending ++ * if 64-bit FACS table address is selected: ++ * https://bugzilla.kernel.org/show_bug.cgi?id=74021 ++ * Default is TRUE, favor the 32-bit addresses. ++ */ ++ACPI_INIT_GLOBAL(u8, acpi_gbl_use32_bit_facs_addresses, TRUE); + + /* + * Optionally truncate I/O addresses to 16 bits. Provides compatibility +diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h +index 1c3002e..181427e 100644 +--- a/include/acpi/actypes.h ++++ b/include/acpi/actypes.h +@@ -572,6 +572,7 @@ typedef u64 acpi_integer; + #define ACPI_NO_ACPI_ENABLE 0x10 + #define ACPI_NO_DEVICE_INIT 0x20 + #define ACPI_NO_OBJECT_INIT 0x40 ++#define ACPI_NO_FACS_INIT 0x80 + + /* + * Initialization state +diff --git a/include/drm/drm_atomic.h b/include/drm/drm_atomic.h +index c1571034..3f13b91 100644 +--- a/include/drm/drm_atomic.h ++++ b/include/drm/drm_atomic.h +@@ -77,26 +77,26 @@ int __must_check drm_atomic_async_commit(struct drm_atomic_state *state); + + #define for_each_connector_in_state(state, connector, connector_state, __i) \ + for ((__i) = 0; \ +- (connector) = (state)->connectors[__i], \ +- (connector_state) = (state)->connector_states[__i], \ +- (__i) < (state)->num_connector; \ ++ (__i) < (state)->num_connector && \ ++ ((connector) = (state)->connectors[__i], \ ++ (connector_state) = (state)->connector_states[__i], 1); \ + (__i)++) \ + if (connector) + + #define for_each_crtc_in_state(state, crtc, crtc_state, __i) \ + for ((__i) = 0; \ +- (crtc) = (state)->crtcs[__i], \ +- (crtc_state) = (state)->crtc_states[__i], \ +- (__i) < (state)->dev->mode_config.num_crtc; \ ++ (__i) < (state)->dev->mode_config.num_crtc && \ ++ ((crtc) = (state)->crtcs[__i], \ ++ (crtc_state) = (state)->crtc_states[__i], 1); \ + (__i)++) \ + if (crtc_state) + +-#define for_each_plane_in_state(state, plane, plane_state, __i) \ +- for ((__i) = 0; \ +- (plane) = (state)->planes[__i], \ +- (plane_state) = (state)->plane_states[__i], \ +- (__i) < (state)->dev->mode_config.num_total_plane; \ +- (__i)++) \ ++#define for_each_plane_in_state(state, plane, plane_state, __i) \ ++ for ((__i) = 0; \ ++ (__i) < (state)->dev->mode_config.num_total_plane && \ ++ ((plane) = (state)->planes[__i], \ ++ (plane_state) = (state)->plane_states[__i], 1); \ ++ (__i)++) \ + if (plane_state) + + #endif /* DRM_ATOMIC_H_ */ +diff --git a/include/drm/drm_crtc.h b/include/drm/drm_crtc.h +index ca71c03..5423358 100644 +--- a/include/drm/drm_crtc.h ++++ b/include/drm/drm_crtc.h +@@ -731,6 +731,8 @@ struct drm_connector { + uint8_t num_h_tile, num_v_tile; + uint8_t tile_h_loc, tile_v_loc; + uint16_t tile_h_size, tile_v_size; ++ ++ struct list_head destroy_list; + }; + + /** +diff --git a/include/drm/drm_dp_mst_helper.h b/include/drm/drm_dp_mst_helper.h +index a250781..86d0b25 100644 +--- a/include/drm/drm_dp_mst_helper.h ++++ b/include/drm/drm_dp_mst_helper.h +@@ -463,6 +463,10 @@ struct drm_dp_mst_topology_mgr { + struct work_struct work; + + struct work_struct tx_work; ++ ++ struct list_head destroy_connector_list; ++ struct mutex destroy_connector_lock; ++ struct work_struct destroy_connector_work; + }; + + int drm_dp_mst_topology_mgr_init(struct drm_dp_mst_topology_mgr *mgr, struct device *dev, struct drm_dp_aux *aux, int max_dpcd_transaction_bytes, int max_payloads, int conn_base_id); +diff --git a/include/linux/acpi.h b/include/linux/acpi.h +index 5da2d2e..4550be3 100644 +--- a/include/linux/acpi.h ++++ b/include/linux/acpi.h +@@ -332,9 +332,6 @@ int acpi_check_region(resource_size_t start, resource_size_t n, + + int acpi_resources_are_enforced(void); + +-int acpi_reserve_region(u64 start, unsigned int length, u8 space_id, +- unsigned long flags, char *desc); +- + #ifdef CONFIG_HIBERNATION + void __init acpi_no_s4_hw_signature(void); + #endif +@@ -530,13 +527,6 @@ static inline int acpi_check_region(resource_size_t start, resource_size_t n, + return 0; + } + +-static inline int acpi_reserve_region(u64 start, unsigned int length, +- u8 space_id, unsigned long flags, +- char *desc) +-{ +- return -ENXIO; +-} +- + struct acpi_table_header; + static inline int acpi_table_parse(char *id, + int (*handler)(struct acpi_table_header *)) +diff --git a/include/linux/ata.h b/include/linux/ata.h +index b666b77..533dbb6 100644 +--- a/include/linux/ata.h ++++ b/include/linux/ata.h +@@ -45,6 +45,7 @@ enum { + ATA_SECT_SIZE = 512, + ATA_MAX_SECTORS_128 = 128, + ATA_MAX_SECTORS = 256, ++ ATA_MAX_SECTORS_1024 = 1024, + ATA_MAX_SECTORS_LBA48 = 65535,/* TODO: 65536? */ + ATA_MAX_SECTORS_TAPE = 65535, + +diff --git a/include/linux/buffer_head.h b/include/linux/buffer_head.h +index 73b4522..e6797de 100644 +--- a/include/linux/buffer_head.h ++++ b/include/linux/buffer_head.h +@@ -317,6 +317,13 @@ sb_getblk(struct super_block *sb, sector_t block) + return __getblk_gfp(sb->s_bdev, block, sb->s_blocksize, __GFP_MOVABLE); + } + ++ ++static inline struct buffer_head * ++sb_getblk_gfp(struct super_block *sb, sector_t block, gfp_t gfp) ++{ ++ return __getblk_gfp(sb->s_bdev, block, sb->s_blocksize, gfp); ++} ++ + static inline struct buffer_head * + sb_find_get_block(struct super_block *sb, sector_t block) + { +diff --git a/include/linux/compiler-intel.h b/include/linux/compiler-intel.h +index 0c9a2f2..d4c7113 100644 +--- a/include/linux/compiler-intel.h ++++ b/include/linux/compiler-intel.h +@@ -13,10 +13,12 @@ + /* Intel ECC compiler doesn't support gcc specific asm stmts. + * It uses intrinsics to do the equivalent things. + */ ++#undef barrier + #undef barrier_data + #undef RELOC_HIDE + #undef OPTIMIZER_HIDE_VAR + ++#define barrier() __memory_barrier() + #define barrier_data(ptr) barrier() + + #define RELOC_HIDE(ptr, off) \ +diff --git a/include/linux/gpio/consumer.h b/include/linux/gpio/consumer.h +index 3a7c9ff..da04265 100644 +--- a/include/linux/gpio/consumer.h ++++ b/include/linux/gpio/consumer.h +@@ -406,6 +406,21 @@ static inline int desc_to_gpio(const struct gpio_desc *desc) + return -EINVAL; + } + ++/* Child properties interface */ ++struct fwnode_handle; ++ ++static inline struct gpio_desc *fwnode_get_named_gpiod( ++ struct fwnode_handle *fwnode, const char *propname) ++{ ++ return ERR_PTR(-ENOSYS); ++} ++ ++static inline struct gpio_desc *devm_get_gpiod_from_child( ++ struct device *dev, const char *con_id, struct fwnode_handle *child) ++{ ++ return ERR_PTR(-ENOSYS); ++} ++ + #endif /* CONFIG_GPIOLIB */ + + /* +diff --git a/include/linux/hid-sensor-hub.h b/include/linux/hid-sensor-hub.h +index 0042bf3..c02b5ce 100644 +--- a/include/linux/hid-sensor-hub.h ++++ b/include/linux/hid-sensor-hub.h +@@ -230,6 +230,7 @@ struct hid_sensor_common { + struct platform_device *pdev; + unsigned usage_id; + atomic_t data_ready; ++ atomic_t user_requested_state; + struct iio_trigger *trigger; + struct hid_sensor_hub_attribute_info poll; + struct hid_sensor_hub_attribute_info report_state; +diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h +index 20e7f78..edb640a 100644 +--- a/include/linux/jbd2.h ++++ b/include/linux/jbd2.h +@@ -1035,7 +1035,7 @@ struct buffer_head *jbd2_journal_get_descriptor_buffer(journal_t *journal); + int jbd2_journal_next_log_block(journal_t *, unsigned long long *); + int jbd2_journal_get_log_tail(journal_t *journal, tid_t *tid, + unsigned long *block); +-void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block); ++int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block); + void jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block); + + /* Commit management */ +@@ -1157,7 +1157,7 @@ extern int jbd2_journal_recover (journal_t *journal); + extern int jbd2_journal_wipe (journal_t *, int); + extern int jbd2_journal_skip_recovery (journal_t *); + extern void jbd2_journal_update_sb_errno(journal_t *); +-extern void jbd2_journal_update_sb_log_tail (journal_t *, tid_t, ++extern int jbd2_journal_update_sb_log_tail (journal_t *, tid_t, + unsigned long, int); + extern void __jbd2_journal_abort_hard (journal_t *); + extern void jbd2_journal_abort (journal_t *, int); +diff --git a/include/linux/libata.h b/include/linux/libata.h +index 28aeae4..e0e3378 100644 +--- a/include/linux/libata.h ++++ b/include/linux/libata.h +@@ -431,6 +431,9 @@ enum { + ATA_HORKAGE_NOLPM = (1 << 20), /* don't use LPM */ + ATA_HORKAGE_WD_BROKEN_LPM = (1 << 21), /* some WDs have broken LPM */ + ATA_HORKAGE_ZERO_AFTER_TRIM = (1 << 22),/* guarantees zero after trim */ ++ ATA_HORKAGE_NO_NCQ_LOG = (1 << 23), /* don't use NCQ for log read */ ++ ATA_HORKAGE_NOTRIM = (1 << 24), /* don't use TRIM */ ++ ATA_HORKAGE_MAX_SEC_1024 = (1 << 25), /* Limit max sects to 1024 */ + + /* DMA mask for user DMA control: User visible values; DO NOT + renumber */ +diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h +index 93ab607..e9e9a8d 100644 +--- a/include/linux/nfs_xdr.h ++++ b/include/linux/nfs_xdr.h +@@ -1142,7 +1142,7 @@ struct nfs41_state_protection { + struct nfs4_op_map allow; + }; + +-#define NFS4_EXCHANGE_ID_LEN (48) ++#define NFS4_EXCHANGE_ID_LEN (127) + struct nfs41_exchange_id_args { + struct nfs_client *client; + nfs4_verifier *verifier; +diff --git a/include/linux/of.h b/include/linux/of.h +index b871ff9..8135d50 100644 +--- a/include/linux/of.h ++++ b/include/linux/of.h +@@ -673,7 +673,10 @@ static inline void of_property_clear_flag(struct property *p, unsigned long flag + #if defined(CONFIG_OF) && defined(CONFIG_NUMA) + extern int of_node_to_nid(struct device_node *np); + #else +-static inline int of_node_to_nid(struct device_node *device) { return 0; } ++static inline int of_node_to_nid(struct device_node *device) ++{ ++ return NUMA_NO_NODE; ++} + #endif + + static inline struct device_node *of_find_matching_node( +diff --git a/include/uapi/drm/i915_drm.h b/include/uapi/drm/i915_drm.h +index 551b673..a7e41fb 100644 +--- a/include/uapi/drm/i915_drm.h ++++ b/include/uapi/drm/i915_drm.h +@@ -1065,6 +1065,14 @@ struct drm_i915_reg_read { + __u64 offset; + __u64 val; /* Return value */ + }; ++/* Known registers: ++ * ++ * Render engine timestamp - 0x2358 + 64bit - gen7+ ++ * - Note this register returns an invalid value if using the default ++ * single instruction 8byte read, in order to workaround that use ++ * offset (0x2538 | 1) instead. ++ * ++ */ + + struct drm_i915_reset_stats { + __u32 ctx_id; +diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig +index 7e01f78..9e30231 100644 +--- a/kernel/power/Kconfig ++++ b/kernel/power/Kconfig +@@ -187,7 +187,7 @@ config DPM_WATCHDOG + config DPM_WATCHDOG_TIMEOUT + int "Watchdog timeout in seconds" + range 1 120 +- default 12 ++ default 60 + depends on DPM_WATCHDOG + + config PM_TRACE +diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c +index c099b08..bff0169 100644 +--- a/kernel/printk/printk.c ++++ b/kernel/printk/printk.c +@@ -484,11 +484,11 @@ int check_syslog_permissions(int type, bool from_file) + * already done the capabilities checks at open time. + */ + if (from_file && type != SYSLOG_ACTION_OPEN) +- return 0; ++ goto ok; + + if (syslog_action_restricted(type)) { + if (capable(CAP_SYSLOG)) +- return 0; ++ goto ok; + /* + * For historical reasons, accept CAP_SYS_ADMIN too, with + * a warning. +@@ -498,10 +498,11 @@ int check_syslog_permissions(int type, bool from_file) + "CAP_SYS_ADMIN but no CAP_SYSLOG " + "(deprecated).\n", + current->comm, task_pid_nr(current)); +- return 0; ++ goto ok; + } + return -EPERM; + } ++ok: + return security_syslog(type); + } + +@@ -1263,10 +1264,6 @@ int do_syslog(int type, char __user *buf, int len, bool from_file) + if (error) + goto out; + +- error = security_syslog(type); +- if (error) +- return error; +- + switch (type) { + case SYSLOG_ACTION_CLOSE: /* Close log */ + break; +diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h +index d261201..921691c 100644 +--- a/kernel/trace/trace.h ++++ b/kernel/trace/trace.h +@@ -444,6 +444,7 @@ enum { + + TRACE_CONTROL_BIT, + ++ TRACE_BRANCH_BIT, + /* + * Abuse of the trace_recursion. + * As we need a way to maintain state if we are tracing the function +@@ -1312,7 +1313,7 @@ void trace_event_init(void); + void trace_event_enum_update(struct trace_enum_map **map, int len); + #else + static inline void __init trace_event_init(void) { } +-static inlin void trace_event_enum_update(struct trace_enum_map **map, int len) { } ++static inline void trace_event_enum_update(struct trace_enum_map **map, int len) { } + #endif + + extern struct trace_iterator *tracepoint_print_iter; +diff --git a/kernel/trace/trace_branch.c b/kernel/trace/trace_branch.c +index 57cbf1e..1879980 100644 +--- a/kernel/trace/trace_branch.c ++++ b/kernel/trace/trace_branch.c +@@ -36,9 +36,12 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect) + struct trace_branch *entry; + struct ring_buffer *buffer; + unsigned long flags; +- int cpu, pc; ++ int pc; + const char *p; + ++ if (current->trace_recursion & TRACE_BRANCH_BIT) ++ return; ++ + /* + * I would love to save just the ftrace_likely_data pointer, but + * this code can also be used by modules. Ugly things can happen +@@ -49,10 +52,10 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect) + if (unlikely(!tr)) + return; + +- local_irq_save(flags); +- cpu = raw_smp_processor_id(); +- data = per_cpu_ptr(tr->trace_buffer.data, cpu); +- if (atomic_inc_return(&data->disabled) != 1) ++ raw_local_irq_save(flags); ++ current->trace_recursion |= TRACE_BRANCH_BIT; ++ data = this_cpu_ptr(tr->trace_buffer.data); ++ if (atomic_read(&data->disabled)) + goto out; + + pc = preempt_count(); +@@ -81,8 +84,8 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect) + __buffer_unlock_commit(buffer, event); + + out: +- atomic_dec(&data->disabled); +- local_irq_restore(flags); ++ current->trace_recursion &= ~TRACE_BRANCH_BIT; ++ raw_local_irq_restore(flags); + } + + static inline +diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c +index 7f2e97c..52adf02 100644 +--- a/kernel/trace/trace_events_filter.c ++++ b/kernel/trace/trace_events_filter.c +@@ -1056,6 +1056,9 @@ static void parse_init(struct filter_parse_state *ps, + + static char infix_next(struct filter_parse_state *ps) + { ++ if (!ps->infix.cnt) ++ return 0; ++ + ps->infix.cnt--; + + return ps->infix.string[ps->infix.tail++]; +@@ -1071,6 +1074,9 @@ static char infix_peek(struct filter_parse_state *ps) + + static void infix_advance(struct filter_parse_state *ps) + { ++ if (!ps->infix.cnt) ++ return; ++ + ps->infix.cnt--; + ps->infix.tail++; + } +@@ -1385,7 +1391,9 @@ static int check_preds(struct filter_parse_state *ps) + if (elt->op != OP_NOT) + cnt--; + n_normal_preds++; +- WARN_ON_ONCE(cnt < 0); ++ /* all ops should have operands */ ++ if (cnt < 0) ++ break; + } + + if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) { +diff --git a/lib/bitmap.c b/lib/bitmap.c +index 64c0926..40162f8 100644 +--- a/lib/bitmap.c ++++ b/lib/bitmap.c +@@ -506,12 +506,12 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen, + unsigned a, b; + int c, old_c, totaldigits; + const char __user __force *ubuf = (const char __user __force *)buf; +- int exp_digit, in_range; ++ int at_start, in_range; + + totaldigits = c = 0; + bitmap_zero(maskp, nmaskbits); + do { +- exp_digit = 1; ++ at_start = 1; + in_range = 0; + a = b = 0; + +@@ -540,11 +540,10 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen, + break; + + if (c == '-') { +- if (exp_digit || in_range) ++ if (at_start || in_range) + return -EINVAL; + b = 0; + in_range = 1; +- exp_digit = 1; + continue; + } + +@@ -554,16 +553,18 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen, + b = b * 10 + (c - '0'); + if (!in_range) + a = b; +- exp_digit = 0; ++ at_start = 0; + totaldigits++; + } + if (!(a <= b)) + return -EINVAL; + if (b >= nmaskbits) + return -ERANGE; +- while (a <= b) { +- set_bit(a, maskp); +- a++; ++ if (!at_start) { ++ while (a <= b) { ++ set_bit(a, maskp); ++ a++; ++ } + } + } while (buflen && c == ','); + return 0; +diff --git a/mm/hugetlb.c b/mm/hugetlb.c +index 271e443..8c4c1f9 100644 +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -40,6 +40,11 @@ int hugepages_treat_as_movable; + int hugetlb_max_hstate __read_mostly; + unsigned int default_hstate_idx; + struct hstate hstates[HUGE_MAX_HSTATE]; ++/* ++ * Minimum page order among possible hugepage sizes, set to a proper value ++ * at boot time. ++ */ ++static unsigned int minimum_order __read_mostly = UINT_MAX; + + __initdata LIST_HEAD(huge_boot_pages); + +@@ -1188,19 +1193,13 @@ static void dissolve_free_huge_page(struct page *page) + */ + void dissolve_free_huge_pages(unsigned long start_pfn, unsigned long end_pfn) + { +- unsigned int order = 8 * sizeof(void *); + unsigned long pfn; +- struct hstate *h; + + if (!hugepages_supported()) + return; + +- /* Set scan step to minimum hugepage size */ +- for_each_hstate(h) +- if (order > huge_page_order(h)) +- order = huge_page_order(h); +- VM_BUG_ON(!IS_ALIGNED(start_pfn, 1 << order)); +- for (pfn = start_pfn; pfn < end_pfn; pfn += 1 << order) ++ VM_BUG_ON(!IS_ALIGNED(start_pfn, 1 << minimum_order)); ++ for (pfn = start_pfn; pfn < end_pfn; pfn += 1 << minimum_order) + dissolve_free_huge_page(pfn_to_page(pfn)); + } + +@@ -1627,10 +1626,14 @@ static void __init hugetlb_init_hstates(void) + struct hstate *h; + + for_each_hstate(h) { ++ if (minimum_order > huge_page_order(h)) ++ minimum_order = huge_page_order(h); ++ + /* oversize hugepages were init'ed in early boot */ + if (!hstate_is_gigantic(h)) + hugetlb_hstate_alloc_pages(h); + } ++ VM_BUG_ON(minimum_order == UINT_MAX); + } + + static char * __init memfmt(char *buf, unsigned long n) +diff --git a/mm/memory.c b/mm/memory.c +index 22e037e..2a9e098 100644 +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -2669,6 +2669,10 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma, + + pte_unmap(page_table); + ++ /* File mapping without ->vm_ops ? */ ++ if (vma->vm_flags & VM_SHARED) ++ return VM_FAULT_SIGBUS; ++ + /* Check if we need to add a guard page to the stack */ + if (check_stack_guard_page(vma, address) < 0) + return VM_FAULT_SIGSEGV; +@@ -3097,6 +3101,9 @@ static int do_fault(struct mm_struct *mm, struct vm_area_struct *vma, + - vma->vm_start) >> PAGE_SHIFT) + vma->vm_pgoff; + + pte_unmap(page_table); ++ /* The VMA was not fully populated on mmap() or missing VM_DONTEXPAND */ ++ if (!vma->vm_ops->fault) ++ return VM_FAULT_SIGBUS; + if (!(flags & FAULT_FLAG_WRITE)) + return do_read_fault(mm, vma, address, pmd, pgoff, flags, + orig_pte); +@@ -3242,13 +3249,12 @@ static int handle_pte_fault(struct mm_struct *mm, + barrier(); + if (!pte_present(entry)) { + if (pte_none(entry)) { +- if (vma->vm_ops) { +- if (likely(vma->vm_ops->fault)) +- return do_fault(mm, vma, address, pte, +- pmd, flags, entry); +- } +- return do_anonymous_page(mm, vma, address, +- pte, pmd, flags); ++ if (vma->vm_ops) ++ return do_fault(mm, vma, address, pte, pmd, ++ flags, entry); ++ ++ return do_anonymous_page(mm, vma, address, pte, pmd, ++ flags); + } + return do_swap_page(mm, vma, address, + pte, pmd, flags, entry); +diff --git a/net/9p/client.c b/net/9p/client.c +index 6f4c4c8..81925b9 100644 +--- a/net/9p/client.c ++++ b/net/9p/client.c +@@ -843,7 +843,8 @@ static struct p9_req_t *p9_client_zc_rpc(struct p9_client *c, int8_t type, + if (err < 0) { + if (err == -EIO) + c->status = Disconnected; +- goto reterr; ++ if (err != -ERESTARTSYS) ++ goto reterr; + } + if (req->status == REQ_STATUS_ERROR) { + p9_debug(P9_DEBUG_ERROR, "req_status error %d\n", req->t_err); +@@ -1647,6 +1648,7 @@ p9_client_write(struct p9_fid *fid, u64 offset, struct iov_iter *from, int *err) + if (*err) { + trace_9p_protocol_dump(clnt, req->rc); + p9_free_req(clnt, req); ++ break; + } + + p9_debug(P9_DEBUG_9P, "<<< RWRITE count %d\n", count); +diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c +index 56f9edb..e11a5cf 100644 +--- a/net/bluetooth/hci_sock.c ++++ b/net/bluetooth/hci_sock.c +@@ -741,10 +741,11 @@ static int hci_sock_bind(struct socket *sock, struct sockaddr *addr, + goto done; + } + +- if (test_bit(HCI_UP, &hdev->flags) || +- test_bit(HCI_INIT, &hdev->flags) || ++ if (test_bit(HCI_INIT, &hdev->flags) || + hci_dev_test_flag(hdev, HCI_SETUP) || +- hci_dev_test_flag(hdev, HCI_CONFIG)) { ++ hci_dev_test_flag(hdev, HCI_CONFIG) || ++ (!hci_dev_test_flag(hdev, HCI_AUTO_OFF) && ++ test_bit(HCI_UP, &hdev->flags))) { + err = -EBUSY; + hci_dev_put(hdev); + goto done; +@@ -760,10 +761,21 @@ static int hci_sock_bind(struct socket *sock, struct sockaddr *addr, + + err = hci_dev_open(hdev->id); + if (err) { +- hci_dev_clear_flag(hdev, HCI_USER_CHANNEL); +- mgmt_index_added(hdev); +- hci_dev_put(hdev); +- goto done; ++ if (err == -EALREADY) { ++ /* In case the transport is already up and ++ * running, clear the error here. ++ * ++ * This can happen when opening an user ++ * channel and HCI_AUTO_OFF grace period ++ * is still active. ++ */ ++ err = 0; ++ } else { ++ hci_dev_clear_flag(hdev, HCI_USER_CHANNEL); ++ mgmt_index_added(hdev); ++ hci_dev_put(hdev); ++ goto done; ++ } + } + + atomic_inc(&hdev->promisc); +diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c +index 1579669..4a31258 100644 +--- a/net/ceph/osdmap.c ++++ b/net/ceph/osdmap.c +@@ -89,7 +89,7 @@ static int crush_decode_tree_bucket(void **p, void *end, + { + int j; + dout("crush_decode_tree_bucket %p to %p\n", *p, end); +- ceph_decode_32_safe(p, end, b->num_nodes, bad); ++ ceph_decode_8_safe(p, end, b->num_nodes, bad); + b->node_weights = kcalloc(b->num_nodes, sizeof(u32), GFP_NOFS); + if (b->node_weights == NULL) + return -ENOMEM; +diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c +index b60c65f..627a253 100644 +--- a/net/ieee802154/socket.c ++++ b/net/ieee802154/socket.c +@@ -739,6 +739,12 @@ static int dgram_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, + sock_recv_ts_and_drops(msg, sk, skb); + + if (saddr) { ++ /* Clear the implicit padding in struct sockaddr_ieee802154 ++ * (16 bits between 'family' and 'addr') and in struct ++ * ieee802154_addr_sa (16 bits at the end of the structure). ++ */ ++ memset(saddr, 0, sizeof(*saddr)); ++ + saddr->family = AF_IEEE802154; + ieee802154_addr_to_sa(&saddr->addr, &mac_cb(skb)->source); + *addr_len = sizeof(*saddr); +diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c +index ff347a0..f06d422 100644 +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -3356,6 +3356,7 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev, + /* Update CSA counters */ + if (sdata->vif.csa_active && + (sdata->vif.type == NL80211_IFTYPE_AP || ++ sdata->vif.type == NL80211_IFTYPE_MESH_POINT || + sdata->vif.type == NL80211_IFTYPE_ADHOC) && + params->n_csa_offsets) { + int i; +diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c +index bfef1b2..a9c9d96 100644 +--- a/net/mac80211/ibss.c ++++ b/net/mac80211/ibss.c +@@ -146,6 +146,7 @@ ieee80211_ibss_build_presp(struct ieee80211_sub_if_data *sdata, + csa_settings->chandef.chan->center_freq); + presp->csa_counter_offsets[0] = (pos - presp->head); + *pos++ = csa_settings->count; ++ presp->csa_current_counter = csa_settings->count; + } + + /* put the remaining rates in WLAN_EID_EXT_SUPP_RATES */ +diff --git a/net/mac80211/main.c b/net/mac80211/main.c +index df3051d..e86daed 100644 +--- a/net/mac80211/main.c ++++ b/net/mac80211/main.c +@@ -249,6 +249,7 @@ static void ieee80211_restart_work(struct work_struct *work) + { + struct ieee80211_local *local = + container_of(work, struct ieee80211_local, restart_work); ++ struct ieee80211_sub_if_data *sdata; + + /* wait for scan work complete */ + flush_workqueue(local->workqueue); +@@ -257,6 +258,8 @@ static void ieee80211_restart_work(struct work_struct *work) + "%s called with hardware scan in progress\n", __func__); + + rtnl_lock(); ++ list_for_each_entry(sdata, &local->interfaces, list) ++ flush_delayed_work(&sdata->dec_tailroom_needed_wk); + ieee80211_scan_cancel(local); + ieee80211_reconfig(local); + rtnl_unlock(); +diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c +index d468424..817098a 100644 +--- a/net/mac80211/mesh.c ++++ b/net/mac80211/mesh.c +@@ -680,6 +680,7 @@ ieee80211_mesh_build_beacon(struct ieee80211_if_mesh *ifmsh) + *pos++ = 0x0; + *pos++ = ieee80211_frequency_to_channel( + csa->settings.chandef.chan->center_freq); ++ bcn->csa_current_counter = csa->settings.count; + bcn->csa_counter_offsets[0] = hdr_len + 6; + *pos++ = csa->settings.count; + *pos++ = WLAN_EID_CHAN_SWITCH_PARAM; +diff --git a/net/sunrpc/backchannel_rqst.c b/net/sunrpc/backchannel_rqst.c +index 9dd0ea8d..28504df 100644 +--- a/net/sunrpc/backchannel_rqst.c ++++ b/net/sunrpc/backchannel_rqst.c +@@ -60,7 +60,7 @@ static void xprt_free_allocation(struct rpc_rqst *req) + + dprintk("RPC: free allocations for req= %p\n", req); + WARN_ON_ONCE(test_bit(RPC_BC_PA_IN_USE, &req->rq_bc_pa_state)); +- xbufp = &req->rq_private_buf; ++ xbufp = &req->rq_rcv_buf; + free_page((unsigned long)xbufp->head[0].iov_base); + xbufp = &req->rq_snd_buf; + free_page((unsigned long)xbufp->head[0].iov_base); +diff --git a/net/wireless/util.c b/net/wireless/util.c +index 70051ab..7e4e3ff 100644 +--- a/net/wireless/util.c ++++ b/net/wireless/util.c +@@ -944,7 +944,7 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev, + ntype == NL80211_IFTYPE_P2P_CLIENT)) + return -EBUSY; + +- if (ntype != otype && netif_running(dev)) { ++ if (ntype != otype) { + dev->ieee80211_ptr->use_4addr = false; + dev->ieee80211_ptr->mesh_id_up_len = 0; + wdev_lock(dev->ieee80211_ptr); +diff --git a/samples/trace_events/trace-events-sample.h b/samples/trace_events/trace-events-sample.h +index 8965d1b..125d640 100644 +--- a/samples/trace_events/trace-events-sample.h ++++ b/samples/trace_events/trace-events-sample.h +@@ -168,7 +168,10 @@ + * + * For __dynamic_array(int, foo, bar) use __get_dynamic_array(foo) + * Use __get_dynamic_array_len(foo) to get the length of the array +- * saved. ++ * saved. Note, __get_dynamic_array_len() returns the total allocated ++ * length of the dynamic array; __print_array() expects the second ++ * parameter to be the number of elements. To get that, the array length ++ * needs to be divided by the element size. + * + * For __string(foo, bar) use __get_str(foo) + * +@@ -288,7 +291,7 @@ TRACE_EVENT(foo_bar, + * This prints out the array that is defined by __array in a nice format. + */ + __print_array(__get_dynamic_array(list), +- __get_dynamic_array_len(list), ++ __get_dynamic_array_len(list) / sizeof(int), + sizeof(int)), + __get_str(str), __get_bitmask(cpus)) + ); +diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c +index 10f9943..5820914 100644 +--- a/security/integrity/evm/evm_main.c ++++ b/security/integrity/evm/evm_main.c +@@ -296,6 +296,17 @@ static int evm_protect_xattr(struct dentry *dentry, const char *xattr_name, + iint = integrity_iint_find(d_backing_inode(dentry)); + if (iint && (iint->flags & IMA_NEW_FILE)) + return 0; ++ ++ /* exception for pseudo filesystems */ ++ if (dentry->d_inode->i_sb->s_magic == TMPFS_MAGIC ++ || dentry->d_inode->i_sb->s_magic == SYSFS_MAGIC) ++ return 0; ++ ++ integrity_audit_msg(AUDIT_INTEGRITY_METADATA, ++ dentry->d_inode, dentry->d_name.name, ++ "update_metadata", ++ integrity_status_msg[evm_status], ++ -EPERM, 0); + } + out: + if (evm_status != INTEGRITY_PASS) +diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h +index 8ee997d..fc56d4d 100644 +--- a/security/integrity/ima/ima.h ++++ b/security/integrity/ima/ima.h +@@ -106,7 +106,7 @@ void ima_add_violation(struct file *file, const unsigned char *filename, + const char *op, const char *cause); + int ima_init_crypto(void); + void ima_putc(struct seq_file *m, void *data, int datalen); +-void ima_print_digest(struct seq_file *m, u8 *digest, int size); ++void ima_print_digest(struct seq_file *m, u8 *digest, u32 size); + struct ima_template_desc *ima_template_desc_current(void); + int ima_init_template(void); + +diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c +index 461215e..816d175 100644 +--- a/security/integrity/ima/ima_fs.c ++++ b/security/integrity/ima/ima_fs.c +@@ -190,9 +190,9 @@ static const struct file_operations ima_measurements_ops = { + .release = seq_release, + }; + +-void ima_print_digest(struct seq_file *m, u8 *digest, int size) ++void ima_print_digest(struct seq_file *m, u8 *digest, u32 size) + { +- int i; ++ u32 i; + + for (i = 0; i < size; i++) + seq_printf(m, "%02x", *(digest + i)); +diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c +index d1eefb9..3997e20 100644 +--- a/security/integrity/ima/ima_policy.c ++++ b/security/integrity/ima/ima_policy.c +@@ -27,6 +27,8 @@ + #define IMA_UID 0x0008 + #define IMA_FOWNER 0x0010 + #define IMA_FSUUID 0x0020 ++#define IMA_INMASK 0x0040 ++#define IMA_EUID 0x0080 + + #define UNKNOWN 0 + #define MEASURE 0x0001 /* same as IMA_MEASURE */ +@@ -42,6 +44,8 @@ enum lsm_rule_types { LSM_OBJ_USER, LSM_OBJ_ROLE, LSM_OBJ_TYPE, + LSM_SUBJ_USER, LSM_SUBJ_ROLE, LSM_SUBJ_TYPE + }; + ++enum policy_types { ORIGINAL_TCB = 1, DEFAULT_TCB }; ++ + struct ima_rule_entry { + struct list_head list; + int action; +@@ -70,7 +74,7 @@ struct ima_rule_entry { + * normal users can easily run the machine out of memory simply building + * and running executables. + */ +-static struct ima_rule_entry default_rules[] = { ++static struct ima_rule_entry dont_measure_rules[] = { + {.action = DONT_MEASURE, .fsmagic = PROC_SUPER_MAGIC, .flags = IMA_FSMAGIC}, + {.action = DONT_MEASURE, .fsmagic = SYSFS_MAGIC, .flags = IMA_FSMAGIC}, + {.action = DONT_MEASURE, .fsmagic = DEBUGFS_MAGIC, .flags = IMA_FSMAGIC}, +@@ -79,12 +83,31 @@ static struct ima_rule_entry default_rules[] = { + {.action = DONT_MEASURE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC}, + {.action = DONT_MEASURE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC}, + {.action = DONT_MEASURE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC}, ++ {.action = DONT_MEASURE, .fsmagic = CGROUP_SUPER_MAGIC, ++ .flags = IMA_FSMAGIC}, ++ {.action = DONT_MEASURE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC} ++}; ++ ++static struct ima_rule_entry original_measurement_rules[] = { + {.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC, + .flags = IMA_FUNC | IMA_MASK}, + {.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC, + .flags = IMA_FUNC | IMA_MASK}, +- {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ, .uid = GLOBAL_ROOT_UID, +- .flags = IMA_FUNC | IMA_MASK | IMA_UID}, ++ {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ, ++ .uid = GLOBAL_ROOT_UID, .flags = IMA_FUNC | IMA_MASK | IMA_UID}, ++ {.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC}, ++ {.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC}, ++}; ++ ++static struct ima_rule_entry default_measurement_rules[] = { ++ {.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC, ++ .flags = IMA_FUNC | IMA_MASK}, ++ {.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC, ++ .flags = IMA_FUNC | IMA_MASK}, ++ {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ, ++ .uid = GLOBAL_ROOT_UID, .flags = IMA_FUNC | IMA_INMASK | IMA_EUID}, ++ {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ, ++ .uid = GLOBAL_ROOT_UID, .flags = IMA_FUNC | IMA_INMASK | IMA_UID}, + {.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC}, + {.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC}, + }; +@@ -99,6 +122,7 @@ static struct ima_rule_entry default_appraise_rules[] = { + {.action = DONT_APPRAISE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC}, + {.action = DONT_APPRAISE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC}, + {.action = DONT_APPRAISE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC}, ++ {.action = DONT_APPRAISE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC}, + {.action = DONT_APPRAISE, .fsmagic = CGROUP_SUPER_MAGIC, .flags = IMA_FSMAGIC}, + #ifndef CONFIG_IMA_APPRAISE_SIGNED_INIT + {.action = APPRAISE, .fowner = GLOBAL_ROOT_UID, .flags = IMA_FOWNER}, +@@ -115,14 +139,29 @@ static struct list_head *ima_rules; + + static DEFINE_MUTEX(ima_rules_mutex); + +-static bool ima_use_tcb __initdata; ++static int ima_policy __initdata; + static int __init default_measure_policy_setup(char *str) + { +- ima_use_tcb = 1; ++ if (ima_policy) ++ return 1; ++ ++ ima_policy = ORIGINAL_TCB; + return 1; + } + __setup("ima_tcb", default_measure_policy_setup); + ++static int __init policy_setup(char *str) ++{ ++ if (ima_policy) ++ return 1; ++ ++ if (strcmp(str, "tcb") == 0) ++ ima_policy = DEFAULT_TCB; ++ ++ return 1; ++} ++__setup("ima_policy=", policy_setup); ++ + static bool ima_use_appraise_tcb __initdata; + static int __init default_appraise_policy_setup(char *str) + { +@@ -182,6 +221,9 @@ static bool ima_match_rules(struct ima_rule_entry *rule, + if ((rule->flags & IMA_MASK) && + (rule->mask != mask && func != POST_SETATTR)) + return false; ++ if ((rule->flags & IMA_INMASK) && ++ (!(rule->mask & mask) && func != POST_SETATTR)) ++ return false; + if ((rule->flags & IMA_FSMAGIC) + && rule->fsmagic != inode->i_sb->s_magic) + return false; +@@ -190,6 +232,16 @@ static bool ima_match_rules(struct ima_rule_entry *rule, + return false; + if ((rule->flags & IMA_UID) && !uid_eq(rule->uid, cred->uid)) + return false; ++ if (rule->flags & IMA_EUID) { ++ if (has_capability_noaudit(current, CAP_SETUID)) { ++ if (!uid_eq(rule->uid, cred->euid) ++ && !uid_eq(rule->uid, cred->suid) ++ && !uid_eq(rule->uid, cred->uid)) ++ return false; ++ } else if (!uid_eq(rule->uid, cred->euid)) ++ return false; ++ } ++ + if ((rule->flags & IMA_FOWNER) && !uid_eq(rule->fowner, inode->i_uid)) + return false; + for (i = 0; i < MAX_LSM_RULES; i++) { +@@ -333,21 +385,31 @@ void __init ima_init_policy(void) + { + int i, measure_entries, appraise_entries; + +- /* if !ima_use_tcb set entries = 0 so we load NO default rules */ +- measure_entries = ima_use_tcb ? ARRAY_SIZE(default_rules) : 0; ++ /* if !ima_policy set entries = 0 so we load NO default rules */ ++ measure_entries = ima_policy ? ARRAY_SIZE(dont_measure_rules) : 0; + appraise_entries = ima_use_appraise_tcb ? + ARRAY_SIZE(default_appraise_rules) : 0; + +- for (i = 0; i < measure_entries + appraise_entries; i++) { +- if (i < measure_entries) +- list_add_tail(&default_rules[i].list, +- &ima_default_rules); +- else { +- int j = i - measure_entries; ++ for (i = 0; i < measure_entries; i++) ++ list_add_tail(&dont_measure_rules[i].list, &ima_default_rules); + +- list_add_tail(&default_appraise_rules[j].list, ++ switch (ima_policy) { ++ case ORIGINAL_TCB: ++ for (i = 0; i < ARRAY_SIZE(original_measurement_rules); i++) ++ list_add_tail(&original_measurement_rules[i].list, + &ima_default_rules); +- } ++ break; ++ case DEFAULT_TCB: ++ for (i = 0; i < ARRAY_SIZE(default_measurement_rules); i++) ++ list_add_tail(&default_measurement_rules[i].list, ++ &ima_default_rules); ++ default: ++ break; ++ } ++ ++ for (i = 0; i < appraise_entries; i++) { ++ list_add_tail(&default_appraise_rules[i].list, ++ &ima_default_rules); + } + + ima_rules = &ima_default_rules; +@@ -373,7 +435,8 @@ enum { + Opt_audit, + Opt_obj_user, Opt_obj_role, Opt_obj_type, + Opt_subj_user, Opt_subj_role, Opt_subj_type, +- Opt_func, Opt_mask, Opt_fsmagic, Opt_uid, Opt_fowner, ++ Opt_func, Opt_mask, Opt_fsmagic, ++ Opt_uid, Opt_euid, Opt_fowner, + Opt_appraise_type, Opt_fsuuid, Opt_permit_directio + }; + +@@ -394,6 +457,7 @@ static match_table_t policy_tokens = { + {Opt_fsmagic, "fsmagic=%s"}, + {Opt_fsuuid, "fsuuid=%s"}, + {Opt_uid, "uid=%s"}, ++ {Opt_euid, "euid=%s"}, + {Opt_fowner, "fowner=%s"}, + {Opt_appraise_type, "appraise_type=%s"}, + {Opt_permit_directio, "permit_directio"}, +@@ -435,6 +499,7 @@ static void ima_log_string(struct audit_buffer *ab, char *key, char *value) + static int ima_parse_rule(char *rule, struct ima_rule_entry *entry) + { + struct audit_buffer *ab; ++ char *from; + char *p; + int result = 0; + +@@ -525,18 +590,23 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry) + if (entry->mask) + result = -EINVAL; + +- if ((strcmp(args[0].from, "MAY_EXEC")) == 0) ++ from = args[0].from; ++ if (*from == '^') ++ from++; ++ ++ if ((strcmp(from, "MAY_EXEC")) == 0) + entry->mask = MAY_EXEC; +- else if (strcmp(args[0].from, "MAY_WRITE") == 0) ++ else if (strcmp(from, "MAY_WRITE") == 0) + entry->mask = MAY_WRITE; +- else if (strcmp(args[0].from, "MAY_READ") == 0) ++ else if (strcmp(from, "MAY_READ") == 0) + entry->mask = MAY_READ; +- else if (strcmp(args[0].from, "MAY_APPEND") == 0) ++ else if (strcmp(from, "MAY_APPEND") == 0) + entry->mask = MAY_APPEND; + else + result = -EINVAL; + if (!result) +- entry->flags |= IMA_MASK; ++ entry->flags |= (*args[0].from == '^') ++ ? IMA_INMASK : IMA_MASK; + break; + case Opt_fsmagic: + ima_log_string(ab, "fsmagic", args[0].from); +@@ -566,6 +636,9 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry) + break; + case Opt_uid: + ima_log_string(ab, "uid", args[0].from); ++ case Opt_euid: ++ if (token == Opt_euid) ++ ima_log_string(ab, "euid", args[0].from); + + if (uid_valid(entry->uid)) { + result = -EINVAL; +@@ -574,11 +647,14 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry) + + result = kstrtoul(args[0].from, 10, &lnum); + if (!result) { +- entry->uid = make_kuid(current_user_ns(), (uid_t)lnum); +- if (!uid_valid(entry->uid) || (((uid_t)lnum) != lnum)) ++ entry->uid = make_kuid(current_user_ns(), ++ (uid_t) lnum); ++ if (!uid_valid(entry->uid) || ++ (uid_t)lnum != lnum) + result = -EINVAL; + else +- entry->flags |= IMA_UID; ++ entry->flags |= (token == Opt_uid) ++ ? IMA_UID : IMA_EUID; + } + break; + case Opt_fowner: +diff --git a/security/integrity/ima/ima_template_lib.c b/security/integrity/ima/ima_template_lib.c +index bcfc36c..61fbd0c 100644 +--- a/security/integrity/ima/ima_template_lib.c ++++ b/security/integrity/ima/ima_template_lib.c +@@ -70,7 +70,8 @@ static void ima_show_template_data_ascii(struct seq_file *m, + enum data_formats datafmt, + struct ima_field_data *field_data) + { +- u8 *buf_ptr = field_data->data, buflen = field_data->len; ++ u8 *buf_ptr = field_data->data; ++ u32 buflen = field_data->len; + + switch (datafmt) { + case DATA_FMT_DIGEST_WITH_ALGO: +diff --git a/security/keys/keyring.c b/security/keys/keyring.c +index e72548b..d334370 100644 +--- a/security/keys/keyring.c ++++ b/security/keys/keyring.c +@@ -1181,9 +1181,11 @@ void __key_link_end(struct key *keyring, + if (index_key->type == &key_type_keyring) + up_write(&keyring_serialise_link_sem); + +- if (edit && !edit->dead_leaf) { +- key_payload_reserve(keyring, +- keyring->datalen - KEYQUOTA_LINK_BYTES); ++ if (edit) { ++ if (!edit->dead_leaf) { ++ key_payload_reserve(keyring, ++ keyring->datalen - KEYQUOTA_LINK_BYTES); ++ } + assoc_array_cancel_edit(edit); + } + up_write(&keyring->sem); +diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c +index 212070e..7f8d7f1 100644 +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -3288,7 +3288,8 @@ static int file_map_prot_check(struct file *file, unsigned long prot, int shared + int rc = 0; + + if (default_noexec && +- (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) { ++ (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) || ++ (!shared && (prot & PROT_WRITE)))) { + /* + * We are making executable an anonymous mapping or a + * private file mapping that will also be writable. +diff --git a/security/selinux/ss/ebitmap.c b/security/selinux/ss/ebitmap.c +index afe6a26..57644b1 100644 +--- a/security/selinux/ss/ebitmap.c ++++ b/security/selinux/ss/ebitmap.c +@@ -153,6 +153,12 @@ int ebitmap_netlbl_import(struct ebitmap *ebmap, + if (offset == (u32)-1) + return 0; + ++ /* don't waste ebitmap space if the netlabel bitmap is empty */ ++ if (bitmap == 0) { ++ offset += EBITMAP_UNIT_SIZE; ++ continue; ++ } ++ + if (e_iter == NULL || + offset >= e_iter->startbit + EBITMAP_SIZE) { + e_prev = e_iter; +diff --git a/sound/soc/codecs/max98925.c b/sound/soc/codecs/max98925.c +index 9b5a17d..aad6642 100644 +--- a/sound/soc/codecs/max98925.c ++++ b/sound/soc/codecs/max98925.c +@@ -346,7 +346,7 @@ static int max98925_dai_set_fmt(struct snd_soc_dai *codec_dai, + } + + regmap_update_bits(max98925->regmap, MAX98925_FORMAT, +- M98925_DAI_BCI_MASK, invert); ++ M98925_DAI_BCI_MASK | M98925_DAI_WCI_MASK, invert); + return 0; + } + +diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c +index be4d741..2ee44ab 100644 +--- a/sound/soc/codecs/rt5645.c ++++ b/sound/soc/codecs/rt5645.c +@@ -2837,6 +2837,8 @@ static int rt5645_i2c_probe(struct i2c_client *i2c, + } + } + ++ INIT_DELAYED_WORK(&rt5645->jack_detect_work, rt5645_jack_detect_work); ++ + if (rt5645->i2c->irq) { + ret = request_threaded_irq(rt5645->i2c->irq, NULL, rt5645_irq, + IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING +@@ -2855,8 +2857,6 @@ static int rt5645_i2c_probe(struct i2c_client *i2c, + dev_err(&i2c->dev, "Fail gpio_direction hp_det_gpio\n"); + } + +- INIT_DELAYED_WORK(&rt5645->jack_detect_work, rt5645_jack_detect_work); +- + return snd_soc_register_codec(&i2c->dev, &soc_codec_dev_rt5645, + rt5645_dai, ARRAY_SIZE(rt5645_dai)); + } +diff --git a/sound/soc/codecs/tas2552.c b/sound/soc/codecs/tas2552.c +index dfb4ff5..1855859 100644 +--- a/sound/soc/codecs/tas2552.c ++++ b/sound/soc/codecs/tas2552.c +@@ -120,6 +120,9 @@ static void tas2552_sw_shutdown(struct tas2552_data *tas_data, int sw_shutdown) + { + u8 cfg1_reg; + ++ if (!tas_data->codec) ++ return; ++ + if (sw_shutdown) + cfg1_reg = 0; + else +@@ -335,7 +338,6 @@ static DECLARE_TLV_DB_SCALE(dac_tlv, -7, 100, 24); + static const struct snd_kcontrol_new tas2552_snd_controls[] = { + SOC_SINGLE_TLV("Speaker Driver Playback Volume", + TAS2552_PGA_GAIN, 0, 0x1f, 1, dac_tlv), +- SOC_DAPM_SINGLE("Playback AMP", SND_SOC_NOPM, 0, 1, 0), + }; + + static const struct reg_default tas2552_init_regs[] = { +diff --git a/sound/soc/codecs/wm5102.c b/sound/soc/codecs/wm5102.c +index 0c6d1bc..d476221 100644 +--- a/sound/soc/codecs/wm5102.c ++++ b/sound/soc/codecs/wm5102.c +@@ -42,7 +42,7 @@ struct wm5102_priv { + static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0); + static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0); + static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0); +-static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0); ++static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0); + static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0); + + static const struct wm_adsp_region wm5102_dsp1_regions[] = { +diff --git a/sound/soc/codecs/wm5110.c b/sound/soc/codecs/wm5110.c +index fbaeddb..3ee6cfd 100644 +--- a/sound/soc/codecs/wm5110.c ++++ b/sound/soc/codecs/wm5110.c +@@ -167,7 +167,7 @@ static int wm5110_sysclk_ev(struct snd_soc_dapm_widget *w, + static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0); + static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0); + static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0); +-static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0); ++static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0); + static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0); + + #define WM5110_NG_SRC(name, base) \ +diff --git a/sound/soc/codecs/wm8737.c b/sound/soc/codecs/wm8737.c +index ada9ac1..51171e4 100644 +--- a/sound/soc/codecs/wm8737.c ++++ b/sound/soc/codecs/wm8737.c +@@ -483,7 +483,8 @@ static int wm8737_set_bias_level(struct snd_soc_codec *codec, + + /* Fast VMID ramp at 2*2.5k */ + snd_soc_update_bits(codec, WM8737_MISC_BIAS_CONTROL, +- WM8737_VMIDSEL_MASK, 0x4); ++ WM8737_VMIDSEL_MASK, ++ 2 << WM8737_VMIDSEL_SHIFT); + + /* Bring VMID up */ + snd_soc_update_bits(codec, WM8737_POWER_MANAGEMENT, +@@ -497,7 +498,8 @@ static int wm8737_set_bias_level(struct snd_soc_codec *codec, + + /* VMID at 2*300k */ + snd_soc_update_bits(codec, WM8737_MISC_BIAS_CONTROL, +- WM8737_VMIDSEL_MASK, 2); ++ WM8737_VMIDSEL_MASK, ++ 1 << WM8737_VMIDSEL_SHIFT); + + break; + +diff --git a/sound/soc/codecs/wm8903.h b/sound/soc/codecs/wm8903.h +index db94931..0bb4a64 100644 +--- a/sound/soc/codecs/wm8903.h ++++ b/sound/soc/codecs/wm8903.h +@@ -172,7 +172,7 @@ extern int wm8903_mic_detect(struct snd_soc_codec *codec, + #define WM8903_VMID_BUF_ENA_WIDTH 1 /* VMID_BUF_ENA */ + + #define WM8903_VMID_RES_50K 2 +-#define WM8903_VMID_RES_250K 3 ++#define WM8903_VMID_RES_250K 4 + #define WM8903_VMID_RES_5K 6 + + /* +diff --git a/sound/soc/codecs/wm8955.c b/sound/soc/codecs/wm8955.c +index 00bec91..03e04bf 100644 +--- a/sound/soc/codecs/wm8955.c ++++ b/sound/soc/codecs/wm8955.c +@@ -298,7 +298,7 @@ static int wm8955_configure_clocking(struct snd_soc_codec *codec) + snd_soc_update_bits(codec, WM8955_PLL_CONTROL_2, + WM8955_K_17_9_MASK, + (pll.k >> 9) & WM8955_K_17_9_MASK); +- snd_soc_update_bits(codec, WM8955_PLL_CONTROL_2, ++ snd_soc_update_bits(codec, WM8955_PLL_CONTROL_3, + WM8955_K_8_0_MASK, + pll.k & WM8955_K_8_0_MASK); + if (pll.k) +diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c +index e97a761..8d7f632 100644 +--- a/sound/soc/codecs/wm8960.c ++++ b/sound/soc/codecs/wm8960.c +@@ -245,7 +245,7 @@ SOC_SINGLE("PCM Playback -6dB Switch", WM8960_DACCTL1, 7, 1, 0), + SOC_ENUM("ADC Polarity", wm8960_enum[0]), + SOC_SINGLE("ADC High Pass Filter Switch", WM8960_DACCTL1, 0, 1, 0), + +-SOC_ENUM("DAC Polarity", wm8960_enum[2]), ++SOC_ENUM("DAC Polarity", wm8960_enum[1]), + SOC_SINGLE_BOOL_EXT("DAC Deemphasis Switch", 0, + wm8960_get_deemph, wm8960_put_deemph), + +diff --git a/sound/soc/codecs/wm8997.c b/sound/soc/codecs/wm8997.c +index a4d1177..e7c81ba 100644 +--- a/sound/soc/codecs/wm8997.c ++++ b/sound/soc/codecs/wm8997.c +@@ -40,7 +40,7 @@ struct wm8997_priv { + static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0); + static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0); + static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0); +-static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0); ++static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0); + static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0); + + static const struct reg_default wm8997_sysclk_reva_patch[] = { +diff --git a/sound/soc/fsl/imx-wm8962.c b/sound/soc/fsl/imx-wm8962.c +index cd146d4..b38b98c 100644 +--- a/sound/soc/fsl/imx-wm8962.c ++++ b/sound/soc/fsl/imx-wm8962.c +@@ -190,7 +190,7 @@ static int imx_wm8962_probe(struct platform_device *pdev) + dev_err(&pdev->dev, "audmux internal port setup failed\n"); + return ret; + } +- imx_audmux_v2_configure_port(ext_port, ++ ret = imx_audmux_v2_configure_port(ext_port, + IMX_AUDMUX_V2_PTCR_SYN, + IMX_AUDMUX_V2_PDCR_RXDSEL(int_port)); + if (ret) { +diff --git a/sound/soc/omap/Kconfig b/sound/soc/omap/Kconfig +index 6768e4f..30d0109 100644 +--- a/sound/soc/omap/Kconfig ++++ b/sound/soc/omap/Kconfig +@@ -100,12 +100,13 @@ config SND_OMAP_SOC_OMAP_TWL4030 + + config SND_OMAP_SOC_OMAP_ABE_TWL6040 + tristate "SoC Audio support for OMAP boards using ABE and twl6040 codec" +- depends on TWL6040_CORE && SND_OMAP_SOC && (ARCH_OMAP4 || SOC_OMAP5 || COMPILE_TEST) ++ depends on TWL6040_CORE && SND_OMAP_SOC ++ depends on ARCH_OMAP4 || (SOC_OMAP5 && MFD_PALMAS) || COMPILE_TEST + select SND_OMAP_SOC_DMIC + select SND_OMAP_SOC_MCPDM + select SND_SOC_TWL6040 + select SND_SOC_DMIC +- select COMMON_CLK_PALMAS if MFD_PALMAS ++ select COMMON_CLK_PALMAS if (SOC_OMAP5 && MFD_PALMAS) + help + Say Y if you want to add support for SoC audio on OMAP boards using + ABE and twl6040 codec. This driver currently supports: +diff --git a/sound/soc/qcom/Kconfig b/sound/soc/qcom/Kconfig +index 5f58e4f..b07f183 100644 +--- a/sound/soc/qcom/Kconfig ++++ b/sound/soc/qcom/Kconfig +@@ -6,12 +6,10 @@ config SND_SOC_QCOM + + config SND_SOC_LPASS_CPU + tristate +- depends on SND_SOC_QCOM + select REGMAP_MMIO + + config SND_SOC_LPASS_PLATFORM + tristate +- depends on SND_SOC_QCOM + select REGMAP_MMIO + + config SND_SOC_STORM +diff --git a/tools/perf/util/cloexec.c b/tools/perf/util/cloexec.c +index 85b5238..2babdda 100644 +--- a/tools/perf/util/cloexec.c ++++ b/tools/perf/util/cloexec.c +@@ -7,11 +7,15 @@ + + static unsigned long flag = PERF_FLAG_FD_CLOEXEC; + ++#ifdef __GLIBC_PREREQ ++#if !__GLIBC_PREREQ(2, 6) + int __weak sched_getcpu(void) + { + errno = ENOSYS; + return -1; + } ++#endif ++#endif + + static int perf_flag_probe(void) + { diff --git a/4.1.3/4420_grsecurity-3.1-4.1.3-201508011613.patch b/4.1.4/4420_grsecurity-3.1-4.1.4-201508032312.patch index bcae8ba..95b7d51 100644 --- a/4.1.3/4420_grsecurity-3.1-4.1.3-201508011613.patch +++ b/4.1.4/4420_grsecurity-3.1-4.1.4-201508032312.patch @@ -313,7 +313,7 @@ index 74b6c6d..eac0e77 100644 A typical pattern in a Kbuild file looks like this: diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt -index 6726139..c825c0a 100644 +index cd03a0f..b8d72be 100644 --- a/Documentation/kernel-parameters.txt +++ b/Documentation/kernel-parameters.txt @@ -1223,6 +1223,13 @@ bytes respectively. Such letter suffixes can also be entirely omitted. @@ -330,7 +330,7 @@ index 6726139..c825c0a 100644 hashdist= [KNL,NUMA] Large hashes allocated during boot are distributed across NUMA nodes. Defaults on for 64-bit NUMA, off otherwise. -@@ -2333,6 +2340,10 @@ bytes respectively. Such letter suffixes can also be entirely omitted. +@@ -2341,6 +2348,10 @@ bytes respectively. Such letter suffixes can also be entirely omitted. noexec=on: enable non-executable mappings (default) noexec=off: disable non-executable mappings @@ -341,7 +341,7 @@ index 6726139..c825c0a 100644 nosmap [X86] Disable SMAP (Supervisor Mode Access Prevention) even if it is supported by processor. -@@ -2631,6 +2642,30 @@ bytes respectively. Such letter suffixes can also be entirely omitted. +@@ -2639,6 +2650,30 @@ bytes respectively. Such letter suffixes can also be entirely omitted. the specified number of seconds. This is to be used if your oopses keep scrolling off the screen. @@ -406,7 +406,7 @@ index c831001..1bfbbf6 100644 A toggle value indicating if modules are allowed to be loaded diff --git a/Makefile b/Makefile -index e3cdec4..56ae73d 100644 +index 36f3225..414e93e 100644 --- a/Makefile +++ b/Makefile @@ -299,7 +299,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \ @@ -3183,7 +3183,7 @@ index 423663e..bfeb0ff 100644 - return page; -} diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c -index cca5b87..68f0f73 100644 +index f11d825..bbe686f 100644 --- a/arch/arm/kernel/smp.c +++ b/arch/arm/kernel/smp.c @@ -76,7 +76,7 @@ enum ipi_msg_type { @@ -33728,7 +33728,7 @@ index b4f2e7e..96c9c3e 100644 pte = kmemcheck_pte_lookup(address); diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c -index 9d518d6..8a091f5 100644 +index 844b06d..f363c86 100644 --- a/arch/x86/mm/mmap.c +++ b/arch/x86/mm/mmap.c @@ -52,7 +52,7 @@ static unsigned long stack_maxrandom_size(void) @@ -33786,7 +33786,7 @@ index 9d518d6..8a091f5 100644 return TASK_UNMAPPED_BASE + rnd; } -@@ -113,16 +126,27 @@ void arch_pick_mmap_layout(struct mm_struct *mm) +@@ -113,18 +126,29 @@ void arch_pick_mmap_layout(struct mm_struct *mm) { unsigned long random_factor = 0UL; @@ -33816,6 +33816,8 @@ index 9d518d6..8a091f5 100644 +#endif + } + + const char *arch_vma_name(struct vm_area_struct *vma) diff --git a/arch/x86/mm/mmio-mod.c b/arch/x86/mm/mmio-mod.c index 0057a7a..95c7edd 100644 --- a/arch/x86/mm/mmio-mod.c @@ -36510,7 +36512,7 @@ index 2f33760..835e50a 100644 #define XCHAL_ICACHE_SIZE 8192 /* I-cache size in bytes or 0 */ #define XCHAL_DCACHE_SIZE 8192 /* D-cache size in bytes or 0 */ diff --git a/block/bio.c b/block/bio.c -index f66a4ea..73ddf55 100644 +index 4441522..dedbafc 100644 --- a/block/bio.c +++ b/block/bio.c @@ -1172,7 +1172,7 @@ struct bio *bio_copy_user_iov(struct request_queue *q, @@ -37107,7 +37109,7 @@ index 287c4ba..6a600bc 100644 unsigned long timeout_msec) { diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c -index 577849c..920847c 100644 +index 41c99be..f058d4a 100644 --- a/drivers/ata/libata-core.c +++ b/drivers/ata/libata-core.c @@ -102,7 +102,7 @@ static unsigned int ata_dev_set_xfermode(struct ata_device *dev); @@ -37119,7 +37121,7 @@ index 577849c..920847c 100644 struct ata_force_param { const char *name; -@@ -4801,7 +4801,7 @@ void ata_qc_free(struct ata_queued_cmd *qc) +@@ -4816,7 +4816,7 @@ void ata_qc_free(struct ata_queued_cmd *qc) struct ata_port *ap; unsigned int tag; @@ -37128,7 +37130,7 @@ index 577849c..920847c 100644 ap = qc->ap; qc->flags = 0; -@@ -4818,7 +4818,7 @@ void __ata_qc_complete(struct ata_queued_cmd *qc) +@@ -4833,7 +4833,7 @@ void __ata_qc_complete(struct ata_queued_cmd *qc) struct ata_port *ap; struct ata_link *link; @@ -37137,7 +37139,7 @@ index 577849c..920847c 100644 WARN_ON_ONCE(!(qc->flags & ATA_QCFLAG_ACTIVE)); ap = qc->ap; link = qc->dev->link; -@@ -5925,6 +5925,7 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops) +@@ -5940,6 +5940,7 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops) return; spin_lock(&lock); @@ -37145,7 +37147,7 @@ index 577849c..920847c 100644 for (cur = ops->inherits; cur; cur = cur->inherits) { void **inherit = (void **)cur; -@@ -5938,8 +5939,9 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops) +@@ -5953,8 +5954,9 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops) if (IS_ERR(*pp)) *pp = NULL; @@ -37156,7 +37158,7 @@ index 577849c..920847c 100644 spin_unlock(&lock); } -@@ -6135,7 +6137,7 @@ int ata_host_register(struct ata_host *host, struct scsi_host_template *sht) +@@ -6150,7 +6152,7 @@ int ata_host_register(struct ata_host *host, struct scsi_host_template *sht) /* give ports names and add SCSI hosts */ for (i = 0; i < host->n_ports; i++) { @@ -37166,10 +37168,10 @@ index 577849c..920847c 100644 } diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c -index 3131adc..93e7aa0 100644 +index 641a61a..8309252 100644 --- a/drivers/ata/libata-scsi.c +++ b/drivers/ata/libata-scsi.c -@@ -4209,7 +4209,7 @@ int ata_sas_port_init(struct ata_port *ap) +@@ -4210,7 +4210,7 @@ int ata_sas_port_init(struct ata_port *ap) if (rc) return rc; @@ -38999,7 +39001,7 @@ index 09e628da..7607aaa 100644 if (ti.nwa_v) { pd->nwa = be32_to_cpu(ti.next_writable); diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c -index ec6c5c6..820ee2abc 100644 +index 53f2535..b8a9ce0 100644 --- a/drivers/block/rbd.c +++ b/drivers/block/rbd.c @@ -64,7 +64,7 @@ @@ -41123,10 +41125,10 @@ index 9b23525..65f4110 100644 dev->driver->context_dtor(dev, ctx->handle); drm_legacy_ctxbitmap_free(dev, ctx->handle); diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c -index 3007b44..420b4a3 100644 +index 800a025..c88f1a4 100644 --- a/drivers/gpu/drm/drm_crtc.c +++ b/drivers/gpu/drm/drm_crtc.c -@@ -4176,7 +4176,7 @@ int drm_mode_getproperty_ioctl(struct drm_device *dev, +@@ -4179,7 +4179,7 @@ int drm_mode_getproperty_ioctl(struct drm_device *dev, goto done; } @@ -41312,10 +41314,10 @@ index cbb4fc0..5c756cb9 100644 else type = types[map->type]; diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c -index aa8bbb4..0f62630 100644 +index 9cfcd0a..97778c5 100644 --- a/drivers/gpu/drm/drm_ioc32.c +++ b/drivers/gpu/drm/drm_ioc32.c -@@ -457,7 +457,7 @@ static int compat_drm_infobufs(struct file *file, unsigned int cmd, +@@ -459,7 +459,7 @@ static int compat_drm_infobufs(struct file *file, unsigned int cmd, request = compat_alloc_user_space(nbytes); if (!access_ok(VERIFY_WRITE, request, nbytes)) return -EFAULT; @@ -41324,7 +41326,7 @@ index aa8bbb4..0f62630 100644 if (__put_user(count, &request->count) || __put_user(list, &request->list)) -@@ -518,7 +518,7 @@ static int compat_drm_mapbufs(struct file *file, unsigned int cmd, +@@ -520,7 +520,7 @@ static int compat_drm_mapbufs(struct file *file, unsigned int cmd, request = compat_alloc_user_space(nbytes); if (!access_ok(VERIFY_WRITE, request, nbytes)) return -EFAULT; @@ -41333,7 +41335,7 @@ index aa8bbb4..0f62630 100644 if (__put_user(count, &request->count) || __put_user(list, &request->list)) -@@ -1016,7 +1016,7 @@ static int compat_drm_wait_vblank(struct file *file, unsigned int cmd, +@@ -1075,7 +1075,7 @@ static int compat_drm_mode_addfb2(struct file *file, unsigned int cmd, return 0; } @@ -41342,7 +41344,7 @@ index aa8bbb4..0f62630 100644 [DRM_IOCTL_NR(DRM_IOCTL_VERSION32)] = compat_drm_version, [DRM_IOCTL_NR(DRM_IOCTL_GET_UNIQUE32)] = compat_drm_getunique, [DRM_IOCTL_NR(DRM_IOCTL_GET_MAP32)] = compat_drm_getmap, -@@ -1062,7 +1062,6 @@ static drm_ioctl_compat_t *drm_compat_ioctls[] = { +@@ -1122,7 +1122,6 @@ static drm_ioctl_compat_t *drm_compat_ioctls[] = { long drm_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) { unsigned int nr = DRM_IOCTL_NR(cmd); @@ -41350,8 +41352,11 @@ index aa8bbb4..0f62630 100644 int ret; /* Assume that ioctls without an explicit compat routine will just -@@ -1072,10 +1071,8 @@ long drm_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) +@@ -1130,12 +1129,11 @@ long drm_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) + * than always failing. + */ if (nr >= ARRAY_SIZE(drm_compat_ioctls)) ++ return drm_ioctl(filp, cmd, arg); - fn = drm_compat_ioctls[nr]; @@ -41499,7 +41504,7 @@ index a3190e79..86b06cb 100644 invalid_flags = __EXEC_OBJECT_UNKNOWN_FLAGS; if (USES_FULL_PPGTT(dev)) diff --git a/drivers/gpu/drm/i915/i915_ioc32.c b/drivers/gpu/drm/i915/i915_ioc32.c -index 176de63..b50b66a 100644 +index 23aa04c..1d25960 100644 --- a/drivers/gpu/drm/i915/i915_ioc32.c +++ b/drivers/gpu/drm/i915/i915_ioc32.c @@ -62,7 +62,7 @@ static int compat_i915_batchbuffer(struct file *file, unsigned int cmd, @@ -41543,7 +41548,7 @@ index 176de63..b50b66a 100644 - drm_ioctl_compat_t *fn = NULL; int ret; - if (nr < DRM_COMMAND_BASE) + if (nr < DRM_COMMAND_BASE || nr >= DRM_COMMAND_END) return drm_compat_ioctl(filp, cmd, arg); - if (nr < DRM_COMMAND_BASE + ARRAY_SIZE(i915_compat_ioctls)) @@ -41557,10 +41562,10 @@ index 176de63..b50b66a 100644 ret = drm_ioctl(filp, cmd, arg); diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c -index d0f3cbc..f3ab4cc 100644 +index 57c8878..8ef38a7 100644 --- a/drivers/gpu/drm/i915/intel_display.c +++ b/drivers/gpu/drm/i915/intel_display.c -@@ -13604,13 +13604,13 @@ struct intel_quirk { +@@ -13617,13 +13617,13 @@ struct intel_quirk { int subsystem_vendor; int subsystem_device; void (*hook)(struct drm_device *dev); @@ -41576,7 +41581,7 @@ index d0f3cbc..f3ab4cc 100644 static int intel_dmi_reverse_brightness(const struct dmi_system_id *id) { -@@ -13618,18 +13618,20 @@ static int intel_dmi_reverse_brightness(const struct dmi_system_id *id) +@@ -13631,18 +13631,20 @@ static int intel_dmi_reverse_brightness(const struct dmi_system_id *id) return 1; } @@ -41830,7 +41835,7 @@ index c7592ec..dd45ebc 100644 static const struct vga_switcheroo_client_ops diff --git a/drivers/gpu/drm/qxl/qxl_cmd.c b/drivers/gpu/drm/qxl/qxl_cmd.c -index 9782364..89bd954 100644 +index f33251d..22f6cb1 100644 --- a/drivers/gpu/drm/qxl/qxl_cmd.c +++ b/drivers/gpu/drm/qxl/qxl_cmd.c @@ -285,27 +285,27 @@ static int wait_for_io_cmd_user(struct qxl_device *qdev, uint8_t val, long port, @@ -41906,10 +41911,10 @@ index 7c6cafe..460f542 100644 wait_queue_head_t display_event; wait_queue_head_t cursor_event; diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c -index b110883..dd06418 100644 +index 7354a4c..f37d7f9 100644 --- a/drivers/gpu/drm/qxl/qxl_ioctl.c +++ b/drivers/gpu/drm/qxl/qxl_ioctl.c -@@ -181,7 +181,7 @@ static int qxl_process_single_command(struct qxl_device *qdev, +@@ -183,7 +183,7 @@ static int qxl_process_single_command(struct qxl_device *qdev, /* TODO copy slow path code from i915 */ fb_cmd = qxl_bo_kmap_atomic_page(qdev, cmd_bo, (release->release_offset & PAGE_SIZE)); @@ -41918,7 +41923,7 @@ index b110883..dd06418 100644 { struct qxl_drawable *draw = fb_cmd; -@@ -201,7 +201,7 @@ static int qxl_process_single_command(struct qxl_device *qdev, +@@ -203,7 +203,7 @@ static int qxl_process_single_command(struct qxl_device *qdev, struct drm_qxl_reloc reloc; if (copy_from_user(&reloc, @@ -41927,7 +41932,7 @@ index b110883..dd06418 100644 sizeof(reloc))) { ret = -EFAULT; goto out_free_bos; -@@ -294,10 +294,10 @@ static int qxl_execbuffer_ioctl(struct drm_device *dev, void *data, +@@ -296,10 +296,10 @@ static int qxl_execbuffer_ioctl(struct drm_device *dev, void *data, for (cmd_num = 0; cmd_num < execbuffer->commands_num; ++cmd_num) { @@ -42177,7 +42182,7 @@ index b928c17..e5d9400 100644 if (regcomp (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) { diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c -index a7fdfa4..04a3964 100644 +index 604c44d..6eb6c4b 100644 --- a/drivers/gpu/drm/radeon/radeon_device.c +++ b/drivers/gpu/drm/radeon/radeon_device.c @@ -1247,7 +1247,7 @@ static bool radeon_switcheroo_can_switch(struct pci_dev *pdev) @@ -43166,7 +43171,7 @@ index bd1c99d..2fa55ad 100644 struct sensor_device_template **t; int i, count; diff --git a/drivers/hwmon/nct7802.c b/drivers/hwmon/nct7802.c -index 5576579..9192666 100644 +index 28fcb2e..fbfc02b 100644 --- a/drivers/hwmon/nct7802.c +++ b/drivers/hwmon/nct7802.c @@ -195,7 +195,7 @@ abort: @@ -45669,10 +45674,10 @@ index a08e3ee..df8ade2 100644 cl->fn = fn; cl->wq = wq; diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c -index 135a090..f7872f6 100644 +index c90118e..226d9e5 100644 --- a/drivers/md/bitmap.c +++ b/drivers/md/bitmap.c -@@ -1927,7 +1927,7 @@ void bitmap_status(struct seq_file *seq, struct bitmap *bitmap) +@@ -1936,7 +1936,7 @@ void bitmap_status(struct seq_file *seq, struct bitmap *bitmap) chunk_kb ? "KB" : "B"); if (bitmap->storage.file) { seq_printf(seq, ", file: "); @@ -45771,7 +45776,7 @@ index 089d627..ef7352e 100644 return (test_bit(DM_RAID1_FLUSH_ERROR, &(m->error_type))) ? 'F' : diff --git a/drivers/md/dm-stats.c b/drivers/md/dm-stats.c -index f478a4c..4b8e5ef 100644 +index 419bdd4..e5eb76d 100644 --- a/drivers/md/dm-stats.c +++ b/drivers/md/dm-stats.c @@ -382,7 +382,7 @@ do_sync_free: @@ -45930,7 +45935,7 @@ index 2caf492..0c0dcac 100644 void dm_uevent_add(struct mapped_device *md, struct list_head *elist) diff --git a/drivers/md/md.c b/drivers/md/md.c -index 4dbed4a..150c3d6 100644 +index b920028..8ac9655 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -197,10 +197,10 @@ EXPORT_SYMBOL_GPL(bio_clone_mddev); @@ -46002,7 +46007,7 @@ index 4dbed4a..150c3d6 100644 INIT_LIST_HEAD(&rdev->same_set); init_waitqueue_head(&rdev->blocked_wait); -@@ -5735,22 +5735,22 @@ static int get_bitmap_file(struct mddev *mddev, void __user * arg) +@@ -5740,22 +5740,22 @@ static int get_bitmap_file(struct mddev *mddev, void __user * arg) char *ptr; int err; @@ -46036,7 +46041,7 @@ index 4dbed4a..150c3d6 100644 spin_unlock(&mddev->lock); if (err == 0 && -@@ -7232,7 +7232,7 @@ static int md_seq_show(struct seq_file *seq, void *v) +@@ -7237,7 +7237,7 @@ static int md_seq_show(struct seq_file *seq, void *v) spin_unlock(&pers_lock); seq_printf(seq, "\n"); @@ -46045,7 +46050,7 @@ index 4dbed4a..150c3d6 100644 return 0; } if (v == (void*)2) { -@@ -7335,7 +7335,7 @@ static int md_seq_open(struct inode *inode, struct file *file) +@@ -7340,7 +7340,7 @@ static int md_seq_open(struct inode *inode, struct file *file) return error; seq = file->private_data; @@ -46054,7 +46059,7 @@ index 4dbed4a..150c3d6 100644 return error; } -@@ -7352,7 +7352,7 @@ static unsigned int mdstat_poll(struct file *filp, poll_table *wait) +@@ -7357,7 +7357,7 @@ static unsigned int mdstat_poll(struct file *filp, poll_table *wait) /* always allow read */ mask = POLLIN | POLLRDNORM; @@ -46063,7 +46068,7 @@ index 4dbed4a..150c3d6 100644 mask |= POLLERR | POLLPRI; return mask; } -@@ -7448,7 +7448,7 @@ static int is_mddev_idle(struct mddev *mddev, int init) +@@ -7453,7 +7453,7 @@ static int is_mddev_idle(struct mddev *mddev, int init) struct gendisk *disk = rdev->bdev->bd_contains->bd_disk; curr_events = (int)part_stat_read(&disk->part0, sectors[0]) + (int)part_stat_read(&disk->part0, sectors[1]) - @@ -46102,10 +46107,10 @@ index 4046a6c..e2f2997 100644 struct md_personality diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c -index e8a9042..35bd145 100644 +index 5309129..7fb096e 100644 --- a/drivers/md/persistent-data/dm-space-map-metadata.c +++ b/drivers/md/persistent-data/dm-space-map-metadata.c -@@ -683,7 +683,7 @@ static int sm_metadata_extend(struct dm_space_map *sm, dm_block_t extra_blocks) +@@ -691,7 +691,7 @@ static int sm_metadata_extend(struct dm_space_map *sm, dm_block_t extra_blocks) * Flick into a mode where all blocks get allocated in the new area. */ smm->begin = old_len; @@ -46114,7 +46119,7 @@ index e8a9042..35bd145 100644 /* * Extend. -@@ -714,7 +714,7 @@ out: +@@ -728,7 +728,7 @@ out: /* * Switch back to normal behaviour. */ @@ -48209,10 +48214,10 @@ index 7f32712..8539ab2 100644 /* * Timer function to enforce the timelimit on the partition disengage. diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c -index 60f7141..ba97c1a 100644 +index 31d2627..d1b80a5 100644 --- a/drivers/mmc/card/block.c +++ b/drivers/mmc/card/block.c -@@ -577,7 +577,7 @@ static int mmc_blk_ioctl_cmd(struct block_device *bdev, +@@ -579,7 +579,7 @@ static int mmc_blk_ioctl_cmd(struct block_device *bdev, if (idata->ic.postsleep_min_us) usleep_range(idata->ic.postsleep_min_us, idata->ic.postsleep_max_us); @@ -50588,10 +50593,10 @@ index c1d2d03..08352db 100644 struct ath_nf_limits { s16 max; diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c -index b0badef..3e3464c 100644 +index d5f2fbf..0740c8b 100644 --- a/drivers/net/wireless/ath/ath9k/main.c +++ b/drivers/net/wireless/ath/ath9k/main.c -@@ -2573,16 +2573,18 @@ void ath9k_fill_chanctx_ops(void) +@@ -2575,16 +2575,18 @@ void ath9k_fill_chanctx_ops(void) if (!ath9k_is_chanctx_enabled()) return; @@ -55648,10 +55653,10 @@ index c3f9091..abe4601 100644 if (!retval) port->flags |= ASYNC_NORMAL_ACTIVE; diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c -index 843f2cd..7d530a6 100644 +index 9ffdfcf..fd81170 100644 --- a/drivers/tty/sysrq.c +++ b/drivers/tty/sysrq.c -@@ -1086,7 +1086,7 @@ EXPORT_SYMBOL(unregister_sysrq_key); +@@ -1069,7 +1069,7 @@ EXPORT_SYMBOL(unregister_sysrq_key); static ssize_t write_sysrq_trigger(struct file *file, const char __user *buf, size_t count, loff_t *ppos) { @@ -56050,7 +56055,7 @@ index 2a3bbdf..91d72cf 100644 file->f_version = event_count; return POLLIN | POLLRDNORM; diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c -index 4b0448c..fc84bec 100644 +index 986abde..80e8279 100644 --- a/drivers/usb/core/devio.c +++ b/drivers/usb/core/devio.c @@ -187,7 +187,7 @@ static ssize_t usbdev_read(struct file *file, char __user *buf, size_t nbytes, @@ -56090,10 +56095,10 @@ index 4b0448c..fc84bec 100644 dev->rawdescriptors[i] + (*ppos - pos), min(len, alloclen))) { diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c -index 45a915c..09f9735 100644 +index 1c1385e..18400ff 100644 --- a/drivers/usb/core/hcd.c +++ b/drivers/usb/core/hcd.c -@@ -1551,7 +1551,7 @@ int usb_hcd_submit_urb (struct urb *urb, gfp_t mem_flags) +@@ -1554,7 +1554,7 @@ int usb_hcd_submit_urb (struct urb *urb, gfp_t mem_flags) */ usb_get_urb(urb); atomic_inc(&urb->use_count); @@ -56102,7 +56107,7 @@ index 45a915c..09f9735 100644 usbmon_urb_submit(&hcd->self, urb); /* NOTE requirements on root-hub callers (usbfs and the hub -@@ -1578,7 +1578,7 @@ int usb_hcd_submit_urb (struct urb *urb, gfp_t mem_flags) +@@ -1581,7 +1581,7 @@ int usb_hcd_submit_urb (struct urb *urb, gfp_t mem_flags) urb->hcpriv = NULL; INIT_LIST_HEAD(&urb->urb_list); atomic_dec(&urb->use_count); @@ -56112,7 +56117,7 @@ index 45a915c..09f9735 100644 wake_up(&usb_kill_urb_queue); usb_put_urb(urb); diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c -index 3b71516..1f26579 100644 +index 1e9a8c9..b4248b7 100644 --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c @@ -26,6 +26,7 @@ @@ -56123,7 +56128,7 @@ index 3b71516..1f26579 100644 #include <asm/uaccess.h> #include <asm/byteorder.h> -@@ -4665,6 +4666,10 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus, +@@ -4649,6 +4650,10 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus, goto done; return; } @@ -72508,20 +72513,10 @@ index 0000000..43d7c4f +:1095D00080000A8080000A00800009808000090065 +:00000001FF diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c -index 703342e..2b96b597 100644 +index 53f1e8a..2b96b597 100644 --- a/fs/9p/vfs_inode.c +++ b/fs/9p/vfs_inode.c -@@ -540,8 +540,7 @@ static struct inode *v9fs_qid_iget(struct super_block *sb, - unlock_new_inode(inode); - return inode; - error: -- unlock_new_inode(inode); -- iput(inode); -+ iget_failed(inode); - return ERR_PTR(retval); - - } -@@ -1312,7 +1311,7 @@ static void *v9fs_vfs_follow_link(struct dentry *dentry, struct nameidata *nd) +@@ -1311,7 +1311,7 @@ static void *v9fs_vfs_follow_link(struct dentry *dentry, struct nameidata *nd) void v9fs_vfs_put_link(struct dentry *dentry, struct nameidata *nd, void *p) { @@ -72530,20 +72525,6 @@ index 703342e..2b96b597 100644 p9_debug(P9_DEBUG_VFS, " %pd %s\n", dentry, IS_ERR(s) ? "<error>" : s); -diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c -index 9861c7c..4d3ecfb 100644 ---- a/fs/9p/vfs_inode_dotl.c -+++ b/fs/9p/vfs_inode_dotl.c -@@ -149,8 +149,7 @@ static struct inode *v9fs_qid_iget_dotl(struct super_block *sb, - unlock_new_inode(inode); - return inode; - error: -- unlock_new_inode(inode); -- iput(inode); -+ iget_failed(inode); - return ERR_PTR(retval); - - } diff --git a/fs/Kconfig.binfmt b/fs/Kconfig.binfmt index 2d0cbbd..a6d6149 100644 --- a/fs/Kconfig.binfmt @@ -76176,7 +76157,7 @@ index 9a83f14..1dd1b38 100644 /* locality groups */ diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c -index 8d1e602..abf497b 100644 +index 4126048..3788867 100644 --- a/fs/ext4/mballoc.c +++ b/fs/ext4/mballoc.c @@ -1901,7 +1901,7 @@ void ext4_mb_simple_scan_group(struct ext4_allocation_context *ac, @@ -76348,10 +76329,10 @@ index cf0c472..ddf284d 100644 err = ext4_handle_dirty_metadata(handle, NULL, bh); if (unlikely(err)) diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index ca9d4a2..4c52f42 100644 +index ca12affd..18b4b75 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c -@@ -1232,7 +1232,7 @@ static ext4_fsblk_t get_sb_block(void **data) +@@ -1233,7 +1233,7 @@ static ext4_fsblk_t get_sb_block(void **data) } #define DEFAULT_JOURNAL_IOPRIO (IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, 3)) @@ -76360,7 +76341,7 @@ index ca9d4a2..4c52f42 100644 "Contact linux-ext4@vger.kernel.org if you think we should keep it.\n"; #ifdef CONFIG_QUOTA -@@ -2442,7 +2442,7 @@ struct ext4_attr { +@@ -2443,7 +2443,7 @@ struct ext4_attr { int offset; int deprecated_val; } u; @@ -98361,10 +98342,10 @@ index ad45054..7c54663 100644 int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu); diff --git a/include/linux/libata.h b/include/linux/libata.h -index 28aeae4..320b3bf6 100644 +index e0e3378..38e206f 100644 --- a/include/linux/libata.h +++ b/include/linux/libata.h -@@ -988,7 +988,7 @@ struct ata_port_operations { +@@ -991,7 +991,7 @@ struct ata_port_operations { * fields must be pointers. */ const struct ata_port_operations *inherits; @@ -102527,7 +102508,7 @@ index ff8f6c0..6b6bae3 100644 TP_ARGS(irq, action, ret), diff --git a/include/uapi/drm/i915_drm.h b/include/uapi/drm/i915_drm.h -index 551b673..9c680df 100644 +index a7e41fb..c115957 100644 --- a/include/uapi/drm/i915_drm.h +++ b/include/uapi/drm/i915_drm.h @@ -350,6 +350,7 @@ typedef struct drm_i915_irq_wait { @@ -106831,7 +106812,7 @@ index a65ba13..f600dbb 100644 if (write && !ns_capable(pid_ns->user_ns, CAP_SYS_ADMIN)) return -EPERM; diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig -index 7e01f78..f5da19d 100644 +index 9e30231..75a6d97 100644 --- a/kernel/power/Kconfig +++ b/kernel/power/Kconfig @@ -24,6 +24,8 @@ config HIBERNATE_CALLBACKS @@ -106887,7 +106868,7 @@ index 564f786..361a18e 100644 if (pm_wakeup_pending()) { diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c -index c099b08..54bcfe8 100644 +index bff0169..c90815d 100644 --- a/kernel/printk/printk.c +++ b/kernel/printk/printk.c @@ -463,7 +463,7 @@ static int log_store(int facility, int level, @@ -106901,7 +106882,7 @@ index c099b08..54bcfe8 100644 { @@ -486,6 +486,11 @@ int check_syslog_permissions(int type, bool from_file) if (from_file && type != SYSLOG_ACTION_OPEN) - return 0; + goto ok; +#ifdef CONFIG_GRKERNSEC_DMESG + if (grsec_enable_dmesg && !capable(CAP_SYSLOG) && !capable_nolog(CAP_SYS_ADMIN)) @@ -106910,7 +106891,7 @@ index c099b08..54bcfe8 100644 + if (syslog_action_restricted(type)) { if (capable(CAP_SYSLOG)) - return 0; + goto ok; diff --git a/kernel/profile.c b/kernel/profile.c index a7bcd28..5b368fa 100644 --- a/kernel/profile.c @@ -110189,10 +110170,10 @@ index 0533049..85e27f0 100644 /* do nothing if flag is already set */ if (!!(trace_flags & mask) == !!enabled) diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h -index d261201..da10429 100644 +index 921691c..64e1da1 100644 --- a/kernel/trace/trace.h +++ b/kernel/trace/trace.h -@@ -1271,7 +1271,7 @@ extern const char *__stop___tracepoint_str[]; +@@ -1272,7 +1272,7 @@ extern const char *__stop___tracepoint_str[]; void trace_printk_init_buffers(void); void trace_printk_start_comm(void); int trace_keep_overwrite(struct tracer *tracer, u32 mask, int set); @@ -110233,30 +110214,6 @@ index c4de47f..5f134b8 100644 static void __add_event_to_tracers(struct ftrace_event_call *call); /* Add an additional event_call dynamically */ -diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c -index 7f2e97c..085a257 100644 ---- a/kernel/trace/trace_events_filter.c -+++ b/kernel/trace/trace_events_filter.c -@@ -1056,6 +1056,9 @@ static void parse_init(struct filter_parse_state *ps, - - static char infix_next(struct filter_parse_state *ps) - { -+ if (!ps->infix.cnt) -+ return 0; -+ - ps->infix.cnt--; - - return ps->infix.string[ps->infix.tail++]; -@@ -1071,6 +1074,9 @@ static char infix_peek(struct filter_parse_state *ps) - - static void infix_advance(struct filter_parse_state *ps) - { -+ if (!ps->infix.cnt) -+ return; -+ - ps->infix.cnt--; - ps->infix.tail++; - } diff --git a/kernel/trace/trace_functions_graph.c b/kernel/trace/trace_functions_graph.c index a51e796..1f32ebd 100644 --- a/kernel/trace/trace_functions_graph.c @@ -110577,7 +110534,7 @@ index 114d1be..ab0350c 100644 (val << avg->factor)) >> avg->weight : (val << avg->factor); diff --git a/lib/bitmap.c b/lib/bitmap.c -index 64c0926f..9de1a1f 100644 +index 40162f8..b55c7c7 100644 --- a/lib/bitmap.c +++ b/lib/bitmap.c @@ -234,7 +234,7 @@ int __bitmap_subset(const unsigned long *bitmap1, @@ -110613,10 +110570,10 @@ index 64c0926f..9de1a1f 100644 int c, old_c, totaldigits; - const char __user __force *ubuf = (const char __user __force *)buf; + const char __user *ubuf = (const char __force_user *)buf; - int exp_digit, in_range; + int at_start, in_range; totaldigits = c = 0; -@@ -600,7 +600,7 @@ int bitmap_parselist_user(const char __user *ubuf, +@@ -601,7 +601,7 @@ int bitmap_parselist_user(const char __user *ubuf, { if (!access_ok(VERIFY_READ, ubuf, ulen)) return -EFAULT; @@ -111661,10 +111618,10 @@ index 123bcd3..0de52ba 100644 set_page_address(page, (void *)vaddr); diff --git a/mm/hugetlb.c b/mm/hugetlb.c -index 271e443..c582971 100644 +index 8c4c1f9..7019e3d 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c -@@ -2362,6 +2362,7 @@ static int hugetlb_sysctl_handler_common(bool obey_mempolicy, +@@ -2365,6 +2365,7 @@ static int hugetlb_sysctl_handler_common(bool obey_mempolicy, struct ctl_table *table, int write, void __user *buffer, size_t *length, loff_t *ppos) { @@ -111672,7 +111629,7 @@ index 271e443..c582971 100644 struct hstate *h = &default_hstate; unsigned long tmp = h->max_huge_pages; int ret; -@@ -2369,9 +2370,10 @@ static int hugetlb_sysctl_handler_common(bool obey_mempolicy, +@@ -2372,9 +2373,10 @@ static int hugetlb_sysctl_handler_common(bool obey_mempolicy, if (!hugepages_supported()) return -ENOTSUPP; @@ -111686,7 +111643,7 @@ index 271e443..c582971 100644 if (ret) goto out; -@@ -2406,6 +2408,7 @@ int hugetlb_overcommit_handler(struct ctl_table *table, int write, +@@ -2409,6 +2411,7 @@ int hugetlb_overcommit_handler(struct ctl_table *table, int write, struct hstate *h = &default_hstate; unsigned long tmp; int ret; @@ -111694,7 +111651,7 @@ index 271e443..c582971 100644 if (!hugepages_supported()) return -ENOTSUPP; -@@ -2415,9 +2418,10 @@ int hugetlb_overcommit_handler(struct ctl_table *table, int write, +@@ -2418,9 +2421,10 @@ int hugetlb_overcommit_handler(struct ctl_table *table, int write, if (write && hstate_is_gigantic(h)) return -EINVAL; @@ -111708,7 +111665,7 @@ index 271e443..c582971 100644 if (ret) goto out; -@@ -2907,6 +2911,27 @@ static void unmap_ref_private(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -2910,6 +2914,27 @@ static void unmap_ref_private(struct mm_struct *mm, struct vm_area_struct *vma, i_mmap_unlock_write(mapping); } @@ -111736,7 +111693,7 @@ index 271e443..c582971 100644 /* * Hugetlb_cow() should be called with page lock of the original hugepage held. * Called with hugetlb_instantiation_mutex held and pte_page locked so we -@@ -3020,6 +3045,11 @@ retry_avoidcopy: +@@ -3023,6 +3048,11 @@ retry_avoidcopy: make_huge_pte(vma, new_page, 1)); page_remove_rmap(old_page); hugepage_add_new_anon_rmap(new_page, vma, address); @@ -111748,7 +111705,7 @@ index 271e443..c582971 100644 /* Make the old page be freed below */ new_page = old_page; } -@@ -3181,6 +3211,10 @@ retry: +@@ -3184,6 +3214,10 @@ retry: && (vma->vm_flags & VM_SHARED))); set_huge_pte_at(mm, address, ptep, new_pte); @@ -111759,7 +111716,7 @@ index 271e443..c582971 100644 if ((flags & FAULT_FLAG_WRITE) && !(vma->vm_flags & VM_SHARED)) { /* Optimization, do the COW without a second fault */ ret = hugetlb_cow(mm, vma, address, ptep, new_pte, page, ptl); -@@ -3248,6 +3282,10 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -3251,6 +3285,10 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma, struct address_space *mapping; int need_wait_lock = 0; @@ -111770,7 +111727,7 @@ index 271e443..c582971 100644 address &= huge_page_mask(h); ptep = huge_pte_offset(mm, address); -@@ -3261,6 +3299,26 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -3264,6 +3302,26 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma, VM_FAULT_SET_HINDEX(hstate_index(h)); } @@ -112067,7 +112024,7 @@ index 501820c..9612bcf 100644 } unset_migratetype_isolate(page, MIGRATE_MOVABLE); diff --git a/mm/memory.c b/mm/memory.c -index 22e037e..347d230 100644 +index 2a9e098..f5d6859 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -414,6 +414,7 @@ static inline void free_pmd_range(struct mmu_gather *tlb, pud_t *pud, @@ -112450,7 +112407,7 @@ index 22e037e..347d230 100644 * We enter with non-exclusive mmap_sem (to exclude vma changes, * but allow concurrent faults), and pte mapped but not yet locked. * We return with mmap_sem still held, but pte unmapped and unlocked. -@@ -2663,27 +2854,23 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -2663,31 +2854,30 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma, unsigned int flags) { struct mem_cgroup *memcg; @@ -112461,11 +112418,18 @@ index 22e037e..347d230 100644 - pte_unmap(page_table); - + /* File mapping without ->vm_ops ? */ +- if (vma->vm_flags & VM_SHARED) ++ if (vma->vm_flags & VM_SHARED) { ++ pte_unmap(page_table); + return VM_FAULT_SIGBUS; +- - /* Check if we need to add a guard page to the stack */ - if (check_stack_guard_page(vma, address) < 0) - return VM_FAULT_SIGSEGV; -- -- /* Use the zero-page for reads */ ++ } + + /* Use the zero-page for reads */ if (!(flags & FAULT_FLAG_WRITE) && !mm_forbids_zeropage(mm)) { entry = pte_mkspecial(pfn_pte(my_zero_pfn(address), vma->vm_page_prot)); @@ -112483,7 +112447,7 @@ index 22e037e..347d230 100644 if (unlikely(anon_vma_prepare(vma))) goto oom; page = alloc_zeroed_user_highpage_movable(vma, address); -@@ -2707,6 +2894,11 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -2711,6 +2901,11 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma, if (!pte_none(*page_table)) goto release; @@ -112495,7 +112459,7 @@ index 22e037e..347d230 100644 inc_mm_counter_fast(mm, MM_ANONPAGES); page_add_new_anon_rmap(page, vma, address); mem_cgroup_commit_charge(page, memcg, false); -@@ -2716,6 +2908,12 @@ setpte: +@@ -2720,6 +2915,12 @@ setpte: /* No need to invalidate - it was non-present before */ update_mmu_cache(vma, address, page_table); @@ -112508,7 +112472,7 @@ index 22e037e..347d230 100644 unlock: pte_unmap_unlock(page_table, ptl); return 0; -@@ -2948,6 +3146,11 @@ static int do_read_fault(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -2952,6 +3153,11 @@ static int do_read_fault(struct mm_struct *mm, struct vm_area_struct *vma, return ret; } do_set_pte(vma, address, fault_page, pte, false, false); @@ -112520,7 +112484,7 @@ index 22e037e..347d230 100644 unlock_page(fault_page); unlock_out: pte_unmap_unlock(pte, ptl); -@@ -2999,7 +3202,18 @@ static int do_cow_fault(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -3003,7 +3209,18 @@ static int do_cow_fault(struct mm_struct *mm, struct vm_area_struct *vma, } goto uncharge_out; } @@ -112539,7 +112503,7 @@ index 22e037e..347d230 100644 mem_cgroup_commit_charge(new_page, memcg, false); lru_cache_add_active_or_unevictable(new_page, vma); pte_unmap_unlock(pte, ptl); -@@ -3057,6 +3271,11 @@ static int do_shared_fault(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -3061,6 +3278,11 @@ static int do_shared_fault(struct mm_struct *mm, struct vm_area_struct *vma, return ret; } do_set_pte(vma, address, fault_page, pte, true, false); @@ -112551,7 +112515,7 @@ index 22e037e..347d230 100644 pte_unmap_unlock(pte, ptl); if (set_page_dirty(fault_page)) -@@ -3280,6 +3499,12 @@ static int handle_pte_fault(struct mm_struct *mm, +@@ -3286,6 +3508,12 @@ static int handle_pte_fault(struct mm_struct *mm, if (flags & FAULT_FLAG_WRITE) flush_tlb_fix_spurious_fault(vma, address); } @@ -112564,7 +112528,7 @@ index 22e037e..347d230 100644 unlock: pte_unmap_unlock(pte, ptl); return 0; -@@ -3299,9 +3524,41 @@ static int __handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -3305,9 +3533,41 @@ static int __handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma, pmd_t *pmd; pte_t *pte; @@ -112606,7 +112570,7 @@ index 22e037e..347d230 100644 pgd = pgd_offset(mm, address); pud = pud_alloc(mm, pgd, address); if (!pud) -@@ -3436,6 +3693,23 @@ int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address) +@@ -3442,6 +3702,23 @@ int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address) spin_unlock(&mm->page_table_lock); return 0; } @@ -112630,7 +112594,7 @@ index 22e037e..347d230 100644 #endif /* __PAGETABLE_PUD_FOLDED */ #ifndef __PAGETABLE_PMD_FOLDED -@@ -3468,6 +3742,32 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address) +@@ -3474,6 +3751,32 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address) spin_unlock(&mm->page_table_lock); return 0; } @@ -112663,7 +112627,7 @@ index 22e037e..347d230 100644 #endif /* __PAGETABLE_PMD_FOLDED */ static int __follow_pte(struct mm_struct *mm, unsigned long address, -@@ -3577,8 +3877,8 @@ out: +@@ -3583,8 +3886,8 @@ out: return ret; } @@ -112674,7 +112638,7 @@ index 22e037e..347d230 100644 { resource_size_t phys_addr; unsigned long prot = 0; -@@ -3604,8 +3904,8 @@ EXPORT_SYMBOL_GPL(generic_access_phys); +@@ -3610,8 +3913,8 @@ EXPORT_SYMBOL_GPL(generic_access_phys); * Access another process' address space as given in mm. If non-NULL, use the * given task for page fault accounting. */ @@ -112685,7 +112649,7 @@ index 22e037e..347d230 100644 { struct vm_area_struct *vma; void *old_buf = buf; -@@ -3613,7 +3913,7 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm, +@@ -3619,7 +3922,7 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm, down_read(&mm->mmap_sem); /* ignore errors, just check how much was successfully transferred */ while (len) { @@ -112694,7 +112658,7 @@ index 22e037e..347d230 100644 void *maddr; struct page *page = NULL; -@@ -3674,8 +3974,8 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm, +@@ -3680,8 +3983,8 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm, * * The caller must hold a reference on @mm. */ @@ -112705,7 +112669,7 @@ index 22e037e..347d230 100644 { return __access_remote_vm(NULL, mm, addr, buf, len, write); } -@@ -3685,11 +3985,11 @@ int access_remote_vm(struct mm_struct *mm, unsigned long addr, +@@ -3691,11 +3994,11 @@ int access_remote_vm(struct mm_struct *mm, unsigned long addr, * Source/target buffer must be kernel space, * Do not walk the page table directly, use get_user_pages */ @@ -117064,10 +117028,10 @@ index 9398c3f..0e79657 100644 atomic_t batman_queue_left; char num_ifaces; diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c -index 56f9edb..0a13cd1 100644 +index e11a5cf..02864cd 100644 --- a/net/bluetooth/hci_sock.c +++ b/net/bluetooth/hci_sock.c -@@ -1241,7 +1241,7 @@ static int hci_sock_setsockopt(struct socket *sock, int level, int optname, +@@ -1253,7 +1253,7 @@ static int hci_sock_setsockopt(struct socket *sock, int level, int optname, uf.event_mask[1] = *((u32 *) f->event_mask + 1); } @@ -120965,7 +120929,7 @@ index 1a3c7e0..80f8b0c 100644 goto out; diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c -index ff347a0..6ea4923 100644 +index f06d422..de37d95 100644 --- a/net/mac80211/cfg.c +++ b/net/mac80211/cfg.c @@ -582,7 +582,7 @@ static int ieee80211_set_monitor_channel(struct wiphy *wiphy, @@ -120977,7 +120941,7 @@ index ff347a0..6ea4923 100644 local->_oper_chandef = *chandef; ieee80211_hw_config(local, 0); } -@@ -3428,7 +3428,7 @@ static void ieee80211_mgmt_frame_register(struct wiphy *wiphy, +@@ -3429,7 +3429,7 @@ static void ieee80211_mgmt_frame_register(struct wiphy *wiphy, else local->probe_req_reg--; @@ -120986,7 +120950,7 @@ index ff347a0..6ea4923 100644 break; ieee80211_queue_work(&local->hw, &local->reconfig_filter); -@@ -3563,8 +3563,8 @@ static int ieee80211_cfg_get_channel(struct wiphy *wiphy, +@@ -3564,8 +3564,8 @@ static int ieee80211_cfg_get_channel(struct wiphy *wiphy, if (chanctx_conf) { *chandef = sdata->vif.bss_conf.chandef; ret = 0; @@ -121095,7 +121059,7 @@ index 84cef60..53ec813 100644 } diff --git a/net/mac80211/main.c b/net/mac80211/main.c -index df3051d..359d2f4 100644 +index e86daed..9cbf3f4 100644 --- a/net/mac80211/main.c +++ b/net/mac80211/main.c @@ -175,7 +175,7 @@ int ieee80211_hw_config(struct ieee80211_local *local, u32 changed) @@ -125621,7 +125585,7 @@ index f2875cd..9fc1de0 100644 if (bprm->cap_effective) return 1; diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h -index 8ee997d..24c174b 100644 +index fc56d4d..ac97140 100644 --- a/security/integrity/ima/ima.h +++ b/security/integrity/ima/ima.h @@ -116,8 +116,8 @@ int ima_init_template(void); @@ -125649,7 +125613,7 @@ index b8a27c5..50a769f 100644 result = ima_alloc_init_template(NULL, file, filename, NULL, 0, &entry); diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c -index 461215e..9bb12ee 100644 +index 816d175..20079ae 100644 --- a/security/integrity/ima/ima_fs.c +++ b/security/integrity/ima/ima_fs.c @@ -28,12 +28,12 @@ @@ -125737,25 +125701,6 @@ index aee2ec5..c276071 100644 /* record the root user tracking */ rb_link_node(&root_key_user.node, -diff --git a/security/keys/keyring.c b/security/keys/keyring.c -index e72548b..d334370 100644 ---- a/security/keys/keyring.c -+++ b/security/keys/keyring.c -@@ -1181,9 +1181,11 @@ void __key_link_end(struct key *keyring, - if (index_key->type == &key_type_keyring) - up_write(&keyring_serialise_link_sem); - -- if (edit && !edit->dead_leaf) { -- key_payload_reserve(keyring, -- keyring->datalen - KEYQUOTA_LINK_BYTES); -+ if (edit) { -+ if (!edit->dead_leaf) { -+ key_payload_reserve(keyring, -+ keyring->datalen - KEYQUOTA_LINK_BYTES); -+ } - assoc_array_cancel_edit(edit); - } - up_write(&keyring->sem); diff --git a/security/min_addr.c b/security/min_addr.c index f728728..6457a0c 100644 --- a/security/min_addr.c @@ -125835,20 +125780,10 @@ index 3c17dda..482b12c 100644 lock = &avc_cache.slots_lock[hvalue]; diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c -index 212070e..87aa172 100644 +index 7f8d7f1..3436ea3 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c -@@ -3288,7 +3288,8 @@ static int file_map_prot_check(struct file *file, unsigned long prot, int shared - int rc = 0; - - if (default_noexec && -- (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) { -+ (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) || -+ (!shared && (prot & PROT_WRITE)))) { - /* - * We are making executable an anonymous mapping or a - * private file mapping that will also be writable. -@@ -5841,7 +5842,8 @@ static int selinux_key_getsecurity(struct key *key, char **_buffer) +@@ -5842,7 +5842,8 @@ static int selinux_key_getsecurity(struct key *key, char **_buffer) #endif @@ -125858,7 +125793,7 @@ index 212070e..87aa172 100644 .name = "selinux", .binder_set_context_mgr = selinux_binder_set_context_mgr, -@@ -6186,6 +6188,9 @@ static void selinux_nf_ip_exit(void) +@@ -6187,6 +6188,9 @@ static void selinux_nf_ip_exit(void) #ifdef CONFIG_SECURITY_SELINUX_DISABLE static int selinux_disabled; @@ -125868,7 +125803,7 @@ index 212070e..87aa172 100644 int selinux_disable(void) { if (ss_initialized) { -@@ -6203,7 +6208,9 @@ int selinux_disable(void) +@@ -6204,7 +6208,9 @@ int selinux_disable(void) selinux_disabled = 1; selinux_enabled = 0; @@ -133810,10 +133745,10 @@ index 0000000..b8e7188 +} diff --git a/tools/gcc/size_overflow_plugin/size_overflow_hash.data b/tools/gcc/size_overflow_plugin/size_overflow_hash.data new file mode 100644 -index 0000000..2e9138d +index 0000000..e445f02 --- /dev/null +++ b/tools/gcc/size_overflow_plugin/size_overflow_hash.data -@@ -0,0 +1,28379 @@ +@@ -0,0 +1,28384 @@ +intel_fake_agp_alloc_by_type_1 intel_fake_agp_alloc_by_type 1 1 NULL nohasharray +iwl_set_tx_power_1 iwl_set_tx_power 0 1 &intel_fake_agp_alloc_by_type_1 +ocfs2_get_refcount_tree_3 ocfs2_get_refcount_tree 0 3 NULL @@ -139603,7 +139538,8 @@ index 0000000..2e9138d +sd_major_13294 sd_major 0-1 13294 NULL +cx23885_start_audio_dma_13295 cx23885_start_audio_dma 0 13295 NULL +map_offset_show_13301 map_offset_show 0 13301 NULL -+set_ptk_13304 set_ptk 0 13304 NULL ++set_ptk_13304 set_ptk 0 13304 NULL nohasharray ++__jbd2_update_log_tail_13304 __jbd2_update_log_tail 0 13304 &set_ptk_13304 +store_13310 store 0 13310 NULL +saa7134_s_ctrl_13313 saa7134_s_ctrl 0 13313 NULL +read_file_phy_err_13318 read_file_phy_err 3-0 13318 NULL nohasharray @@ -146926,6 +146862,7 @@ index 0000000..2e9138d +__pci_request_selected_regions_30058 __pci_request_selected_regions 0 30058 NULL +SyS_write_30059 SyS_write 3 30059 NULL +general_stats_read_30067 general_stats_read 0 30067 NULL ++jbd2_log_do_checkpoint_30069 jbd2_log_do_checkpoint 0 30069 NULL +capture_pcm_prepare_30072 capture_pcm_prepare 0 30072 NULL +snd_seq_timer_open_30077 snd_seq_timer_open 0 30077 NULL +m5602_write_sensor_30078 m5602_write_sensor 0 30078 NULL nohasharray @@ -146961,6 +146898,7 @@ index 0000000..2e9138d +start_transfer_30146 start_transfer 0 30146 NULL +ext4_write_inline_data_end_30151 ext4_write_inline_data_end 0-4 30151 NULL +hvfb_check_var_30153 hvfb_check_var 0 30153 NULL ++jbd2_write_superblock_30154 jbd2_write_superblock 0 30154 NULL +elfcorehdr_read_30159 elfcorehdr_read 2 30159 NULL +netlink_realloc_groups_30162 netlink_realloc_groups 0 30162 NULL nohasharray +start_stop_khugepaged_30162 start_stop_khugepaged 0 30162 &netlink_realloc_groups_30162 @@ -161140,6 +161078,7 @@ index 0000000..2e9138d +generic_file_fsync_62999 generic_file_fsync 0 62999 NULL +asus_wmi_get_devstate_63000 asus_wmi_get_devstate 0 63000 NULL +hash_max_show_63001 hash_max_show 0 63001 NULL ++jbd2_journal_update_sb_log_tail_63005 jbd2_journal_update_sb_log_tail 0 63005 NULL +get_skb_63008 get_skb 2 63008 NULL +__ext3_journal_stop_63017 __ext3_journal_stop 0 63017 NULL +__sctp_connect_63020 __sctp_connect 0 63020 NULL @@ -161566,7 +161505,8 @@ index 0000000..2e9138d +qlcnic_alloc_sw_resources_64057 qlcnic_alloc_sw_resources 0 64057 NULL +tps65912_reg_disable_64058 tps65912_reg_disable 0 64058 NULL +alloc_codec_buffers_64063 alloc_codec_buffers 0 64063 NULL -+start_hw_64065 start_hw 0 64065 NULL ++start_hw_64065 start_hw 0 64065 NULL nohasharray ++jbd2_cleanup_journal_tail_64065 jbd2_cleanup_journal_tail 0 64065 &start_hw_64065 +nfs4_lookup_root_64067 nfs4_lookup_root 0 64067 NULL +__sock_create_64069 __sock_create 0 64069 NULL +pcifront_bus_write_64071 pcifront_bus_write 0 64071 NULL diff --git a/4.1.3/4425_grsec_remove_EI_PAX.patch b/4.1.4/4425_grsec_remove_EI_PAX.patch index a80a5d7..a80a5d7 100644 --- a/4.1.3/4425_grsec_remove_EI_PAX.patch +++ b/4.1.4/4425_grsec_remove_EI_PAX.patch diff --git a/4.1.3/4427_force_XATTR_PAX_tmpfs.patch b/4.1.4/4427_force_XATTR_PAX_tmpfs.patch index a789f0b..a789f0b 100644 --- a/4.1.3/4427_force_XATTR_PAX_tmpfs.patch +++ b/4.1.4/4427_force_XATTR_PAX_tmpfs.patch diff --git a/4.1.3/4430_grsec-remove-localversion-grsec.patch b/4.1.4/4430_grsec-remove-localversion-grsec.patch index 31cf878..31cf878 100644 --- a/4.1.3/4430_grsec-remove-localversion-grsec.patch +++ b/4.1.4/4430_grsec-remove-localversion-grsec.patch diff --git a/4.1.3/4435_grsec-mute-warnings.patch b/4.1.4/4435_grsec-mute-warnings.patch index b7564e4..b7564e4 100644 --- a/4.1.3/4435_grsec-mute-warnings.patch +++ b/4.1.4/4435_grsec-mute-warnings.patch diff --git a/4.1.3/4440_grsec-remove-protected-paths.patch b/4.1.4/4440_grsec-remove-protected-paths.patch index 741546d..741546d 100644 --- a/4.1.3/4440_grsec-remove-protected-paths.patch +++ b/4.1.4/4440_grsec-remove-protected-paths.patch diff --git a/4.1.3/4450_grsec-kconfig-default-gids.patch b/4.1.4/4450_grsec-kconfig-default-gids.patch index 61d903e..61d903e 100644 --- a/4.1.3/4450_grsec-kconfig-default-gids.patch +++ b/4.1.4/4450_grsec-kconfig-default-gids.patch diff --git a/4.1.3/4465_selinux-avc_audit-log-curr_ip.patch b/4.1.4/4465_selinux-avc_audit-log-curr_ip.patch index ba89596..ba89596 100644 --- a/4.1.3/4465_selinux-avc_audit-log-curr_ip.patch +++ b/4.1.4/4465_selinux-avc_audit-log-curr_ip.patch diff --git a/4.1.3/4470_disable-compat_vdso.patch b/4.1.4/4470_disable-compat_vdso.patch index 7aefa02..7aefa02 100644 --- a/4.1.3/4470_disable-compat_vdso.patch +++ b/4.1.4/4470_disable-compat_vdso.patch diff --git a/4.1.3/4475_emutramp_default_on.patch b/4.1.4/4475_emutramp_default_on.patch index a128205..a128205 100644 --- a/4.1.3/4475_emutramp_default_on.patch +++ b/4.1.4/4475_emutramp_default_on.patch |