diff options
Diffstat (limited to '3.14.49/1048_linux-3.14.49.patch')
| -rw-r--r-- | 3.14.49/1048_linux-3.14.49.patch | 4039 |
1 files changed, 0 insertions, 4039 deletions
diff --git a/3.14.49/1048_linux-3.14.49.patch b/3.14.49/1048_linux-3.14.49.patch deleted file mode 100644 index a202904..0000000 --- a/3.14.49/1048_linux-3.14.49.patch +++ /dev/null @@ -1,4039 +0,0 @@ -diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt -index 01ef408..8faff12 100644 ---- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt -+++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt -@@ -91,5 +91,5 @@ mpp61 61 gpo, dev(wen1), uart1(txd), audio(rclk) - mpp62 62 gpio, dev(a2), uart1(cts), tdm(drx), pcie(clkreq0), - audio(mclk), uart0(cts) - mpp63 63 gpo, spi0(sck), tclk --mpp64 64 gpio, spi0(miso), spi0-1(cs1) --mpp65 65 gpio, spi0(mosi), spi0-1(cs2) -+mpp64 64 gpio, spi0(miso), spi0(cs1) -+mpp65 65 gpio, spi0(mosi), spi0(cs2) -diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt -index bfa0a2e..86dec67 100644 ---- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt -+++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt -@@ -41,15 +41,15 @@ mpp20 20 gpio, ge0(rxd4), ge1(rxd2), lcd(d20), ptp(clk) - mpp21 21 gpio, ge0(rxd5), ge1(rxd3), lcd(d21), mem(bat) - mpp22 22 gpio, ge0(rxd6), ge1(rxctl), lcd(d22), sata0(prsnt) - mpp23 23 gpio, ge0(rxd7), ge1(rxclk), lcd(d23), sata1(prsnt) --mpp24 24 gpio, lcd(hsync), sata1(prsnt), nf(bootcs-re), tdm(rst) --mpp25 25 gpio, lcd(vsync), sata0(prsnt), nf(bootcs-we), tdm(pclk) --mpp26 26 gpio, lcd(clk), tdm(fsync), vdd(cpu1-pd) -+mpp24 24 gpio, lcd(hsync), sata1(prsnt), tdm(rst) -+mpp25 25 gpio, lcd(vsync), sata0(prsnt), tdm(pclk) -+mpp26 26 gpio, lcd(clk), tdm(fsync) - mpp27 27 gpio, lcd(e), tdm(dtx), ptp(trig) - mpp28 28 gpio, lcd(pwm), tdm(drx), ptp(evreq) --mpp29 29 gpio, lcd(ref-clk), tdm(int0), ptp(clk), vdd(cpu0-pd) -+mpp29 29 gpio, lcd(ref-clk), tdm(int0), ptp(clk) - mpp30 30 gpio, tdm(int1), sd0(clk) --mpp31 31 gpio, tdm(int2), sd0(cmd), vdd(cpu0-pd) --mpp32 32 gpio, tdm(int3), sd0(d0), vdd(cpu1-pd) -+mpp31 31 gpio, tdm(int2), sd0(cmd) -+mpp32 32 gpio, tdm(int3), sd0(d0) - mpp33 33 gpio, tdm(int4), sd0(d1), mem(bat) - mpp34 34 gpio, tdm(int5), sd0(d2), sata0(prsnt) - mpp35 35 gpio, tdm(int6), sd0(d3), sata1(prsnt) -@@ -57,21 +57,18 @@ mpp36 36 gpio, spi(mosi) - mpp37 37 gpio, spi(miso) - mpp38 38 gpio, spi(sck) - mpp39 39 gpio, spi(cs0) --mpp40 40 gpio, spi(cs1), uart2(cts), lcd(vga-hsync), vdd(cpu1-pd), -- pcie(clkreq0) -+mpp40 40 gpio, spi(cs1), uart2(cts), lcd(vga-hsync), pcie(clkreq0) - mpp41 41 gpio, spi(cs2), uart2(rts), lcd(vga-vsync), sata1(prsnt), - pcie(clkreq1) --mpp42 42 gpio, uart2(rxd), uart0(cts), tdm(int7), tdm-1(timer), -- vdd(cpu0-pd) --mpp43 43 gpio, uart2(txd), uart0(rts), spi(cs3), pcie(rstout), -- vdd(cpu2-3-pd){1} -+mpp42 42 gpio, uart2(rxd), uart0(cts), tdm(int7), tdm-1(timer) -+mpp43 43 gpio, uart2(txd), uart0(rts), spi(cs3), pcie(rstout) - mpp44 44 gpio, uart2(cts), uart3(rxd), spi(cs4), pcie(clkreq2), - mem(bat) - mpp45 45 gpio, uart2(rts), uart3(txd), spi(cs5), sata1(prsnt) - mpp46 46 gpio, uart3(rts), uart1(rts), spi(cs6), sata0(prsnt) - mpp47 47 gpio, uart3(cts), uart1(cts), spi(cs7), pcie(clkreq3), - ref(clkout) --mpp48 48 gpio, tclk, dev(burst/last) -+mpp48 48 gpio, dev(clkout), dev(burst/last) - - * Marvell Armada XP (mv78260 and mv78460 only) - -@@ -83,9 +80,9 @@ mpp51 51 gpio, dev(ad16) - mpp52 52 gpio, dev(ad17) - mpp53 53 gpio, dev(ad18) - mpp54 54 gpio, dev(ad19) --mpp55 55 gpio, dev(ad20), vdd(cpu0-pd) --mpp56 56 gpio, dev(ad21), vdd(cpu1-pd) --mpp57 57 gpio, dev(ad22), vdd(cpu2-3-pd){1} -+mpp55 55 gpio, dev(ad20) -+mpp56 56 gpio, dev(ad21) -+mpp57 57 gpio, dev(ad22) - mpp58 58 gpio, dev(ad23) - mpp59 59 gpio, dev(ad24) - mpp60 60 gpio, dev(ad25) -@@ -95,6 +92,3 @@ mpp63 63 gpio, dev(ad28) - mpp64 64 gpio, dev(ad29) - mpp65 65 gpio, dev(ad30) - mpp66 66 gpio, dev(ad31) -- --Notes: --* {1} vdd(cpu2-3-pd) only available on mv78460. -diff --git a/Documentation/devicetree/bindings/spi/spi_pl022.txt b/Documentation/devicetree/bindings/spi/spi_pl022.txt -index 22ed679..4d1673c 100644 ---- a/Documentation/devicetree/bindings/spi/spi_pl022.txt -+++ b/Documentation/devicetree/bindings/spi/spi_pl022.txt -@@ -4,9 +4,9 @@ Required properties: - - compatible : "arm,pl022", "arm,primecell" - - reg : Offset and length of the register set for the device - - interrupts : Should contain SPI controller interrupt -+- num-cs : total number of chipselects - - Optional properties: --- num-cs : total number of chipselects - - cs-gpios : should specify GPIOs used for chipselects. - The gpios will be referred to as reg = <index> in the SPI child nodes. - If unspecified, a single SPI device without a chip select can be used. -diff --git a/Makefile b/Makefile -index 25393e8..fee8460 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 3 - PATCHLEVEL = 14 --SUBLEVEL = 48 -+SUBLEVEL = 49 - EXTRAVERSION = - NAME = Remembering Coco - -diff --git a/arch/arc/include/asm/cmpxchg.h b/arch/arc/include/asm/cmpxchg.h -index 03cd689..90de5c5 100644 ---- a/arch/arc/include/asm/cmpxchg.h -+++ b/arch/arc/include/asm/cmpxchg.h -@@ -25,10 +25,11 @@ __cmpxchg(volatile void *ptr, unsigned long expected, unsigned long new) - " scond %3, [%1] \n" - " bnz 1b \n" - "2: \n" -- : "=&r"(prev) -- : "r"(ptr), "ir"(expected), -- "r"(new) /* can't be "ir". scond can't take limm for "b" */ -- : "cc"); -+ : "=&r"(prev) /* Early clobber, to prevent reg reuse */ -+ : "r"(ptr), /* Not "m": llock only supports reg direct addr mode */ -+ "ir"(expected), -+ "r"(new) /* can't be "ir". scond can't take LIMM for "b" */ -+ : "cc", "memory"); /* so that gcc knows memory is being written here */ - - return prev; - } -diff --git a/arch/arm64/kernel/vdso/Makefile b/arch/arm64/kernel/vdso/Makefile -index a268a9a..a622dd0 100644 ---- a/arch/arm64/kernel/vdso/Makefile -+++ b/arch/arm64/kernel/vdso/Makefile -@@ -15,6 +15,10 @@ ccflags-y := -shared -fno-common -fno-builtin - ccflags-y += -nostdlib -Wl,-soname=linux-vdso.so.1 \ - $(call cc-ldoption, -Wl$(comma)--hash-style=sysv) - -+# Workaround for bare-metal (ELF) toolchains that neglect to pass -shared -+# down to collect2, resulting in silent corruption of the vDSO image. -+ccflags-y += -Wl,-shared -+ - obj-y += vdso.o - extra-y += vdso.lds vdso-offsets.h - CPPFLAGS_vdso.lds += -P -C -U$(ARCH) -diff --git a/arch/arm64/mm/context.c b/arch/arm64/mm/context.c -index baa758d..76c1e6c 100644 ---- a/arch/arm64/mm/context.c -+++ b/arch/arm64/mm/context.c -@@ -92,6 +92,14 @@ static void reset_context(void *info) - unsigned int cpu = smp_processor_id(); - struct mm_struct *mm = current->active_mm; - -+ /* -+ * current->active_mm could be init_mm for the idle thread immediately -+ * after secondary CPU boot or hotplug. TTBR0_EL1 is already set to -+ * the reserved value, so no need to reset any context. -+ */ -+ if (mm == &init_mm) -+ return; -+ - smp_rmb(); - asid = cpu_last_asid + cpu; - -diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c -index 023747b..e3a24b7 100644 ---- a/arch/arm64/mm/hugetlbpage.c -+++ b/arch/arm64/mm/hugetlbpage.c -@@ -46,13 +46,13 @@ struct page *follow_huge_addr(struct mm_struct *mm, unsigned long address, - - int pmd_huge(pmd_t pmd) - { -- return !(pmd_val(pmd) & PMD_TABLE_BIT); -+ return pmd_val(pmd) && !(pmd_val(pmd) & PMD_TABLE_BIT); - } - - int pud_huge(pud_t pud) - { - #ifndef __PAGETABLE_PMD_FOLDED -- return !(pud_val(pud) & PUD_TABLE_BIT); -+ return pud_val(pud) && !(pud_val(pud) & PUD_TABLE_BIT); - #else - return 0; - #endif -diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c -index d0b4c2e..aeb95a1 100644 ---- a/arch/arm64/mm/init.c -+++ b/arch/arm64/mm/init.c -@@ -243,7 +243,7 @@ static void __init free_unused_memmap(void) - * memmap entries are valid from the bank end aligned to - * MAX_ORDER_NR_PAGES. - */ -- prev_end = ALIGN(start + __phys_to_pfn(reg->size), -+ prev_end = ALIGN(__phys_to_pfn(reg->base + reg->size), - MAX_ORDER_NR_PAGES); - } - -diff --git a/arch/mips/kvm/kvm_mips_emul.c b/arch/mips/kvm/kvm_mips_emul.c -index e75ef82..c76f297 100644 ---- a/arch/mips/kvm/kvm_mips_emul.c -+++ b/arch/mips/kvm/kvm_mips_emul.c -@@ -1626,7 +1626,7 @@ kvm_mips_complete_mmio_load(struct kvm_vcpu *vcpu, struct kvm_run *run) - if (vcpu->mmio_needed == 2) - *gpr = *(int16_t *) run->mmio.data; - else -- *gpr = *(int16_t *) run->mmio.data; -+ *gpr = *(uint16_t *)run->mmio.data; - - break; - case 1: -diff --git a/drivers/acpi/acpica/utxfinit.c b/drivers/acpi/acpica/utxfinit.c -index 246ef68..2c3c578 100644 ---- a/drivers/acpi/acpica/utxfinit.c -+++ b/drivers/acpi/acpica/utxfinit.c -@@ -175,10 +175,12 @@ acpi_status __init acpi_enable_subsystem(u32 flags) - * Obtain a permanent mapping for the FACS. This is required for the - * Global Lock and the Firmware Waking Vector - */ -- status = acpi_tb_initialize_facs(); -- if (ACPI_FAILURE(status)) { -- ACPI_WARNING((AE_INFO, "Could not map the FACS table")); -- return_ACPI_STATUS(status); -+ if (!(flags & ACPI_NO_FACS_INIT)) { -+ status = acpi_tb_initialize_facs(); -+ if (ACPI_FAILURE(status)) { -+ ACPI_WARNING((AE_INFO, "Could not map the FACS table")); -+ return_ACPI_STATUS(status); -+ } - } - #endif /* !ACPI_REDUCED_HARDWARE */ - -diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c -index b48aefa..60be8d0 100644 ---- a/drivers/acpi/bus.c -+++ b/drivers/acpi/bus.c -@@ -450,6 +450,16 @@ static int __init acpi_bus_init_irq(void) - u8 acpi_gbl_permanent_mmap; - - -+/** -+ * acpi_early_init - Initialize ACPICA and populate the ACPI namespace. -+ * -+ * The ACPI tables are accessible after this, but the handling of events has not -+ * been initialized and the global lock is not available yet, so AML should not -+ * be executed at this point. -+ * -+ * Doing this before switching the EFI runtime services to virtual mode allows -+ * the EfiBootServices memory to be freed slightly earlier on boot. -+ */ - void __init acpi_early_init(void) - { - acpi_status status; -@@ -510,26 +520,42 @@ void __init acpi_early_init(void) - acpi_gbl_FADT.sci_interrupt = acpi_sci_override_gsi; - } - #endif -+ return; -+ -+ error0: -+ disable_acpi(); -+} -+ -+/** -+ * acpi_subsystem_init - Finalize the early initialization of ACPI. -+ * -+ * Switch over the platform to the ACPI mode (if possible), initialize the -+ * handling of ACPI events, install the interrupt and global lock handlers. -+ * -+ * Doing this too early is generally unsafe, but at the same time it needs to be -+ * done before all things that really depend on ACPI. The right spot appears to -+ * be before finalizing the EFI initialization. -+ */ -+void __init acpi_subsystem_init(void) -+{ -+ acpi_status status; -+ -+ if (acpi_disabled) -+ return; - - status = acpi_enable_subsystem(~ACPI_NO_ACPI_ENABLE); - if (ACPI_FAILURE(status)) { - printk(KERN_ERR PREFIX "Unable to enable ACPI\n"); -- goto error0; -+ disable_acpi(); -+ } else { -+ /* -+ * If the system is using ACPI then we can be reasonably -+ * confident that any regulators are managed by the firmware -+ * so tell the regulator core it has everything it needs to -+ * know. -+ */ -+ regulator_has_full_constraints(); - } -- -- /* -- * If the system is using ACPI then we can be reasonably -- * confident that any regulators are managed by the firmware -- * so tell the regulator core it has everything it needs to -- * know. -- */ -- regulator_has_full_constraints(); -- -- return; -- -- error0: -- disable_acpi(); -- return; - } - - static int __init acpi_bus_init(void) -diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c -index b1c0fcd..b0e6691 100644 ---- a/drivers/ata/libata-core.c -+++ b/drivers/ata/libata-core.c -@@ -4173,9 +4173,10 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { - { "ST3320[68]13AS", "SD1[5-9]", ATA_HORKAGE_NONCQ | - ATA_HORKAGE_FIRMWARE_WARN }, - -- /* Seagate Momentus SpinPoint M8 seem to have FPMDA_AA issues */ -+ /* drives which fail FPDMA_AA activation (some may freeze afterwards) */ - { "ST1000LM024 HN-M101MBB", "2AR10001", ATA_HORKAGE_BROKEN_FPDMA_AA }, - { "ST1000LM024 HN-M101MBB", "2BA30001", ATA_HORKAGE_BROKEN_FPDMA_AA }, -+ { "VB0250EAVER", "HPG7", ATA_HORKAGE_BROKEN_FPDMA_AA }, - - /* Blacklist entries taken from Silicon Image 3124/3132 - Windows driver .inf file - also several Linux problem reports */ -@@ -4229,6 +4230,9 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { - { "Micron_M550*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, }, - { "Crucial_CT*M550SSD*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, }, - -+ /* devices that don't properly handle TRIM commands */ -+ { "SuperSSpeed S238*", NULL, ATA_HORKAGE_NOTRIM, }, -+ - /* - * Some WD SATA-I drives spin up and down erratically when the link - * is put into the slumber mode. We don't have full list of the -@@ -4533,7 +4537,8 @@ static unsigned int ata_dev_set_xfermode(struct ata_device *dev) - else /* In the ancient relic department - skip all of this */ - return 0; - -- err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 0); -+ /* On some disks, this command causes spin-up, so we need longer timeout */ -+ err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 15000); - - DPRINTK("EXIT, err_mask=%x\n", err_mask); - return err_mask; -diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c -index ef8567d..6fecf0b 100644 ---- a/drivers/ata/libata-scsi.c -+++ b/drivers/ata/libata-scsi.c -@@ -2510,7 +2510,8 @@ static unsigned int ata_scsiop_read_cap(struct ata_scsi_args *args, u8 *rbuf) - rbuf[14] = (lowest_aligned >> 8) & 0x3f; - rbuf[15] = lowest_aligned; - -- if (ata_id_has_trim(args->id)) { -+ if (ata_id_has_trim(args->id) && -+ !(dev->horkage & ATA_HORKAGE_NOTRIM)) { - rbuf[14] |= 0x80; /* TPE */ - - if (ata_id_has_zero_after_trim(args->id)) -diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c -index 2495ee5..f0c15f9 100644 ---- a/drivers/base/firmware_class.c -+++ b/drivers/base/firmware_class.c -@@ -544,10 +544,8 @@ static void fw_dev_release(struct device *dev) - kfree(fw_priv); - } - --static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env) -+static int do_firmware_uevent(struct firmware_priv *fw_priv, struct kobj_uevent_env *env) - { -- struct firmware_priv *fw_priv = to_firmware_priv(dev); -- - if (add_uevent_var(env, "FIRMWARE=%s", fw_priv->buf->fw_id)) - return -ENOMEM; - if (add_uevent_var(env, "TIMEOUT=%i", loading_timeout)) -@@ -558,6 +556,18 @@ static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env) - return 0; - } - -+static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env) -+{ -+ struct firmware_priv *fw_priv = to_firmware_priv(dev); -+ int err = 0; -+ -+ mutex_lock(&fw_lock); -+ if (fw_priv->buf) -+ err = do_firmware_uevent(fw_priv, env); -+ mutex_unlock(&fw_lock); -+ return err; -+} -+ - static struct class firmware_class = { - .name = "firmware", - .class_attrs = firmware_class_attrs, -diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c -index 2f9a3d8..58559d7 100644 ---- a/drivers/base/regmap/regmap.c -+++ b/drivers/base/regmap/regmap.c -@@ -808,11 +808,10 @@ EXPORT_SYMBOL_GPL(devm_regmap_init); - static void regmap_field_init(struct regmap_field *rm_field, - struct regmap *regmap, struct reg_field reg_field) - { -- int field_bits = reg_field.msb - reg_field.lsb + 1; - rm_field->regmap = regmap; - rm_field->reg = reg_field.reg; - rm_field->shift = reg_field.lsb; -- rm_field->mask = ((BIT(field_bits) - 1) << reg_field.lsb); -+ rm_field->mask = GENMASK(reg_field.msb, reg_field.lsb); - rm_field->id_size = reg_field.id_size; - rm_field->id_offset = reg_field.id_offset; - } -@@ -1947,7 +1946,7 @@ int regmap_bulk_read(struct regmap *map, unsigned int reg, void *val, - &ival); - if (ret != 0) - return ret; -- memcpy(val + (i * val_bytes), &ival, val_bytes); -+ map->format.format_val(val + (i * val_bytes), ival, 0); - } - } - -diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c -index 63688d3..12be7cb 100644 ---- a/drivers/block/rbd.c -+++ b/drivers/block/rbd.c -@@ -1826,11 +1826,11 @@ static struct rbd_obj_request *rbd_obj_request_create(const char *object_name, - rbd_assert(obj_request_type_valid(type)); - - size = strlen(object_name) + 1; -- name = kmalloc(size, GFP_KERNEL); -+ name = kmalloc(size, GFP_NOIO); - if (!name) - return NULL; - -- obj_request = kmem_cache_zalloc(rbd_obj_request_cache, GFP_KERNEL); -+ obj_request = kmem_cache_zalloc(rbd_obj_request_cache, GFP_NOIO); - if (!obj_request) { - kfree(name); - return NULL; -diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c -index c0e7a9aa9..c23658e 100644 ---- a/drivers/bluetooth/btusb.c -+++ b/drivers/bluetooth/btusb.c -@@ -1293,6 +1293,8 @@ static int btusb_setup_intel(struct hci_dev *hdev) - } - fw_ptr = fw->data; - -+ kfree_skb(skb); -+ - /* This Intel specific command enables the manufacturer mode of the - * controller. - * -diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c -index 5c85350..19e301f 100644 ---- a/drivers/char/agp/intel-gtt.c -+++ b/drivers/char/agp/intel-gtt.c -@@ -586,7 +586,7 @@ static inline int needs_ilk_vtd_wa(void) - /* Query intel_iommu to see if we need the workaround. Presumably that - * was loaded first. - */ -- if ((gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB || -+ if ((gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_D_IG || - gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_M_IG) && - intel_iommu_gfx_mapped) - return 1; -diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c -index 102463ba..643bba7 100644 ---- a/drivers/char/tpm/tpm_ibmvtpm.c -+++ b/drivers/char/tpm/tpm_ibmvtpm.c -@@ -579,6 +579,9 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev, - goto cleanup; - } - -+ ibmvtpm->dev = dev; -+ ibmvtpm->vdev = vio_dev; -+ - crq_q = &ibmvtpm->crq_queue; - crq_q->crq_addr = (struct ibmvtpm_crq *)get_zeroed_page(GFP_KERNEL); - if (!crq_q->crq_addr) { -@@ -623,8 +626,6 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev, - - crq_q->index = 0; - -- ibmvtpm->dev = dev; -- ibmvtpm->vdev = vio_dev; - TPM_VPRIV(chip) = (void *)ibmvtpm; - - spin_lock_init(&ibmvtpm->rtce_lock); -diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c -index 831b482..ddd03f8 100644 ---- a/drivers/clocksource/exynos_mct.c -+++ b/drivers/clocksource/exynos_mct.c -@@ -422,15 +422,12 @@ static int exynos4_local_timer_setup(struct clock_event_device *evt) - exynos4_mct_write(TICK_BASE_CNT, mevt->base + MCT_L_TCNTB_OFFSET); - - if (mct_int_type == MCT_INT_SPI) { -- evt->irq = mct_irqs[MCT_L0_IRQ + cpu]; -- if (request_irq(evt->irq, exynos4_mct_tick_isr, -- IRQF_TIMER | IRQF_NOBALANCING, -- evt->name, mevt)) { -- pr_err("exynos-mct: cannot register IRQ %d\n", -- evt->irq); -+ -+ if (evt->irq == -1) - return -EIO; -- } -- irq_force_affinity(mct_irqs[MCT_L0_IRQ + cpu], cpumask_of(cpu)); -+ -+ irq_force_affinity(evt->irq, cpumask_of(cpu)); -+ enable_irq(evt->irq); - } else { - enable_percpu_irq(mct_irqs[MCT_L0_IRQ], 0); - } -@@ -443,10 +440,12 @@ static int exynos4_local_timer_setup(struct clock_event_device *evt) - static void exynos4_local_timer_stop(struct clock_event_device *evt) - { - evt->set_mode(CLOCK_EVT_MODE_UNUSED, evt); -- if (mct_int_type == MCT_INT_SPI) -- free_irq(evt->irq, this_cpu_ptr(&percpu_mct_tick)); -- else -+ if (mct_int_type == MCT_INT_SPI) { -+ if (evt->irq != -1) -+ disable_irq_nosync(evt->irq); -+ } else { - disable_percpu_irq(mct_irqs[MCT_L0_IRQ]); -+ } - } - - static int exynos4_mct_cpu_notify(struct notifier_block *self, -@@ -478,7 +477,7 @@ static struct notifier_block exynos4_mct_cpu_nb = { - - static void __init exynos4_timer_resources(struct device_node *np, void __iomem *base) - { -- int err; -+ int err, cpu; - struct mct_clock_event_device *mevt = this_cpu_ptr(&percpu_mct_tick); - struct clk *mct_clk, *tick_clk; - -@@ -505,7 +504,25 @@ static void __init exynos4_timer_resources(struct device_node *np, void __iomem - WARN(err, "MCT: can't request IRQ %d (%d)\n", - mct_irqs[MCT_L0_IRQ], err); - } else { -- irq_set_affinity(mct_irqs[MCT_L0_IRQ], cpumask_of(0)); -+ for_each_possible_cpu(cpu) { -+ int mct_irq = mct_irqs[MCT_L0_IRQ + cpu]; -+ struct mct_clock_event_device *pcpu_mevt = -+ per_cpu_ptr(&percpu_mct_tick, cpu); -+ -+ pcpu_mevt->evt.irq = -1; -+ -+ irq_set_status_flags(mct_irq, IRQ_NOAUTOEN); -+ if (request_irq(mct_irq, -+ exynos4_mct_tick_isr, -+ IRQF_TIMER | IRQF_NOBALANCING, -+ pcpu_mevt->name, pcpu_mevt)) { -+ pr_err("exynos-mct: cannot register IRQ (cpu%d)\n", -+ cpu); -+ -+ continue; -+ } -+ pcpu_mevt->evt.irq = mct_irq; -+ } - } - - err = register_cpu_notifier(&exynos4_mct_cpu_nb); -diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c -index e3d2052..1adc039 100644 ---- a/drivers/cpuidle/cpuidle.c -+++ b/drivers/cpuidle/cpuidle.c -@@ -131,6 +131,9 @@ int cpuidle_idle_call(void) - - /* ask the governor for the next state */ - next_state = cpuidle_curr_governor->select(drv, dev); -+ if (next_state < 0) -+ return -EBUSY; -+ - if (need_resched()) { - dev->last_residency = 0; - /* give the governor an opportunity to reflect on the outcome */ -diff --git a/drivers/cpuidle/governors/menu.c b/drivers/cpuidle/governors/menu.c -index cf7f2f0..027c484 100644 ---- a/drivers/cpuidle/governors/menu.c -+++ b/drivers/cpuidle/governors/menu.c -@@ -297,7 +297,7 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev) - data->needs_update = 0; - } - -- data->last_state_idx = 0; -+ data->last_state_idx = CPUIDLE_DRIVER_STATE_START - 1; - data->exit_us = 0; - - /* Special case when user has set very strict latency requirement */ -diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c -index 394cbc5..6b2f01d 100644 ---- a/drivers/dma/mv_xor.c -+++ b/drivers/dma/mv_xor.c -@@ -316,7 +316,8 @@ static void __mv_xor_slot_cleanup(struct mv_xor_chan *mv_chan) - dma_cookie_t cookie = 0; - int busy = mv_chan_is_busy(mv_chan); - u32 current_desc = mv_chan_get_current_desc(mv_chan); -- int seen_current = 0; -+ int current_cleaned = 0; -+ struct mv_xor_desc *hw_desc; - - dev_dbg(mv_chan_to_devp(mv_chan), "%s %d\n", __func__, __LINE__); - dev_dbg(mv_chan_to_devp(mv_chan), "current_desc %x\n", current_desc); -@@ -328,38 +329,57 @@ static void __mv_xor_slot_cleanup(struct mv_xor_chan *mv_chan) - - list_for_each_entry_safe(iter, _iter, &mv_chan->chain, - chain_node) { -- prefetch(_iter); -- prefetch(&_iter->async_tx); - -- /* do not advance past the current descriptor loaded into the -- * hardware channel, subsequent descriptors are either in -- * process or have not been submitted -- */ -- if (seen_current) -- break; -+ /* clean finished descriptors */ -+ hw_desc = iter->hw_desc; -+ if (hw_desc->status & XOR_DESC_SUCCESS) { -+ cookie = mv_xor_run_tx_complete_actions(iter, mv_chan, -+ cookie); - -- /* stop the search if we reach the current descriptor and the -- * channel is busy -- */ -- if (iter->async_tx.phys == current_desc) { -- seen_current = 1; -- if (busy) -+ /* done processing desc, clean slot */ -+ mv_xor_clean_slot(iter, mv_chan); -+ -+ /* break if we did cleaned the current */ -+ if (iter->async_tx.phys == current_desc) { -+ current_cleaned = 1; -+ break; -+ } -+ } else { -+ if (iter->async_tx.phys == current_desc) { -+ current_cleaned = 0; - break; -+ } - } -- -- cookie = mv_xor_run_tx_complete_actions(iter, mv_chan, cookie); -- -- if (mv_xor_clean_slot(iter, mv_chan)) -- break; - } - - if ((busy == 0) && !list_empty(&mv_chan->chain)) { -- struct mv_xor_desc_slot *chain_head; -- chain_head = list_entry(mv_chan->chain.next, -- struct mv_xor_desc_slot, -- chain_node); -- -- mv_xor_start_new_chain(mv_chan, chain_head); -+ if (current_cleaned) { -+ /* -+ * current descriptor cleaned and removed, run -+ * from list head -+ */ -+ iter = list_entry(mv_chan->chain.next, -+ struct mv_xor_desc_slot, -+ chain_node); -+ mv_xor_start_new_chain(mv_chan, iter); -+ } else { -+ if (!list_is_last(&iter->chain_node, &mv_chan->chain)) { -+ /* -+ * descriptors are still waiting after -+ * current, trigger them -+ */ -+ iter = list_entry(iter->chain_node.next, -+ struct mv_xor_desc_slot, -+ chain_node); -+ mv_xor_start_new_chain(mv_chan, iter); -+ } else { -+ /* -+ * some descriptors are still waiting -+ * to be cleaned -+ */ -+ tasklet_schedule(&mv_chan->irq_tasklet); -+ } -+ } - } - - if (cookie > 0) -diff --git a/drivers/dma/mv_xor.h b/drivers/dma/mv_xor.h -index d074922..5d14e4b 100644 ---- a/drivers/dma/mv_xor.h -+++ b/drivers/dma/mv_xor.h -@@ -33,6 +33,7 @@ - #define XOR_OPERATION_MODE_XOR 0 - #define XOR_OPERATION_MODE_MEMCPY 2 - #define XOR_DESCRIPTOR_SWAP BIT(14) -+#define XOR_DESC_SUCCESS 0x40000000 - - #define XOR_CURR_DESC(chan) (chan->mmr_high_base + 0x10 + (chan->idx * 4)) - #define XOR_NEXT_DESC(chan) (chan->mmr_high_base + 0x00 + (chan->idx * 4)) -diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c -index 3b7d32d..903db3c 100644 ---- a/drivers/gpu/drm/drm_crtc.c -+++ b/drivers/gpu/drm/drm_crtc.c -@@ -2155,8 +2155,11 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, - if (!drm_core_check_feature(dev, DRIVER_MODESET)) - return -EINVAL; - -- /* For some reason crtc x/y offsets are signed internally. */ -- if (crtc_req->x > INT_MAX || crtc_req->y > INT_MAX) -+ /* -+ * Universal plane src offsets are only 16.16, prevent havoc for -+ * drivers using universal plane code internally. -+ */ -+ if (crtc_req->x & 0xffff0000 || crtc_req->y & 0xffff0000) - return -ERANGE; - - drm_modeset_lock_all(dev); -diff --git a/drivers/gpu/drm/qxl/qxl_cmd.c b/drivers/gpu/drm/qxl/qxl_cmd.c -index eb89653..c5e96a3 100644 ---- a/drivers/gpu/drm/qxl/qxl_cmd.c -+++ b/drivers/gpu/drm/qxl/qxl_cmd.c -@@ -505,6 +505,7 @@ int qxl_hw_surface_alloc(struct qxl_device *qdev, - - cmd = (struct qxl_surface_cmd *)qxl_release_map(qdev, release); - cmd->type = QXL_SURFACE_CMD_CREATE; -+ cmd->flags = QXL_SURF_FLAG_KEEP_DATA; - cmd->u.surface_create.format = surf->surf.format; - cmd->u.surface_create.width = surf->surf.width; - cmd->u.surface_create.height = surf->surf.height; -diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c -index 0bb86e6..56a13a9 100644 ---- a/drivers/gpu/drm/qxl/qxl_ioctl.c -+++ b/drivers/gpu/drm/qxl/qxl_ioctl.c -@@ -122,8 +122,10 @@ static struct qxl_bo *qxlhw_handle_to_bo(struct qxl_device *qdev, - qobj = gem_to_qxl_bo(gobj); - - ret = qxl_release_list_add(release, qobj); -- if (ret) -+ if (ret) { -+ drm_gem_object_unreference_unlocked(gobj); - return NULL; -+ } - - return qobj; - } -diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c -index c4558bd..2fd2fb3 100644 ---- a/drivers/gpu/drm/radeon/cik.c -+++ b/drivers/gpu/drm/radeon/cik.c -@@ -4148,6 +4148,31 @@ void cik_compute_set_wptr(struct radeon_device *rdev, - WDOORBELL32(ring->doorbell_index, ring->wptr); - } - -+static void cik_compute_stop(struct radeon_device *rdev, -+ struct radeon_ring *ring) -+{ -+ u32 j, tmp; -+ -+ cik_srbm_select(rdev, ring->me, ring->pipe, ring->queue, 0); -+ /* Disable wptr polling. */ -+ tmp = RREG32(CP_PQ_WPTR_POLL_CNTL); -+ tmp &= ~WPTR_POLL_EN; -+ WREG32(CP_PQ_WPTR_POLL_CNTL, tmp); -+ /* Disable HQD. */ -+ if (RREG32(CP_HQD_ACTIVE) & 1) { -+ WREG32(CP_HQD_DEQUEUE_REQUEST, 1); -+ for (j = 0; j < rdev->usec_timeout; j++) { -+ if (!(RREG32(CP_HQD_ACTIVE) & 1)) -+ break; -+ udelay(1); -+ } -+ WREG32(CP_HQD_DEQUEUE_REQUEST, 0); -+ WREG32(CP_HQD_PQ_RPTR, 0); -+ WREG32(CP_HQD_PQ_WPTR, 0); -+ } -+ cik_srbm_select(rdev, 0, 0, 0, 0); -+} -+ - /** - * cik_cp_compute_enable - enable/disable the compute CP MEs - * -@@ -4161,6 +4186,15 @@ static void cik_cp_compute_enable(struct radeon_device *rdev, bool enable) - if (enable) - WREG32(CP_MEC_CNTL, 0); - else { -+ /* -+ * To make hibernation reliable we need to clear compute ring -+ * configuration before halting the compute ring. -+ */ -+ mutex_lock(&rdev->srbm_mutex); -+ cik_compute_stop(rdev,&rdev->ring[CAYMAN_RING_TYPE_CP1_INDEX]); -+ cik_compute_stop(rdev,&rdev->ring[CAYMAN_RING_TYPE_CP2_INDEX]); -+ mutex_unlock(&rdev->srbm_mutex); -+ - WREG32(CP_MEC_CNTL, (MEC_ME1_HALT | MEC_ME2_HALT)); - rdev->ring[CAYMAN_RING_TYPE_CP1_INDEX].ready = false; - rdev->ring[CAYMAN_RING_TYPE_CP2_INDEX].ready = false; -diff --git a/drivers/gpu/drm/radeon/cik_sdma.c b/drivers/gpu/drm/radeon/cik_sdma.c -index 66ba713..e590aec 100644 ---- a/drivers/gpu/drm/radeon/cik_sdma.c -+++ b/drivers/gpu/drm/radeon/cik_sdma.c -@@ -266,6 +266,17 @@ static void cik_sdma_gfx_stop(struct radeon_device *rdev) - } - rdev->ring[R600_RING_TYPE_DMA_INDEX].ready = false; - rdev->ring[CAYMAN_RING_TYPE_DMA1_INDEX].ready = false; -+ -+ /* FIXME use something else than big hammer but after few days can not -+ * seem to find good combination so reset SDMA blocks as it seems we -+ * do not shut them down properly. This fix hibernation and does not -+ * affect suspend to ram. -+ */ -+ WREG32(SRBM_SOFT_RESET, SOFT_RESET_SDMA | SOFT_RESET_SDMA1); -+ (void)RREG32(SRBM_SOFT_RESET); -+ udelay(50); -+ WREG32(SRBM_SOFT_RESET, 0); -+ (void)RREG32(SRBM_SOFT_RESET); - } - - /** -diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c -index a8f9b46..e609722 100644 ---- a/drivers/gpu/drm/radeon/radeon_gart.c -+++ b/drivers/gpu/drm/radeon/radeon_gart.c -@@ -251,8 +251,10 @@ void radeon_gart_unbind(struct radeon_device *rdev, unsigned offset, - } - } - } -- mb(); -- radeon_gart_tlb_flush(rdev); -+ if (rdev->gart.ptr) { -+ mb(); -+ radeon_gart_tlb_flush(rdev); -+ } - } - - /** -@@ -294,8 +296,10 @@ int radeon_gart_bind(struct radeon_device *rdev, unsigned offset, - } - } - } -- mb(); -- radeon_gart_tlb_flush(rdev); -+ if (rdev->gart.ptr) { -+ mb(); -+ radeon_gart_tlb_flush(rdev); -+ } - return 0; - } - -diff --git a/drivers/gpu/drm/radeon/radeon_irq_kms.c b/drivers/gpu/drm/radeon/radeon_irq_kms.c -index b3f0293..f8b20e1 100644 ---- a/drivers/gpu/drm/radeon/radeon_irq_kms.c -+++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c -@@ -79,10 +79,12 @@ static void radeon_hotplug_work_func(struct work_struct *work) - struct drm_mode_config *mode_config = &dev->mode_config; - struct drm_connector *connector; - -+ mutex_lock(&mode_config->mutex); - if (mode_config->num_connector) { - list_for_each_entry(connector, &mode_config->connector_list, head) - radeon_connector_hotplug(connector); - } -+ mutex_unlock(&mode_config->mutex); - /* Just fire off a uevent and let userspace tell us what to do */ - drm_helper_hpd_irq_event(dev); - } -diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c -index 11804cc..c9053f7 100644 ---- a/drivers/gpu/drm/radeon/si_dpm.c -+++ b/drivers/gpu/drm/radeon/si_dpm.c -@@ -2914,6 +2914,7 @@ static struct si_dpm_quirk si_dpm_quirk_list[] = { - /* PITCAIRN - https://bugs.freedesktop.org/show_bug.cgi?id=76490 */ - { PCI_VENDOR_ID_ATI, 0x6810, 0x1462, 0x3036, 0, 120000 }, - { PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0xe271, 0, 120000 }, -+ { PCI_VENDOR_ID_ATI, 0x6810, 0x174b, 0xe271, 85000, 90000 }, - { 0, 0, 0, 0 }, - }; - -diff --git a/drivers/hwmon/mcp3021.c b/drivers/hwmon/mcp3021.c -index d219c06..972444a 100644 ---- a/drivers/hwmon/mcp3021.c -+++ b/drivers/hwmon/mcp3021.c -@@ -31,14 +31,11 @@ - /* output format */ - #define MCP3021_SAR_SHIFT 2 - #define MCP3021_SAR_MASK 0x3ff -- - #define MCP3021_OUTPUT_RES 10 /* 10-bit resolution */ --#define MCP3021_OUTPUT_SCALE 4 - - #define MCP3221_SAR_SHIFT 0 - #define MCP3221_SAR_MASK 0xfff - #define MCP3221_OUTPUT_RES 12 /* 12-bit resolution */ --#define MCP3221_OUTPUT_SCALE 1 - - enum chips { - mcp3021, -@@ -54,7 +51,6 @@ struct mcp3021_data { - u16 sar_shift; - u16 sar_mask; - u8 output_res; -- u8 output_scale; - }; - - static int mcp3021_read16(struct i2c_client *client) -@@ -84,13 +80,7 @@ static int mcp3021_read16(struct i2c_client *client) - - static inline u16 volts_from_reg(struct mcp3021_data *data, u16 val) - { -- if (val == 0) -- return 0; -- -- val = val * data->output_scale - data->output_scale / 2; -- -- return val * DIV_ROUND_CLOSEST(data->vdd, -- (1 << data->output_res) * data->output_scale); -+ return DIV_ROUND_CLOSEST(data->vdd * val, 1 << data->output_res); - } - - static ssize_t show_in_input(struct device *dev, struct device_attribute *attr, -@@ -132,14 +122,12 @@ static int mcp3021_probe(struct i2c_client *client, - data->sar_shift = MCP3021_SAR_SHIFT; - data->sar_mask = MCP3021_SAR_MASK; - data->output_res = MCP3021_OUTPUT_RES; -- data->output_scale = MCP3021_OUTPUT_SCALE; - break; - - case mcp3221: - data->sar_shift = MCP3221_SAR_SHIFT; - data->sar_mask = MCP3221_SAR_MASK; - data->output_res = MCP3221_OUTPUT_RES; -- data->output_scale = MCP3221_OUTPUT_SCALE; - break; - } - -diff --git a/drivers/i2c/busses/i2c-at91.c b/drivers/i2c/busses/i2c-at91.c -index 8873d84..50862c9 100644 ---- a/drivers/i2c/busses/i2c-at91.c -+++ b/drivers/i2c/busses/i2c-at91.c -@@ -62,6 +62,9 @@ - #define AT91_TWI_UNRE 0x0080 /* Underrun Error */ - #define AT91_TWI_NACK 0x0100 /* Not Acknowledged */ - -+#define AT91_TWI_INT_MASK \ -+ (AT91_TWI_TXCOMP | AT91_TWI_RXRDY | AT91_TWI_TXRDY | AT91_TWI_NACK) -+ - #define AT91_TWI_IER 0x0024 /* Interrupt Enable Register */ - #define AT91_TWI_IDR 0x0028 /* Interrupt Disable Register */ - #define AT91_TWI_IMR 0x002c /* Interrupt Mask Register */ -@@ -117,13 +120,12 @@ static void at91_twi_write(struct at91_twi_dev *dev, unsigned reg, unsigned val) - - static void at91_disable_twi_interrupts(struct at91_twi_dev *dev) - { -- at91_twi_write(dev, AT91_TWI_IDR, -- AT91_TWI_TXCOMP | AT91_TWI_RXRDY | AT91_TWI_TXRDY); -+ at91_twi_write(dev, AT91_TWI_IDR, AT91_TWI_INT_MASK); - } - - static void at91_twi_irq_save(struct at91_twi_dev *dev) - { -- dev->imr = at91_twi_read(dev, AT91_TWI_IMR) & 0x7; -+ dev->imr = at91_twi_read(dev, AT91_TWI_IMR) & AT91_TWI_INT_MASK; - at91_disable_twi_interrupts(dev); - } - -@@ -213,6 +215,14 @@ static void at91_twi_write_data_dma_callback(void *data) - dma_unmap_single(dev->dev, sg_dma_address(&dev->dma.sg), - dev->buf_len, DMA_TO_DEVICE); - -+ /* -+ * When this callback is called, THR/TX FIFO is likely not to be empty -+ * yet. So we have to wait for TXCOMP or NACK bits to be set into the -+ * Status Register to be sure that the STOP bit has been sent and the -+ * transfer is completed. The NACK interrupt has already been enabled, -+ * we just have to enable TXCOMP one. -+ */ -+ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_TXCOMP); - at91_twi_write(dev, AT91_TWI_CR, AT91_TWI_STOP); - } - -@@ -307,7 +317,7 @@ static void at91_twi_read_data_dma_callback(void *data) - /* The last two bytes have to be read without using dma */ - dev->buf += dev->buf_len - 2; - dev->buf_len = 2; -- at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_RXRDY); -+ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_RXRDY | AT91_TWI_TXCOMP); - } - - static void at91_twi_read_data_dma(struct at91_twi_dev *dev) -@@ -368,7 +378,7 @@ static irqreturn_t atmel_twi_interrupt(int irq, void *dev_id) - /* catch error flags */ - dev->transfer_status |= status; - -- if (irqstatus & AT91_TWI_TXCOMP) { -+ if (irqstatus & (AT91_TWI_TXCOMP | AT91_TWI_NACK)) { - at91_disable_twi_interrupts(dev); - complete(&dev->cmd_complete); - } -@@ -381,6 +391,34 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev) - int ret; - bool has_unre_flag = dev->pdata->has_unre_flag; - -+ /* -+ * WARNING: the TXCOMP bit in the Status Register is NOT a clear on -+ * read flag but shows the state of the transmission at the time the -+ * Status Register is read. According to the programmer datasheet, -+ * TXCOMP is set when both holding register and internal shifter are -+ * empty and STOP condition has been sent. -+ * Consequently, we should enable NACK interrupt rather than TXCOMP to -+ * detect transmission failure. -+ * -+ * Besides, the TXCOMP bit is already set before the i2c transaction -+ * has been started. For read transactions, this bit is cleared when -+ * writing the START bit into the Control Register. So the -+ * corresponding interrupt can safely be enabled just after. -+ * However for write transactions managed by the CPU, we first write -+ * into THR, so TXCOMP is cleared. Then we can safely enable TXCOMP -+ * interrupt. If TXCOMP interrupt were enabled before writing into THR, -+ * the interrupt handler would be called immediately and the i2c command -+ * would be reported as completed. -+ * Also when a write transaction is managed by the DMA controller, -+ * enabling the TXCOMP interrupt in this function may lead to a race -+ * condition since we don't know whether the TXCOMP interrupt is enabled -+ * before or after the DMA has started to write into THR. So the TXCOMP -+ * interrupt is enabled later by at91_twi_write_data_dma_callback(). -+ * Immediately after in that DMA callback, we still need to send the -+ * STOP condition manually writing the corresponding bit into the -+ * Control Register. -+ */ -+ - dev_dbg(dev->dev, "transfer: %s %d bytes.\n", - (dev->msg->flags & I2C_M_RD) ? "read" : "write", dev->buf_len); - -@@ -411,26 +449,24 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev) - * seems to be the best solution. - */ - if (dev->use_dma && (dev->buf_len > AT91_I2C_DMA_THRESHOLD)) { -+ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_NACK); - at91_twi_read_data_dma(dev); -- /* -- * It is important to enable TXCOMP irq here because -- * doing it only when transferring the last two bytes -- * will mask NACK errors since TXCOMP is set when a -- * NACK occurs. -- */ -- at91_twi_write(dev, AT91_TWI_IER, -- AT91_TWI_TXCOMP); -- } else -+ } else { - at91_twi_write(dev, AT91_TWI_IER, -- AT91_TWI_TXCOMP | AT91_TWI_RXRDY); -+ AT91_TWI_TXCOMP | -+ AT91_TWI_NACK | -+ AT91_TWI_RXRDY); -+ } - } else { - if (dev->use_dma && (dev->buf_len > AT91_I2C_DMA_THRESHOLD)) { -+ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_NACK); - at91_twi_write_data_dma(dev); -- at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_TXCOMP); - } else { - at91_twi_write_next_byte(dev); - at91_twi_write(dev, AT91_TWI_IER, -- AT91_TWI_TXCOMP | AT91_TWI_TXRDY); -+ AT91_TWI_TXCOMP | -+ AT91_TWI_NACK | -+ AT91_TWI_TXRDY); - } - } - -diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c -index e6bf77d..ed4e45f 100644 ---- a/drivers/iio/adc/at91_adc.c -+++ b/drivers/iio/adc/at91_adc.c -@@ -58,7 +58,7 @@ struct at91_adc_caps { - u8 ts_pen_detect_sensitivity; - - /* startup time calculate function */ -- u32 (*calc_startup_ticks)(u8 startup_time, u32 adc_clk_khz); -+ u32 (*calc_startup_ticks)(u32 startup_time, u32 adc_clk_khz); - - u8 num_channels; - struct at91_adc_reg_desc registers; -@@ -82,7 +82,7 @@ struct at91_adc_state { - u8 num_channels; - void __iomem *reg_base; - struct at91_adc_reg_desc *registers; -- u8 startup_time; -+ u32 startup_time; - u8 sample_hold_time; - bool sleep_mode; - struct iio_trigger **trig; -@@ -590,7 +590,7 @@ ret: - return ret; - } - --static u32 calc_startup_ticks_9260(u8 startup_time, u32 adc_clk_khz) -+static u32 calc_startup_ticks_9260(u32 startup_time, u32 adc_clk_khz) - { - /* - * Number of ticks needed to cover the startup time of the ADC -@@ -601,7 +601,7 @@ static u32 calc_startup_ticks_9260(u8 startup_time, u32 adc_clk_khz) - return round_up((startup_time * adc_clk_khz / 1000) - 1, 8) / 8; - } - --static u32 calc_startup_ticks_9x5(u8 startup_time, u32 adc_clk_khz) -+static u32 calc_startup_ticks_9x5(u32 startup_time, u32 adc_clk_khz) - { - /* - * For sama5d3x and at91sam9x5, the formula changes to: -diff --git a/drivers/iio/dac/ad5624r_spi.c b/drivers/iio/dac/ad5624r_spi.c -index e8199cc..1e66651 100644 ---- a/drivers/iio/dac/ad5624r_spi.c -+++ b/drivers/iio/dac/ad5624r_spi.c -@@ -22,7 +22,7 @@ - #include "ad5624r.h" - - static int ad5624r_spi_write(struct spi_device *spi, -- u8 cmd, u8 addr, u16 val, u8 len) -+ u8 cmd, u8 addr, u16 val, u8 shift) - { - u32 data; - u8 msg[3]; -@@ -35,7 +35,7 @@ static int ad5624r_spi_write(struct spi_device *spi, - * 14-, 12-bit input code followed by 0, 2, or 4 don't care bits, - * for the AD5664R, AD5644R, and AD5624R, respectively. - */ -- data = (0 << 22) | (cmd << 19) | (addr << 16) | (val << (16 - len)); -+ data = (0 << 22) | (cmd << 19) | (addr << 16) | (val << shift); - msg[0] = data >> 16; - msg[1] = data >> 8; - msg[2] = data; -diff --git a/drivers/iio/temperature/tmp006.c b/drivers/iio/temperature/tmp006.c -index 84a0789..7a80509 100644 ---- a/drivers/iio/temperature/tmp006.c -+++ b/drivers/iio/temperature/tmp006.c -@@ -132,6 +132,9 @@ static int tmp006_write_raw(struct iio_dev *indio_dev, - struct tmp006_data *data = iio_priv(indio_dev); - int i; - -+ if (mask != IIO_CHAN_INFO_SAMP_FREQ) -+ return -EINVAL; -+ - for (i = 0; i < ARRAY_SIZE(tmp006_freqs); i++) - if ((val == tmp006_freqs[i][0]) && - (val2 == tmp006_freqs[i][1])) { -diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c -index 6014227..dd2b610 100644 ---- a/drivers/infiniband/ulp/isert/ib_isert.c -+++ b/drivers/infiniband/ulp/isert/ib_isert.c -@@ -59,6 +59,8 @@ static int - isert_rdma_accept(struct isert_conn *isert_conn); - struct rdma_cm_id *isert_setup_id(struct isert_np *isert_np); - -+static void isert_release_work(struct work_struct *work); -+ - static void - isert_qp_event_callback(struct ib_event *e, void *context) - { -@@ -206,7 +208,7 @@ fail: - static void - isert_free_rx_descriptors(struct isert_conn *isert_conn) - { -- struct ib_device *ib_dev = isert_conn->conn_cm_id->device; -+ struct ib_device *ib_dev = isert_conn->conn_device->ib_device; - struct iser_rx_desc *rx_desc; - int i; - -@@ -534,6 +536,7 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event) - mutex_init(&isert_conn->conn_mutex); - spin_lock_init(&isert_conn->conn_lock); - INIT_LIST_HEAD(&isert_conn->conn_fr_pool); -+ INIT_WORK(&isert_conn->release_work, isert_release_work); - - isert_conn->conn_cm_id = cma_id; - isert_conn->responder_resources = event->param.conn.responder_resources; -@@ -647,9 +650,9 @@ out: - static void - isert_connect_release(struct isert_conn *isert_conn) - { -- struct ib_device *ib_dev = isert_conn->conn_cm_id->device; - struct isert_device *device = isert_conn->conn_device; - int cq_index; -+ struct ib_device *ib_dev = device->ib_device; - - pr_debug("Entering isert_connect_release(): >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n"); - -@@ -657,7 +660,8 @@ isert_connect_release(struct isert_conn *isert_conn) - isert_conn_free_fastreg_pool(isert_conn); - - isert_free_rx_descriptors(isert_conn); -- rdma_destroy_id(isert_conn->conn_cm_id); -+ if (isert_conn->conn_cm_id) -+ rdma_destroy_id(isert_conn->conn_cm_id); - - if (isert_conn->conn_qp) { - cq_index = ((struct isert_cq_desc *) -@@ -799,6 +803,7 @@ isert_disconnected_handler(struct rdma_cm_id *cma_id, - { - struct isert_np *isert_np = cma_id->context; - struct isert_conn *isert_conn; -+ bool terminating = false; - - if (isert_np->np_cm_id == cma_id) - return isert_np_cma_handler(cma_id->context, event); -@@ -806,21 +811,37 @@ isert_disconnected_handler(struct rdma_cm_id *cma_id, - isert_conn = cma_id->qp->qp_context; - - mutex_lock(&isert_conn->conn_mutex); -+ terminating = (isert_conn->state == ISER_CONN_TERMINATING); - isert_conn_terminate(isert_conn); - mutex_unlock(&isert_conn->conn_mutex); - - pr_info("conn %p completing conn_wait\n", isert_conn); - complete(&isert_conn->conn_wait); - -+ if (terminating) -+ goto out; -+ -+ mutex_lock(&isert_np->np_accept_mutex); -+ if (!list_empty(&isert_conn->conn_accept_node)) { -+ list_del_init(&isert_conn->conn_accept_node); -+ isert_put_conn(isert_conn); -+ queue_work(isert_release_wq, &isert_conn->release_work); -+ } -+ mutex_unlock(&isert_np->np_accept_mutex); -+ -+out: - return 0; - } - --static void -+static int - isert_connect_error(struct rdma_cm_id *cma_id) - { - struct isert_conn *isert_conn = cma_id->qp->qp_context; - -+ isert_conn->conn_cm_id = NULL; - isert_put_conn(isert_conn); -+ -+ return -1; - } - - static int -@@ -850,7 +871,7 @@ isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event) - case RDMA_CM_EVENT_REJECTED: /* FALLTHRU */ - case RDMA_CM_EVENT_UNREACHABLE: /* FALLTHRU */ - case RDMA_CM_EVENT_CONNECT_ERROR: -- isert_connect_error(cma_id); -+ ret = isert_connect_error(cma_id); - break; - default: - pr_err("Unhandled RDMA CMA event: %d\n", event->event); -@@ -2944,7 +2965,6 @@ static void isert_wait_conn(struct iscsi_conn *conn) - - wait_for_completion(&isert_conn->conn_wait_comp_err); - -- INIT_WORK(&isert_conn->release_work, isert_release_work); - queue_work(isert_release_wq, &isert_conn->release_work); - } - -diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c -index f37d63c..825545c 100644 ---- a/drivers/leds/led-class.c -+++ b/drivers/leds/led-class.c -@@ -178,6 +178,7 @@ void led_classdev_resume(struct led_classdev *led_cdev) - } - EXPORT_SYMBOL_GPL(led_classdev_resume); - -+#ifdef CONFIG_PM_SLEEP - static int led_suspend(struct device *dev) - { - struct led_classdev *led_cdev = dev_get_drvdata(dev); -@@ -197,11 +198,9 @@ static int led_resume(struct device *dev) - - return 0; - } -+#endif - --static const struct dev_pm_ops leds_class_dev_pm_ops = { -- .suspend = led_suspend, -- .resume = led_resume, --}; -+static SIMPLE_DEV_PM_OPS(leds_class_dev_pm_ops, led_suspend, led_resume); - - /** - * led_classdev_register - register a new object of led_classdev class. -diff --git a/drivers/md/dm-stats.c b/drivers/md/dm-stats.c -index 28a9012..b3b0697 100644 ---- a/drivers/md/dm-stats.c -+++ b/drivers/md/dm-stats.c -@@ -795,6 +795,8 @@ static int message_stats_create(struct mapped_device *md, - return -EINVAL; - - if (sscanf(argv[2], "/%u%c", &divisor, &dummy) == 1) { -+ if (!divisor) -+ return -EINVAL; - step = end - start; - if (do_div(step, divisor)) - step++; -diff --git a/drivers/md/md.c b/drivers/md/md.c -index 40959ee..b4067b9 100644 ---- a/drivers/md/md.c -+++ b/drivers/md/md.c -@@ -6232,7 +6232,7 @@ static int update_array_info(struct mddev *mddev, mdu_array_info_t *info) - mddev->ctime != info->ctime || - mddev->level != info->level || - /* mddev->layout != info->layout || */ -- !mddev->persistent != info->not_persistent|| -+ mddev->persistent != !info->not_persistent || - mddev->chunk_sectors != info->chunk_size >> 9 || - /* ignore bottom 8 bits of state, and allow SB_BITMAP_PRESENT to change */ - ((state^info->state) & 0xfffffe00) -diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c -index b88757c..a03178e 100644 ---- a/drivers/md/persistent-data/dm-btree-remove.c -+++ b/drivers/md/persistent-data/dm-btree-remove.c -@@ -309,8 +309,8 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent, - - if (s < 0 && nr_center < -s) { - /* not enough in central node */ -- shift(left, center, nr_center); -- s = nr_center - target; -+ shift(left, center, -nr_center); -+ s += nr_center; - shift(left, right, s); - nr_right += s; - } else -@@ -323,7 +323,7 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent, - if (s > 0 && nr_center < s) { - /* not enough in central node */ - shift(center, right, nr_center); -- s = target - nr_center; -+ s -= nr_center; - shift(left, right, s); - nr_left -= s; - } else -diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c -index 200ac12..fdd3793 100644 ---- a/drivers/md/persistent-data/dm-btree.c -+++ b/drivers/md/persistent-data/dm-btree.c -@@ -255,7 +255,7 @@ int dm_btree_del(struct dm_btree_info *info, dm_block_t root) - int r; - struct del_stack *s; - -- s = kmalloc(sizeof(*s), GFP_KERNEL); -+ s = kmalloc(sizeof(*s), GFP_NOIO); - if (!s) - return -ENOMEM; - s->info = info; -diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c -index f4e22bc..199c9cc 100644 ---- a/drivers/md/persistent-data/dm-space-map-metadata.c -+++ b/drivers/md/persistent-data/dm-space-map-metadata.c -@@ -204,6 +204,27 @@ static void in(struct sm_metadata *smm) - smm->recursion_count++; - } - -+static int apply_bops(struct sm_metadata *smm) -+{ -+ int r = 0; -+ -+ while (!brb_empty(&smm->uncommitted)) { -+ struct block_op bop; -+ -+ r = brb_pop(&smm->uncommitted, &bop); -+ if (r) { -+ DMERR("bug in bop ring buffer"); -+ break; -+ } -+ -+ r = commit_bop(smm, &bop); -+ if (r) -+ break; -+ } -+ -+ return r; -+} -+ - static int out(struct sm_metadata *smm) - { - int r = 0; -@@ -216,21 +237,8 @@ static int out(struct sm_metadata *smm) - return -ENOMEM; - } - -- if (smm->recursion_count == 1) { -- while (!brb_empty(&smm->uncommitted)) { -- struct block_op bop; -- -- r = brb_pop(&smm->uncommitted, &bop); -- if (r) { -- DMERR("bug in bop ring buffer"); -- break; -- } -- -- r = commit_bop(smm, &bop); -- if (r) -- break; -- } -- } -+ if (smm->recursion_count == 1) -+ apply_bops(smm); - - smm->recursion_count--; - -@@ -702,6 +710,12 @@ static int sm_metadata_extend(struct dm_space_map *sm, dm_block_t extra_blocks) - } - old_len = smm->begin; - -+ r = apply_bops(smm); -+ if (r) { -+ DMERR("%s: apply_bops failed", __func__); -+ goto out; -+ } -+ - r = sm_ll_commit(&smm->ll); - if (r) - goto out; -@@ -771,6 +785,12 @@ int dm_sm_metadata_create(struct dm_space_map *sm, - if (r) - return r; - -+ r = apply_bops(smm); -+ if (r) { -+ DMERR("%s: apply_bops failed", __func__); -+ return r; -+ } -+ - return sm_metadata_commit(sm); - } - -diff --git a/drivers/media/dvb-frontends/af9013.c b/drivers/media/dvb-frontends/af9013.c -index fb504f1..5930aee 100644 ---- a/drivers/media/dvb-frontends/af9013.c -+++ b/drivers/media/dvb-frontends/af9013.c -@@ -606,6 +606,10 @@ static int af9013_set_frontend(struct dvb_frontend *fe) - } - } - -+ /* Return an error if can't find bandwidth or the right clock */ -+ if (i == ARRAY_SIZE(coeff_lut)) -+ return -EINVAL; -+ - ret = af9013_wr_regs(state, 0xae00, coeff_lut[i].val, - sizeof(coeff_lut[i].val)); - } -diff --git a/drivers/media/dvb-frontends/cx24116.c b/drivers/media/dvb-frontends/cx24116.c -index 2916d7c..7bc68b3 100644 ---- a/drivers/media/dvb-frontends/cx24116.c -+++ b/drivers/media/dvb-frontends/cx24116.c -@@ -963,6 +963,10 @@ static int cx24116_send_diseqc_msg(struct dvb_frontend *fe, - struct cx24116_state *state = fe->demodulator_priv; - int i, ret; - -+ /* Validate length */ -+ if (d->msg_len > sizeof(d->msg)) -+ return -EINVAL; -+ - /* Dump DiSEqC message */ - if (debug) { - printk(KERN_INFO "cx24116: %s(", __func__); -@@ -974,10 +978,6 @@ static int cx24116_send_diseqc_msg(struct dvb_frontend *fe, - printk(") toneburst=%d\n", toneburst); - } - -- /* Validate length */ -- if (d->msg_len > (CX24116_ARGLEN - CX24116_DISEQC_MSGOFS)) -- return -EINVAL; -- - /* DiSEqC message */ - for (i = 0; i < d->msg_len; i++) - state->dsec_cmd.args[CX24116_DISEQC_MSGOFS + i] = d->msg[i]; -diff --git a/drivers/media/dvb-frontends/cx24117.c b/drivers/media/dvb-frontends/cx24117.c -index a6c3c9e..d2eab06 100644 ---- a/drivers/media/dvb-frontends/cx24117.c -+++ b/drivers/media/dvb-frontends/cx24117.c -@@ -1043,7 +1043,7 @@ static int cx24117_send_diseqc_msg(struct dvb_frontend *fe, - dev_dbg(&state->priv->i2c->dev, ")\n"); - - /* Validate length */ -- if (d->msg_len > 15) -+ if (d->msg_len > sizeof(d->msg)) - return -EINVAL; - - /* DiSEqC message */ -diff --git a/drivers/media/dvb-frontends/s5h1420.c b/drivers/media/dvb-frontends/s5h1420.c -index 93eeaf7..0b4f8fe 100644 ---- a/drivers/media/dvb-frontends/s5h1420.c -+++ b/drivers/media/dvb-frontends/s5h1420.c -@@ -180,7 +180,7 @@ static int s5h1420_send_master_cmd (struct dvb_frontend* fe, - int result = 0; - - dprintk("enter %s\n", __func__); -- if (cmd->msg_len > 8) -+ if (cmd->msg_len > sizeof(cmd->msg)) - return -EINVAL; - - /* setup for DISEQC */ -diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c -index b1e21fc..d71f5ef 100644 ---- a/drivers/mmc/card/block.c -+++ b/drivers/mmc/card/block.c -@@ -205,6 +205,8 @@ static ssize_t power_ro_lock_show(struct device *dev, - - ret = snprintf(buf, PAGE_SIZE, "%d\n", locked); - -+ mmc_blk_put(md); -+ - return ret; - } - -@@ -1861,9 +1863,11 @@ static int mmc_blk_issue_rw_rq(struct mmc_queue *mq, struct request *rqc) - break; - case MMC_BLK_CMD_ERR: - ret = mmc_blk_cmd_err(md, card, brq, req, ret); -- if (!mmc_blk_reset(md, card->host, type)) -- break; -- goto cmd_abort; -+ if (mmc_blk_reset(md, card->host, type)) -+ goto cmd_abort; -+ if (!ret) -+ goto start_new_req; -+ break; - case MMC_BLK_RETRY: - if (retry++ < 5) - break; -diff --git a/drivers/mtd/maps/dc21285.c b/drivers/mtd/maps/dc21285.c -index f8a7dd1..70a3db3 100644 ---- a/drivers/mtd/maps/dc21285.c -+++ b/drivers/mtd/maps/dc21285.c -@@ -38,9 +38,9 @@ static void nw_en_write(void) - * we want to write a bit pattern XXX1 to Xilinx to enable - * the write gate, which will be open for about the next 2ms. - */ -- spin_lock_irqsave(&nw_gpio_lock, flags); -+ raw_spin_lock_irqsave(&nw_gpio_lock, flags); - nw_cpld_modify(CPLD_FLASH_WR_ENABLE, CPLD_FLASH_WR_ENABLE); -- spin_unlock_irqrestore(&nw_gpio_lock, flags); -+ raw_spin_unlock_irqrestore(&nw_gpio_lock, flags); - - /* - * let the ISA bus to catch on... -diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c -index 5073cbc..32d5e40 100644 ---- a/drivers/mtd/mtd_blkdevs.c -+++ b/drivers/mtd/mtd_blkdevs.c -@@ -199,6 +199,7 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode) - return -ERESTARTSYS; /* FIXME: busy loop! -arnd*/ - - mutex_lock(&dev->lock); -+ mutex_lock(&mtd_table_mutex); - - if (dev->open) - goto unlock; -@@ -222,6 +223,7 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode) - - unlock: - dev->open++; -+ mutex_unlock(&mtd_table_mutex); - mutex_unlock(&dev->lock); - blktrans_dev_put(dev); - return ret; -@@ -232,6 +234,7 @@ error_release: - error_put: - module_put(dev->tr->owner); - kref_put(&dev->ref, blktrans_dev_release); -+ mutex_unlock(&mtd_table_mutex); - mutex_unlock(&dev->lock); - blktrans_dev_put(dev); - return ret; -@@ -245,6 +248,7 @@ static void blktrans_release(struct gendisk *disk, fmode_t mode) - return; - - mutex_lock(&dev->lock); -+ mutex_lock(&mtd_table_mutex); - - if (--dev->open) - goto unlock; -@@ -258,6 +262,7 @@ static void blktrans_release(struct gendisk *disk, fmode_t mode) - __put_mtd_device(dev->mtd); - } - unlock: -+ mutex_unlock(&mtd_table_mutex); - mutex_unlock(&dev->lock); - blktrans_dev_put(dev); - } -diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c -index 9715a7b..efc542d 100644 ---- a/drivers/mtd/nand/nand_base.c -+++ b/drivers/mtd/nand/nand_base.c -@@ -2000,7 +2000,7 @@ static int nand_write_page_raw_syndrome(struct mtd_info *mtd, - oob += chip->ecc.prepad; - } - -- chip->read_buf(mtd, oob, eccbytes); -+ chip->write_buf(mtd, oob, eccbytes); - oob += eccbytes; - - if (chip->ecc.postpad) { -@@ -3063,7 +3063,7 @@ static int nand_flash_detect_onfi(struct mtd_info *mtd, struct nand_chip *chip, - int *busw) - { - struct nand_onfi_params *p = &chip->onfi_params; -- int i; -+ int i, j; - int val; - - /* Try ONFI for unknown chip or LP */ -@@ -3072,18 +3072,10 @@ static int nand_flash_detect_onfi(struct mtd_info *mtd, struct nand_chip *chip, - chip->read_byte(mtd) != 'F' || chip->read_byte(mtd) != 'I') - return 0; - -- /* -- * ONFI must be probed in 8-bit mode or with NAND_BUSWIDTH_AUTO, not -- * with NAND_BUSWIDTH_16 -- */ -- if (chip->options & NAND_BUSWIDTH_16) { -- pr_err("ONFI cannot be probed in 16-bit mode; aborting\n"); -- return 0; -- } -- - chip->cmdfunc(mtd, NAND_CMD_PARAM, 0, -1); - for (i = 0; i < 3; i++) { -- chip->read_buf(mtd, (uint8_t *)p, sizeof(*p)); -+ for (j = 0; j < sizeof(*p); j++) -+ ((uint8_t *)p)[j] = chip->read_byte(mtd); - if (onfi_crc16(ONFI_CRC_BASE, (uint8_t *)p, 254) == - le16_to_cpu(p->crc)) { - break; -diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c -index 5924f72..f35ce8e 100644 ---- a/drivers/net/wireless/ath/ath9k/main.c -+++ b/drivers/net/wireless/ath/ath9k/main.c -@@ -205,11 +205,13 @@ static bool ath_prepare_reset(struct ath_softc *sc) - ath_stop_ani(sc); - ath9k_hw_disable_interrupts(ah); - -- if (!ath_drain_all_txq(sc)) -- ret = false; -- -- if (!ath_stoprecv(sc)) -- ret = false; -+ if (AR_SREV_9300_20_OR_LATER(ah)) { -+ ret &= ath_stoprecv(sc); -+ ret &= ath_drain_all_txq(sc); -+ } else { -+ ret &= ath_drain_all_txq(sc); -+ ret &= ath_stoprecv(sc); -+ } - - return ret; - } -diff --git a/drivers/of/base.c b/drivers/of/base.c -index 3935614..e99f329 100644 ---- a/drivers/of/base.c -+++ b/drivers/of/base.c -@@ -77,7 +77,7 @@ EXPORT_SYMBOL(of_n_size_cells); - #ifdef CONFIG_NUMA - int __weak of_node_to_nid(struct device_node *np) - { -- return numa_node_id(); -+ return NUMA_NO_NODE; - } - #endif - -diff --git a/drivers/pcmcia/topic.h b/drivers/pcmcia/topic.h -index 615a45a..582688fe 100644 ---- a/drivers/pcmcia/topic.h -+++ b/drivers/pcmcia/topic.h -@@ -104,6 +104,9 @@ - #define TOPIC_EXCA_IF_CONTROL 0x3e /* 8 bit */ - #define TOPIC_EXCA_IFC_33V_ENA 0x01 - -+#define TOPIC_PCI_CFG_PPBCN 0x3e /* 16-bit */ -+#define TOPIC_PCI_CFG_PPBCN_WBEN 0x0400 -+ - static void topic97_zoom_video(struct pcmcia_socket *sock, int onoff) - { - struct yenta_socket *socket = container_of(sock, struct yenta_socket, socket); -@@ -138,6 +141,7 @@ static int topic97_override(struct yenta_socket *socket) - static int topic95_override(struct yenta_socket *socket) - { - u8 fctrl; -+ u16 ppbcn; - - /* enable 3.3V support for 16bit cards */ - fctrl = exca_readb(socket, TOPIC_EXCA_IF_CONTROL); -@@ -146,6 +150,18 @@ static int topic95_override(struct yenta_socket *socket) - /* tell yenta to use exca registers to power 16bit cards */ - socket->flags |= YENTA_16BIT_POWER_EXCA | YENTA_16BIT_POWER_DF; - -+ /* Disable write buffers to prevent lockups under load with numerous -+ Cardbus cards, observed on Tecra 500CDT and reported elsewhere on the -+ net. This is not a power-on default according to the datasheet -+ but some BIOSes seem to set it. */ -+ if (pci_read_config_word(socket->dev, TOPIC_PCI_CFG_PPBCN, &ppbcn) == 0 -+ && socket->dev->revision <= 7 -+ && (ppbcn & TOPIC_PCI_CFG_PPBCN_WBEN)) { -+ ppbcn &= ~TOPIC_PCI_CFG_PPBCN_WBEN; -+ pci_write_config_word(socket->dev, TOPIC_PCI_CFG_PPBCN, ppbcn); -+ dev_info(&socket->dev->dev, "Disabled ToPIC95 Cardbus write buffers.\n"); -+ } -+ - return 0; - } - -diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-370.c b/drivers/pinctrl/mvebu/pinctrl-armada-370.c -index ae1f760..bb525b1 100644 ---- a/drivers/pinctrl/mvebu/pinctrl-armada-370.c -+++ b/drivers/pinctrl/mvebu/pinctrl-armada-370.c -@@ -358,11 +358,11 @@ static struct mvebu_mpp_mode mv88f6710_mpp_modes[] = { - MPP_MODE(64, - MPP_FUNCTION(0x0, "gpio", NULL), - MPP_FUNCTION(0x1, "spi0", "miso"), -- MPP_FUNCTION(0x2, "spi0-1", "cs1")), -+ MPP_FUNCTION(0x2, "spi0", "cs1")), - MPP_MODE(65, - MPP_FUNCTION(0x0, "gpio", NULL), - MPP_FUNCTION(0x1, "spi0", "mosi"), -- MPP_FUNCTION(0x2, "spi0-1", "cs2")), -+ MPP_FUNCTION(0x2, "spi0", "cs2")), - }; - - static struct mvebu_pinctrl_soc_info armada_370_pinctrl_info; -diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-xp.c b/drivers/pinctrl/mvebu/pinctrl-armada-xp.c -index 843a51f..d918c51 100644 ---- a/drivers/pinctrl/mvebu/pinctrl-armada-xp.c -+++ b/drivers/pinctrl/mvebu/pinctrl-armada-xp.c -@@ -14,10 +14,7 @@ - * available: mv78230, mv78260 and mv78460. From a pin muxing - * perspective, the mv78230 has 49 MPP pins. The mv78260 and mv78460 - * both have 67 MPP pins (more GPIOs and address lines for the memory -- * bus mainly). The only difference between the mv78260 and the -- * mv78460 in terms of pin muxing is the addition of two functions on -- * pins 43 and 56 to access the VDD of the CPU2 and 3 (mv78260 has two -- * cores, mv78460 has four cores). -+ * bus mainly). - */ - - #include <linux/err.h> -@@ -159,20 +156,17 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = { - MPP_MODE(24, - MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x1, "sata1", "prsnt", V_MV78230_PLUS), -- MPP_VAR_FUNCTION(0x2, "nf", "bootcs-re", V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x3, "tdm", "rst", V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x4, "lcd", "hsync", V_MV78230_PLUS)), - MPP_MODE(25, - MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x1, "sata0", "prsnt", V_MV78230_PLUS), -- MPP_VAR_FUNCTION(0x2, "nf", "bootcs-we", V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x3, "tdm", "pclk", V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x4, "lcd", "vsync", V_MV78230_PLUS)), - MPP_MODE(26, - MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x3, "tdm", "fsync", V_MV78230_PLUS), -- MPP_VAR_FUNCTION(0x4, "lcd", "clk", V_MV78230_PLUS), -- MPP_VAR_FUNCTION(0x5, "vdd", "cpu1-pd", V_MV78230_PLUS)), -+ MPP_VAR_FUNCTION(0x4, "lcd", "clk", V_MV78230_PLUS)), - MPP_MODE(27, - MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x1, "ptp", "trig", V_MV78230_PLUS), -@@ -187,8 +181,7 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = { - MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x1, "ptp", "clk", V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x3, "tdm", "int0", V_MV78230_PLUS), -- MPP_VAR_FUNCTION(0x4, "lcd", "ref-clk", V_MV78230_PLUS), -- MPP_VAR_FUNCTION(0x5, "vdd", "cpu0-pd", V_MV78230_PLUS)), -+ MPP_VAR_FUNCTION(0x4, "lcd", "ref-clk", V_MV78230_PLUS)), - MPP_MODE(30, - MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x1, "sd0", "clk", V_MV78230_PLUS), -@@ -196,13 +189,11 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = { - MPP_MODE(31, - MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x1, "sd0", "cmd", V_MV78230_PLUS), -- MPP_VAR_FUNCTION(0x3, "tdm", "int2", V_MV78230_PLUS), -- MPP_VAR_FUNCTION(0x5, "vdd", "cpu0-pd", V_MV78230_PLUS)), -+ MPP_VAR_FUNCTION(0x3, "tdm", "int2", V_MV78230_PLUS)), - MPP_MODE(32, - MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x1, "sd0", "d0", V_MV78230_PLUS), -- MPP_VAR_FUNCTION(0x3, "tdm", "int3", V_MV78230_PLUS), -- MPP_VAR_FUNCTION(0x5, "vdd", "cpu1-pd", V_MV78230_PLUS)), -+ MPP_VAR_FUNCTION(0x3, "tdm", "int3", V_MV78230_PLUS)), - MPP_MODE(33, - MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x1, "sd0", "d1", V_MV78230_PLUS), -@@ -234,7 +225,6 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = { - MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x1, "spi", "cs1", V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x2, "uart2", "cts", V_MV78230_PLUS), -- MPP_VAR_FUNCTION(0x3, "vdd", "cpu1-pd", V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x4, "lcd", "vga-hsync", V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x5, "pcie", "clkreq0", V_MV78230_PLUS)), - MPP_MODE(41, -@@ -249,15 +239,13 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = { - MPP_VAR_FUNCTION(0x1, "uart2", "rxd", V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x2, "uart0", "cts", V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x3, "tdm", "int7", V_MV78230_PLUS), -- MPP_VAR_FUNCTION(0x4, "tdm-1", "timer", V_MV78230_PLUS), -- MPP_VAR_FUNCTION(0x5, "vdd", "cpu0-pd", V_MV78230_PLUS)), -+ MPP_VAR_FUNCTION(0x4, "tdm-1", "timer", V_MV78230_PLUS)), - MPP_MODE(43, - MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x1, "uart2", "txd", V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x2, "uart0", "rts", V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x3, "spi", "cs3", V_MV78230_PLUS), -- MPP_VAR_FUNCTION(0x4, "pcie", "rstout", V_MV78230_PLUS), -- MPP_VAR_FUNCTION(0x5, "vdd", "cpu2-3-pd", V_MV78460)), -+ MPP_VAR_FUNCTION(0x4, "pcie", "rstout", V_MV78230_PLUS)), - MPP_MODE(44, - MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x1, "uart2", "cts", V_MV78230_PLUS), -@@ -286,7 +274,7 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = { - MPP_VAR_FUNCTION(0x5, "pcie", "clkreq3", V_MV78230_PLUS)), - MPP_MODE(48, - MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), -- MPP_VAR_FUNCTION(0x1, "tclk", NULL, V_MV78230_PLUS), -+ MPP_VAR_FUNCTION(0x1, "dev", "clkout", V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x2, "dev", "burst/last", V_MV78230_PLUS)), - MPP_MODE(49, - MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS), -@@ -308,16 +296,13 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = { - MPP_VAR_FUNCTION(0x1, "dev", "ad19", V_MV78260_PLUS)), - MPP_MODE(55, - MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS), -- MPP_VAR_FUNCTION(0x1, "dev", "ad20", V_MV78260_PLUS), -- MPP_VAR_FUNCTION(0x2, "vdd", "cpu0-pd", V_MV78260_PLUS)), -+ MPP_VAR_FUNCTION(0x1, "dev", "ad20", V_MV78260_PLUS)), - MPP_MODE(56, - MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS), -- MPP_VAR_FUNCTION(0x1, "dev", "ad21", V_MV78260_PLUS), -- MPP_VAR_FUNCTION(0x2, "vdd", "cpu1-pd", V_MV78260_PLUS)), -+ MPP_VAR_FUNCTION(0x1, "dev", "ad21", V_MV78260_PLUS)), - MPP_MODE(57, - MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS), -- MPP_VAR_FUNCTION(0x1, "dev", "ad22", V_MV78260_PLUS), -- MPP_VAR_FUNCTION(0x2, "vdd", "cpu2-3-pd", V_MV78460)), -+ MPP_VAR_FUNCTION(0x1, "dev", "ad22", V_MV78260_PLUS)), - MPP_MODE(58, - MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS), - MPP_VAR_FUNCTION(0x1, "dev", "ad23", V_MV78260_PLUS)), -diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c -index fed4111..1beb232 100644 ---- a/drivers/platform/x86/dell-laptop.c -+++ b/drivers/platform/x86/dell-laptop.c -@@ -272,7 +272,6 @@ static struct dmi_system_id dell_quirks[] = { - }; - - static struct calling_interface_buffer *buffer; --static struct page *bufferpage; - static DEFINE_MUTEX(buffer_mutex); - - static int hwswitch_state; -@@ -825,12 +824,11 @@ static int __init dell_init(void) - * Allocate buffer below 4GB for SMI data--only 32-bit physical addr - * is passed to SMI handler. - */ -- bufferpage = alloc_page(GFP_KERNEL | GFP_DMA32); -- if (!bufferpage) { -+ buffer = (void *)__get_free_page(GFP_KERNEL | GFP_DMA32); -+ if (!buffer) { - ret = -ENOMEM; - goto fail_buffer; - } -- buffer = page_address(bufferpage); - - ret = dell_setup_rfkill(); - -@@ -892,7 +890,7 @@ fail_backlight: - cancel_delayed_work_sync(&dell_rfkill_work); - dell_cleanup_rfkill(); - fail_rfkill: -- free_page((unsigned long)bufferpage); -+ free_page((unsigned long)buffer); - fail_buffer: - platform_device_del(platform_device); - fail_platform_device2: -diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c -index 6dd060a..0d1a5d4 100644 ---- a/drivers/platform/x86/ideapad-laptop.c -+++ b/drivers/platform/x86/ideapad-laptop.c -@@ -461,8 +461,9 @@ const struct ideapad_rfk_data ideapad_rfk_data[] = { - static int ideapad_rfk_set(void *data, bool blocked) - { - struct ideapad_rfk_priv *priv = data; -+ int opcode = ideapad_rfk_data[priv->dev].opcode; - -- return write_ec_cmd(priv->priv->adev->handle, priv->dev, !blocked); -+ return write_ec_cmd(priv->priv->adev->handle, opcode, !blocked); - } - - static struct rfkill_ops ideapad_rfk_ops = { -diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c -index 5d8d2dc..427cb62 100644 ---- a/drivers/regulator/core.c -+++ b/drivers/regulator/core.c -@@ -773,7 +773,7 @@ static int suspend_prepare(struct regulator_dev *rdev, suspend_state_t state) - static void print_constraints(struct regulator_dev *rdev) - { - struct regulation_constraints *constraints = rdev->constraints; -- char buf[80] = ""; -+ char buf[160] = ""; - int count = 0; - int ret; - -diff --git a/drivers/scsi/ipr.h b/drivers/scsi/ipr.h -index 0801f3d..02edae7 100644 ---- a/drivers/scsi/ipr.h -+++ b/drivers/scsi/ipr.h -@@ -264,7 +264,7 @@ - #define IPR_RUNTIME_RESET 0x40000000 - - #define IPR_IPL_INIT_MIN_STAGE_TIME 5 --#define IPR_IPL_INIT_DEFAULT_STAGE_TIME 15 -+#define IPR_IPL_INIT_DEFAULT_STAGE_TIME 30 - #define IPR_IPL_INIT_STAGE_UNKNOWN 0x0 - #define IPR_IPL_INIT_STAGE_TRANSOP 0xB0000000 - #define IPR_IPL_INIT_STAGE_MASK 0xff000000 -diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c -index 0a1dcb4..13f4bef 100644 ---- a/drivers/scsi/qla2xxx/qla_isr.c -+++ b/drivers/scsi/qla2xxx/qla_isr.c -@@ -572,8 +572,9 @@ qla2x00_async_event(scsi_qla_host_t *vha, struct rsp_que *rsp, uint16_t *mb) - struct device_reg_2xxx __iomem *reg = &ha->iobase->isp; - struct device_reg_24xx __iomem *reg24 = &ha->iobase->isp24; - struct device_reg_82xx __iomem *reg82 = &ha->iobase->isp82; -- uint32_t rscn_entry, host_pid; -+ uint32_t rscn_entry, host_pid, tmp_pid; - unsigned long flags; -+ fc_port_t *fcport = NULL; - - /* Setup to process RIO completion. */ - handle_cnt = 0; -@@ -968,6 +969,20 @@ skip_rio: - if (qla2x00_is_a_vp_did(vha, rscn_entry)) - break; - -+ /* -+ * Search for the rport related to this RSCN entry and mark it -+ * as lost. -+ */ -+ list_for_each_entry(fcport, &vha->vp_fcports, list) { -+ if (atomic_read(&fcport->state) != FCS_ONLINE) -+ continue; -+ tmp_pid = fcport->d_id.b24; -+ if (fcport->d_id.b24 == rscn_entry) { -+ qla2x00_mark_device_lost(vha, fcport, 0, 0); -+ break; -+ } -+ } -+ - atomic_set(&vha->loop_down_timer, 0); - vha->flags.management_server_logged_in = 0; - -diff --git a/drivers/scsi/scsi_transport_srp.c b/drivers/scsi/scsi_transport_srp.c -index e3e794e..b85eaa0 100644 ---- a/drivers/scsi/scsi_transport_srp.c -+++ b/drivers/scsi/scsi_transport_srp.c -@@ -397,6 +397,36 @@ static void srp_reconnect_work(struct work_struct *work) - } - } - -+/** -+ * scsi_request_fn_active() - number of kernel threads inside scsi_request_fn() -+ * @shost: SCSI host for which to count the number of scsi_request_fn() callers. -+ * -+ * To do: add support for scsi-mq in this function. -+ */ -+static int scsi_request_fn_active(struct Scsi_Host *shost) -+{ -+ struct scsi_device *sdev; -+ struct request_queue *q; -+ int request_fn_active = 0; -+ -+ shost_for_each_device(sdev, shost) { -+ q = sdev->request_queue; -+ -+ spin_lock_irq(q->queue_lock); -+ request_fn_active += q->request_fn_active; -+ spin_unlock_irq(q->queue_lock); -+ } -+ -+ return request_fn_active; -+} -+ -+/* Wait until ongoing shost->hostt->queuecommand() calls have finished. */ -+static void srp_wait_for_queuecommand(struct Scsi_Host *shost) -+{ -+ while (scsi_request_fn_active(shost)) -+ msleep(20); -+} -+ - static void __rport_fail_io_fast(struct srp_rport *rport) - { - struct Scsi_Host *shost = rport_to_shost(rport); -@@ -410,8 +440,10 @@ static void __rport_fail_io_fast(struct srp_rport *rport) - - /* Involve the LLD if possible to terminate all I/O on the rport. */ - i = to_srp_internal(shost->transportt); -- if (i->f->terminate_rport_io) -+ if (i->f->terminate_rport_io) { -+ srp_wait_for_queuecommand(shost); - i->f->terminate_rport_io(rport); -+ } - } - - /** -@@ -505,27 +537,6 @@ void srp_start_tl_fail_timers(struct srp_rport *rport) - EXPORT_SYMBOL(srp_start_tl_fail_timers); - - /** -- * scsi_request_fn_active() - number of kernel threads inside scsi_request_fn() -- * @shost: SCSI host for which to count the number of scsi_request_fn() callers. -- */ --static int scsi_request_fn_active(struct Scsi_Host *shost) --{ -- struct scsi_device *sdev; -- struct request_queue *q; -- int request_fn_active = 0; -- -- shost_for_each_device(sdev, shost) { -- q = sdev->request_queue; -- -- spin_lock_irq(q->queue_lock); -- request_fn_active += q->request_fn_active; -- spin_unlock_irq(q->queue_lock); -- } -- -- return request_fn_active; --} -- --/** - * srp_reconnect_rport() - reconnect to an SRP target port - * @rport: SRP target port. - * -@@ -560,8 +571,7 @@ int srp_reconnect_rport(struct srp_rport *rport) - if (res) - goto out; - scsi_target_block(&shost->shost_gendev); -- while (scsi_request_fn_active(shost)) -- msleep(20); -+ srp_wait_for_queuecommand(shost); - res = rport->state != SRP_RPORT_LOST ? i->f->reconnect(rport) : -ENODEV; - pr_debug("%s (state %d): transport.reconnect() returned %d\n", - dev_name(&shost->shost_gendev), rport->state, res); -diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c -index d6563ec..f3e3ae8 100644 ---- a/drivers/spi/spi.c -+++ b/drivers/spi/spi.c -@@ -834,9 +834,6 @@ void spi_finalize_current_message(struct spi_master *master) - - spin_lock_irqsave(&master->queue_lock, flags); - mesg = master->cur_msg; -- master->cur_msg = NULL; -- -- queue_kthread_work(&master->kworker, &master->pump_messages); - spin_unlock_irqrestore(&master->queue_lock, flags); - - if (master->cur_msg_prepared && master->unprepare_message) { -@@ -847,9 +844,13 @@ void spi_finalize_current_message(struct spi_master *master) - } - } - -- trace_spi_message_done(mesg); -- -+ spin_lock_irqsave(&master->queue_lock, flags); -+ master->cur_msg = NULL; - master->cur_msg_prepared = false; -+ queue_kthread_work(&master->kworker, &master->pump_messages); -+ spin_unlock_irqrestore(&master->queue_lock, flags); -+ -+ trace_spi_message_done(mesg); - - mesg->state = NULL; - if (mesg->complete) -diff --git a/drivers/staging/rtl8712/rtl8712_recv.c b/drivers/staging/rtl8712/rtl8712_recv.c -index ea96537..d060b1f 100644 ---- a/drivers/staging/rtl8712/rtl8712_recv.c -+++ b/drivers/staging/rtl8712/rtl8712_recv.c -@@ -1075,7 +1075,8 @@ static int recvbuf2recvframe(struct _adapter *padapter, struct sk_buff *pskb) - /* for first fragment packet, driver need allocate 1536 + - * drvinfo_sz + RXDESC_SIZE to defrag packet. */ - if ((mf == 1) && (frag == 0)) -- alloc_sz = 1658;/*1658+6=1664, 1664 is 128 alignment.*/ -+ /*1658+6=1664, 1664 is 128 alignment.*/ -+ alloc_sz = max_t(u16, tmp_len, 1658); - else - alloc_sz = tmp_len; - /* 2 is for IP header 4 bytes alignment in QoS packet case. -diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c -index b61c555..c8d7b30 100644 ---- a/drivers/target/iscsi/iscsi_target.c -+++ b/drivers/target/iscsi/iscsi_target.c -@@ -518,7 +518,7 @@ static struct iscsit_transport iscsi_target_transport = { - - static int __init iscsi_target_init_module(void) - { -- int ret = 0; -+ int ret = 0, size; - - pr_debug("iSCSI-Target "ISCSIT_VERSION"\n"); - -@@ -527,6 +527,7 @@ static int __init iscsi_target_init_module(void) - pr_err("Unable to allocate memory for iscsit_global\n"); - return -1; - } -+ spin_lock_init(&iscsit_global->ts_bitmap_lock); - mutex_init(&auth_id_lock); - spin_lock_init(&sess_idr_lock); - idr_init(&tiqn_idr); -@@ -536,15 +537,11 @@ static int __init iscsi_target_init_module(void) - if (ret < 0) - goto out; - -- ret = iscsi_thread_set_init(); -- if (ret < 0) -+ size = BITS_TO_LONGS(ISCSIT_BITMAP_BITS) * sizeof(long); -+ iscsit_global->ts_bitmap = vzalloc(size); -+ if (!iscsit_global->ts_bitmap) { -+ pr_err("Unable to allocate iscsit_global->ts_bitmap\n"); - goto configfs_out; -- -- if (iscsi_allocate_thread_sets(TARGET_THREAD_SET_COUNT) != -- TARGET_THREAD_SET_COUNT) { -- pr_err("iscsi_allocate_thread_sets() returned" -- " unexpected value!\n"); -- goto ts_out1; - } - - lio_qr_cache = kmem_cache_create("lio_qr_cache", -@@ -553,7 +550,7 @@ static int __init iscsi_target_init_module(void) - if (!lio_qr_cache) { - pr_err("nable to kmem_cache_create() for" - " lio_qr_cache\n"); -- goto ts_out2; -+ goto bitmap_out; - } - - lio_dr_cache = kmem_cache_create("lio_dr_cache", -@@ -597,10 +594,8 @@ dr_out: - kmem_cache_destroy(lio_dr_cache); - qr_out: - kmem_cache_destroy(lio_qr_cache); --ts_out2: -- iscsi_deallocate_thread_sets(); --ts_out1: -- iscsi_thread_set_free(); -+bitmap_out: -+ vfree(iscsit_global->ts_bitmap); - configfs_out: - iscsi_target_deregister_configfs(); - out: -@@ -610,8 +605,6 @@ out: - - static void __exit iscsi_target_cleanup_module(void) - { -- iscsi_deallocate_thread_sets(); -- iscsi_thread_set_free(); - iscsit_release_discovery_tpg(); - iscsit_unregister_transport(&iscsi_target_transport); - kmem_cache_destroy(lio_qr_cache); -@@ -621,6 +614,7 @@ static void __exit iscsi_target_cleanup_module(void) - - iscsi_target_deregister_configfs(); - -+ vfree(iscsit_global->ts_bitmap); - kfree(iscsit_global); - } - -@@ -3653,17 +3647,16 @@ static int iscsit_send_reject( - - void iscsit_thread_get_cpumask(struct iscsi_conn *conn) - { -- struct iscsi_thread_set *ts = conn->thread_set; - int ord, cpu; - /* -- * thread_id is assigned from iscsit_global->ts_bitmap from -- * within iscsi_thread_set.c:iscsi_allocate_thread_sets() -+ * bitmap_id is assigned from iscsit_global->ts_bitmap from -+ * within iscsit_start_kthreads() - * -- * Here we use thread_id to determine which CPU that this -- * iSCSI connection's iscsi_thread_set will be scheduled to -+ * Here we use bitmap_id to determine which CPU that this -+ * iSCSI connection's RX/TX threads will be scheduled to - * execute upon. - */ -- ord = ts->thread_id % cpumask_weight(cpu_online_mask); -+ ord = conn->bitmap_id % cpumask_weight(cpu_online_mask); - for_each_online_cpu(cpu) { - if (ord-- == 0) { - cpumask_set_cpu(cpu, conn->conn_cpumask); -@@ -3855,7 +3848,7 @@ check_rsp_state: - switch (state) { - case ISTATE_SEND_LOGOUTRSP: - if (!iscsit_logout_post_handler(cmd, conn)) -- goto restart; -+ return -ECONNRESET; - /* fall through */ - case ISTATE_SEND_STATUS: - case ISTATE_SEND_ASYNCMSG: -@@ -3883,8 +3876,6 @@ check_rsp_state: - - err: - return -1; --restart: -- return -EAGAIN; - } - - static int iscsit_handle_response_queue(struct iscsi_conn *conn) -@@ -3911,21 +3902,13 @@ static int iscsit_handle_response_queue(struct iscsi_conn *conn) - int iscsi_target_tx_thread(void *arg) - { - int ret = 0; -- struct iscsi_conn *conn; -- struct iscsi_thread_set *ts = arg; -+ struct iscsi_conn *conn = arg; - /* - * Allow ourselves to be interrupted by SIGINT so that a - * connection recovery / failure event can be triggered externally. - */ - allow_signal(SIGINT); - --restart: -- conn = iscsi_tx_thread_pre_handler(ts); -- if (!conn) -- goto out; -- -- ret = 0; -- - while (!kthread_should_stop()) { - /* - * Ensure that both TX and RX per connection kthreads -@@ -3934,11 +3917,9 @@ restart: - iscsit_thread_check_cpumask(conn, current, 1); - - wait_event_interruptible(conn->queues_wq, -- !iscsit_conn_all_queues_empty(conn) || -- ts->status == ISCSI_THREAD_SET_RESET); -+ !iscsit_conn_all_queues_empty(conn)); - -- if ((ts->status == ISCSI_THREAD_SET_RESET) || -- signal_pending(current)) -+ if (signal_pending(current)) - goto transport_err; - - get_immediate: -@@ -3949,15 +3930,14 @@ get_immediate: - ret = iscsit_handle_response_queue(conn); - if (ret == 1) - goto get_immediate; -- else if (ret == -EAGAIN) -- goto restart; -+ else if (ret == -ECONNRESET) -+ goto out; - else if (ret < 0) - goto transport_err; - } - - transport_err: - iscsit_take_action_for_connection_exit(conn); -- goto restart; - out: - return 0; - } -@@ -4046,8 +4026,7 @@ int iscsi_target_rx_thread(void *arg) - int ret; - u8 buffer[ISCSI_HDR_LEN], opcode; - u32 checksum = 0, digest = 0; -- struct iscsi_conn *conn = NULL; -- struct iscsi_thread_set *ts = arg; -+ struct iscsi_conn *conn = arg; - struct kvec iov; - /* - * Allow ourselves to be interrupted by SIGINT so that a -@@ -4055,11 +4034,6 @@ int iscsi_target_rx_thread(void *arg) - */ - allow_signal(SIGINT); - --restart: -- conn = iscsi_rx_thread_pre_handler(ts); -- if (!conn) -- goto out; -- - if (conn->conn_transport->transport_type == ISCSI_INFINIBAND) { - struct completion comp; - int rc; -@@ -4069,7 +4043,7 @@ restart: - if (rc < 0) - goto transport_err; - -- goto out; -+ goto transport_err; - } - - while (!kthread_should_stop()) { -@@ -4145,8 +4119,6 @@ transport_err: - if (!signal_pending(current)) - atomic_set(&conn->transport_failed, 1); - iscsit_take_action_for_connection_exit(conn); -- goto restart; --out: - return 0; - } - -@@ -4208,7 +4180,24 @@ int iscsit_close_connection( - if (conn->conn_transport->transport_type == ISCSI_TCP) - complete(&conn->conn_logout_comp); - -- iscsi_release_thread_set(conn); -+ if (!strcmp(current->comm, ISCSI_RX_THREAD_NAME)) { -+ if (conn->tx_thread && -+ cmpxchg(&conn->tx_thread_active, true, false)) { -+ send_sig(SIGINT, conn->tx_thread, 1); -+ kthread_stop(conn->tx_thread); -+ } -+ } else if (!strcmp(current->comm, ISCSI_TX_THREAD_NAME)) { -+ if (conn->rx_thread && -+ cmpxchg(&conn->rx_thread_active, true, false)) { -+ send_sig(SIGINT, conn->rx_thread, 1); -+ kthread_stop(conn->rx_thread); -+ } -+ } -+ -+ spin_lock(&iscsit_global->ts_bitmap_lock); -+ bitmap_release_region(iscsit_global->ts_bitmap, conn->bitmap_id, -+ get_order(1)); -+ spin_unlock(&iscsit_global->ts_bitmap_lock); - - iscsit_stop_timers_for_cmds(conn); - iscsit_stop_nopin_response_timer(conn); -@@ -4487,15 +4476,13 @@ static void iscsit_logout_post_handler_closesession( - struct iscsi_conn *conn) - { - struct iscsi_session *sess = conn->sess; -- -- iscsi_set_thread_clear(conn, ISCSI_CLEAR_TX_THREAD); -- iscsi_set_thread_set_signal(conn, ISCSI_SIGNAL_TX_THREAD); -+ int sleep = cmpxchg(&conn->tx_thread_active, true, false); - - atomic_set(&conn->conn_logout_remove, 0); - complete(&conn->conn_logout_comp); - - iscsit_dec_conn_usage_count(conn); -- iscsit_stop_session(sess, 1, 1); -+ iscsit_stop_session(sess, sleep, sleep); - iscsit_dec_session_usage_count(sess); - target_put_session(sess->se_sess); - } -@@ -4503,13 +4490,12 @@ static void iscsit_logout_post_handler_closesession( - static void iscsit_logout_post_handler_samecid( - struct iscsi_conn *conn) - { -- iscsi_set_thread_clear(conn, ISCSI_CLEAR_TX_THREAD); -- iscsi_set_thread_set_signal(conn, ISCSI_SIGNAL_TX_THREAD); -+ int sleep = cmpxchg(&conn->tx_thread_active, true, false); - - atomic_set(&conn->conn_logout_remove, 0); - complete(&conn->conn_logout_comp); - -- iscsit_cause_connection_reinstatement(conn, 1); -+ iscsit_cause_connection_reinstatement(conn, sleep); - iscsit_dec_conn_usage_count(conn); - } - -diff --git a/drivers/target/iscsi/iscsi_target_core.h b/drivers/target/iscsi/iscsi_target_core.h -index 1d4a8c8..825b579 100644 ---- a/drivers/target/iscsi/iscsi_target_core.h -+++ b/drivers/target/iscsi/iscsi_target_core.h -@@ -601,6 +601,11 @@ struct iscsi_conn { - struct iscsi_session *sess; - /* Pointer to thread_set in use for this conn's threads */ - struct iscsi_thread_set *thread_set; -+ int bitmap_id; -+ int rx_thread_active; -+ struct task_struct *rx_thread; -+ int tx_thread_active; -+ struct task_struct *tx_thread; - /* list_head for session connection list */ - struct list_head conn_list; - } ____cacheline_aligned; -@@ -869,10 +874,12 @@ struct iscsit_global { - /* Unique identifier used for the authentication daemon */ - u32 auth_id; - u32 inactive_ts; -+#define ISCSIT_BITMAP_BITS 262144 - /* Thread Set bitmap count */ - int ts_bitmap_count; - /* Thread Set bitmap pointer */ - unsigned long *ts_bitmap; -+ spinlock_t ts_bitmap_lock; - /* Used for iSCSI discovery session authentication */ - struct iscsi_node_acl discovery_acl; - struct iscsi_portal_group *discovery_tpg; -diff --git a/drivers/target/iscsi/iscsi_target_erl0.c b/drivers/target/iscsi/iscsi_target_erl0.c -index 0d1e6ee..7396d90 100644 ---- a/drivers/target/iscsi/iscsi_target_erl0.c -+++ b/drivers/target/iscsi/iscsi_target_erl0.c -@@ -864,7 +864,10 @@ void iscsit_connection_reinstatement_rcfr(struct iscsi_conn *conn) - } - spin_unlock_bh(&conn->state_lock); - -- iscsi_thread_set_force_reinstatement(conn); -+ if (conn->tx_thread && conn->tx_thread_active) -+ send_sig(SIGINT, conn->tx_thread, 1); -+ if (conn->rx_thread && conn->rx_thread_active) -+ send_sig(SIGINT, conn->rx_thread, 1); - - sleep: - wait_for_completion(&conn->conn_wait_rcfr_comp); -@@ -889,10 +892,10 @@ void iscsit_cause_connection_reinstatement(struct iscsi_conn *conn, int sleep) - return; - } - -- if (iscsi_thread_set_force_reinstatement(conn) < 0) { -- spin_unlock_bh(&conn->state_lock); -- return; -- } -+ if (conn->tx_thread && conn->tx_thread_active) -+ send_sig(SIGINT, conn->tx_thread, 1); -+ if (conn->rx_thread && conn->rx_thread_active) -+ send_sig(SIGINT, conn->rx_thread, 1); - - atomic_set(&conn->connection_reinstatement, 1); - if (!sleep) { -diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c -index c5d3811..449df09 100644 ---- a/drivers/target/iscsi/iscsi_target_login.c -+++ b/drivers/target/iscsi/iscsi_target_login.c -@@ -681,6 +681,51 @@ static void iscsi_post_login_start_timers(struct iscsi_conn *conn) - iscsit_start_nopin_timer(conn); - } - -+int iscsit_start_kthreads(struct iscsi_conn *conn) -+{ -+ int ret = 0; -+ -+ spin_lock(&iscsit_global->ts_bitmap_lock); -+ conn->bitmap_id = bitmap_find_free_region(iscsit_global->ts_bitmap, -+ ISCSIT_BITMAP_BITS, get_order(1)); -+ spin_unlock(&iscsit_global->ts_bitmap_lock); -+ -+ if (conn->bitmap_id < 0) { -+ pr_err("bitmap_find_free_region() failed for" -+ " iscsit_start_kthreads()\n"); -+ return -ENOMEM; -+ } -+ -+ conn->tx_thread = kthread_run(iscsi_target_tx_thread, conn, -+ "%s", ISCSI_TX_THREAD_NAME); -+ if (IS_ERR(conn->tx_thread)) { -+ pr_err("Unable to start iscsi_target_tx_thread\n"); -+ ret = PTR_ERR(conn->tx_thread); -+ goto out_bitmap; -+ } -+ conn->tx_thread_active = true; -+ -+ conn->rx_thread = kthread_run(iscsi_target_rx_thread, conn, -+ "%s", ISCSI_RX_THREAD_NAME); -+ if (IS_ERR(conn->rx_thread)) { -+ pr_err("Unable to start iscsi_target_rx_thread\n"); -+ ret = PTR_ERR(conn->rx_thread); -+ goto out_tx; -+ } -+ conn->rx_thread_active = true; -+ -+ return 0; -+out_tx: -+ kthread_stop(conn->tx_thread); -+ conn->tx_thread_active = false; -+out_bitmap: -+ spin_lock(&iscsit_global->ts_bitmap_lock); -+ bitmap_release_region(iscsit_global->ts_bitmap, conn->bitmap_id, -+ get_order(1)); -+ spin_unlock(&iscsit_global->ts_bitmap_lock); -+ return ret; -+} -+ - int iscsi_post_login_handler( - struct iscsi_np *np, - struct iscsi_conn *conn, -@@ -691,7 +736,7 @@ int iscsi_post_login_handler( - struct se_session *se_sess = sess->se_sess; - struct iscsi_portal_group *tpg = sess->tpg; - struct se_portal_group *se_tpg = &tpg->tpg_se_tpg; -- struct iscsi_thread_set *ts; -+ int rc; - - iscsit_inc_conn_usage_count(conn); - -@@ -706,7 +751,6 @@ int iscsi_post_login_handler( - /* - * SCSI Initiator -> SCSI Target Port Mapping - */ -- ts = iscsi_get_thread_set(); - if (!zero_tsih) { - iscsi_set_session_parameters(sess->sess_ops, - conn->param_list, 0); -@@ -733,9 +777,11 @@ int iscsi_post_login_handler( - sess->sess_ops->InitiatorName); - spin_unlock_bh(&sess->conn_lock); - -- iscsi_post_login_start_timers(conn); -+ rc = iscsit_start_kthreads(conn); -+ if (rc) -+ return rc; - -- iscsi_activate_thread_set(conn, ts); -+ iscsi_post_login_start_timers(conn); - /* - * Determine CPU mask to ensure connection's RX and TX kthreads - * are scheduled on the same CPU. -@@ -792,8 +838,11 @@ int iscsi_post_login_handler( - " iSCSI Target Portal Group: %hu\n", tpg->nsessions, tpg->tpgt); - spin_unlock_bh(&se_tpg->session_lock); - -+ rc = iscsit_start_kthreads(conn); -+ if (rc) -+ return rc; -+ - iscsi_post_login_start_timers(conn); -- iscsi_activate_thread_set(conn, ts); - /* - * Determine CPU mask to ensure connection's RX and TX kthreads - * are scheduled on the same CPU. -diff --git a/drivers/thermal/step_wise.c b/drivers/thermal/step_wise.c -index ee52ab7..c501eba 100644 ---- a/drivers/thermal/step_wise.c -+++ b/drivers/thermal/step_wise.c -@@ -76,7 +76,7 @@ static unsigned long get_target_state(struct thermal_instance *instance, - next_target = instance->upper; - break; - case THERMAL_TREND_DROPPING: -- if (cur_state == instance->lower) { -+ if (cur_state <= instance->lower) { - if (!throttle) - next_target = THERMAL_NO_TARGET; - } else { -diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c -index 45b7b96..8016aaa 100644 ---- a/drivers/usb/core/devio.c -+++ b/drivers/usb/core/devio.c -@@ -513,7 +513,7 @@ static void async_completed(struct urb *urb) - snoop(&urb->dev->dev, "urb complete\n"); - snoop_urb(urb->dev, as->userurb, urb->pipe, urb->actual_length, - as->status, COMPLETE, NULL, 0); -- if ((urb->transfer_flags & URB_DIR_MASK) == USB_DIR_IN) -+ if ((urb->transfer_flags & URB_DIR_MASK) == URB_DIR_IN) - snoop_urb_data(urb, urb->actual_length); - - if (as->status < 0 && as->bulk_addr && as->status != -ECONNRESET && -@@ -1591,7 +1591,7 @@ static struct async *reap_as(struct dev_state *ps) - for (;;) { - __set_current_state(TASK_INTERRUPTIBLE); - as = async_getcompleted(ps); -- if (as) -+ if (as || !connected(ps)) - break; - if (signal_pending(current)) - break; -@@ -1614,7 +1614,7 @@ static int proc_reapurb(struct dev_state *ps, void __user *arg) - } - if (signal_pending(current)) - return -EINTR; -- return -EIO; -+ return -ENODEV; - } - - static int proc_reapurbnonblock(struct dev_state *ps, void __user *arg) -@@ -1623,10 +1623,11 @@ static int proc_reapurbnonblock(struct dev_state *ps, void __user *arg) - struct async *as; - - as = async_getcompleted(ps); -- retval = -EAGAIN; - if (as) { - retval = processcompl(as, (void __user * __user *)arg); - free_async(as); -+ } else { -+ retval = (connected(ps) ? -EAGAIN : -ENODEV); - } - return retval; - } -@@ -1756,7 +1757,7 @@ static int proc_reapurb_compat(struct dev_state *ps, void __user *arg) - } - if (signal_pending(current)) - return -EINTR; -- return -EIO; -+ return -ENODEV; - } - - static int proc_reapurbnonblock_compat(struct dev_state *ps, void __user *arg) -@@ -1764,11 +1765,12 @@ static int proc_reapurbnonblock_compat(struct dev_state *ps, void __user *arg) - int retval; - struct async *as; - -- retval = -EAGAIN; - as = async_getcompleted(ps); - if (as) { - retval = processcompl_compat(as, (void __user * __user *)arg); - free_async(as); -+ } else { -+ retval = (connected(ps) ? -EAGAIN : -ENODEV); - } - return retval; - } -@@ -1940,7 +1942,8 @@ static int proc_get_capabilities(struct dev_state *ps, void __user *arg) - { - __u32 caps; - -- caps = USBDEVFS_CAP_ZERO_PACKET | USBDEVFS_CAP_NO_PACKET_SIZE_LIM; -+ caps = USBDEVFS_CAP_ZERO_PACKET | USBDEVFS_CAP_NO_PACKET_SIZE_LIM | -+ USBDEVFS_CAP_REAP_AFTER_DISCONNECT; - if (!ps->dev->bus->no_stop_on_short) - caps |= USBDEVFS_CAP_BULK_CONTINUATION; - if (ps->dev->bus->sg_tablesize) -@@ -2001,6 +2004,32 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd, - return -EPERM; - - usb_lock_device(dev); -+ -+ /* Reap operations are allowed even after disconnection */ -+ switch (cmd) { -+ case USBDEVFS_REAPURB: -+ snoop(&dev->dev, "%s: REAPURB\n", __func__); -+ ret = proc_reapurb(ps, p); -+ goto done; -+ -+ case USBDEVFS_REAPURBNDELAY: -+ snoop(&dev->dev, "%s: REAPURBNDELAY\n", __func__); -+ ret = proc_reapurbnonblock(ps, p); -+ goto done; -+ -+#ifdef CONFIG_COMPAT -+ case USBDEVFS_REAPURB32: -+ snoop(&dev->dev, "%s: REAPURB32\n", __func__); -+ ret = proc_reapurb_compat(ps, p); -+ goto done; -+ -+ case USBDEVFS_REAPURBNDELAY32: -+ snoop(&dev->dev, "%s: REAPURBNDELAY32\n", __func__); -+ ret = proc_reapurbnonblock_compat(ps, p); -+ goto done; -+#endif -+ } -+ - if (!connected(ps)) { - usb_unlock_device(dev); - return -ENODEV; -@@ -2094,16 +2123,6 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd, - inode->i_mtime = CURRENT_TIME; - break; - -- case USBDEVFS_REAPURB32: -- snoop(&dev->dev, "%s: REAPURB32\n", __func__); -- ret = proc_reapurb_compat(ps, p); -- break; -- -- case USBDEVFS_REAPURBNDELAY32: -- snoop(&dev->dev, "%s: REAPURBNDELAY32\n", __func__); -- ret = proc_reapurbnonblock_compat(ps, p); -- break; -- - case USBDEVFS_IOCTL32: - snoop(&dev->dev, "%s: IOCTL32\n", __func__); - ret = proc_ioctl_compat(ps, ptr_to_compat(p)); -@@ -2115,16 +2134,6 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd, - ret = proc_unlinkurb(ps, p); - break; - -- case USBDEVFS_REAPURB: -- snoop(&dev->dev, "%s: REAPURB\n", __func__); -- ret = proc_reapurb(ps, p); -- break; -- -- case USBDEVFS_REAPURBNDELAY: -- snoop(&dev->dev, "%s: REAPURBNDELAY\n", __func__); -- ret = proc_reapurbnonblock(ps, p); -- break; -- - case USBDEVFS_DISCSIGNAL: - snoop(&dev->dev, "%s: DISCSIGNAL\n", __func__); - ret = proc_disconnectsignal(ps, p); -@@ -2161,6 +2170,8 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd, - ret = proc_disconnect_claim(ps, p); - break; - } -+ -+ done: - usb_unlock_device(dev); - if (ret >= 0) - inode->i_atime = CURRENT_TIME; -diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c -index 0985ff7..a05fc58 100644 ---- a/drivers/usb/dwc3/ep0.c -+++ b/drivers/usb/dwc3/ep0.c -@@ -707,6 +707,10 @@ static int dwc3_ep0_std_request(struct dwc3 *dwc, struct usb_ctrlrequest *ctrl) - dev_vdbg(dwc->dev, "USB_REQ_SET_ISOCH_DELAY\n"); - ret = dwc3_ep0_set_isoch_delay(dwc, ctrl); - break; -+ case USB_REQ_SET_INTERFACE: -+ dev_vdbg(dwc->dev, "USB_REQ_SET_INTERFACE\n"); -+ dwc->start_config_issued = false; -+ /* Fall through */ - default: - dev_vdbg(dwc->dev, "Forwarding to gadget driver\n"); - ret = dwc3_ep0_delegate_req(dwc, ctrl); -diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c -index 8f6738d..a57ad1f 100644 ---- a/drivers/usb/dwc3/gadget.c -+++ b/drivers/usb/dwc3/gadget.c -@@ -299,6 +299,8 @@ int dwc3_send_gadget_generic_command(struct dwc3 *dwc, int cmd, u32 param) - if (!(reg & DWC3_DGCMD_CMDACT)) { - dev_vdbg(dwc->dev, "Command Complete --> %d\n", - DWC3_DGCMD_STATUS(reg)); -+ if (DWC3_DGCMD_STATUS(reg)) -+ return -EINVAL; - return 0; - } - -@@ -335,6 +337,8 @@ int dwc3_send_gadget_ep_cmd(struct dwc3 *dwc, unsigned ep, - if (!(reg & DWC3_DEPCMD_CMDACT)) { - dev_vdbg(dwc->dev, "Command Complete --> %d\n", - DWC3_DEPCMD_STATUS(reg)); -+ if (DWC3_DEPCMD_STATUS(reg)) -+ return -EINVAL; - return 0; - } - -diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c -index 9bce4f0..f8893b3 100644 ---- a/drivers/usb/host/xhci-mem.c -+++ b/drivers/usb/host/xhci-mem.c -@@ -1331,10 +1331,10 @@ int xhci_endpoint_init(struct xhci_hcd *xhci, - /* Attempt to use the ring cache */ - if (virt_dev->num_rings_cached == 0) - return -ENOMEM; -+ virt_dev->num_rings_cached--; - virt_dev->eps[ep_index].new_ring = - virt_dev->ring_cache[virt_dev->num_rings_cached]; - virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL; -- virt_dev->num_rings_cached--; - xhci_reinit_cached_ring(xhci, virt_dev->eps[ep_index].new_ring, - 1, type); - } -diff --git a/drivers/usb/musb/musb_virthub.c b/drivers/usb/musb/musb_virthub.c -index 0241a3a..1e9bde4 100644 ---- a/drivers/usb/musb/musb_virthub.c -+++ b/drivers/usb/musb/musb_virthub.c -@@ -273,9 +273,7 @@ static int musb_has_gadget(struct musb *musb) - #ifdef CONFIG_USB_MUSB_HOST - return 1; - #else -- if (musb->port_mode == MUSB_PORT_MODE_HOST) -- return 1; -- return musb->g.dev.driver != NULL; -+ return musb->port_mode == MUSB_PORT_MODE_HOST; - #endif - } - -diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c -index 73c7292..d11335d 100644 ---- a/drivers/usb/serial/cp210x.c -+++ b/drivers/usb/serial/cp210x.c -@@ -187,6 +187,7 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(0x1FB9, 0x0602) }, /* Lake Shore Model 648 Magnet Power Supply */ - { USB_DEVICE(0x1FB9, 0x0700) }, /* Lake Shore Model 737 VSM Controller */ - { USB_DEVICE(0x1FB9, 0x0701) }, /* Lake Shore Model 776 Hall Matrix */ -+ { USB_DEVICE(0x2626, 0xEA60) }, /* Aruba Networks 7xxx USB Serial Console */ - { USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */ - { USB_DEVICE(0x3195, 0xF280) }, /* Link Instruments MSO-28 */ - { USB_DEVICE(0x3195, 0xF281) }, /* Link Instruments MSO-28 */ -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index 8b34841..096438e 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -1755,6 +1755,7 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) }, - { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ - { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ -+ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */ - { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) }, - { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) }, - { } /* Terminating entry */ -diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c -index 9a08e18..3d66e9c 100644 ---- a/drivers/usb/serial/usb-serial.c -+++ b/drivers/usb/serial/usb-serial.c -@@ -1300,6 +1300,7 @@ static void __exit usb_serial_exit(void) - tty_unregister_driver(usb_serial_tty_driver); - put_tty_driver(usb_serial_tty_driver); - bus_unregister(&usb_serial_bus_type); -+ idr_destroy(&serial_minors); - } - - -diff --git a/drivers/watchdog/omap_wdt.c b/drivers/watchdog/omap_wdt.c -index 09cf013..90a6406 100644 ---- a/drivers/watchdog/omap_wdt.c -+++ b/drivers/watchdog/omap_wdt.c -@@ -134,6 +134,13 @@ static int omap_wdt_start(struct watchdog_device *wdog) - - pm_runtime_get_sync(wdev->dev); - -+ /* -+ * Make sure the watchdog is disabled. This is unfortunately required -+ * because writing to various registers with the watchdog running has no -+ * effect. -+ */ -+ omap_wdt_disable(wdev); -+ - /* initialize prescaler */ - while (readl_relaxed(base + OMAP_WATCHDOG_WPS) & 0x01) - cpu_relax(); -diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c -index bb7991c..bfdeadb 100644 ---- a/fs/9p/vfs_inode.c -+++ b/fs/9p/vfs_inode.c -@@ -540,8 +540,7 @@ static struct inode *v9fs_qid_iget(struct super_block *sb, - unlock_new_inode(inode); - return inode; - error: -- unlock_new_inode(inode); -- iput(inode); -+ iget_failed(inode); - return ERR_PTR(retval); - - } -diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c -index 59dc8e8..de8606c 100644 ---- a/fs/9p/vfs_inode_dotl.c -+++ b/fs/9p/vfs_inode_dotl.c -@@ -149,8 +149,7 @@ static struct inode *v9fs_qid_iget_dotl(struct super_block *sb, - unlock_new_inode(inode); - return inode; - error: -- unlock_new_inode(inode); -- iput(inode); -+ iget_failed(inode); - return ERR_PTR(retval); - - } -diff --git a/fs/bio.c b/fs/bio.c -index 8754e7b..b2b1451 100644 ---- a/fs/bio.c -+++ b/fs/bio.c -@@ -1806,8 +1806,9 @@ EXPORT_SYMBOL(bio_endio_nodec); - * Allocates and returns a new bio which represents @sectors from the start of - * @bio, and updates @bio to represent the remaining sectors. - * -- * The newly allocated bio will point to @bio's bi_io_vec; it is the caller's -- * responsibility to ensure that @bio is not freed before the split. -+ * Unless this is a discard request the newly allocated bio will point -+ * to @bio's bi_io_vec; it is the caller's responsibility to ensure that -+ * @bio is not freed before the split. - */ - struct bio *bio_split(struct bio *bio, int sectors, - gfp_t gfp, struct bio_set *bs) -@@ -1817,7 +1818,15 @@ struct bio *bio_split(struct bio *bio, int sectors, - BUG_ON(sectors <= 0); - BUG_ON(sectors >= bio_sectors(bio)); - -- split = bio_clone_fast(bio, gfp, bs); -+ /* -+ * Discards need a mutable bio_vec to accommodate the payload -+ * required by the DSM TRIM and UNMAP commands. -+ */ -+ if (bio->bi_rw & REQ_DISCARD) -+ split = bio_clone_bioset(bio, gfp, bs); -+ else -+ split = bio_clone_fast(bio, gfp, bs); -+ - if (!split) - return NULL; - -diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c -index ab485e5..644942a 100644 ---- a/fs/btrfs/inode-map.c -+++ b/fs/btrfs/inode-map.c -@@ -281,7 +281,7 @@ void btrfs_unpin_free_ino(struct btrfs_root *root) - __btrfs_add_free_space(ctl, info->offset, count); - free: - rb_erase(&info->offset_index, rbroot); -- kfree(info); -+ kmem_cache_free(btrfs_free_space_cachep, info); - } - } - -diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c -index 3e16042..d40ae42 100644 ---- a/fs/btrfs/ioctl.c -+++ b/fs/btrfs/ioctl.c -@@ -2743,7 +2743,7 @@ out_unlock: - static long btrfs_ioctl_file_extent_same(struct file *file, - struct btrfs_ioctl_same_args __user *argp) - { -- struct btrfs_ioctl_same_args *same; -+ struct btrfs_ioctl_same_args *same = NULL; - struct btrfs_ioctl_same_extent_info *info; - struct inode *src = file_inode(file); - u64 off; -@@ -2773,6 +2773,7 @@ static long btrfs_ioctl_file_extent_same(struct file *file, - - if (IS_ERR(same)) { - ret = PTR_ERR(same); -+ same = NULL; - goto out; - } - -@@ -2843,6 +2844,7 @@ static long btrfs_ioctl_file_extent_same(struct file *file, - - out: - mnt_drop_write_file(file); -+ kfree(same); - return ret; - } - -diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c -index e6574d7..a7c5277 100644 ---- a/fs/ext4/indirect.c -+++ b/fs/ext4/indirect.c -@@ -576,7 +576,7 @@ int ext4_ind_map_blocks(handle_t *handle, struct inode *inode, - EXT4_FEATURE_RO_COMPAT_BIGALLOC)) { - EXT4_ERROR_INODE(inode, "Can't allocate blocks for " - "non-extent mapped inodes with bigalloc"); -- return -ENOSPC; -+ return -EUCLEAN; - } - - goal = ext4_find_goal(inode, map->m_lblk, partial); -diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c -index da03340..f9c63ae 100644 ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -1357,7 +1357,7 @@ static void ext4_da_page_release_reservation(struct page *page, - unsigned int offset, - unsigned int length) - { -- int to_release = 0; -+ int to_release = 0, contiguous_blks = 0; - struct buffer_head *head, *bh; - unsigned int curr_off = 0; - struct inode *inode = page->mapping->host; -@@ -1378,14 +1378,23 @@ static void ext4_da_page_release_reservation(struct page *page, - - if ((offset <= curr_off) && (buffer_delay(bh))) { - to_release++; -+ contiguous_blks++; - clear_buffer_delay(bh); -+ } else if (contiguous_blks) { -+ lblk = page->index << -+ (PAGE_CACHE_SHIFT - inode->i_blkbits); -+ lblk += (curr_off >> inode->i_blkbits) - -+ contiguous_blks; -+ ext4_es_remove_extent(inode, lblk, contiguous_blks); -+ contiguous_blks = 0; - } - curr_off = next_off; - } while ((bh = bh->b_this_page) != head); - -- if (to_release) { -+ if (contiguous_blks) { - lblk = page->index << (PAGE_CACHE_SHIFT - inode->i_blkbits); -- ext4_es_remove_extent(inode, lblk, to_release); -+ lblk += (curr_off >> inode->i_blkbits) - contiguous_blks; -+ ext4_es_remove_extent(inode, lblk, contiguous_blks); - } - - /* If we have released all the blocks belonging to a cluster, then we -@@ -1744,19 +1753,32 @@ static int __ext4_journalled_writepage(struct page *page, - ext4_walk_page_buffers(handle, page_bufs, 0, len, - NULL, bget_one); - } -- /* As soon as we unlock the page, it can go away, but we have -- * references to buffers so we are safe */ -+ /* -+ * We need to release the page lock before we start the -+ * journal, so grab a reference so the page won't disappear -+ * out from under us. -+ */ -+ get_page(page); - unlock_page(page); - - handle = ext4_journal_start(inode, EXT4_HT_WRITE_PAGE, - ext4_writepage_trans_blocks(inode)); - if (IS_ERR(handle)) { - ret = PTR_ERR(handle); -- goto out; -+ put_page(page); -+ goto out_no_pagelock; - } -- - BUG_ON(!ext4_handle_valid(handle)); - -+ lock_page(page); -+ put_page(page); -+ if (page->mapping != mapping) { -+ /* The page got truncated from under us */ -+ ext4_journal_stop(handle); -+ ret = 0; -+ goto out; -+ } -+ - if (inline_data) { - ret = ext4_journal_get_write_access(handle, inode_bh); - -@@ -1781,6 +1803,8 @@ static int __ext4_journalled_writepage(struct page *page, - NULL, bput_one); - ext4_set_inode_state(inode, EXT4_STATE_JDATA); - out: -+ unlock_page(page); -+out_no_pagelock: - brelse(inode_bh); - return ret; - } -diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c -index 7620133..c4a5e4d 100644 ---- a/fs/ext4/mballoc.c -+++ b/fs/ext4/mballoc.c -@@ -4793,18 +4793,12 @@ do_more: - /* - * blocks being freed are metadata. these blocks shouldn't - * be used until this transaction is committed -+ * -+ * We use __GFP_NOFAIL because ext4_free_blocks() is not allowed -+ * to fail. - */ -- retry: -- new_entry = kmem_cache_alloc(ext4_free_data_cachep, GFP_NOFS); -- if (!new_entry) { -- /* -- * We use a retry loop because -- * ext4_free_blocks() is not allowed to fail. -- */ -- cond_resched(); -- congestion_wait(BLK_RW_ASYNC, HZ/50); -- goto retry; -- } -+ new_entry = kmem_cache_alloc(ext4_free_data_cachep, -+ GFP_NOFS|__GFP_NOFAIL); - new_entry->efd_start_cluster = bit; - new_entry->efd_group = block_group; - new_entry->efd_count = count_clusters; -diff --git a/fs/ext4/migrate.c b/fs/ext4/migrate.c -index 2ae73a8..be92ed2 100644 ---- a/fs/ext4/migrate.c -+++ b/fs/ext4/migrate.c -@@ -616,6 +616,7 @@ int ext4_ind_migrate(struct inode *inode) - struct ext4_inode_info *ei = EXT4_I(inode); - struct ext4_extent *ex; - unsigned int i, len; -+ ext4_lblk_t start, end; - ext4_fsblk_t blk; - handle_t *handle; - int ret; -@@ -629,6 +630,14 @@ int ext4_ind_migrate(struct inode *inode) - EXT4_FEATURE_RO_COMPAT_BIGALLOC)) - return -EOPNOTSUPP; - -+ /* -+ * In order to get correct extent info, force all delayed allocation -+ * blocks to be allocated, otherwise delayed allocation blocks may not -+ * be reflected and bypass the checks on extent header. -+ */ -+ if (test_opt(inode->i_sb, DELALLOC)) -+ ext4_alloc_da_blocks(inode); -+ - handle = ext4_journal_start(inode, EXT4_HT_MIGRATE, 1); - if (IS_ERR(handle)) - return PTR_ERR(handle); -@@ -646,11 +655,13 @@ int ext4_ind_migrate(struct inode *inode) - goto errout; - } - if (eh->eh_entries == 0) -- blk = len = 0; -+ blk = len = start = end = 0; - else { - len = le16_to_cpu(ex->ee_len); - blk = ext4_ext_pblock(ex); -- if (len > EXT4_NDIR_BLOCKS) { -+ start = le32_to_cpu(ex->ee_block); -+ end = start + len - 1; -+ if (end >= EXT4_NDIR_BLOCKS) { - ret = -EOPNOTSUPP; - goto errout; - } -@@ -658,7 +669,7 @@ int ext4_ind_migrate(struct inode *inode) - - ext4_clear_inode_flag(inode, EXT4_INODE_EXTENTS); - memset(ei->i_data, 0, sizeof(ei->i_data)); -- for (i=0; i < len; i++) -+ for (i = start; i <= end; i++) - ei->i_data[i] = cpu_to_le32(blk++); - ext4_mark_inode_dirty(handle, inode); - errout: -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index 9fb3e6c..a07af5b 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -832,6 +832,7 @@ static void ext4_put_super(struct super_block *sb) - dump_orphan_list(sb, sbi); - J_ASSERT(list_empty(&sbi->s_orphan)); - -+ sync_blockdev(sb->s_bdev); - invalidate_bdev(sb->s_bdev); - if (sbi->journal_bdev && sbi->journal_bdev != sb->s_bdev) { - /* -diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c -index 73f6bcb..faf00af 100644 ---- a/fs/fuse/inode.c -+++ b/fs/fuse/inode.c -@@ -1026,6 +1026,7 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent) - goto err_fput; - - fuse_conn_init(fc); -+ fc->release = fuse_free_conn; - - fc->dev = sb->s_dev; - fc->sb = sb; -@@ -1040,7 +1041,6 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent) - fc->dont_mask = 1; - sb->s_flags |= MS_POSIXACL; - -- fc->release = fuse_free_conn; - fc->flags = d.flags; - fc->user_id = d.user_id; - fc->group_id = d.group_id; -diff --git a/fs/hpfs/super.c b/fs/hpfs/super.c -index 4534ff6..77b583d 100644 ---- a/fs/hpfs/super.c -+++ b/fs/hpfs/super.c -@@ -52,17 +52,20 @@ static void unmark_dirty(struct super_block *s) - } - - /* Filesystem error... */ --static char err_buf[1024]; -- - void hpfs_error(struct super_block *s, const char *fmt, ...) - { -+ struct va_format vaf; - va_list args; - - va_start(args, fmt); -- vsnprintf(err_buf, sizeof(err_buf), fmt, args); -+ -+ vaf.fmt = fmt; -+ vaf.va = &args; -+ -+ pr_err("filesystem error: %pV", &vaf); -+ - va_end(args); - -- printk("HPFS: filesystem error: %s", err_buf); - if (!hpfs_sb(s)->sb_was_error) { - if (hpfs_sb(s)->sb_err == 2) { - printk("; crashing the system because you wanted it\n"); -diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c -index 7f34f47..b892355 100644 ---- a/fs/jbd2/checkpoint.c -+++ b/fs/jbd2/checkpoint.c -@@ -448,7 +448,7 @@ int jbd2_cleanup_journal_tail(journal_t *journal) - unsigned long blocknr; - - if (is_journal_aborted(journal)) -- return 1; -+ return -EIO; - - if (!jbd2_journal_get_log_tail(journal, &first_tid, &blocknr)) - return 1; -@@ -463,10 +463,9 @@ int jbd2_cleanup_journal_tail(journal_t *journal) - * jbd2_cleanup_journal_tail() doesn't get called all that often. - */ - if (journal->j_flags & JBD2_BARRIER) -- blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL); -+ blkdev_issue_flush(journal->j_fs_dev, GFP_NOFS, NULL); - -- __jbd2_update_log_tail(journal, first_tid, blocknr); -- return 0; -+ return __jbd2_update_log_tail(journal, first_tid, blocknr); - } - - -diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c -index f2d78a3..e8d62d7 100644 ---- a/fs/jbd2/journal.c -+++ b/fs/jbd2/journal.c -@@ -885,9 +885,10 @@ int jbd2_journal_get_log_tail(journal_t *journal, tid_t *tid, - * - * Requires j_checkpoint_mutex - */ --void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block) -+int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block) - { - unsigned long freed; -+ int ret; - - BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex)); - -@@ -897,7 +898,10 @@ void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block) - * space and if we lose sb update during power failure we'd replay - * old transaction with possibly newly overwritten data. - */ -- jbd2_journal_update_sb_log_tail(journal, tid, block, WRITE_FUA); -+ ret = jbd2_journal_update_sb_log_tail(journal, tid, block, WRITE_FUA); -+ if (ret) -+ goto out; -+ - write_lock(&journal->j_state_lock); - freed = block - journal->j_tail; - if (block < journal->j_tail) -@@ -913,6 +917,9 @@ void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block) - journal->j_tail_sequence = tid; - journal->j_tail = block; - write_unlock(&journal->j_state_lock); -+ -+out: -+ return ret; - } - - /* -@@ -1331,7 +1338,7 @@ static int journal_reset(journal_t *journal) - return jbd2_journal_start_thread(journal); - } - --static void jbd2_write_superblock(journal_t *journal, int write_op) -+static int jbd2_write_superblock(journal_t *journal, int write_op) - { - struct buffer_head *bh = journal->j_sb_buffer; - journal_superblock_t *sb = journal->j_superblock; -@@ -1370,7 +1377,10 @@ static void jbd2_write_superblock(journal_t *journal, int write_op) - printk(KERN_ERR "JBD2: Error %d detected when updating " - "journal superblock for %s.\n", ret, - journal->j_devname); -+ jbd2_journal_abort(journal, ret); - } -+ -+ return ret; - } - - /** -@@ -1383,10 +1393,11 @@ static void jbd2_write_superblock(journal_t *journal, int write_op) - * Update a journal's superblock information about log tail and write it to - * disk, waiting for the IO to complete. - */ --void jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid, -+int jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid, - unsigned long tail_block, int write_op) - { - journal_superblock_t *sb = journal->j_superblock; -+ int ret; - - BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex)); - jbd_debug(1, "JBD2: updating superblock (start %lu, seq %u)\n", -@@ -1395,13 +1406,18 @@ void jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid, - sb->s_sequence = cpu_to_be32(tail_tid); - sb->s_start = cpu_to_be32(tail_block); - -- jbd2_write_superblock(journal, write_op); -+ ret = jbd2_write_superblock(journal, write_op); -+ if (ret) -+ goto out; - - /* Log is no longer empty */ - write_lock(&journal->j_state_lock); - WARN_ON(!sb->s_sequence); - journal->j_flags &= ~JBD2_FLUSHED; - write_unlock(&journal->j_state_lock); -+ -+out: -+ return ret; - } - - /** -@@ -1952,7 +1968,14 @@ int jbd2_journal_flush(journal_t *journal) - return -EIO; - - mutex_lock(&journal->j_checkpoint_mutex); -- jbd2_cleanup_journal_tail(journal); -+ if (!err) { -+ err = jbd2_cleanup_journal_tail(journal); -+ if (err < 0) { -+ mutex_unlock(&journal->j_checkpoint_mutex); -+ goto out; -+ } -+ err = 0; -+ } - - /* Finally, mark the journal as really needing no recovery. - * This sets s_start==0 in the underlying superblock, which is -@@ -1968,7 +1991,8 @@ int jbd2_journal_flush(journal_t *journal) - J_ASSERT(journal->j_head == journal->j_tail); - J_ASSERT(journal->j_tail_sequence == journal->j_transaction_sequence); - write_unlock(&journal->j_state_lock); -- return 0; -+out: -+ return err; - } - - /** -diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c -index fa6d721..4495cad 100644 ---- a/fs/nfs/nfs3xdr.c -+++ b/fs/nfs/nfs3xdr.c -@@ -1342,7 +1342,7 @@ static void nfs3_xdr_enc_setacl3args(struct rpc_rqst *req, - if (args->npages != 0) - xdr_write_pages(xdr, args->pages, 0, args->len); - else -- xdr_reserve_space(xdr, NFS_ACL_INLINE_BUFSIZE); -+ xdr_reserve_space(xdr, args->len); - - error = nfsacl_encode(xdr->buf, base, args->inode, - (args->mask & NFS_ACL) ? -diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c -index b4f177f..c402b67 100644 ---- a/fs/nfs/nfs4state.c -+++ b/fs/nfs/nfs4state.c -@@ -1482,6 +1482,8 @@ restart: - spin_unlock(&state->state_lock); - } - nfs4_put_open_state(state); -+ clear_bit(NFS4CLNT_RECLAIM_NOGRACE, -+ &state->flags); - spin_lock(&sp->so_lock); - goto restart; - } -diff --git a/fs/xfs/xfs_symlink.c b/fs/xfs/xfs_symlink.c -index 14e58f2..98d4948 100644 ---- a/fs/xfs/xfs_symlink.c -+++ b/fs/xfs/xfs_symlink.c -@@ -102,7 +102,7 @@ xfs_readlink_bmap( - cur_chunk += sizeof(struct xfs_dsymlink_hdr); - } - -- memcpy(link + offset, bp->b_addr, byte_cnt); -+ memcpy(link + offset, cur_chunk, byte_cnt); - - pathlen -= byte_cnt; - offset += byte_cnt; -diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h -index 8fc12f8..69afb57 100644 ---- a/include/acpi/actypes.h -+++ b/include/acpi/actypes.h -@@ -561,6 +561,7 @@ typedef u64 acpi_integer; - #define ACPI_NO_ACPI_ENABLE 0x10 - #define ACPI_NO_DEVICE_INIT 0x20 - #define ACPI_NO_OBJECT_INIT 0x40 -+#define ACPI_NO_FACS_INIT 0x80 - - /* - * Initialization state -diff --git a/include/linux/acpi.h b/include/linux/acpi.h -index cd80aa8..77af621 100644 ---- a/include/linux/acpi.h -+++ b/include/linux/acpi.h -@@ -402,6 +402,7 @@ extern acpi_status acpi_pci_osc_control_set(acpi_handle handle, - #define ACPI_OST_SC_INSERT_NOT_SUPPORTED 0x82 - - extern void acpi_early_init(void); -+extern void acpi_subsystem_init(void); - - extern int acpi_nvs_register(__u64 start, __u64 size); - -@@ -436,6 +437,7 @@ static inline const char *acpi_dev_name(struct acpi_device *adev) - } - - static inline void acpi_early_init(void) { } -+static inline void acpi_subsystem_init(void) { } - - static inline int early_acpi_boot_init(void) - { -diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h -index 0dae71e..e1fb0f6 100644 ---- a/include/linux/jbd2.h -+++ b/include/linux/jbd2.h -@@ -1035,7 +1035,7 @@ struct buffer_head *jbd2_journal_get_descriptor_buffer(journal_t *journal); - int jbd2_journal_next_log_block(journal_t *, unsigned long long *); - int jbd2_journal_get_log_tail(journal_t *journal, tid_t *tid, - unsigned long *block); --void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block); -+int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block); - void jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block); - - /* Commit management */ -@@ -1157,7 +1157,7 @@ extern int jbd2_journal_recover (journal_t *journal); - extern int jbd2_journal_wipe (journal_t *, int); - extern int jbd2_journal_skip_recovery (journal_t *); - extern void jbd2_journal_update_sb_errno(journal_t *); --extern void jbd2_journal_update_sb_log_tail (journal_t *, tid_t, -+extern int jbd2_journal_update_sb_log_tail (journal_t *, tid_t, - unsigned long, int); - extern void __jbd2_journal_abort_hard (journal_t *); - extern void jbd2_journal_abort (journal_t *, int); -diff --git a/include/linux/libata.h b/include/linux/libata.h -index b84e786..189c9ff 100644 ---- a/include/linux/libata.h -+++ b/include/linux/libata.h -@@ -428,6 +428,7 @@ enum { - ATA_HORKAGE_NO_NCQ_TRIM = (1 << 19), /* don't use queued TRIM */ - ATA_HORKAGE_NOLPM = (1 << 20), /* don't use LPM */ - ATA_HORKAGE_WD_BROKEN_LPM = (1 << 21), /* some WDs have broken LPM */ -+ ATA_HORKAGE_NOTRIM = (1 << 24), /* don't use TRIM */ - - /* DMA mask for user DMA control: User visible values; DO NOT - renumber */ -diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h -index 53988cb..3a36a2c 100644 ---- a/include/linux/nfs_xdr.h -+++ b/include/linux/nfs_xdr.h -@@ -1155,7 +1155,7 @@ struct nfs41_state_protection { - struct nfs4_op_map allow; - }; - --#define NFS4_EXCHANGE_ID_LEN (48) -+#define NFS4_EXCHANGE_ID_LEN (127) - struct nfs41_exchange_id_args { - struct nfs_client *client; - nfs4_verifier *verifier; -diff --git a/include/linux/of.h b/include/linux/of.h -index 3f8144d..9f2698d 100644 ---- a/include/linux/of.h -+++ b/include/linux/of.h -@@ -517,7 +517,10 @@ static inline const char *of_prop_next_string(struct property *prop, - #if defined(CONFIG_OF) && defined(CONFIG_NUMA) - extern int of_node_to_nid(struct device_node *np); - #else --static inline int of_node_to_nid(struct device_node *device) { return 0; } -+static inline int of_node_to_nid(struct device_node *device) -+{ -+ return NUMA_NO_NODE; -+} - #endif - - static inline struct device_node *of_find_matching_node( -diff --git a/include/uapi/linux/usbdevice_fs.h b/include/uapi/linux/usbdevice_fs.h -index 0c65e4b..ef29266 100644 ---- a/include/uapi/linux/usbdevice_fs.h -+++ b/include/uapi/linux/usbdevice_fs.h -@@ -125,11 +125,12 @@ struct usbdevfs_hub_portinfo { - char port [127]; /* e.g. port 3 connects to device 27 */ - }; - --/* Device capability flags */ -+/* System and bus capability flags */ - #define USBDEVFS_CAP_ZERO_PACKET 0x01 - #define USBDEVFS_CAP_BULK_CONTINUATION 0x02 - #define USBDEVFS_CAP_NO_PACKET_SIZE_LIM 0x04 - #define USBDEVFS_CAP_BULK_SCATTER_GATHER 0x08 -+#define USBDEVFS_CAP_REAP_AFTER_DISCONNECT 0x10 - - /* USBDEVFS_DISCONNECT_CLAIM flags & struct */ - -diff --git a/init/main.c b/init/main.c -index 58c132d..008edce 100644 ---- a/init/main.c -+++ b/init/main.c -@@ -643,6 +643,7 @@ asmlinkage void __init start_kernel(void) - - check_bugs(); - -+ acpi_subsystem_init(); - sfi_init_late(); - - if (efi_enabled(EFI_RUNTIME_SERVICES)) { -diff --git a/kernel/irq/devres.c b/kernel/irq/devres.c -index 1ef0606..0296d6f 100644 ---- a/kernel/irq/devres.c -+++ b/kernel/irq/devres.c -@@ -104,7 +104,7 @@ int devm_request_any_context_irq(struct device *dev, unsigned int irq, - return -ENOMEM; - - rc = request_any_context_irq(irq, handler, irqflags, devname, dev_id); -- if (rc) { -+ if (rc < 0) { - devres_free(dr); - return rc; - } -@@ -113,7 +113,7 @@ int devm_request_any_context_irq(struct device *dev, unsigned int irq, - dr->dev_id = dev_id; - devres_add(dev, dr); - -- return 0; -+ return rc; - } - EXPORT_SYMBOL(devm_request_any_context_irq); - -diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig -index 2fac9cc..9d18628 100644 ---- a/kernel/power/Kconfig -+++ b/kernel/power/Kconfig -@@ -191,7 +191,7 @@ config DPM_WATCHDOG - config DPM_WATCHDOG_TIMEOUT - int "Watchdog timeout in seconds" - range 1 120 -- default 12 -+ default 60 - depends on DPM_WATCHDOG - - config PM_TRACE -diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c -index a755ad7..02e7fb4 100644 ---- a/kernel/printk/printk.c -+++ b/kernel/printk/printk.c -@@ -383,11 +383,11 @@ static int check_syslog_permissions(int type, bool from_file) - * already done the capabilities checks at open time. - */ - if (from_file && type != SYSLOG_ACTION_OPEN) -- return 0; -+ goto ok; - - if (syslog_action_restricted(type)) { - if (capable(CAP_SYSLOG)) -- return 0; -+ goto ok; - /* - * For historical reasons, accept CAP_SYS_ADMIN too, with - * a warning. -@@ -397,10 +397,11 @@ static int check_syslog_permissions(int type, bool from_file) - "CAP_SYS_ADMIN but no CAP_SYSLOG " - "(deprecated).\n", - current->comm, task_pid_nr(current)); -- return 0; -+ goto ok; - } - return -EPERM; - } -+ok: - return security_syslog(type); - } - -@@ -1126,10 +1127,6 @@ int do_syslog(int type, char __user *buf, int len, bool from_file) - if (error) - goto out; - -- error = security_syslog(type); -- if (error) -- return error; -- - switch (type) { - case SYSLOG_ACTION_CLOSE: /* Close log */ - break; -diff --git a/kernel/rcu/tiny.c b/kernel/rcu/tiny.c -index 1254f31..ae359f0 100644 ---- a/kernel/rcu/tiny.c -+++ b/kernel/rcu/tiny.c -@@ -284,6 +284,11 @@ static void __rcu_process_callbacks(struct rcu_ctrlblk *rcp) - - /* Move the ready-to-invoke callbacks to a local list. */ - local_irq_save(flags); -+ if (rcp->donetail == &rcp->rcucblist) { -+ /* No callbacks ready, so just leave. */ -+ local_irq_restore(flags); -+ return; -+ } - RCU_TRACE(trace_rcu_batch_start(rcp->name, 0, rcp->qlen, -1)); - list = rcp->rcucblist; - rcp->rcucblist = *rcp->donetail; -diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h -index c8bd809..c1be95c 100644 ---- a/kernel/trace/trace.h -+++ b/kernel/trace/trace.h -@@ -422,6 +422,7 @@ enum { - - TRACE_CONTROL_BIT, - -+ TRACE_BRANCH_BIT, - /* - * Abuse of the trace_recursion. - * As we need a way to maintain state if we are tracing the function -diff --git a/kernel/trace/trace_branch.c b/kernel/trace/trace_branch.c -index 697fb9b..60850b4 100644 ---- a/kernel/trace/trace_branch.c -+++ b/kernel/trace/trace_branch.c -@@ -37,9 +37,12 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect) - struct trace_branch *entry; - struct ring_buffer *buffer; - unsigned long flags; -- int cpu, pc; -+ int pc; - const char *p; - -+ if (current->trace_recursion & TRACE_BRANCH_BIT) -+ return; -+ - /* - * I would love to save just the ftrace_likely_data pointer, but - * this code can also be used by modules. Ugly things can happen -@@ -50,10 +53,10 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect) - if (unlikely(!tr)) - return; - -- local_irq_save(flags); -- cpu = raw_smp_processor_id(); -- data = per_cpu_ptr(tr->trace_buffer.data, cpu); -- if (atomic_inc_return(&data->disabled) != 1) -+ raw_local_irq_save(flags); -+ current->trace_recursion |= TRACE_BRANCH_BIT; -+ data = this_cpu_ptr(tr->trace_buffer.data); -+ if (atomic_read(&data->disabled)) - goto out; - - pc = preempt_count(); -@@ -82,8 +85,8 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect) - __buffer_unlock_commit(buffer, event); - - out: -- atomic_dec(&data->disabled); -- local_irq_restore(flags); -+ current->trace_recursion &= ~TRACE_BRANCH_BIT; -+ raw_local_irq_restore(flags); - } - - static inline -diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c -index cb347e8..7b244d0 100644 ---- a/kernel/trace/trace_events_filter.c -+++ b/kernel/trace/trace_events_filter.c -@@ -1086,6 +1086,9 @@ static void parse_init(struct filter_parse_state *ps, - - static char infix_next(struct filter_parse_state *ps) - { -+ if (!ps->infix.cnt) -+ return 0; -+ - ps->infix.cnt--; - - return ps->infix.string[ps->infix.tail++]; -@@ -1101,6 +1104,9 @@ static char infix_peek(struct filter_parse_state *ps) - - static void infix_advance(struct filter_parse_state *ps) - { -+ if (!ps->infix.cnt) -+ return; -+ - ps->infix.cnt--; - ps->infix.tail++; - } -@@ -1413,7 +1419,9 @@ static int check_preds(struct filter_parse_state *ps) - continue; - } - n_normal_preds++; -- WARN_ON_ONCE(cnt < 0); -+ /* all ops should have operands */ -+ if (cnt < 0) -+ break; - } - - if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) { -diff --git a/lib/bitmap.c b/lib/bitmap.c -index e5c4ebe..c0634aa 100644 ---- a/lib/bitmap.c -+++ b/lib/bitmap.c -@@ -603,12 +603,12 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen, - unsigned a, b; - int c, old_c, totaldigits; - const char __user __force *ubuf = (const char __user __force *)buf; -- int exp_digit, in_range; -+ int at_start, in_range; - - totaldigits = c = 0; - bitmap_zero(maskp, nmaskbits); - do { -- exp_digit = 1; -+ at_start = 1; - in_range = 0; - a = b = 0; - -@@ -637,11 +637,10 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen, - break; - - if (c == '-') { -- if (exp_digit || in_range) -+ if (at_start || in_range) - return -EINVAL; - b = 0; - in_range = 1; -- exp_digit = 1; - continue; - } - -@@ -651,16 +650,18 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen, - b = b * 10 + (c - '0'); - if (!in_range) - a = b; -- exp_digit = 0; -+ at_start = 0; - totaldigits++; - } - if (!(a <= b)) - return -EINVAL; - if (b >= nmaskbits) - return -ERANGE; -- while (a <= b) { -- set_bit(a, maskp); -- a++; -+ if (!at_start) { -+ while (a <= b) { -+ set_bit(a, maskp); -+ a++; -+ } - } - } while (buflen && c == ','); - return 0; -diff --git a/net/9p/client.c b/net/9p/client.c -index 9186550..08046f3 100644 ---- a/net/9p/client.c -+++ b/net/9p/client.c -@@ -839,7 +839,8 @@ static struct p9_req_t *p9_client_zc_rpc(struct p9_client *c, int8_t type, - if (err < 0) { - if (err == -EIO) - c->status = Disconnected; -- goto reterr; -+ if (err != -ERESTARTSYS) -+ goto reterr; - } - if (req->status == REQ_STATUS_ERROR) { - p9_debug(P9_DEBUG_ERROR, "req_status error %d\n", req->t_err); -diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c -index aade4a5..bde94d8 100644 ---- a/net/ceph/osdmap.c -+++ b/net/ceph/osdmap.c -@@ -89,7 +89,7 @@ static int crush_decode_tree_bucket(void **p, void *end, - { - int j; - dout("crush_decode_tree_bucket %p to %p\n", *p, end); -- ceph_decode_32_safe(p, end, b->num_nodes, bad); -+ ceph_decode_8_safe(p, end, b->num_nodes, bad); - b->node_weights = kcalloc(b->num_nodes, sizeof(u32), GFP_NOFS); - if (b->node_weights == NULL) - return -ENOMEM; -diff --git a/net/mac80211/main.c b/net/mac80211/main.c -index c7a7a86..9e58c99 100644 ---- a/net/mac80211/main.c -+++ b/net/mac80211/main.c -@@ -248,6 +248,7 @@ static void ieee80211_restart_work(struct work_struct *work) - { - struct ieee80211_local *local = - container_of(work, struct ieee80211_local, restart_work); -+ struct ieee80211_sub_if_data *sdata; - - /* wait for scan work complete */ - flush_workqueue(local->workqueue); -@@ -256,6 +257,8 @@ static void ieee80211_restart_work(struct work_struct *work) - "%s called with hardware scan in progress\n", __func__); - - rtnl_lock(); -+ list_for_each_entry(sdata, &local->interfaces, list) -+ flush_delayed_work(&sdata->dec_tailroom_needed_wk); - ieee80211_scan_cancel(local); - ieee80211_reconfig(local); - rtnl_unlock(); -diff --git a/net/sunrpc/backchannel_rqst.c b/net/sunrpc/backchannel_rqst.c -index e860d4f..ab21968 100644 ---- a/net/sunrpc/backchannel_rqst.c -+++ b/net/sunrpc/backchannel_rqst.c -@@ -60,7 +60,7 @@ static void xprt_free_allocation(struct rpc_rqst *req) - - dprintk("RPC: free allocations for req= %p\n", req); - WARN_ON_ONCE(test_bit(RPC_BC_PA_IN_USE, &req->rq_bc_pa_state)); -- xbufp = &req->rq_private_buf; -+ xbufp = &req->rq_rcv_buf; - free_page((unsigned long)xbufp->head[0].iov_base); - xbufp = &req->rq_snd_buf; - free_page((unsigned long)xbufp->head[0].iov_base); -diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c -index 7e71e06..048550a 100644 ---- a/security/integrity/evm/evm_main.c -+++ b/security/integrity/evm/evm_main.c -@@ -20,6 +20,7 @@ - #include <linux/xattr.h> - #include <linux/integrity.h> - #include <linux/evm.h> -+#include <linux/magic.h> - #include <crypto/hash.h> - #include "evm.h" - -@@ -275,6 +276,17 @@ static int evm_protect_xattr(struct dentry *dentry, const char *xattr_name, - iint = integrity_iint_find(dentry->d_inode); - if (iint && (iint->flags & IMA_NEW_FILE)) - return 0; -+ -+ /* exception for pseudo filesystems */ -+ if (dentry->d_inode->i_sb->s_magic == TMPFS_MAGIC -+ || dentry->d_inode->i_sb->s_magic == SYSFS_MAGIC) -+ return 0; -+ -+ integrity_audit_msg(AUDIT_INTEGRITY_METADATA, -+ dentry->d_inode, dentry->d_name.name, -+ "update_metadata", -+ integrity_status_msg[evm_status], -+ -EPERM, 0); - } - out: - if (evm_status != INTEGRITY_PASS) -diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h -index f79fa8b..5cb7de9 100644 ---- a/security/integrity/ima/ima.h -+++ b/security/integrity/ima/ima.h -@@ -106,7 +106,7 @@ void ima_add_violation(struct file *file, const unsigned char *filename, - const char *op, const char *cause); - int ima_init_crypto(void); - void ima_putc(struct seq_file *m, void *data, int datalen); --void ima_print_digest(struct seq_file *m, u8 *digest, int size); -+void ima_print_digest(struct seq_file *m, u8 *digest, u32 size); - struct ima_template_desc *ima_template_desc_current(void); - int ima_init_template(void); - -diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c -index 468a3ba..35f3c90 100644 ---- a/security/integrity/ima/ima_fs.c -+++ b/security/integrity/ima/ima_fs.c -@@ -186,9 +186,9 @@ static const struct file_operations ima_measurements_ops = { - .release = seq_release, - }; - --void ima_print_digest(struct seq_file *m, u8 *digest, int size) -+void ima_print_digest(struct seq_file *m, u8 *digest, u32 size) - { -- int i; -+ u32 i; - - for (i = 0; i < size; i++) - seq_printf(m, "%02x", *(digest + i)); -diff --git a/security/integrity/ima/ima_template_lib.c b/security/integrity/ima/ima_template_lib.c -index e8592e7..dcf77b7 100644 ---- a/security/integrity/ima/ima_template_lib.c -+++ b/security/integrity/ima/ima_template_lib.c -@@ -79,7 +79,8 @@ static void ima_show_template_data_ascii(struct seq_file *m, - enum data_formats datafmt, - struct ima_field_data *field_data) - { -- u8 *buf_ptr = field_data->data, buflen = field_data->len; -+ u8 *buf_ptr = field_data->data; -+ u32 buflen = field_data->len; - - switch (datafmt) { - case DATA_FMT_DIGEST_WITH_ALGO: -diff --git a/security/keys/keyring.c b/security/keys/keyring.c -index 2fb2576..04d0d7c 100644 ---- a/security/keys/keyring.c -+++ b/security/keys/keyring.c -@@ -1151,9 +1151,11 @@ void __key_link_end(struct key *keyring, - if (index_key->type == &key_type_keyring) - up_write(&keyring_serialise_link_sem); - -- if (edit && !edit->dead_leaf) { -- key_payload_reserve(keyring, -- keyring->datalen - KEYQUOTA_LINK_BYTES); -+ if (edit) { -+ if (!edit->dead_leaf) { -+ key_payload_reserve(keyring, -+ keyring->datalen - KEYQUOTA_LINK_BYTES); -+ } - assoc_array_cancel_edit(edit); - } - up_write(&keyring->sem); -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index ba17522..2f503c0 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -3955,6 +3955,7 @@ enum { - ALC269_FIXUP_LIFEBOOK, - ALC269_FIXUP_LIFEBOOK_EXTMIC, - ALC269_FIXUP_LIFEBOOK_HP_PIN, -+ ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT, - ALC269_FIXUP_AMIC, - ALC269_FIXUP_DMIC, - ALC269VB_FIXUP_AMIC, -@@ -3973,6 +3974,7 @@ enum { - ALC269_FIXUP_DELL3_MIC_NO_PRESENCE, - ALC269_FIXUP_HEADSET_MODE, - ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC, -+ ALC269_FIXUP_ASPIRE_HEADSET_MIC, - ALC269_FIXUP_ASUS_X101_FUNC, - ALC269_FIXUP_ASUS_X101_VERB, - ALC269_FIXUP_ASUS_X101, -@@ -4096,6 +4098,10 @@ static const struct hda_fixup alc269_fixups[] = { - { } - }, - }, -+ [ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT] = { -+ .type = HDA_FIXUP_FUNC, -+ .v.func = alc269_fixup_pincfg_no_hp_to_lineout, -+ }, - [ALC269_FIXUP_AMIC] = { - .type = HDA_FIXUP_PINS, - .v.pins = (const struct hda_pintbl[]) { -@@ -4214,6 +4220,15 @@ static const struct hda_fixup alc269_fixups[] = { - .type = HDA_FIXUP_FUNC, - .v.func = alc_fixup_headset_mode_no_hp_mic, - }, -+ [ALC269_FIXUP_ASPIRE_HEADSET_MIC] = { -+ .type = HDA_FIXUP_PINS, -+ .v.pins = (const struct hda_pintbl[]) { -+ { 0x19, 0x01a1913c }, /* headset mic w/o jack detect */ -+ { } -+ }, -+ .chained = true, -+ .chain_id = ALC269_FIXUP_HEADSET_MODE, -+ }, - [ALC286_FIXUP_SONY_MIC_NO_PRESENCE] = { - .type = HDA_FIXUP_PINS, - .v.pins = (const struct hda_pintbl[]) { -@@ -4397,6 +4412,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x1025, 0x029b, "Acer 1810TZ", ALC269_FIXUP_INV_DMIC), - SND_PCI_QUIRK(0x1025, 0x0349, "Acer AOD260", ALC269_FIXUP_INV_DMIC), - SND_PCI_QUIRK(0x1025, 0x047c, "Acer AC700", ALC269_FIXUP_ACER_AC700), -+ SND_PCI_QUIRK(0x1025, 0x072d, "Acer Aspire V5-571G", ALC269_FIXUP_ASPIRE_HEADSET_MIC), -+ SND_PCI_QUIRK(0x1025, 0x080d, "Acer Aspire V5-122P", ALC269_FIXUP_ASPIRE_HEADSET_MIC), - SND_PCI_QUIRK(0x1025, 0x0740, "Acer AO725", ALC271_FIXUP_HP_GATE_MIC_JACK), - SND_PCI_QUIRK(0x1025, 0x0742, "Acer AO756", ALC271_FIXUP_HP_GATE_MIC_JACK), - SND_PCI_QUIRK_VENDOR(0x1025, "Acer Aspire", ALC271_FIXUP_DMIC), -@@ -4549,6 +4566,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x104d, 0x9084, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ), - SND_PCI_QUIRK_VENDOR(0x104d, "Sony VAIO", ALC269_FIXUP_SONY_VAIO), - SND_PCI_QUIRK(0x10cf, 0x1475, "Lifebook", ALC269_FIXUP_LIFEBOOK), -+ SND_PCI_QUIRK(0x10cf, 0x159f, "Lifebook E780", ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT), - SND_PCI_QUIRK(0x10cf, 0x15dc, "Lifebook T731", ALC269_FIXUP_LIFEBOOK_HP_PIN), - SND_PCI_QUIRK(0x10cf, 0x1757, "Lifebook E752", ALC269_FIXUP_LIFEBOOK_HP_PIN), - SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC), -diff --git a/sound/soc/codecs/wm5102.c b/sound/soc/codecs/wm5102.c -index ce9c8e1..fbee45c 100644 ---- a/sound/soc/codecs/wm5102.c -+++ b/sound/soc/codecs/wm5102.c -@@ -41,7 +41,7 @@ struct wm5102_priv { - static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0); - static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0); - static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0); --static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0); -+static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0); - static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0); - - static const struct wm_adsp_region wm5102_dsp1_regions[] = { -diff --git a/sound/soc/codecs/wm5110.c b/sound/soc/codecs/wm5110.c -index 2c3c962..0fce853 100644 ---- a/sound/soc/codecs/wm5110.c -+++ b/sound/soc/codecs/wm5110.c -@@ -167,7 +167,7 @@ static int wm5110_sysclk_ev(struct snd_soc_dapm_widget *w, - static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0); - static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0); - static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0); --static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0); -+static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0); - static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0); - - #define WM5110_NG_SRC(name, base) \ -diff --git a/sound/soc/codecs/wm8737.c b/sound/soc/codecs/wm8737.c -index 2f167a8..62bacb8 100644 ---- a/sound/soc/codecs/wm8737.c -+++ b/sound/soc/codecs/wm8737.c -@@ -494,7 +494,8 @@ static int wm8737_set_bias_level(struct snd_soc_codec *codec, - - /* Fast VMID ramp at 2*2.5k */ - snd_soc_update_bits(codec, WM8737_MISC_BIAS_CONTROL, -- WM8737_VMIDSEL_MASK, 0x4); -+ WM8737_VMIDSEL_MASK, -+ 2 << WM8737_VMIDSEL_SHIFT); - - /* Bring VMID up */ - snd_soc_update_bits(codec, WM8737_POWER_MANAGEMENT, -@@ -508,7 +509,8 @@ static int wm8737_set_bias_level(struct snd_soc_codec *codec, - - /* VMID at 2*300k */ - snd_soc_update_bits(codec, WM8737_MISC_BIAS_CONTROL, -- WM8737_VMIDSEL_MASK, 2); -+ WM8737_VMIDSEL_MASK, -+ 1 << WM8737_VMIDSEL_SHIFT); - - break; - -diff --git a/sound/soc/codecs/wm8903.h b/sound/soc/codecs/wm8903.h -index db94931..0bb4a64 100644 ---- a/sound/soc/codecs/wm8903.h -+++ b/sound/soc/codecs/wm8903.h -@@ -172,7 +172,7 @@ extern int wm8903_mic_detect(struct snd_soc_codec *codec, - #define WM8903_VMID_BUF_ENA_WIDTH 1 /* VMID_BUF_ENA */ - - #define WM8903_VMID_RES_50K 2 --#define WM8903_VMID_RES_250K 3 -+#define WM8903_VMID_RES_250K 4 - #define WM8903_VMID_RES_5K 6 - - /* -diff --git a/sound/soc/codecs/wm8955.c b/sound/soc/codecs/wm8955.c -index 1c1fc61..475fc24 100644 ---- a/sound/soc/codecs/wm8955.c -+++ b/sound/soc/codecs/wm8955.c -@@ -298,7 +298,7 @@ static int wm8955_configure_clocking(struct snd_soc_codec *codec) - snd_soc_update_bits(codec, WM8955_PLL_CONTROL_2, - WM8955_K_17_9_MASK, - (pll.k >> 9) & WM8955_K_17_9_MASK); -- snd_soc_update_bits(codec, WM8955_PLL_CONTROL_2, -+ snd_soc_update_bits(codec, WM8955_PLL_CONTROL_3, - WM8955_K_8_0_MASK, - pll.k & WM8955_K_8_0_MASK); - if (pll.k) -diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c -index edfd4ed..e04dbaa 100644 ---- a/sound/soc/codecs/wm8960.c -+++ b/sound/soc/codecs/wm8960.c -@@ -242,7 +242,7 @@ SOC_SINGLE("PCM Playback -6dB Switch", WM8960_DACCTL1, 7, 1, 0), - SOC_ENUM("ADC Polarity", wm8960_enum[0]), - SOC_SINGLE("ADC High Pass Filter Switch", WM8960_DACCTL1, 0, 1, 0), - --SOC_ENUM("DAC Polarity", wm8960_enum[2]), -+SOC_ENUM("DAC Polarity", wm8960_enum[1]), - SOC_SINGLE_BOOL_EXT("DAC Deemphasis Switch", 0, - wm8960_get_deemph, wm8960_put_deemph), - -diff --git a/sound/soc/codecs/wm8997.c b/sound/soc/codecs/wm8997.c -index 555115e..1461ae61 100644 ---- a/sound/soc/codecs/wm8997.c -+++ b/sound/soc/codecs/wm8997.c -@@ -40,7 +40,7 @@ struct wm8997_priv { - static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0); - static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0); - static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0); --static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0); -+static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0); - static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0); - - static const struct reg_default wm8997_sysclk_reva_patch[] = { -diff --git a/sound/soc/fsl/imx-wm8962.c b/sound/soc/fsl/imx-wm8962.c -index 3a3d17c..6644525 100644 ---- a/sound/soc/fsl/imx-wm8962.c -+++ b/sound/soc/fsl/imx-wm8962.c -@@ -190,7 +190,7 @@ static int imx_wm8962_probe(struct platform_device *pdev) - dev_err(&pdev->dev, "audmux internal port setup failed\n"); - return ret; - } -- imx_audmux_v2_configure_port(ext_port, -+ ret = imx_audmux_v2_configure_port(ext_port, - IMX_AUDMUX_V2_PTCR_SYN, - IMX_AUDMUX_V2_PDCR_RXDSEL(int_port)); - if (ret) { |