diff options
Diffstat (limited to '3.2.71/1070_linux-3.2.71.patch')
| -rw-r--r-- | 3.2.71/1070_linux-3.2.71.patch | 3488 |
1 files changed, 3488 insertions, 0 deletions
diff --git a/3.2.71/1070_linux-3.2.71.patch b/3.2.71/1070_linux-3.2.71.patch new file mode 100644 index 0000000..8702e84 --- /dev/null +++ b/3.2.71/1070_linux-3.2.71.patch @@ -0,0 +1,3488 @@ +diff --git a/Makefile b/Makefile +index 41a626b..9d5fea7 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 2 +-SUBLEVEL = 70 ++SUBLEVEL = 71 + EXTRAVERSION = + NAME = Saber-toothed Squirrel + +diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c +index 53088e2..2ba1226 100644 +--- a/arch/s390/kernel/process.c ++++ b/arch/s390/kernel/process.c +@@ -250,7 +250,7 @@ asmlinkage void execve_tail(void) + { + current->thread.fp_regs.fpc = 0; + if (MACHINE_HAS_IEEE) +- asm volatile("sfpc %0,%0" : : "d" (0)); ++ asm volatile("sfpc %0" : : "d" (0)); + } + + /* +diff --git a/arch/s390/kernel/sclp.S b/arch/s390/kernel/sclp.S +index 95792d8..51ca1c3 100644 +--- a/arch/s390/kernel/sclp.S ++++ b/arch/s390/kernel/sclp.S +@@ -270,6 +270,8 @@ ENTRY(_sclp_print_early) + jno .Lesa2 + ahi %r15,-80 + stmh %r6,%r15,96(%r15) # store upper register halves ++ basr %r13,0 ++ lmh %r0,%r15,.Lzeroes-.(%r13) # clear upper register halves + .Lesa2: + #endif + lr %r10,%r2 # save string pointer +@@ -293,6 +295,8 @@ ENTRY(_sclp_print_early) + #endif + lm %r6,%r15,120(%r15) # restore registers + br %r14 ++.Lzeroes: ++ .fill 64,4,0 + + .LwritedataS4: + .long 0x00760005 # SCLP command for write data +diff --git a/arch/tile/kernel/setup.c b/arch/tile/kernel/setup.c +index a09b6c3..bf3e71a 100644 +--- a/arch/tile/kernel/setup.c ++++ b/arch/tile/kernel/setup.c +@@ -973,7 +973,7 @@ static void __init load_hv_initrd(void) + + void __init free_initrd_mem(unsigned long begin, unsigned long end) + { +- free_bootmem(__pa(begin), end - begin); ++ free_bootmem_late(__pa(begin), end - begin); + } + + #else +diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h +index 9171618..93ce7e4 100644 +--- a/arch/x86/include/asm/kvm_host.h ++++ b/arch/x86/include/asm/kvm_host.h +@@ -472,7 +472,7 @@ struct kvm_arch { + struct kvm_pic *vpic; + struct kvm_ioapic *vioapic; + struct kvm_pit *vpit; +- int vapics_in_nmi_mode; ++ atomic_t vapics_in_nmi_mode; + + unsigned int tss_addr; + struct page *apic_access_page; +diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c +index cced57f..ab98fe5 100644 +--- a/arch/x86/kvm/i8254.c ++++ b/arch/x86/kvm/i8254.c +@@ -318,7 +318,7 @@ static void pit_do_work(struct work_struct *work) + * LVT0 to NMI delivery. Other PIC interrupts are just sent to + * VCPU0, and only if its LVT0 is in EXTINT mode. + */ +- if (kvm->arch.vapics_in_nmi_mode > 0) ++ if (atomic_read(&kvm->arch.vapics_in_nmi_mode) > 0) + kvm_for_each_vcpu(i, vcpu, kvm) + kvm_apic_nmi_wd_deliver(vcpu); + } +diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c +index 176205a..055cc49 100644 +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -757,10 +757,10 @@ static void apic_manage_nmi_watchdog(struct kvm_lapic *apic, u32 lvt0_val) + if (!nmi_wd_enabled) { + apic_debug("Receive NMI setting on APIC_LVT0 " + "for cpu %d\n", apic->vcpu->vcpu_id); +- apic->vcpu->kvm->arch.vapics_in_nmi_mode++; ++ atomic_inc(&apic->vcpu->kvm->arch.vapics_in_nmi_mode); + } + } else if (nmi_wd_enabled) +- apic->vcpu->kvm->arch.vapics_in_nmi_mode--; ++ atomic_dec(&apic->vcpu->kvm->arch.vapics_in_nmi_mode); + } + + static int apic_reg_write(struct kvm_lapic *apic, u32 reg, u32 val) +@@ -1253,6 +1253,7 @@ void kvm_apic_post_state_restore(struct kvm_vcpu *vcpu) + + apic_update_ppr(apic); + hrtimer_cancel(&apic->lapic_timer.timer); ++ apic_manage_nmi_watchdog(apic, apic_get_reg(apic, APIC_LVT0)); + update_divide_count(apic); + start_apic_timer(apic); + apic->irr_pending = true; +diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c +index 5189fe8..81afe1b 100644 +--- a/arch/x86/xen/enlighten.c ++++ b/arch/x86/xen/enlighten.c +@@ -321,6 +321,7 @@ static void set_aliased_prot(void *v, pgprot_t prot) + pte_t pte; + unsigned long pfn; + struct page *page; ++ unsigned char dummy; + + ptep = lookup_address((unsigned long)v, &level); + BUG_ON(ptep == NULL); +@@ -330,6 +331,32 @@ static void set_aliased_prot(void *v, pgprot_t prot) + + pte = pfn_pte(pfn, prot); + ++ /* ++ * Careful: update_va_mapping() will fail if the virtual address ++ * we're poking isn't populated in the page tables. We don't ++ * need to worry about the direct map (that's always in the page ++ * tables), but we need to be careful about vmap space. In ++ * particular, the top level page table can lazily propagate ++ * entries between processes, so if we've switched mms since we ++ * vmapped the target in the first place, we might not have the ++ * top-level page table entry populated. ++ * ++ * We disable preemption because we want the same mm active when ++ * we probe the target and when we issue the hypercall. We'll ++ * have the same nominal mm, but if we're a kernel thread, lazy ++ * mm dropping could change our pgd. ++ * ++ * Out of an abundance of caution, this uses __get_user() to fault ++ * in the target address just in case there's some obscure case ++ * in which the target address isn't readable. ++ */ ++ ++ preempt_disable(); ++ ++ pagefault_disable(); /* Avoid warnings due to being atomic. */ ++ __get_user(dummy, (unsigned char __user __force *)v); ++ pagefault_enable(); ++ + if (HYPERVISOR_update_va_mapping((unsigned long)v, pte, 0)) + BUG(); + +@@ -341,6 +368,8 @@ static void set_aliased_prot(void *v, pgprot_t prot) + BUG(); + } else + kmap_flush_unused(); ++ ++ preempt_enable(); + } + + static void xen_alloc_ldt(struct desc_struct *ldt, unsigned entries) +@@ -348,6 +377,17 @@ static void xen_alloc_ldt(struct desc_struct *ldt, unsigned entries) + const unsigned entries_per_page = PAGE_SIZE / LDT_ENTRY_SIZE; + int i; + ++ /* ++ * We need to mark the all aliases of the LDT pages RO. We ++ * don't need to call vm_flush_aliases(), though, since that's ++ * only responsible for flushing aliases out the TLBs, not the ++ * page tables, and Xen will flush the TLB for us if needed. ++ * ++ * To avoid confusing future readers: none of this is necessary ++ * to load the LDT. The hypervisor only checks this when the ++ * LDT is faulted in due to subsequent descriptor access. ++ */ ++ + for(i = 0; i < entries; i += entries_per_page) + set_aliased_prot(ldt + i, PAGE_KERNEL_RO); + } +diff --git a/drivers/acpi/acpica/utxface.c b/drivers/acpi/acpica/utxface.c +index 420ebfe..ecc428e 100644 +--- a/drivers/acpi/acpica/utxface.c ++++ b/drivers/acpi/acpica/utxface.c +@@ -163,10 +163,12 @@ acpi_status acpi_enable_subsystem(u32 flags) + * Obtain a permanent mapping for the FACS. This is required for the + * Global Lock and the Firmware Waking Vector + */ +- status = acpi_tb_initialize_facs(); +- if (ACPI_FAILURE(status)) { +- ACPI_WARNING((AE_INFO, "Could not map the FACS table")); +- return_ACPI_STATUS(status); ++ if (!(flags & ACPI_NO_FACS_INIT)) { ++ status = acpi_tb_initialize_facs(); ++ if (ACPI_FAILURE(status)) { ++ ACPI_WARNING((AE_INFO, "Could not map the FACS table")); ++ return_ACPI_STATUS(status); ++ } + } + + /* +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index fcd8586..4e9beff 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -4107,9 +4107,10 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { + { "ST3320[68]13AS", "SD1[5-9]", ATA_HORKAGE_NONCQ | + ATA_HORKAGE_FIRMWARE_WARN }, + +- /* Seagate Momentus SpinPoint M8 seem to have FPMDA_AA issues */ ++ /* drives which fail FPDMA_AA activation (some may freeze afterwards) */ + { "ST1000LM024 HN-M101MBB", "2AR10001", ATA_HORKAGE_BROKEN_FPDMA_AA }, + { "ST1000LM024 HN-M101MBB", "2BA30001", ATA_HORKAGE_BROKEN_FPDMA_AA }, ++ { "VB0250EAVER", "HPG7", ATA_HORKAGE_BROKEN_FPDMA_AA }, + + /* Blacklist entries taken from Silicon Image 3124/3132 + Windows driver .inf file - also several Linux problem reports */ +@@ -4154,6 +4155,9 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { + { "PIONEER DVD-RW DVR-212D", NULL, ATA_HORKAGE_NOSETXFER }, + { "PIONEER DVD-RW DVR-216D", NULL, ATA_HORKAGE_NOSETXFER }, + ++ /* devices that don't properly handle TRIM commands */ ++ { "SuperSSpeed S238*", NULL, ATA_HORKAGE_NOTRIM, }, ++ + /* + * Some WD SATA-I drives spin up and down erratically when the link + * is put into the slumber mode. We don't have full list of the +@@ -4458,7 +4462,8 @@ static unsigned int ata_dev_set_xfermode(struct ata_device *dev) + else /* In the ancient relic department - skip all of this */ + return 0; + +- err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 0); ++ /* On some disks, this command causes spin-up, so we need longer timeout */ ++ err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 15000); + + DPRINTK("EXIT, err_mask=%x\n", err_mask); + return err_mask; +diff --git a/drivers/ata/libata-pmp.c b/drivers/ata/libata-pmp.c +index 0ba32fe..93ea335 100644 +--- a/drivers/ata/libata-pmp.c ++++ b/drivers/ata/libata-pmp.c +@@ -460,6 +460,13 @@ static void sata_pmp_quirks(struct ata_port *ap) + ATA_LFLAG_NO_SRST | + ATA_LFLAG_ASSUME_ATA; + } ++ } else if (vendor == 0x11ab && devid == 0x4140) { ++ /* Marvell 4140 quirks */ ++ ata_for_each_link(link, ap, EDGE) { ++ /* port 4 is for SEMB device and it doesn't like SRST */ ++ if (link->pmp == 4) ++ link->flags |= ATA_LFLAG_DISABLED; ++ } + } + } + +diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c +index 8460e62..0ac7a5e 100644 +--- a/drivers/ata/libata-scsi.c ++++ b/drivers/ata/libata-scsi.c +@@ -2473,7 +2473,8 @@ static unsigned int ata_scsiop_read_cap(struct ata_scsi_args *args, u8 *rbuf) + rbuf[14] = (lowest_aligned >> 8) & 0x3f; + rbuf[15] = lowest_aligned; + +- if (ata_id_has_trim(args->id)) { ++ if (ata_id_has_trim(args->id) && ++ !(dev->horkage & ATA_HORKAGE_NOTRIM)) { + rbuf[14] |= 0x80; /* TPE */ + + if (ata_id_has_zero_after_trim(args->id)) +diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c +index 9f32f43..e9e8f3b 100644 +--- a/drivers/bluetooth/ath3k.c ++++ b/drivers/bluetooth/ath3k.c +@@ -78,6 +78,7 @@ static struct usb_device_id ath3k_table[] = { + { USB_DEVICE(0x0489, 0xe057) }, + { USB_DEVICE(0x0489, 0xe056) }, + { USB_DEVICE(0x0489, 0xe05f) }, ++ { USB_DEVICE(0x0489, 0xe076) }, + { USB_DEVICE(0x0489, 0xe078) }, + { USB_DEVICE(0x04c5, 0x1330) }, + { USB_DEVICE(0x04CA, 0x3004) }, +@@ -86,6 +87,7 @@ static struct usb_device_id ath3k_table[] = { + { USB_DEVICE(0x04CA, 0x3007) }, + { USB_DEVICE(0x04CA, 0x3008) }, + { USB_DEVICE(0x04CA, 0x300b) }, ++ { USB_DEVICE(0x04CA, 0x300f) }, + { USB_DEVICE(0x04CA, 0x3010) }, + { USB_DEVICE(0x0930, 0x0219) }, + { USB_DEVICE(0x0930, 0x0220) }, +@@ -109,6 +111,7 @@ static struct usb_device_id ath3k_table[] = { + { USB_DEVICE(0x13d3, 0x3408) }, + { USB_DEVICE(0x13d3, 0x3423) }, + { USB_DEVICE(0x13d3, 0x3432) }, ++ { USB_DEVICE(0x13d3, 0x3474) }, + + /* Atheros AR5BBU12 with sflash firmware */ + { USB_DEVICE(0x0489, 0xE02C) }, +@@ -133,6 +136,7 @@ static struct usb_device_id ath3k_blist_tbl[] = { + { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 }, +@@ -141,6 +145,7 @@ static struct usb_device_id ath3k_blist_tbl[] = { + { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 }, +@@ -164,6 +169,7 @@ static struct usb_device_id ath3k_blist_tbl[] = { + { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 }, + + /* Atheros AR5BBU22 with sflash firmware */ + { USB_DEVICE(0x0489, 0xE036), .driver_info = BTUSB_ATH3012 }, +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 92973a3..c5e400b 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -163,6 +163,7 @@ static struct usb_device_id blacklist_table[] = { + { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 }, +@@ -171,6 +172,7 @@ static struct usb_device_id blacklist_table[] = { + { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 }, +@@ -194,6 +196,7 @@ static struct usb_device_id blacklist_table[] = { + { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 }, + + /* Atheros AR5BBU12 with sflash firmware */ + { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE }, +diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c +index 43c4ec3..59d4697 100644 +--- a/drivers/char/agp/intel-gtt.c ++++ b/drivers/char/agp/intel-gtt.c +@@ -1195,7 +1195,7 @@ static inline int needs_idle_maps(void) + /* Query intel_iommu to see if we need the workaround. Presumably that + * was loaded first. + */ +- if ((gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB || ++ if ((gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_D_IG || + gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_M_IG) && + intel_iommu_gfx_mapped) + return 1; +diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c +index dbe76b5..90c76fc 100644 +--- a/drivers/crypto/talitos.c ++++ b/drivers/crypto/talitos.c +@@ -2384,6 +2384,7 @@ static struct talitos_crypto_alg *talitos_alg_alloc(struct device *dev, + break; + default: + dev_err(dev, "unknown algorithm type %d\n", t_alg->algt.type); ++ kfree(t_alg); + return ERR_PTR(-EINVAL); + } + +diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c +index 9b01145..a258101 100644 +--- a/drivers/dma/mv_xor.c ++++ b/drivers/dma/mv_xor.c +@@ -386,7 +386,8 @@ static void __mv_xor_slot_cleanup(struct mv_xor_chan *mv_chan) + dma_cookie_t cookie = 0; + int busy = mv_chan_is_busy(mv_chan); + u32 current_desc = mv_chan_get_current_desc(mv_chan); +- int seen_current = 0; ++ int current_cleaned = 0; ++ struct mv_xor_desc *hw_desc; + + dev_dbg(mv_chan->device->common.dev, "%s %d\n", __func__, __LINE__); + dev_dbg(mv_chan->device->common.dev, "current_desc %x\n", current_desc); +@@ -398,38 +399,57 @@ static void __mv_xor_slot_cleanup(struct mv_xor_chan *mv_chan) + + list_for_each_entry_safe(iter, _iter, &mv_chan->chain, + chain_node) { +- prefetch(_iter); +- prefetch(&_iter->async_tx); + +- /* do not advance past the current descriptor loaded into the +- * hardware channel, subsequent descriptors are either in +- * process or have not been submitted +- */ +- if (seen_current) +- break; ++ /* clean finished descriptors */ ++ hw_desc = iter->hw_desc; ++ if (hw_desc->status & XOR_DESC_SUCCESS) { ++ cookie = mv_xor_run_tx_complete_actions(iter, mv_chan, ++ cookie); + +- /* stop the search if we reach the current descriptor and the +- * channel is busy +- */ +- if (iter->async_tx.phys == current_desc) { +- seen_current = 1; +- if (busy) ++ /* done processing desc, clean slot */ ++ mv_xor_clean_slot(iter, mv_chan); ++ ++ /* break if we did cleaned the current */ ++ if (iter->async_tx.phys == current_desc) { ++ current_cleaned = 1; ++ break; ++ } ++ } else { ++ if (iter->async_tx.phys == current_desc) { ++ current_cleaned = 0; + break; ++ } + } +- +- cookie = mv_xor_run_tx_complete_actions(iter, mv_chan, cookie); +- +- if (mv_xor_clean_slot(iter, mv_chan)) +- break; + } + + if ((busy == 0) && !list_empty(&mv_chan->chain)) { +- struct mv_xor_desc_slot *chain_head; +- chain_head = list_entry(mv_chan->chain.next, +- struct mv_xor_desc_slot, +- chain_node); +- +- mv_xor_start_new_chain(mv_chan, chain_head); ++ if (current_cleaned) { ++ /* ++ * current descriptor cleaned and removed, run ++ * from list head ++ */ ++ iter = list_entry(mv_chan->chain.next, ++ struct mv_xor_desc_slot, ++ chain_node); ++ mv_xor_start_new_chain(mv_chan, iter); ++ } else { ++ if (!list_is_last(&iter->chain_node, &mv_chan->chain)) { ++ /* ++ * descriptors are still waiting after ++ * current, trigger them ++ */ ++ iter = list_entry(iter->chain_node.next, ++ struct mv_xor_desc_slot, ++ chain_node); ++ mv_xor_start_new_chain(mv_chan, iter); ++ } else { ++ /* ++ * some descriptors are still waiting ++ * to be cleaned ++ */ ++ tasklet_schedule(&mv_chan->irq_tasklet); ++ } ++ } + } + + if (cookie > 0) +diff --git a/drivers/dma/mv_xor.h b/drivers/dma/mv_xor.h +index 977b592..ae2cfba 100644 +--- a/drivers/dma/mv_xor.h ++++ b/drivers/dma/mv_xor.h +@@ -30,6 +30,7 @@ + #define XOR_OPERATION_MODE_XOR 0 + #define XOR_OPERATION_MODE_MEMCPY 2 + #define XOR_OPERATION_MODE_MEMSET 4 ++#define XOR_DESC_SUCCESS 0x40000000 + + #define XOR_CURR_DESC(chan) (chan->mmr_base + 0x210 + (chan->idx * 4)) + #define XOR_NEXT_DESC(chan) (chan->mmr_base + 0x200 + (chan->idx * 4)) +diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c +index 09851ce..20110b4 100644 +--- a/drivers/gpu/drm/drm_crtc.c ++++ b/drivers/gpu/drm/drm_crtc.c +@@ -1505,6 +1505,13 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, + if (!drm_core_check_feature(dev, DRIVER_MODESET)) + return -EINVAL; + ++ /* ++ * Universal plane src offsets are only 16.16, prevent havoc for ++ * drivers using universal plane code internally. ++ */ ++ if (crtc_req->x & 0xffff0000 || crtc_req->y & 0xffff0000) ++ return -ERANGE; ++ + mutex_lock(&dev->mode_config.mutex); + obj = drm_mode_object_find(dev, crtc_req->crtc_id, + DRM_MODE_OBJECT_CRTC); +diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c +index 8115557..21e689d 100644 +--- a/drivers/gpu/drm/radeon/radeon_combios.c ++++ b/drivers/gpu/drm/radeon/radeon_combios.c +@@ -1259,10 +1259,15 @@ struct radeon_encoder_lvds *radeon_combios_get_lvds_info(struct radeon_encoder + + if ((RBIOS16(tmp) == lvds->native_mode.hdisplay) && + (RBIOS16(tmp + 2) == lvds->native_mode.vdisplay)) { ++ u32 hss = (RBIOS16(tmp + 21) - RBIOS16(tmp + 19) - 1) * 8; ++ ++ if (hss > lvds->native_mode.hdisplay) ++ hss = (10 - 1) * 8; ++ + lvds->native_mode.htotal = lvds->native_mode.hdisplay + + (RBIOS16(tmp + 17) - RBIOS16(tmp + 19)) * 8; + lvds->native_mode.hsync_start = lvds->native_mode.hdisplay + +- (RBIOS16(tmp + 21) - RBIOS16(tmp + 19) - 1) * 8; ++ hss; + lvds->native_mode.hsync_end = lvds->native_mode.hsync_start + + (RBIOS8(tmp + 23) * 8); + +diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c +index ba7ab79..d2572108 100644 +--- a/drivers/gpu/drm/radeon/radeon_gart.c ++++ b/drivers/gpu/drm/radeon/radeon_gart.c +@@ -171,8 +171,10 @@ void radeon_gart_unbind(struct radeon_device *rdev, unsigned offset, + } + } + } +- mb(); +- radeon_gart_tlb_flush(rdev); ++ if (rdev->gart.ptr) { ++ mb(); ++ radeon_gart_tlb_flush(rdev); ++ } + } + + int radeon_gart_bind(struct radeon_device *rdev, unsigned offset, +@@ -217,8 +219,10 @@ int radeon_gart_bind(struct radeon_device *rdev, unsigned offset, + } + } + } +- mb(); +- radeon_gart_tlb_flush(rdev); ++ if (rdev->gart.ptr) { ++ mb(); ++ radeon_gart_tlb_flush(rdev); ++ } + return 0; + } + +diff --git a/drivers/gpu/drm/radeon/radeon_irq_kms.c b/drivers/gpu/drm/radeon/radeon_irq_kms.c +index 4f9496e..42f5a2b 100644 +--- a/drivers/gpu/drm/radeon/radeon_irq_kms.c ++++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c +@@ -51,10 +51,12 @@ static void radeon_hotplug_work_func(struct work_struct *work) + struct drm_mode_config *mode_config = &dev->mode_config; + struct drm_connector *connector; + ++ mutex_lock(&mode_config->mutex); + if (mode_config->num_connector) { + list_for_each_entry(connector, &mode_config->connector_list, head) + radeon_connector_hotplug(connector); + } ++ mutex_unlock(&mode_config->mutex); + /* Just fire off a uevent and let userspace tell us what to do */ + drm_helper_hpd_irq_event(dev); + } +diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c +index 73fd664..e26a7c3 100644 +--- a/drivers/input/touchscreen/usbtouchscreen.c ++++ b/drivers/input/touchscreen/usbtouchscreen.c +@@ -528,6 +528,9 @@ static int dmc_tsc10_init(struct usbtouch_usb *usbtouch) + goto err_out; + } + ++ /* TSC-25 data sheet specifies a delay after the RESET command */ ++ msleep(150); ++ + /* set coordinate output rate */ + buf[0] = buf[1] = 0xFF; + ret = usb_control_msg(dev, usb_rcvctrlpipe (dev, 0), +diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c +index 80f8bd5..d9f23a4 100644 +--- a/drivers/md/dm-thin.c ++++ b/drivers/md/dm-thin.c +@@ -13,6 +13,7 @@ + #include <linux/init.h> + #include <linux/module.h> + #include <linux/slab.h> ++#include <linux/vmalloc.h> + + #define DM_MSG_PREFIX "thin" + +@@ -158,9 +159,7 @@ static struct bio_prison *prison_create(unsigned nr_cells) + { + unsigned i; + uint32_t nr_buckets = calc_nr_buckets(nr_cells); +- size_t len = sizeof(struct bio_prison) + +- (sizeof(struct hlist_head) * nr_buckets); +- struct bio_prison *prison = kmalloc(len, GFP_KERNEL); ++ struct bio_prison *prison = kmalloc(sizeof(*prison), GFP_KERNEL); + + if (!prison) + return NULL; +@@ -173,9 +172,15 @@ static struct bio_prison *prison_create(unsigned nr_cells) + return NULL; + } + ++ prison->cells = vmalloc(sizeof(*prison->cells) * nr_buckets); ++ if (!prison->cells) { ++ mempool_destroy(prison->cell_pool); ++ kfree(prison); ++ return NULL; ++ } ++ + prison->nr_buckets = nr_buckets; + prison->hash_mask = nr_buckets - 1; +- prison->cells = (struct hlist_head *) (prison + 1); + for (i = 0; i < nr_buckets; i++) + INIT_HLIST_HEAD(prison->cells + i); + +@@ -184,6 +189,7 @@ static struct bio_prison *prison_create(unsigned nr_cells) + + static void prison_destroy(struct bio_prison *prison) + { ++ vfree(prison->cells); + mempool_destroy(prison->cell_pool); + kfree(prison); + } +diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c +index 1de0f5f..6e79c11 100644 +--- a/drivers/md/persistent-data/dm-btree-remove.c ++++ b/drivers/md/persistent-data/dm-btree-remove.c +@@ -309,8 +309,8 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent, + + if (s < 0 && nr_center < -s) { + /* not enough in central node */ +- shift(left, center, nr_center); +- s = nr_center - target; ++ shift(left, center, -nr_center); ++ s += nr_center; + shift(left, right, s); + nr_right += s; + } else +@@ -323,7 +323,7 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent, + if (s > 0 && nr_center < s) { + /* not enough in central node */ + shift(center, right, nr_center); +- s = target - nr_center; ++ s -= nr_center; + shift(left, right, s); + nr_left -= s; + } else +diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c +index bbb2ec5..18f37e0 100644 +--- a/drivers/md/persistent-data/dm-btree.c ++++ b/drivers/md/persistent-data/dm-btree.c +@@ -236,7 +236,7 @@ int dm_btree_del(struct dm_btree_info *info, dm_block_t root) + int r; + struct del_stack *s; + +- s = kmalloc(sizeof(*s), GFP_KERNEL); ++ s = kmalloc(sizeof(*s), GFP_NOIO); + if (!s) + return -ENOMEM; + s->tm = info->tm; +diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c +index aec029a..6e7b002 100644 +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -313,7 +313,7 @@ static void raid1_end_read_request(struct bio *bio, int error) + spin_lock_irqsave(&conf->device_lock, flags); + if (r1_bio->mddev->degraded == conf->raid_disks || + (r1_bio->mddev->degraded == conf->raid_disks-1 && +- !test_bit(Faulty, &conf->mirrors[mirror].rdev->flags))) ++ test_bit(In_sync, &conf->mirrors[mirror].rdev->flags))) + uptodate = 1; + spin_unlock_irqrestore(&conf->device_lock, flags); + } +diff --git a/drivers/media/dvb/frontends/cx24116.c b/drivers/media/dvb/frontends/cx24116.c +index ccd0525..4ff6d15 100644 +--- a/drivers/media/dvb/frontends/cx24116.c ++++ b/drivers/media/dvb/frontends/cx24116.c +@@ -963,6 +963,10 @@ static int cx24116_send_diseqc_msg(struct dvb_frontend *fe, + struct cx24116_state *state = fe->demodulator_priv; + int i, ret; + ++ /* Validate length */ ++ if (d->msg_len > sizeof(d->msg)) ++ return -EINVAL; ++ + /* Dump DiSEqC message */ + if (debug) { + printk(KERN_INFO "cx24116: %s(", __func__); +@@ -974,10 +978,6 @@ static int cx24116_send_diseqc_msg(struct dvb_frontend *fe, + printk(") toneburst=%d\n", toneburst); + } + +- /* Validate length */ +- if (d->msg_len > (CX24116_ARGLEN - CX24116_DISEQC_MSGOFS)) +- return -EINVAL; +- + /* DiSEqC message */ + for (i = 0; i < d->msg_len; i++) + state->dsec_cmd.args[CX24116_DISEQC_MSGOFS + i] = d->msg[i]; +diff --git a/drivers/media/dvb/frontends/s5h1420.c b/drivers/media/dvb/frontends/s5h1420.c +index 3879d2e..507ccae 100644 +--- a/drivers/media/dvb/frontends/s5h1420.c ++++ b/drivers/media/dvb/frontends/s5h1420.c +@@ -180,7 +180,7 @@ static int s5h1420_send_master_cmd (struct dvb_frontend* fe, + int result = 0; + + dprintk("enter %s\n", __func__); +- if (cmd->msg_len > 8) ++ if (cmd->msg_len > sizeof(cmd->msg)) + return -EINVAL; + + /* setup for DISEQC */ +diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c +index 4802f7f..f53d5c8 100644 +--- a/drivers/mmc/card/block.c ++++ b/drivers/mmc/card/block.c +@@ -1285,9 +1285,11 @@ static int mmc_blk_issue_rw_rq(struct mmc_queue *mq, struct request *rqc) + break; + case MMC_BLK_CMD_ERR: + ret = mmc_blk_cmd_err(md, card, brq, req, ret); +- if (!mmc_blk_reset(md, card->host, type)) +- break; +- goto cmd_abort; ++ if (mmc_blk_reset(md, card->host, type)) ++ goto cmd_abort; ++ if (!ret) ++ goto start_new_req; ++ break; + case MMC_BLK_RETRY: + if (retry++ < 5) + break; +diff --git a/drivers/mtd/maps/dc21285.c b/drivers/mtd/maps/dc21285.c +index f43b365..9af1528 100644 +--- a/drivers/mtd/maps/dc21285.c ++++ b/drivers/mtd/maps/dc21285.c +@@ -38,9 +38,9 @@ static void nw_en_write(void) + * we want to write a bit pattern XXX1 to Xilinx to enable + * the write gate, which will be open for about the next 2ms. + */ +- spin_lock_irqsave(&nw_gpio_lock, flags); ++ raw_spin_lock_irqsave(&nw_gpio_lock, flags); + nw_cpld_modify(CPLD_FLASH_WR_ENABLE, CPLD_FLASH_WR_ENABLE); +- spin_unlock_irqrestore(&nw_gpio_lock, flags); ++ raw_spin_unlock_irqrestore(&nw_gpio_lock, flags); + + /* + * let the ISA bus to catch on... +diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c +index 424ca5f..df58db3 100644 +--- a/drivers/mtd/mtd_blkdevs.c ++++ b/drivers/mtd/mtd_blkdevs.c +@@ -214,6 +214,7 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode) + return -ERESTARTSYS; /* FIXME: busy loop! -arnd*/ + + mutex_lock(&dev->lock); ++ mutex_lock(&mtd_table_mutex); + + if (dev->open) + goto unlock; +@@ -236,6 +237,7 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode) + + unlock: + dev->open++; ++ mutex_unlock(&mtd_table_mutex); + mutex_unlock(&dev->lock); + blktrans_dev_put(dev); + return ret; +@@ -246,6 +248,7 @@ error_release: + error_put: + module_put(dev->tr->owner); + kref_put(&dev->ref, blktrans_dev_release); ++ mutex_unlock(&mtd_table_mutex); + mutex_unlock(&dev->lock); + blktrans_dev_put(dev); + return ret; +@@ -260,6 +263,7 @@ static int blktrans_release(struct gendisk *disk, fmode_t mode) + return ret; + + mutex_lock(&dev->lock); ++ mutex_lock(&mtd_table_mutex); + + if (--dev->open) + goto unlock; +@@ -272,6 +276,7 @@ static int blktrans_release(struct gendisk *disk, fmode_t mode) + __put_mtd_device(dev->mtd); + } + unlock: ++ mutex_unlock(&mtd_table_mutex); + mutex_unlock(&dev->lock); + blktrans_dev_put(dev); + return ret; +diff --git a/drivers/net/ethernet/stmicro/stmmac/descs.h b/drivers/net/ethernet/stmicro/stmmac/descs.h +index 9820ec8..e93a0bf 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/descs.h ++++ b/drivers/net/ethernet/stmicro/stmmac/descs.h +@@ -153,6 +153,8 @@ struct dma_desc { + u32 buffer2_size:13; + u32 reserved4:3; + } etx; /* -- enhanced -- */ ++ ++ u64 all_flags; + } des01; + unsigned int des2; + unsigned int des3; +diff --git a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c +index d879763..73e647b 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c ++++ b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c +@@ -232,6 +232,7 @@ static void enh_desc_init_rx_desc(struct dma_desc *p, unsigned int ring_size, + { + int i; + for (i = 0; i < ring_size; i++) { ++ p->des01.all_flags = 0; + p->des01.erx.own = 1; + p->des01.erx.buffer1_size = BUF_SIZE_8KiB - 1; + +@@ -248,7 +249,7 @@ static void enh_desc_init_tx_desc(struct dma_desc *p, unsigned int ring_size) + int i; + + for (i = 0; i < ring_size; i++) { +- p->des01.etx.own = 0; ++ p->des01.all_flags = 0; + ehn_desc_tx_set_on_ring_chain(p, (i == ring_size - 1)); + p++; + } +diff --git a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c +index fda5d2b..5bf9c37 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c ++++ b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c +@@ -126,6 +126,7 @@ static void ndesc_init_rx_desc(struct dma_desc *p, unsigned int ring_size, + { + int i; + for (i = 0; i < ring_size; i++) { ++ p->des01.all_flags = 0; + p->des01.rx.own = 1; + p->des01.rx.buffer1_size = BUF_SIZE_2KiB - 1; + +@@ -141,7 +142,7 @@ static void ndesc_init_tx_desc(struct dma_desc *p, unsigned int ring_size) + { + int i; + for (i = 0; i < ring_size; i++) { +- p->des01.tx.own = 0; ++ p->des01.all_flags = 0; + ndesc_tx_set_on_ring_chain(p, (i == (ring_size - 1))); + p++; + } +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index d4d2bc1..05852e3 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -441,19 +441,17 @@ static void init_dma_desc_rings(struct net_device *dev) + priv->rx_skbuff = + kmalloc(sizeof(struct sk_buff *) * rxsize, GFP_KERNEL); + priv->dma_rx = +- (struct dma_desc *)dma_alloc_coherent(priv->device, +- rxsize * +- sizeof(struct dma_desc), +- &priv->dma_rx_phy, +- GFP_KERNEL); ++ (struct dma_desc *)dma_zalloc_coherent(priv->device, rxsize * ++ sizeof(struct dma_desc), ++ &priv->dma_rx_phy, ++ GFP_KERNEL); + priv->tx_skbuff = kmalloc(sizeof(struct sk_buff *) * txsize, + GFP_KERNEL); + priv->dma_tx = +- (struct dma_desc *)dma_alloc_coherent(priv->device, +- txsize * +- sizeof(struct dma_desc), +- &priv->dma_tx_phy, +- GFP_KERNEL); ++ (struct dma_desc *)dma_zalloc_coherent(priv->device, txsize * ++ sizeof(struct dma_desc), ++ &priv->dma_tx_phy, ++ GFP_KERNEL); + + if ((priv->dma_rx == NULL) || (priv->dma_tx == NULL)) { + pr_err("%s:ERROR allocating the DMA Tx/Rx desc\n", __func__); +diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c +index 73c7081..c646a49 100644 +--- a/drivers/net/ethernet/sun/niu.c ++++ b/drivers/net/ethernet/sun/niu.c +@@ -6670,10 +6670,8 @@ static netdev_tx_t niu_start_xmit(struct sk_buff *skb, + struct sk_buff *skb_new; + + skb_new = skb_realloc_headroom(skb, len); +- if (!skb_new) { +- rp->tx_errors++; ++ if (!skb_new) + goto out_drop; +- } + kfree_skb(skb); + skb = skb_new; + } else +diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c +index ad33126..8d64c16 100644 +--- a/drivers/net/wireless/ath/ath9k/main.c ++++ b/drivers/net/wireless/ath/ath9k/main.c +@@ -235,7 +235,7 @@ static bool ath_prepare_reset(struct ath_softc *sc, bool retry_tx, bool flush) + { + struct ath_hw *ah = sc->sc_ah; + struct ath_common *common = ath9k_hw_common(ah); +- bool ret; ++ bool ret = true; + + ieee80211_stop_queues(sc->hw); + +@@ -245,10 +245,13 @@ static bool ath_prepare_reset(struct ath_softc *sc, bool retry_tx, bool flush) + ath9k_debug_samp_bb_mac(sc); + ath9k_hw_disable_interrupts(ah); + +- ret = ath_drain_all_txq(sc, retry_tx); +- +- if (!ath_stoprecv(sc)) +- ret = false; ++ if (AR_SREV_9300_20_OR_LATER(ah)) { ++ ret &= ath_stoprecv(sc); ++ ret &= ath_drain_all_txq(sc, retry_tx); ++ } else { ++ ret &= ath_drain_all_txq(sc, retry_tx); ++ ret &= ath_stoprecv(sc); ++ } + + if (!flush) { + if (ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) +diff --git a/drivers/pcmcia/topic.h b/drivers/pcmcia/topic.h +index 615a45a..582688fe 100644 +--- a/drivers/pcmcia/topic.h ++++ b/drivers/pcmcia/topic.h +@@ -104,6 +104,9 @@ + #define TOPIC_EXCA_IF_CONTROL 0x3e /* 8 bit */ + #define TOPIC_EXCA_IFC_33V_ENA 0x01 + ++#define TOPIC_PCI_CFG_PPBCN 0x3e /* 16-bit */ ++#define TOPIC_PCI_CFG_PPBCN_WBEN 0x0400 ++ + static void topic97_zoom_video(struct pcmcia_socket *sock, int onoff) + { + struct yenta_socket *socket = container_of(sock, struct yenta_socket, socket); +@@ -138,6 +141,7 @@ static int topic97_override(struct yenta_socket *socket) + static int topic95_override(struct yenta_socket *socket) + { + u8 fctrl; ++ u16 ppbcn; + + /* enable 3.3V support for 16bit cards */ + fctrl = exca_readb(socket, TOPIC_EXCA_IF_CONTROL); +@@ -146,6 +150,18 @@ static int topic95_override(struct yenta_socket *socket) + /* tell yenta to use exca registers to power 16bit cards */ + socket->flags |= YENTA_16BIT_POWER_EXCA | YENTA_16BIT_POWER_DF; + ++ /* Disable write buffers to prevent lockups under load with numerous ++ Cardbus cards, observed on Tecra 500CDT and reported elsewhere on the ++ net. This is not a power-on default according to the datasheet ++ but some BIOSes seem to set it. */ ++ if (pci_read_config_word(socket->dev, TOPIC_PCI_CFG_PPBCN, &ppbcn) == 0 ++ && socket->dev->revision <= 7 ++ && (ppbcn & TOPIC_PCI_CFG_PPBCN_WBEN)) { ++ ppbcn &= ~TOPIC_PCI_CFG_PPBCN_WBEN; ++ pci_write_config_word(socket->dev, TOPIC_PCI_CFG_PPBCN, ppbcn); ++ dev_info(&socket->dev->dev, "Disabled ToPIC95 Cardbus write buffers.\n"); ++ } ++ + return 0; + } + +diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c +index 1d3bcce..e57f5de 100644 +--- a/drivers/platform/x86/dell-laptop.c ++++ b/drivers/platform/x86/dell-laptop.c +@@ -215,7 +215,6 @@ static struct dmi_system_id __devinitdata dell_quirks[] = { + }; + + static struct calling_interface_buffer *buffer; +-static struct page *bufferpage; + static DEFINE_MUTEX(buffer_mutex); + + static int hwswitch_state; +@@ -715,11 +714,10 @@ static int __init dell_init(void) + * Allocate buffer below 4GB for SMI data--only 32-bit physical addr + * is passed to SMI handler. + */ +- bufferpage = alloc_page(GFP_KERNEL | GFP_DMA32); ++ buffer = (void *)__get_free_page(GFP_KERNEL | GFP_DMA32); + +- if (!bufferpage) ++ if (!buffer) + goto fail_buffer; +- buffer = page_address(bufferpage); + + ret = dell_setup_rfkill(); + +@@ -788,7 +786,7 @@ fail_backlight: + fail_filter: + dell_cleanup_rfkill(); + fail_rfkill: +- free_page((unsigned long)bufferpage); ++ free_page((unsigned long)buffer); + fail_buffer: + platform_device_del(platform_device); + fail_platform_device2: +diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c +index a36addf..04a6928 100644 +--- a/drivers/platform/x86/ideapad-laptop.c ++++ b/drivers/platform/x86/ideapad-laptop.c +@@ -407,7 +407,8 @@ const struct ideapad_rfk_data ideapad_rfk_data[] = { + + static int ideapad_rfk_set(void *data, bool blocked) + { +- unsigned long opcode = (unsigned long)data; ++ unsigned long dev = (unsigned long)data; ++ int opcode = ideapad_rfk_data[dev].opcode; + + return write_ec_cmd(ideapad_handle, opcode, !blocked); + } +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index adba3d6..2dd9838 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -726,7 +726,7 @@ static int suspend_prepare(struct regulator_dev *rdev, suspend_state_t state) + static void print_constraints(struct regulator_dev *rdev) + { + struct regulation_constraints *constraints = rdev->constraints; +- char buf[80] = ""; ++ char buf[160] = ""; + int count = 0; + int ret; + +diff --git a/drivers/scsi/ipr.h b/drivers/scsi/ipr.h +index ac84736..a9932bd 100644 +--- a/drivers/scsi/ipr.h ++++ b/drivers/scsi/ipr.h +@@ -251,7 +251,7 @@ + #define IPR_RUNTIME_RESET 0x40000000 + + #define IPR_IPL_INIT_MIN_STAGE_TIME 5 +-#define IPR_IPL_INIT_DEFAULT_STAGE_TIME 15 ++#define IPR_IPL_INIT_DEFAULT_STAGE_TIME 30 + #define IPR_IPL_INIT_STAGE_UNKNOWN 0x0 + #define IPR_IPL_INIT_STAGE_TRANSOP 0xB0000000 + #define IPR_IPL_INIT_STAGE_MASK 0xff000000 +diff --git a/drivers/staging/iio/dac/ad5624r_spi.c b/drivers/staging/iio/dac/ad5624r_spi.c +index 284d8790..8e81fce 100644 +--- a/drivers/staging/iio/dac/ad5624r_spi.c ++++ b/drivers/staging/iio/dac/ad5624r_spi.c +@@ -49,7 +49,7 @@ static const struct ad5624r_chip_info ad5624r_chip_info_tbl[] = { + }; + + static int ad5624r_spi_write(struct spi_device *spi, +- u8 cmd, u8 addr, u16 val, u8 len) ++ u8 cmd, u8 addr, u16 val, u8 shift) + { + u32 data; + u8 msg[3]; +@@ -62,7 +62,7 @@ static int ad5624r_spi_write(struct spi_device *spi, + * 14-, 12-bit input code followed by 0, 2, or 4 don't care bits, + * for the AD5664R, AD5644R, and AD5624R, respectively. + */ +- data = (0 << 22) | (cmd << 19) | (addr << 16) | (val << (16 - len)); ++ data = (0 << 22) | (cmd << 19) | (addr << 16) | (val << shift); + msg[0] = data >> 16; + msg[1] = data >> 8; + msg[2] = data; +diff --git a/drivers/staging/rtl8712/rtl8712_recv.c b/drivers/staging/rtl8712/rtl8712_recv.c +index 6d69265..a33bece 100644 +--- a/drivers/staging/rtl8712/rtl8712_recv.c ++++ b/drivers/staging/rtl8712/rtl8712_recv.c +@@ -1076,7 +1076,8 @@ static int recvbuf2recvframe(struct _adapter *padapter, struct sk_buff *pskb) + /* for first fragment packet, driver need allocate 1536 + + * drvinfo_sz + RXDESC_SIZE to defrag packet. */ + if ((mf == 1) && (frag == 0)) +- alloc_sz = 1658;/*1658+6=1664, 1664 is 128 alignment.*/ ++ /*1658+6=1664, 1664 is 128 alignment.*/ ++ alloc_sz = max_t(u16, tmp_len, 1658); + else + alloc_sz = tmp_len; + /* 2 is for IP header 4 bytes alignment in QoS packet case. +diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c +index d540a06..077c506 100644 +--- a/drivers/staging/vt6655/device_main.c ++++ b/drivers/staging/vt6655/device_main.c +@@ -1602,6 +1602,10 @@ static int device_rx_srv(PSDevice pDevice, unsigned int uIdx) { + // DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "pDevice->pCurrRD = %x, works = %d\n", pRD, works); + if (works++>15) + break; ++ ++ if (!pRD->pRDInfo->skb) ++ break; ++ + if (device_receive_frame(pDevice, pRD)) { + if (!device_alloc_rx_buf(pDevice,pRD)) { + DBG_PRT(MSG_LEVEL_ERR, KERN_ERR +diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c +index ae4e7da..59fb984 100644 +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -4509,6 +4509,7 @@ int iscsit_release_sessions_for_tpg(struct iscsi_portal_group *tpg, int force) + struct iscsi_session *sess; + struct se_portal_group *se_tpg = &tpg->tpg_se_tpg; + struct se_session *se_sess, *se_sess_tmp; ++ LIST_HEAD(free_list); + int session_count = 0; + + spin_lock_bh(&se_tpg->session_lock); +@@ -4530,14 +4531,17 @@ int iscsit_release_sessions_for_tpg(struct iscsi_portal_group *tpg, int force) + } + atomic_set(&sess->session_reinstatement, 1); + spin_unlock(&sess->conn_lock); +- spin_unlock_bh(&se_tpg->session_lock); + +- iscsit_free_session(sess); +- spin_lock_bh(&se_tpg->session_lock); ++ list_move_tail(&se_sess->sess_list, &free_list); ++ } ++ spin_unlock_bh(&se_tpg->session_lock); + ++ list_for_each_entry_safe(se_sess, se_sess_tmp, &free_list, sess_list) { ++ sess = (struct iscsi_session *)se_sess->fabric_sess_ptr; ++ ++ iscsit_free_session(sess); + session_count++; + } +- spin_unlock_bh(&se_tpg->session_lock); + + pr_debug("Released %d iSCSI Session(s) from Target Portal" + " Group: %hu\n", session_count, tpg->tpgt); +diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c +index 99fcb8c..9645186 100644 +--- a/drivers/tty/serial/atmel_serial.c ++++ b/drivers/tty/serial/atmel_serial.c +@@ -229,8 +229,7 @@ void atmel_config_rs485(struct uart_port *port, struct serial_rs485 *rs485conf) + if (rs485conf->flags & SER_RS485_ENABLED) { + dev_dbg(port->dev, "Setting UART to RS485\n"); + atmel_port->tx_done_mask = ATMEL_US_TXEMPTY; +- if ((rs485conf->delay_rts_after_send) > 0) +- UART_PUT_TTGR(port, rs485conf->delay_rts_after_send); ++ UART_PUT_TTGR(port, rs485conf->delay_rts_after_send); + mode |= ATMEL_US_USMODE_RS485; + } else { + dev_dbg(port->dev, "Setting UART to RS232\n"); +@@ -305,9 +304,7 @@ static void atmel_set_mctrl(struct uart_port *port, u_int mctrl) + + if (atmel_port->rs485.flags & SER_RS485_ENABLED) { + dev_dbg(port->dev, "Setting UART to RS485\n"); +- if ((atmel_port->rs485.delay_rts_after_send) > 0) +- UART_PUT_TTGR(port, +- atmel_port->rs485.delay_rts_after_send); ++ UART_PUT_TTGR(port, atmel_port->rs485.delay_rts_after_send); + mode |= ATMEL_US_USMODE_RS485; + } else { + dev_dbg(port->dev, "Setting UART to RS232\n"); +@@ -1229,9 +1226,7 @@ static void atmel_set_termios(struct uart_port *port, struct ktermios *termios, + + if (atmel_port->rs485.flags & SER_RS485_ENABLED) { + dev_dbg(port->dev, "Setting UART to RS485\n"); +- if ((atmel_port->rs485.delay_rts_after_send) > 0) +- UART_PUT_TTGR(port, +- atmel_port->rs485.delay_rts_after_send); ++ UART_PUT_TTGR(port, atmel_port->rs485.delay_rts_after_send); + mode |= ATMEL_US_USMODE_RS485; + } else { + dev_dbg(port->dev, "Setting UART to RS232\n"); +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index 57d6302..ca666d0 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -1295,6 +1295,11 @@ skip_countries: + + acm_table[minor] = acm; + ++ if (quirks & CLEAR_HALT_CONDITIONS) { ++ usb_clear_halt(usb_dev, usb_rcvbulkpipe(usb_dev, epread->bEndpointAddress)); ++ usb_clear_halt(usb_dev, usb_sndbulkpipe(usb_dev, epwrite->bEndpointAddress)); ++ } ++ + return 0; + alloc_fail7: + for (i = 0; i < ACM_NW; i++) +@@ -1574,6 +1579,10 @@ static const struct usb_device_id acm_ids[] = { + .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */ + }, + ++ { USB_DEVICE(0x2912, 0x0001), /* ATOL FPrint */ ++ .driver_info = CLEAR_HALT_CONDITIONS, ++ }, ++ + /* Nokia S60 phones expose two ACM channels. The first is + * a modem and is picked up by the standard AT-command + * information below. The second is 'vendor-specific' but +diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h +index c3f1b36..7aa5e9a 100644 +--- a/drivers/usb/class/cdc-acm.h ++++ b/drivers/usb/class/cdc-acm.h +@@ -127,3 +127,4 @@ struct acm { + #define NO_CAP_LINE 4 + #define NOT_A_MODEM 8 + #define NO_DATA_INTERFACE 16 ++#define CLEAR_HALT_CONDITIONS BIT(7) +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index 18286ce..7cfe286 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -2157,9 +2157,6 @@ static unsigned hub_is_wusb(struct usb_hub *hub) + #define HUB_LONG_RESET_TIME 200 + #define HUB_RESET_TIMEOUT 800 + +-static int hub_port_reset(struct usb_hub *hub, int port1, +- struct usb_device *udev, unsigned int delay, bool warm); +- + /* Is a USB 3.0 port in the Inactive or Complinance Mode state? + * Port worm reset is required to recover + */ +@@ -2239,44 +2236,6 @@ delay: + return -EBUSY; + } + +-static void hub_port_finish_reset(struct usb_hub *hub, int port1, +- struct usb_device *udev, int *status) +-{ +- switch (*status) { +- case 0: +- /* TRSTRCY = 10 ms; plus some extra */ +- msleep(10 + 40); +- if (udev) { +- struct usb_hcd *hcd = bus_to_hcd(udev->bus); +- +- update_devnum(udev, 0); +- /* The xHC may think the device is already reset, +- * so ignore the status. +- */ +- if (hcd->driver->reset_device) +- hcd->driver->reset_device(hcd, udev); +- } +- /* FALL THROUGH */ +- case -ENOTCONN: +- case -ENODEV: +- clear_port_feature(hub->hdev, +- port1, USB_PORT_FEAT_C_RESET); +- if (hub_is_superspeed(hub->hdev)) { +- clear_port_feature(hub->hdev, port1, +- USB_PORT_FEAT_C_BH_PORT_RESET); +- clear_port_feature(hub->hdev, port1, +- USB_PORT_FEAT_C_PORT_LINK_STATE); +- clear_port_feature(hub->hdev, port1, +- USB_PORT_FEAT_C_CONNECTION); +- } +- if (udev) +- usb_set_device_state(udev, *status +- ? USB_STATE_NOTATTACHED +- : USB_STATE_DEFAULT); +- break; +- } +-} +- + /* Handle port reset and port warm(BH) reset (for USB3 protocol ports) */ + static int hub_port_reset(struct usb_hub *hub, int port1, + struct usb_device *udev, unsigned int delay, bool warm) +@@ -2299,13 +2258,9 @@ static int hub_port_reset(struct usb_hub *hub, int port1, + * If the caller hasn't explicitly requested a warm reset, + * double check and see if one is needed. + */ +- status = hub_port_status(hub, port1, +- &portstatus, &portchange); +- if (status < 0) +- goto done; +- +- if (hub_port_warm_reset_required(hub, portstatus)) +- warm = true; ++ if (hub_port_status(hub, port1, &portstatus, &portchange) == 0) ++ if (hub_port_warm_reset_required(hub, portstatus)) ++ warm = true; + } + + /* Reset the port */ +@@ -2328,11 +2283,19 @@ static int hub_port_reset(struct usb_hub *hub, int port1, + + /* Check for disconnect or reset */ + if (status == 0 || status == -ENOTCONN || status == -ENODEV) { +- hub_port_finish_reset(hub, port1, udev, &status); ++ clear_port_feature(hub->hdev, port1, ++ USB_PORT_FEAT_C_RESET); + + if (!hub_is_superspeed(hub->hdev)) + goto done; + ++ clear_port_feature(hub->hdev, port1, ++ USB_PORT_FEAT_C_BH_PORT_RESET); ++ clear_port_feature(hub->hdev, port1, ++ USB_PORT_FEAT_C_PORT_LINK_STATE); ++ clear_port_feature(hub->hdev, port1, ++ USB_PORT_FEAT_C_CONNECTION); ++ + /* + * If a USB 3.0 device migrates from reset to an error + * state, re-issue the warm reset. +@@ -2366,6 +2329,26 @@ static int hub_port_reset(struct usb_hub *hub, int port1, + port1); + + done: ++ if (status == 0) { ++ /* TRSTRCY = 10 ms; plus some extra */ ++ msleep(10 + 40); ++ if (udev) { ++ struct usb_hcd *hcd = bus_to_hcd(udev->bus); ++ ++ update_devnum(udev, 0); ++ /* The xHC may think the device is already reset, ++ * so ignore the status. ++ */ ++ if (hcd->driver->reset_device) ++ hcd->driver->reset_device(hcd, udev); ++ ++ usb_set_device_state(udev, USB_STATE_DEFAULT); ++ } ++ } else { ++ if (udev) ++ usb_set_device_state(udev, USB_STATE_NOTATTACHED); ++ } ++ + if (!hub_is_superspeed(hub->hdev)) + up_read(&ehci_cf_port_reset_rwsem); + +diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c +index c4134e8..24864d4 100644 +--- a/drivers/usb/dwc3/ep0.c ++++ b/drivers/usb/dwc3/ep0.c +@@ -498,6 +498,10 @@ static int dwc3_ep0_std_request(struct dwc3 *dwc, struct usb_ctrlrequest *ctrl) + dev_vdbg(dwc->dev, "USB_REQ_SET_CONFIGURATION\n"); + ret = dwc3_ep0_set_config(dwc, ctrl); + break; ++ case USB_REQ_SET_INTERFACE: ++ dev_vdbg(dwc->dev ,"USB_REQ_SET_INTERFACE"); ++ dwc->start_config_issued = false; ++ /* Fall through */ + default: + dev_vdbg(dwc->dev, "Forwarding to gadget driver\n"); + ret = dwc3_ep0_delegate_req(dwc, ctrl); +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index 5f2e3d0..b4623f1 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -171,6 +171,8 @@ int dwc3_send_gadget_ep_cmd(struct dwc3 *dwc, unsigned ep, + if (!(reg & DWC3_DEPCMD_CMDACT)) { + dev_vdbg(dwc->dev, "Command Complete --> %d\n", + DWC3_DEPCMD_STATUS(reg)); ++ if (DWC3_DEPCMD_STATUS(reg)) ++ return -EINVAL; + return 0; + } + +diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c +index c1fa92e..8605813 100644 +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -449,10 +449,13 @@ static void xhci_hub_report_link_state(struct xhci_hcd *xhci, + u32 pls = status_reg & PORT_PLS_MASK; + + /* resume state is a xHCI internal state. +- * Do not report it to usb core. ++ * Do not report it to usb core, instead, pretend to be U3, ++ * thus usb core knows it's not ready for transfer + */ +- if (pls == XDEV_RESUME) ++ if (pls == XDEV_RESUME) { ++ *status |= USB_SS_PORT_LS_U3; + return; ++ } + + /* When the CAS bit is set then warm reset + * should be performed on port +@@ -592,7 +595,14 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, + status |= USB_PORT_STAT_C_RESET << 16; + /* USB3.0 only */ + if (hcd->speed == HCD_USB3) { +- if ((temp & PORT_PLC)) ++ /* Port link change with port in resume state should not be ++ * reported to usbcore, as this is an internal state to be ++ * handled by xhci driver. Reporting PLC to usbcore may ++ * cause usbcore clearing PLC first and port change event ++ * irq won't be generated. ++ */ ++ if ((temp & PORT_PLC) && ++ (temp & PORT_PLS_MASK) != XDEV_RESUME) + status |= USB_PORT_STAT_C_LINK_STATE << 16; + if ((temp & PORT_WRC)) + status |= USB_PORT_STAT_C_BH_RESET << 16; +diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c +index 0f4a41d..d5d2af5 100644 +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -1330,10 +1330,10 @@ int xhci_endpoint_init(struct xhci_hcd *xhci, + /* Attempt to use the ring cache */ + if (virt_dev->num_rings_cached == 0) + return -ENOMEM; ++ virt_dev->num_rings_cached--; + virt_dev->eps[ep_index].new_ring = + virt_dev->ring_cache[virt_dev->num_rings_cached]; + virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL; +- virt_dev->num_rings_cached--; + xhci_reinit_cached_ring(xhci, virt_dev->eps[ep_index].new_ring, + usb_endpoint_xfer_isoc(&ep->desc) ? true : false); + } +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 5c535a8..950a8cc 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -3361,6 +3361,9 @@ int xhci_discover_or_reset_device(struct usb_hcd *hcd, struct usb_device *udev) + return -EINVAL; + } + ++ if (virt_dev->tt_info) ++ old_active_eps = virt_dev->tt_info->active_eps; ++ + if (virt_dev->udev != udev) { + /* If the virt_dev and the udev does not match, this virt_dev + * may belong to another udev. +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index 073a0f98..1a19724 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -193,6 +193,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x1FB9, 0x0602) }, /* Lake Shore Model 648 Magnet Power Supply */ + { USB_DEVICE(0x1FB9, 0x0700) }, /* Lake Shore Model 737 VSM Controller */ + { USB_DEVICE(0x1FB9, 0x0701) }, /* Lake Shore Model 776 Hall Matrix */ ++ { USB_DEVICE(0x2626, 0xEA60) }, /* Aruba Networks 7xxx USB Serial Console */ + { USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */ + { USB_DEVICE(0x3195, 0xF280) }, /* Link Instruments MSO-28 */ + { USB_DEVICE(0x3195, 0xF281) }, /* Link Instruments MSO-28 */ +diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h +index 68e8552..a0c4cc4 100644 +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -2019,6 +2019,18 @@ UNUSUAL_DEV( 0x1908, 0x3335, 0x0200, 0x0200, + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_NO_READ_DISC_INFO ), + ++/* Reported by Oliver Neukum <oneukum@suse.com> ++ * This device morphes spontaneously into another device if the access ++ * pattern of Windows isn't followed. Thus writable media would be dirty ++ * if the initial instance is used. So the device is limited to its ++ * virtual CD. ++ * And yes, the concept that BCD goes up to 9 is not heeded */ ++UNUSUAL_DEV( 0x19d2, 0x1225, 0x0000, 0xffff, ++ "ZTE,Incorporated", ++ "ZTE WCDMA Technologies MSM", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_SINGLE_LUN ), ++ + /* Reported by Sven Geggus <sven-usbst@geggus.net> + * This encrypted pen drive returns bogus data for the initial READ(10). + */ +diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c +index be32b1b..738707a 100644 +--- a/drivers/vhost/vhost.c ++++ b/drivers/vhost/vhost.c +@@ -883,6 +883,7 @@ long vhost_dev_ioctl(struct vhost_dev *d, unsigned int ioctl, unsigned long arg) + } + if (eventfp != d->log_file) { + filep = d->log_file; ++ d->log_file = eventfp; + ctx = d->log_ctx; + d->log_ctx = eventfp ? + eventfd_ctx_fileget(eventfp) : NULL; +diff --git a/drivers/watchdog/omap_wdt.c b/drivers/watchdog/omap_wdt.c +index 2b4acb8..8a93753 100644 +--- a/drivers/watchdog/omap_wdt.c ++++ b/drivers/watchdog/omap_wdt.c +@@ -150,6 +150,13 @@ static int omap_wdt_open(struct inode *inode, struct file *file) + + pm_runtime_get_sync(wdev->dev); + ++ /* ++ * Make sure the watchdog is disabled. This is unfortunately required ++ * because writing to various registers with the watchdog running has no ++ * effect. ++ */ ++ omap_wdt_disable(wdev); ++ + /* initialize prescaler */ + while (__raw_readl(base + OMAP_WATCHDOG_WPS) & 0x01) + cpu_relax(); +diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c +index 879ed88..bf1df72 100644 +--- a/fs/9p/vfs_inode.c ++++ b/fs/9p/vfs_inode.c +@@ -527,8 +527,7 @@ static struct inode *v9fs_qid_iget(struct super_block *sb, + unlock_new_inode(inode); + return inode; + error: +- unlock_new_inode(inode); +- iput(inode); ++ iget_failed(inode); + return ERR_PTR(retval); + + } +diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c +index 30d4fa8..dbbc83f 100644 +--- a/fs/9p/vfs_inode_dotl.c ++++ b/fs/9p/vfs_inode_dotl.c +@@ -169,8 +169,7 @@ static struct inode *v9fs_qid_iget_dotl(struct super_block *sb, + unlock_new_inode(inode); + return inode; + error: +- unlock_new_inode(inode); +- iput(inode); ++ iget_failed(inode); + return ERR_PTR(retval); + + } +diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c +index a1fee6f..b3d1efe 100644 +--- a/fs/btrfs/inode-map.c ++++ b/fs/btrfs/inode-map.c +@@ -244,6 +244,7 @@ void btrfs_unpin_free_ino(struct btrfs_root *root) + { + struct btrfs_free_space_ctl *ctl = root->free_ino_ctl; + struct rb_root *rbroot = &root->free_ino_pinned->free_space_offset; ++ spinlock_t *rbroot_lock = &root->free_ino_pinned->tree_lock; + struct btrfs_free_space *info; + struct rb_node *n; + u64 count; +@@ -252,24 +253,30 @@ void btrfs_unpin_free_ino(struct btrfs_root *root) + return; + + while (1) { ++ bool add_to_ctl = true; ++ ++ spin_lock(rbroot_lock); + n = rb_first(rbroot); +- if (!n) ++ if (!n) { ++ spin_unlock(rbroot_lock); + break; ++ } + + info = rb_entry(n, struct btrfs_free_space, offset_index); + BUG_ON(info->bitmap); + + if (info->offset > root->cache_progress) +- goto free; ++ add_to_ctl = false; + else if (info->offset + info->bytes > root->cache_progress) + count = root->cache_progress - info->offset + 1; + else + count = info->bytes; + +- __btrfs_add_free_space(ctl, info->offset, count); +-free: + rb_erase(&info->offset_index, rbroot); +- kfree(info); ++ spin_unlock(rbroot_lock); ++ if (add_to_ctl) ++ __btrfs_add_free_space(ctl, info->offset, count); ++ kmem_cache_free(btrfs_free_space_cachep, info); + } + } + +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index 52bacff..ba26540 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -2448,6 +2448,20 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd, + new_key.offset += skip; + } + ++ /* ++ * Don't copy an inline extent into an offset ++ * greater than zero. Having an inline extent ++ * at such an offset results in chaos as btrfs ++ * isn't prepared for such cases. Just skip ++ * this case for the same reasons as commented ++ * at btrfs_ioctl_clone(). ++ */ ++ if (new_key.offset > 0) { ++ ret = -EOPNOTSUPP; ++ btrfs_end_transaction(trans, root); ++ goto out; ++ } ++ + if (key.offset + datal > off+len) + trim = key.offset + datal - (off+len); + +diff --git a/fs/buffer.c b/fs/buffer.c +index c457f84..7eb4da4 100644 +--- a/fs/buffer.c ++++ b/fs/buffer.c +@@ -1002,7 +1002,7 @@ init_page_buffers(struct page *page, struct block_device *bdev, + */ + static int + grow_dev_page(struct block_device *bdev, sector_t block, +- pgoff_t index, int size, int sizebits) ++ pgoff_t index, int size, int sizebits, gfp_t gfp) + { + struct inode *inode = bdev->bd_inode; + struct page *page; +@@ -1011,7 +1011,7 @@ grow_dev_page(struct block_device *bdev, sector_t block, + int ret = 0; /* Will call free_more_memory() */ + + page = find_or_create_page(inode->i_mapping, index, +- (mapping_gfp_mask(inode->i_mapping) & ~__GFP_FS)|__GFP_MOVABLE); ++ (mapping_gfp_mask(inode->i_mapping) & ~__GFP_FS) | gfp); + if (!page) + return ret; + +@@ -1059,7 +1059,7 @@ failed: + * that page was dirty, the buffers are set dirty also. + */ + static int +-grow_buffers(struct block_device *bdev, sector_t block, int size) ++grow_buffers(struct block_device *bdev, sector_t block, int size, gfp_t gfp) + { + pgoff_t index; + int sizebits; +@@ -1086,11 +1086,12 @@ grow_buffers(struct block_device *bdev, sector_t block, int size) + } + + /* Create a page with the proper size buffers.. */ +- return grow_dev_page(bdev, block, index, size, sizebits); ++ return grow_dev_page(bdev, block, index, size, sizebits, gfp); + } + +-static struct buffer_head * +-__getblk_slow(struct block_device *bdev, sector_t block, int size) ++struct buffer_head * ++__getblk_slow(struct block_device *bdev, sector_t block, ++ unsigned size, gfp_t gfp) + { + /* Size must be multiple of hard sectorsize */ + if (unlikely(size & (bdev_logical_block_size(bdev)-1) || +@@ -1112,13 +1113,14 @@ __getblk_slow(struct block_device *bdev, sector_t block, int size) + if (bh) + return bh; + +- ret = grow_buffers(bdev, block, size); ++ ret = grow_buffers(bdev, block, size, gfp); + if (ret < 0) + return NULL; + if (ret == 0) + free_more_memory(); + } + } ++EXPORT_SYMBOL(__getblk_slow); + + /* + * The relationship between dirty buffers and dirty pages: +@@ -1369,24 +1371,25 @@ __find_get_block(struct block_device *bdev, sector_t block, unsigned size) + EXPORT_SYMBOL(__find_get_block); + + /* +- * __getblk will locate (and, if necessary, create) the buffer_head ++ * __getblk_gfp() will locate (and, if necessary, create) the buffer_head + * which corresponds to the passed block_device, block and size. The + * returned buffer has its reference count incremented. + * +- * __getblk() will lock up the machine if grow_dev_page's try_to_free_buffers() +- * attempt is failing. FIXME, perhaps? ++ * __getblk_gfp() will lock up the machine if grow_dev_page's ++ * try_to_free_buffers() attempt is failing. FIXME, perhaps? + */ + struct buffer_head * +-__getblk(struct block_device *bdev, sector_t block, unsigned size) ++__getblk_gfp(struct block_device *bdev, sector_t block, ++ unsigned size, gfp_t gfp) + { + struct buffer_head *bh = __find_get_block(bdev, block, size); + + might_sleep(); + if (bh == NULL) +- bh = __getblk_slow(bdev, block, size); ++ bh = __getblk_slow(bdev, block, size, gfp); + return bh; + } +-EXPORT_SYMBOL(__getblk); ++EXPORT_SYMBOL(__getblk_gfp); + + /* + * Do async read-ahead on a buffer.. +@@ -1402,24 +1405,28 @@ void __breadahead(struct block_device *bdev, sector_t block, unsigned size) + EXPORT_SYMBOL(__breadahead); + + /** +- * __bread() - reads a specified block and returns the bh ++ * __bread_gfp() - reads a specified block and returns the bh + * @bdev: the block_device to read from + * @block: number of block + * @size: size (in bytes) to read +- * ++ * @gfp: page allocation flag ++ * + * Reads a specified block, and returns buffer head that contains it. ++ * The page cache can be allocated from non-movable area ++ * not to prevent page migration if you set gfp to zero. + * It returns NULL if the block was unreadable. + */ + struct buffer_head * +-__bread(struct block_device *bdev, sector_t block, unsigned size) ++__bread_gfp(struct block_device *bdev, sector_t block, ++ unsigned size, gfp_t gfp) + { +- struct buffer_head *bh = __getblk(bdev, block, size); ++ struct buffer_head *bh = __getblk_gfp(bdev, block, size, gfp); + + if (likely(bh) && !buffer_uptodate(bh)) + bh = __bread_slow(bh); + return bh; + } +-EXPORT_SYMBOL(__bread); ++EXPORT_SYMBOL(__bread_gfp); + + /* + * invalidate_bh_lrus() is called rarely - but not only at unmount. +diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c +index 2da63ab..e3d65ab 100644 +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -700,7 +700,8 @@ ext4_ext_find_extent(struct inode *inode, ext4_lblk_t block, + path[ppos].p_depth = i; + path[ppos].p_ext = NULL; + +- bh = sb_getblk(inode->i_sb, path[ppos].p_block); ++ bh = sb_getblk_gfp(inode->i_sb, path[ppos].p_block, ++ __GFP_MOVABLE | GFP_NOFS); + if (unlikely(!bh)) { + ret = -ENOMEM; + goto err; +@@ -905,7 +906,7 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode, + err = -EIO; + goto cleanup; + } +- bh = sb_getblk(inode->i_sb, newblock); ++ bh = sb_getblk_gfp(inode->i_sb, newblock, __GFP_MOVABLE | GFP_NOFS); + if (!bh) { + err = -ENOMEM; + goto cleanup; +@@ -1089,7 +1090,7 @@ static int ext4_ext_grow_indepth(handle_t *handle, struct inode *inode, + if (newblock == 0) + return err; + +- bh = sb_getblk(inode->i_sb, newblock); ++ bh = sb_getblk_gfp(inode->i_sb, newblock, __GFP_MOVABLE | GFP_NOFS); + if (!bh) + return -ENOMEM; + lock_buffer(bh); +diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c +index 26d6dbf..ae1425a 100644 +--- a/fs/ext4/indirect.c ++++ b/fs/ext4/indirect.c +@@ -706,7 +706,7 @@ int ext4_ind_map_blocks(handle_t *handle, struct inode *inode, + EXT4_FEATURE_RO_COMPAT_BIGALLOC)) { + EXT4_ERROR_INODE(inode, "Can't allocate blocks for " + "non-extent mapped inodes with bigalloc"); +- return -ENOSPC; ++ return -EUCLEAN; + } + + goal = ext4_find_goal(inode, map->m_lblk, partial); +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index f06857b..0610766 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -1849,18 +1849,31 @@ static int __ext4_journalled_writepage(struct page *page, + page_bufs = page_buffers(page); + BUG_ON(!page_bufs); + walk_page_buffers(handle, page_bufs, 0, len, NULL, bget_one); +- /* As soon as we unlock the page, it can go away, but we have +- * references to buffers so we are safe */ ++ /* ++ * We need to release the page lock before we start the ++ * journal, so grab a reference so the page won't disappear ++ * out from under us. ++ */ ++ get_page(page); + unlock_page(page); + + handle = ext4_journal_start(inode, ext4_writepage_trans_blocks(inode)); + if (IS_ERR(handle)) { + ret = PTR_ERR(handle); +- goto out; ++ put_page(page); ++ goto out_no_pagelock; + } +- + BUG_ON(!ext4_handle_valid(handle)); + ++ lock_page(page); ++ put_page(page); ++ if (page->mapping != mapping) { ++ /* The page got truncated from under us */ ++ ext4_journal_stop(handle); ++ ret = 0; ++ goto out; ++ } ++ + ret = walk_page_buffers(handle, page_bufs, 0, len, NULL, + do_journal_get_write_access); + +@@ -1876,6 +1889,8 @@ static int __ext4_journalled_writepage(struct page *page, + walk_page_buffers(handle, page_bufs, 0, len, NULL, bput_one); + ext4_set_inode_state(inode, EXT4_STATE_JDATA); + out: ++ unlock_page(page); ++out_no_pagelock: + return ret; + } + +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index 5baa7ba..7c03826 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -4720,18 +4720,12 @@ do_more: + /* + * blocks being freed are metadata. these blocks shouldn't + * be used until this transaction is committed ++ * ++ * We use __GFP_NOFAIL because ext4_free_blocks() is not allowed ++ * to fail. + */ +- retry: +- new_entry = kmem_cache_alloc(ext4_free_ext_cachep, GFP_NOFS); +- if (!new_entry) { +- /* +- * We use a retry loop because +- * ext4_free_blocks() is not allowed to fail. +- */ +- cond_resched(); +- congestion_wait(BLK_RW_ASYNC, HZ/50); +- goto retry; +- } ++ new_entry = kmem_cache_alloc(ext4_free_ext_cachep, ++ GFP_NOFS|__GFP_NOFAIL); + new_entry->start_cluster = bit; + new_entry->group = block_group; + new_entry->count = count_clusters; +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 422be11..be4db0e 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -857,6 +857,7 @@ static void ext4_put_super(struct super_block *sb) + dump_orphan_list(sb, sbi); + J_ASSERT(list_empty(&sbi->s_orphan)); + ++ sync_blockdev(sb->s_bdev); + invalidate_bdev(sb->s_bdev); + if (sbi->journal_bdev && sbi->journal_bdev != sb->s_bdev) { + /* +diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c +index afc0f706..e613870 100644 +--- a/fs/fuse/inode.c ++++ b/fs/fuse/inode.c +@@ -993,6 +993,7 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent) + goto err_fput; + + fuse_conn_init(fc); ++ fc->release = fuse_free_conn; + + fc->dev = sb->s_dev; + fc->sb = sb; +@@ -1007,7 +1008,6 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent) + fc->dont_mask = 1; + sb->s_flags |= MS_POSIXACL; + +- fc->release = fuse_free_conn; + fc->flags = d.flags; + fc->user_id = d.user_id; + fc->group_id = d.group_id; +diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c +index 16a698b..39c7059 100644 +--- a/fs/jbd2/checkpoint.c ++++ b/fs/jbd2/checkpoint.c +@@ -478,80 +478,28 @@ out: + + int jbd2_cleanup_journal_tail(journal_t *journal) + { +- transaction_t * transaction; + tid_t first_tid; +- unsigned long blocknr, freed; ++ unsigned long blocknr; + + if (is_journal_aborted(journal)) +- return 1; +- +- /* OK, work out the oldest transaction remaining in the log, and +- * the log block it starts at. +- * +- * If the log is now empty, we need to work out which is the +- * next transaction ID we will write, and where it will +- * start. */ ++ return -EIO; + +- write_lock(&journal->j_state_lock); +- spin_lock(&journal->j_list_lock); +- transaction = journal->j_checkpoint_transactions; +- if (transaction) { +- first_tid = transaction->t_tid; +- blocknr = transaction->t_log_start; +- } else if ((transaction = journal->j_committing_transaction) != NULL) { +- first_tid = transaction->t_tid; +- blocknr = transaction->t_log_start; +- } else if ((transaction = journal->j_running_transaction) != NULL) { +- first_tid = transaction->t_tid; +- blocknr = journal->j_head; +- } else { +- first_tid = journal->j_transaction_sequence; +- blocknr = journal->j_head; +- } +- spin_unlock(&journal->j_list_lock); +- J_ASSERT(blocknr != 0); +- +- /* If the oldest pinned transaction is at the tail of the log +- already then there's not much we can do right now. */ +- if (journal->j_tail_sequence == first_tid) { +- write_unlock(&journal->j_state_lock); ++ if (!jbd2_journal_get_log_tail(journal, &first_tid, &blocknr)) + return 1; +- } +- +- /* OK, update the superblock to recover the freed space. +- * Physical blocks come first: have we wrapped beyond the end of +- * the log? */ +- freed = blocknr - journal->j_tail; +- if (blocknr < journal->j_tail) +- freed = freed + journal->j_last - journal->j_first; +- +- trace_jbd2_cleanup_journal_tail(journal, first_tid, blocknr, freed); +- jbd_debug(1, +- "Cleaning journal tail from %d to %d (offset %lu), " +- "freeing %lu\n", +- journal->j_tail_sequence, first_tid, blocknr, freed); +- +- journal->j_free += freed; +- journal->j_tail_sequence = first_tid; +- journal->j_tail = blocknr; +- write_unlock(&journal->j_state_lock); ++ J_ASSERT(blocknr != 0); + + /* +- * If there is an external journal, we need to make sure that +- * any data blocks that were recently written out --- perhaps +- * by jbd2_log_do_checkpoint() --- are flushed out before we +- * drop the transactions from the external journal. It's +- * unlikely this will be necessary, especially with a +- * appropriately sized journal, but we need this to guarantee +- * correctness. Fortunately jbd2_cleanup_journal_tail() +- * doesn't get called all that often. ++ * We need to make sure that any blocks that were recently written out ++ * --- perhaps by jbd2_log_do_checkpoint() --- are flushed out before ++ * we drop the transactions from the journal. It's unlikely this will ++ * be necessary, especially with an appropriately sized journal, but we ++ * need this to guarantee correctness. Fortunately ++ * jbd2_cleanup_journal_tail() doesn't get called all that often. + */ +- if ((journal->j_fs_dev != journal->j_dev) && +- (journal->j_flags & JBD2_BARRIER)) +- blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL); +- if (!(journal->j_flags & JBD2_ABORT)) +- jbd2_journal_update_superblock(journal, 1); +- return 0; ++ if (journal->j_flags & JBD2_BARRIER) ++ blkdev_issue_flush(journal->j_fs_dev, GFP_NOFS, NULL); ++ ++ return __jbd2_update_log_tail(journal, first_tid, blocknr); + } + + +diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c +index ab9463a..bccb605 100644 +--- a/fs/jbd2/commit.c ++++ b/fs/jbd2/commit.c +@@ -340,7 +340,16 @@ void jbd2_journal_commit_transaction(journal_t *journal) + /* Do we need to erase the effects of a prior jbd2_journal_flush? */ + if (journal->j_flags & JBD2_FLUSHED) { + jbd_debug(3, "super block updated\n"); +- jbd2_journal_update_superblock(journal, 1); ++ /* ++ * We hold j_checkpoint_mutex so tail cannot change under us. ++ * We don't need any special data guarantees for writing sb ++ * since journal is empty and it is ok for write to be ++ * flushed only with transaction commit. ++ */ ++ jbd2_journal_update_sb_log_tail(journal, ++ journal->j_tail_sequence, ++ journal->j_tail, ++ WRITE_SYNC); + } else { + jbd_debug(3, "superblock not updated\n"); + } +diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c +index 17b04fc..9532dac 100644 +--- a/fs/jbd2/journal.c ++++ b/fs/jbd2/journal.c +@@ -775,6 +775,92 @@ struct journal_head *jbd2_journal_get_descriptor_buffer(journal_t *journal) + return jbd2_journal_add_journal_head(bh); + } + ++/* ++ * Return tid of the oldest transaction in the journal and block in the journal ++ * where the transaction starts. ++ * ++ * If the journal is now empty, return which will be the next transaction ID ++ * we will write and where will that transaction start. ++ * ++ * The return value is 0 if journal tail cannot be pushed any further, 1 if ++ * it can. ++ */ ++int jbd2_journal_get_log_tail(journal_t *journal, tid_t *tid, ++ unsigned long *block) ++{ ++ transaction_t *transaction; ++ int ret; ++ ++ read_lock(&journal->j_state_lock); ++ spin_lock(&journal->j_list_lock); ++ transaction = journal->j_checkpoint_transactions; ++ if (transaction) { ++ *tid = transaction->t_tid; ++ *block = transaction->t_log_start; ++ } else if ((transaction = journal->j_committing_transaction) != NULL) { ++ *tid = transaction->t_tid; ++ *block = transaction->t_log_start; ++ } else if ((transaction = journal->j_running_transaction) != NULL) { ++ *tid = transaction->t_tid; ++ *block = journal->j_head; ++ } else { ++ *tid = journal->j_transaction_sequence; ++ *block = journal->j_head; ++ } ++ ret = tid_gt(*tid, journal->j_tail_sequence); ++ spin_unlock(&journal->j_list_lock); ++ read_unlock(&journal->j_state_lock); ++ ++ return ret; ++} ++ ++/* ++ * Update information in journal structure and in on disk journal superblock ++ * about log tail. This function does not check whether information passed in ++ * really pushes log tail further. It's responsibility of the caller to make ++ * sure provided log tail information is valid (e.g. by holding ++ * j_checkpoint_mutex all the time between computing log tail and calling this ++ * function as is the case with jbd2_cleanup_journal_tail()). ++ * ++ * Requires j_checkpoint_mutex ++ */ ++int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block) ++{ ++ unsigned long freed; ++ int ret; ++ ++ BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex)); ++ ++ /* ++ * We cannot afford for write to remain in drive's caches since as ++ * soon as we update j_tail, next transaction can start reusing journal ++ * space and if we lose sb update during power failure we'd replay ++ * old transaction with possibly newly overwritten data. ++ */ ++ ret = jbd2_journal_update_sb_log_tail(journal, tid, block, WRITE_FUA); ++ if (ret) ++ goto out; ++ ++ write_lock(&journal->j_state_lock); ++ freed = block - journal->j_tail; ++ if (block < journal->j_tail) ++ freed += journal->j_last - journal->j_first; ++ ++ trace_jbd2_update_log_tail(journal, tid, block, freed); ++ jbd_debug(1, ++ "Cleaning journal tail from %d to %d (offset %lu), " ++ "freeing %lu\n", ++ journal->j_tail_sequence, tid, block, freed); ++ ++ journal->j_free += freed; ++ journal->j_tail_sequence = tid; ++ journal->j_tail = block; ++ write_unlock(&journal->j_state_lock); ++ ++out: ++ return ret; ++} ++ + struct jbd2_stats_proc_session { + journal_t *journal; + struct transaction_stats_s *stats; +@@ -1143,40 +1229,41 @@ static int journal_reset(journal_t *journal) + + journal->j_max_transaction_buffers = journal->j_maxlen / 4; + +- /* Add the dynamic fields and write it to disk. */ +- jbd2_journal_update_superblock(journal, 1); +- return jbd2_journal_start_thread(journal); +-} +- +-/** +- * void jbd2_journal_update_superblock() - Update journal sb on disk. +- * @journal: The journal to update. +- * @wait: Set to '0' if you don't want to wait for IO completion. +- * +- * Update a journal's dynamic superblock fields and write it to disk, +- * optionally waiting for the IO to complete. +- */ +-void jbd2_journal_update_superblock(journal_t *journal, int wait) +-{ +- journal_superblock_t *sb = journal->j_superblock; +- struct buffer_head *bh = journal->j_sb_buffer; +- + /* + * As a special case, if the on-disk copy is already marked as needing +- * no recovery (s_start == 0) and there are no outstanding transactions +- * in the filesystem, then we can safely defer the superblock update +- * until the next commit by setting JBD2_FLUSHED. This avoids ++ * no recovery (s_start == 0), then we can safely defer the superblock ++ * update until the next commit by setting JBD2_FLUSHED. This avoids + * attempting a write to a potential-readonly device. + */ +- if (sb->s_start == 0 && journal->j_tail_sequence == +- journal->j_transaction_sequence) { ++ if (sb->s_start == 0) { + jbd_debug(1, "JBD2: Skipping superblock update on recovered sb " + "(start %ld, seq %d, errno %d)\n", + journal->j_tail, journal->j_tail_sequence, + journal->j_errno); +- goto out; ++ journal->j_flags |= JBD2_FLUSHED; ++ } else { ++ /* ++ * Update log tail information. We use WRITE_FUA since new ++ * transaction will start reusing journal space and so we ++ * must make sure information about current log tail is on ++ * disk before that. ++ */ ++ jbd2_journal_update_sb_log_tail(journal, ++ journal->j_tail_sequence, ++ journal->j_tail, ++ WRITE_FUA); + } ++ return jbd2_journal_start_thread(journal); ++} + ++static int jbd2_write_superblock(journal_t *journal, int write_op) ++{ ++ struct buffer_head *bh = journal->j_sb_buffer; ++ int ret; ++ ++ if (!(journal->j_flags & JBD2_BARRIER)) ++ write_op &= ~(REQ_FUA | REQ_FLUSH); ++ lock_buffer(bh); + if (buffer_write_io_error(bh)) { + /* + * Oh, dear. A previous attempt to write the journal +@@ -1192,48 +1279,112 @@ void jbd2_journal_update_superblock(journal_t *journal, int wait) + clear_buffer_write_io_error(bh); + set_buffer_uptodate(bh); + } ++ get_bh(bh); ++ bh->b_end_io = end_buffer_write_sync; ++ ret = submit_bh(write_op, bh); ++ wait_on_buffer(bh); ++ if (buffer_write_io_error(bh)) { ++ clear_buffer_write_io_error(bh); ++ set_buffer_uptodate(bh); ++ ret = -EIO; ++ } ++ if (ret) { ++ printk(KERN_ERR "JBD2: Error %d detected when updating " ++ "journal superblock for %s.\n", ret, ++ journal->j_devname); ++ jbd2_journal_abort(journal, ret); ++ } ++ ++ return ret; ++} ++ ++/** ++ * jbd2_journal_update_sb_log_tail() - Update log tail in journal sb on disk. ++ * @journal: The journal to update. ++ * @tail_tid: TID of the new transaction at the tail of the log ++ * @tail_block: The first block of the transaction at the tail of the log ++ * @write_op: With which operation should we write the journal sb ++ * ++ * Update a journal's superblock information about log tail and write it to ++ * disk, waiting for the IO to complete. ++ */ ++int jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid, ++ unsigned long tail_block, int write_op) ++{ ++ journal_superblock_t *sb = journal->j_superblock; ++ int ret; ++ ++ jbd_debug(1, "JBD2: updating superblock (start %lu, seq %u)\n", ++ tail_block, tail_tid); ++ ++ sb->s_sequence = cpu_to_be32(tail_tid); ++ sb->s_start = cpu_to_be32(tail_block); ++ ++ ret = jbd2_write_superblock(journal, write_op); ++ if (ret) ++ goto out; ++ /* Log is no longer empty */ ++ write_lock(&journal->j_state_lock); ++ WARN_ON(!sb->s_sequence); ++ journal->j_flags &= ~JBD2_FLUSHED; ++ write_unlock(&journal->j_state_lock); ++ ++out: ++ return ret; ++} ++ ++/** ++ * jbd2_mark_journal_empty() - Mark on disk journal as empty. ++ * @journal: The journal to update. ++ * ++ * Update a journal's dynamic superblock fields to show that journal is empty. ++ * Write updated superblock to disk waiting for IO to complete. ++ */ ++static void jbd2_mark_journal_empty(journal_t *journal) ++{ ++ journal_superblock_t *sb = journal->j_superblock; + + read_lock(&journal->j_state_lock); +- jbd_debug(1, "JBD2: updating superblock (start %ld, seq %d, errno %d)\n", +- journal->j_tail, journal->j_tail_sequence, journal->j_errno); ++ jbd_debug(1, "JBD2: Marking journal as empty (seq %d)\n", ++ journal->j_tail_sequence); + + sb->s_sequence = cpu_to_be32(journal->j_tail_sequence); +- sb->s_start = cpu_to_be32(journal->j_tail); +- sb->s_errno = cpu_to_be32(journal->j_errno); ++ sb->s_start = cpu_to_be32(0); + read_unlock(&journal->j_state_lock); + +- BUFFER_TRACE(bh, "marking dirty"); +- mark_buffer_dirty(bh); +- if (wait) { +- sync_dirty_buffer(bh); +- if (buffer_write_io_error(bh)) { +- printk(KERN_ERR "JBD2: I/O error detected " +- "when updating journal superblock for %s.\n", +- journal->j_devname); +- clear_buffer_write_io_error(bh); +- set_buffer_uptodate(bh); +- } +- } else +- write_dirty_buffer(bh, WRITE); +- +-out: +- /* If we have just flushed the log (by marking s_start==0), then +- * any future commit will have to be careful to update the +- * superblock again to re-record the true start of the log. */ ++ jbd2_write_superblock(journal, WRITE_FUA); + ++ /* Log is no longer empty */ + write_lock(&journal->j_state_lock); +- if (sb->s_start) +- journal->j_flags &= ~JBD2_FLUSHED; +- else +- journal->j_flags |= JBD2_FLUSHED; ++ journal->j_flags |= JBD2_FLUSHED; + write_unlock(&journal->j_state_lock); + } + ++ ++/** ++ * jbd2_journal_update_sb_errno() - Update error in the journal. ++ * @journal: The journal to update. ++ * ++ * Update a journal's errno. Write updated superblock to disk waiting for IO ++ * to complete. ++ */ ++static void jbd2_journal_update_sb_errno(journal_t *journal) ++{ ++ journal_superblock_t *sb = journal->j_superblock; ++ ++ read_lock(&journal->j_state_lock); ++ jbd_debug(1, "JBD2: updating superblock error (errno %d)\n", ++ journal->j_errno); ++ sb->s_errno = cpu_to_be32(journal->j_errno); ++ read_unlock(&journal->j_state_lock); ++ ++ jbd2_write_superblock(journal, WRITE_SYNC); ++} ++ + /* + * Read the superblock for a given journal, performing initial + * validation of the format. + */ +- + static int journal_get_superblock(journal_t *journal) + { + struct buffer_head *bh; +@@ -1426,15 +1577,10 @@ int jbd2_journal_destroy(journal_t *journal) + spin_unlock(&journal->j_list_lock); + + if (journal->j_sb_buffer) { +- if (!is_journal_aborted(journal)) { +- /* We can now mark the journal as empty. */ +- journal->j_tail = 0; +- journal->j_tail_sequence = +- ++journal->j_transaction_sequence; +- jbd2_journal_update_superblock(journal, 1); +- } else { ++ if (!is_journal_aborted(journal)) ++ jbd2_mark_journal_empty(journal); ++ else + err = -EIO; +- } + brelse(journal->j_sb_buffer); + } + +@@ -1648,7 +1794,6 @@ int jbd2_journal_flush(journal_t *journal) + { + int err = 0; + transaction_t *transaction = NULL; +- unsigned long old_tail; + + write_lock(&journal->j_state_lock); + +@@ -1683,28 +1828,28 @@ int jbd2_journal_flush(journal_t *journal) + if (is_journal_aborted(journal)) + return -EIO; + +- jbd2_cleanup_journal_tail(journal); ++ if (!err) { ++ err = jbd2_cleanup_journal_tail(journal); ++ if (err < 0) ++ goto out; ++ err = 0; ++ } + + /* Finally, mark the journal as really needing no recovery. + * This sets s_start==0 in the underlying superblock, which is + * the magic code for a fully-recovered superblock. Any future + * commits of data to the journal will restore the current + * s_start value. */ ++ jbd2_mark_journal_empty(journal); + write_lock(&journal->j_state_lock); +- old_tail = journal->j_tail; +- journal->j_tail = 0; +- write_unlock(&journal->j_state_lock); +- jbd2_journal_update_superblock(journal, 1); +- write_lock(&journal->j_state_lock); +- journal->j_tail = old_tail; +- + J_ASSERT(!journal->j_running_transaction); + J_ASSERT(!journal->j_committing_transaction); + J_ASSERT(!journal->j_checkpoint_transactions); + J_ASSERT(journal->j_head == journal->j_tail); + J_ASSERT(journal->j_tail_sequence == journal->j_transaction_sequence); + write_unlock(&journal->j_state_lock); +- return 0; ++out: ++ return err; + } + + /** +@@ -1738,7 +1883,7 @@ int jbd2_journal_wipe(journal_t *journal, int write) + + err = jbd2_journal_skip_recovery(journal); + if (write) +- jbd2_journal_update_superblock(journal, 1); ++ jbd2_mark_journal_empty(journal); + + no_recovery: + return err; +@@ -1788,7 +1933,7 @@ static void __journal_abort_soft (journal_t *journal, int errno) + __jbd2_journal_abort_hard(journal); + + if (errno) +- jbd2_journal_update_superblock(journal, 1); ++ jbd2_journal_update_sb_errno(journal); + } + + /** +diff --git a/fs/jbd2/recovery.c b/fs/jbd2/recovery.c +index 421834b..875df5f 100644 +--- a/fs/jbd2/recovery.c ++++ b/fs/jbd2/recovery.c +@@ -21,6 +21,7 @@ + #include <linux/jbd2.h> + #include <linux/errno.h> + #include <linux/crc32.h> ++#include <linux/blkdev.h> + #endif + + /* +@@ -265,7 +266,9 @@ int jbd2_journal_recover(journal_t *journal) + err2 = sync_blockdev(journal->j_fs_dev); + if (!err) + err = err2; +- ++ /* Make sure all replayed data is on permanent storage */ ++ if (journal->j_flags & JBD2_BARRIER) ++ blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL); + return err; + } + +diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c +index 183c6b1..bee14a3 100644 +--- a/fs/nfs/nfs3xdr.c ++++ b/fs/nfs/nfs3xdr.c +@@ -1333,7 +1333,7 @@ static void nfs3_xdr_enc_setacl3args(struct rpc_rqst *req, + if (args->npages != 0) + xdr_write_pages(xdr, args->pages, 0, args->len); + else +- xdr_reserve_space(xdr, NFS_ACL_INLINE_BUFSIZE); ++ xdr_reserve_space(xdr, args->len); + + error = nfsacl_encode(xdr->buf, base, args->inode, + (args->mask & NFS_ACL) ? +diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c +index ce4168a..cd55214 100644 +--- a/fs/nfs/nfs4state.c ++++ b/fs/nfs/nfs4state.c +@@ -1192,6 +1192,8 @@ restart: + } + spin_unlock(&state->state_lock); + nfs4_put_open_state(state); ++ clear_bit(NFS4CLNT_RECLAIM_NOGRACE, ++ &state->flags); + goto restart; + } + } +diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h +index b0d7ef8..31a0f4b 100644 +--- a/include/acpi/actypes.h ++++ b/include/acpi/actypes.h +@@ -495,6 +495,7 @@ typedef u64 acpi_integer; + #define ACPI_NO_ACPI_ENABLE 0x10 + #define ACPI_NO_DEVICE_INIT 0x20 + #define ACPI_NO_OBJECT_INIT 0x40 ++#define ACPI_NO_FACS_INIT 0x80 + + /* + * Initialization state +diff --git a/include/linux/buffer_head.h b/include/linux/buffer_head.h +index 458f497..fed3f3a 100644 +--- a/include/linux/buffer_head.h ++++ b/include/linux/buffer_head.h +@@ -166,12 +166,13 @@ void __wait_on_buffer(struct buffer_head *); + wait_queue_head_t *bh_waitq_head(struct buffer_head *bh); + struct buffer_head *__find_get_block(struct block_device *bdev, sector_t block, + unsigned size); +-struct buffer_head *__getblk(struct block_device *bdev, sector_t block, +- unsigned size); ++struct buffer_head *__getblk_gfp(struct block_device *bdev, sector_t block, ++ unsigned size, gfp_t gfp); + void __brelse(struct buffer_head *); + void __bforget(struct buffer_head *); + void __breadahead(struct block_device *, sector_t block, unsigned int size); +-struct buffer_head *__bread(struct block_device *, sector_t block, unsigned size); ++struct buffer_head *__bread_gfp(struct block_device *, ++ sector_t block, unsigned size, gfp_t gfp); + void invalidate_bh_lrus(void); + struct buffer_head *alloc_buffer_head(gfp_t gfp_flags); + void free_buffer_head(struct buffer_head * bh); +@@ -286,7 +287,13 @@ static inline void bforget(struct buffer_head *bh) + static inline struct buffer_head * + sb_bread(struct super_block *sb, sector_t block) + { +- return __bread(sb->s_bdev, block, sb->s_blocksize); ++ return __bread_gfp(sb->s_bdev, block, sb->s_blocksize, __GFP_MOVABLE); ++} ++ ++static inline struct buffer_head * ++sb_bread_unmovable(struct super_block *sb, sector_t block) ++{ ++ return __bread_gfp(sb->s_bdev, block, sb->s_blocksize, 0); + } + + static inline void +@@ -298,7 +305,14 @@ sb_breadahead(struct super_block *sb, sector_t block) + static inline struct buffer_head * + sb_getblk(struct super_block *sb, sector_t block) + { +- return __getblk(sb->s_bdev, block, sb->s_blocksize); ++ return __getblk_gfp(sb->s_bdev, block, sb->s_blocksize, __GFP_MOVABLE); ++} ++ ++ ++static inline struct buffer_head * ++sb_getblk_gfp(struct super_block *sb, sector_t block, gfp_t gfp) ++{ ++ return __getblk_gfp(sb->s_bdev, block, sb->s_blocksize, gfp); + } + + static inline struct buffer_head * +@@ -335,6 +349,36 @@ static inline void lock_buffer(struct buffer_head *bh) + __lock_buffer(bh); + } + ++static inline struct buffer_head *getblk_unmovable(struct block_device *bdev, ++ sector_t block, ++ unsigned size) ++{ ++ return __getblk_gfp(bdev, block, size, 0); ++} ++ ++static inline struct buffer_head *__getblk(struct block_device *bdev, ++ sector_t block, ++ unsigned size) ++{ ++ return __getblk_gfp(bdev, block, size, __GFP_MOVABLE); ++} ++ ++/** ++ * __bread() - reads a specified block and returns the bh ++ * @bdev: the block_device to read from ++ * @block: number of block ++ * @size: size (in bytes) to read ++ * ++ * Reads a specified block, and returns buffer head that contains it. ++ * The page cache is allocated from movable area so that it can be migrated. ++ * It returns NULL if the block was unreadable. ++ */ ++static inline struct buffer_head * ++__bread(struct block_device *bdev, sector_t block, unsigned size) ++{ ++ return __bread_gfp(bdev, block, size, __GFP_MOVABLE); ++} ++ + extern int __set_page_dirty_buffers(struct page *page); + + #else /* CONFIG_BLOCK */ +diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h +index a153ed5..4920c55 100644 +--- a/include/linux/jbd2.h ++++ b/include/linux/jbd2.h +@@ -972,6 +972,9 @@ extern void __journal_clean_data_list(transaction_t *transaction); + /* Log buffer allocation */ + extern struct journal_head * jbd2_journal_get_descriptor_buffer(journal_t *); + int jbd2_journal_next_log_block(journal_t *, unsigned long long *); ++int jbd2_journal_get_log_tail(journal_t *journal, tid_t *tid, ++ unsigned long *block); ++int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block); + + /* Commit management */ + extern void jbd2_journal_commit_transaction(journal_t *); +@@ -1083,7 +1086,8 @@ extern int jbd2_journal_destroy (journal_t *); + extern int jbd2_journal_recover (journal_t *journal); + extern int jbd2_journal_wipe (journal_t *, int); + extern int jbd2_journal_skip_recovery (journal_t *); +-extern void jbd2_journal_update_superblock (journal_t *, int); ++extern int jbd2_journal_update_sb_log_tail (journal_t *, tid_t, ++ unsigned long, int); + extern void __jbd2_journal_abort_hard (journal_t *); + extern void jbd2_journal_abort (journal_t *, int); + extern int jbd2_journal_errno (journal_t *); +diff --git a/include/linux/libata.h b/include/linux/libata.h +index 3d4b5b6..000434e 100644 +--- a/include/linux/libata.h ++++ b/include/linux/libata.h +@@ -403,6 +403,8 @@ enum { + ATA_HORKAGE_MAX_SEC_LBA48 = (1 << 17), /* Set max sects to 65535 */ + ATA_HORKAGE_NOLPM = (1 << 20), /* don't use LPM */ + ATA_HORKAGE_WD_BROKEN_LPM = (1 << 21), /* some WDs have broken LPM */ ++ ATA_HORKAGE_NOTRIM = (1 << 24), /* don't use TRIM */ ++ + + /* DMA mask for user DMA control: User visible values; DO NOT + renumber */ +diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h +index 41116ab..d2abc34 100644 +--- a/include/linux/nfs_xdr.h ++++ b/include/linux/nfs_xdr.h +@@ -1056,7 +1056,7 @@ struct nfs_impl_id4 { + struct nfstime4 date; + }; + +-#define NFS4_EXCHANGE_ID_LEN (48) ++#define NFS4_EXCHANGE_ID_LEN (127) + struct nfs41_exchange_id_args { + struct nfs_client *client; + nfs4_verifier *verifier; +diff --git a/include/trace/events/jbd2.h b/include/trace/events/jbd2.h +index 7596441..5c74007 100644 +--- a/include/trace/events/jbd2.h ++++ b/include/trace/events/jbd2.h +@@ -200,7 +200,7 @@ TRACE_EVENT(jbd2_checkpoint_stats, + __entry->forced_to_close, __entry->written, __entry->dropped) + ); + +-TRACE_EVENT(jbd2_cleanup_journal_tail, ++TRACE_EVENT(jbd2_update_log_tail, + + TP_PROTO(journal_t *journal, tid_t first_tid, + unsigned long block_nr, unsigned long freed), +diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c +index 20e88af..d9ce3d4 100644 +--- a/kernel/hrtimer.c ++++ b/kernel/hrtimer.c +@@ -848,6 +848,9 @@ u64 hrtimer_forward(struct hrtimer *timer, ktime_t now, ktime_t interval) + if (delta.tv64 < 0) + return 0; + ++ if (WARN_ON(timer->state & HRTIMER_STATE_ENQUEUED)) ++ return 0; ++ + if (interval.tv64 < timer->base->resolution.tv64) + interval.tv64 = timer->base->resolution.tv64; + +@@ -1260,11 +1263,14 @@ static void __run_hrtimer(struct hrtimer *timer, ktime_t *now) + * Note: We clear the CALLBACK bit after enqueue_hrtimer and + * we do not reprogramm the event hardware. Happens either in + * hrtimer_start_range_ns() or in hrtimer_interrupt() ++ * ++ * Note: Because we dropped the cpu_base->lock above, ++ * hrtimer_start_range_ns() can have popped in and enqueued the timer ++ * for us already. + */ +- if (restart != HRTIMER_NORESTART) { +- BUG_ON(timer->state != HRTIMER_STATE_CALLBACK); ++ if (restart != HRTIMER_NORESTART && ++ !(timer->state & HRTIMER_STATE_ENQUEUED)) + enqueue_hrtimer(timer, base); +- } + + WARN_ON_ONCE(!(timer->state & HRTIMER_STATE_CALLBACK)); + +diff --git a/kernel/rcutiny.c b/kernel/rcutiny.c +index 636af6d..bc84596 100644 +--- a/kernel/rcutiny.c ++++ b/kernel/rcutiny.c +@@ -160,6 +160,11 @@ static void __rcu_process_callbacks(struct rcu_ctrlblk *rcp) + + /* Move the ready-to-invoke callbacks to a local list. */ + local_irq_save(flags); ++ if (rcp->donetail == &rcp->rcucblist) { ++ /* No callbacks ready, so just leave. */ ++ local_irq_restore(flags); ++ return; ++ } + RCU_TRACE(trace_rcu_batch_start(rcp->name, 0, -1)); + list = rcp->rcucblist; + rcp->rcucblist = *rcp->donetail; +diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c +index 47343cc..bfeb725 100644 +--- a/kernel/trace/trace_events_filter.c ++++ b/kernel/trace/trace_events_filter.c +@@ -1027,6 +1027,9 @@ static void parse_init(struct filter_parse_state *ps, + + static char infix_next(struct filter_parse_state *ps) + { ++ if (!ps->infix.cnt) ++ return 0; ++ + ps->infix.cnt--; + + return ps->infix.string[ps->infix.tail++]; +@@ -1042,6 +1045,9 @@ static char infix_peek(struct filter_parse_state *ps) + + static void infix_advance(struct filter_parse_state *ps) + { ++ if (!ps->infix.cnt) ++ return; ++ + ps->infix.cnt--; + ps->infix.tail++; + } +@@ -1358,7 +1364,9 @@ static int check_preds(struct filter_parse_state *ps) + } + cnt--; + n_normal_preds++; +- WARN_ON_ONCE(cnt < 0); ++ /* all ops should have operands */ ++ if (cnt < 0) ++ break; + } + + if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) { +diff --git a/lib/bitmap.c b/lib/bitmap.c +index dbc526f..389e75e 100644 +--- a/lib/bitmap.c ++++ b/lib/bitmap.c +@@ -601,12 +601,12 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen, + unsigned a, b; + int c, old_c, totaldigits; + const char __user __force *ubuf = (const char __user __force *)buf; +- int exp_digit, in_range; ++ int at_start, in_range; + + totaldigits = c = 0; + bitmap_zero(maskp, nmaskbits); + do { +- exp_digit = 1; ++ at_start = 1; + in_range = 0; + a = b = 0; + +@@ -635,11 +635,10 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen, + break; + + if (c == '-') { +- if (exp_digit || in_range) ++ if (at_start || in_range) + return -EINVAL; + b = 0; + in_range = 1; +- exp_digit = 1; + continue; + } + +@@ -649,16 +648,18 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen, + b = b * 10 + (c - '0'); + if (!in_range) + a = b; +- exp_digit = 0; ++ at_start = 0; + totaldigits++; + } + if (!(a <= b)) + return -EINVAL; + if (b >= nmaskbits) + return -ERANGE; +- while (a <= b) { +- set_bit(a, maskp); +- a++; ++ if (!at_start) { ++ while (a <= b) { ++ set_bit(a, maskp); ++ a++; ++ } + } + } while (buflen && c == ','); + return 0; +diff --git a/mm/filemap.c b/mm/filemap.c +index 556858c..6c009c2 100644 +--- a/mm/filemap.c ++++ b/mm/filemap.c +@@ -2007,8 +2007,8 @@ int file_remove_suid(struct file *file) + error = security_inode_killpriv(dentry); + if (!error && killsuid) + error = __remove_suid(dentry, killsuid); +- if (!error && (inode->i_sb->s_flags & MS_NOSEC)) +- inode->i_flags |= S_NOSEC; ++ if (!error) ++ inode_has_no_xattr(inode); + + return error; + } +diff --git a/mm/kmemleak.c b/mm/kmemleak.c +index cc8cf1d..cbae846 100644 +--- a/mm/kmemleak.c ++++ b/mm/kmemleak.c +@@ -192,6 +192,8 @@ static struct kmem_cache *scan_area_cache; + + /* set if tracing memory operations is enabled */ + static atomic_t kmemleak_enabled = ATOMIC_INIT(0); ++/* same as above but only for the kmemleak_free() callback */ ++static int kmemleak_free_enabled; + /* set in the late_initcall if there were no errors */ + static atomic_t kmemleak_initialized = ATOMIC_INIT(0); + /* enables or disables early logging of the memory operations */ +@@ -885,7 +887,7 @@ void __ref kmemleak_free(const void *ptr) + { + pr_debug("%s(0x%p)\n", __func__, ptr); + +- if (atomic_read(&kmemleak_enabled) && ptr && !IS_ERR(ptr)) ++ if (kmemleak_free_enabled && ptr && !IS_ERR(ptr)) + delete_object_full((unsigned long)ptr); + else if (atomic_read(&kmemleak_early_log)) + log_early(KMEMLEAK_FREE, ptr, 0, 0); +@@ -1614,6 +1616,13 @@ static void kmemleak_do_cleanup(struct work_struct *work) + mutex_lock(&scan_mutex); + stop_scan_thread(); + ++ /* ++ * Once the scan thread has stopped, it is safe to no longer track ++ * object freeing. Ordering of the scan thread stopping and the memory ++ * accesses below is guaranteed by the kthread_stop() function. ++ */ ++ kmemleak_free_enabled = 0; ++ + rcu_read_lock(); + list_for_each_entry_rcu(object, &object_list, object_list) + delete_object_full(object->pointer); +@@ -1640,6 +1649,8 @@ static void kmemleak_disable(void) + /* check whether it is too early for a kernel thread */ + if (atomic_read(&kmemleak_initialized)) + schedule_work(&cleanup_work); ++ else ++ kmemleak_free_enabled = 0; + + pr_info("Kernel memory leak detector disabled\n"); + } +@@ -1688,6 +1699,7 @@ void __init kmemleak_init(void) + if (!atomic_read(&kmemleak_error)) { + atomic_set(&kmemleak_enabled, 1); + atomic_set(&kmemleak_early_log, 0); ++ kmemleak_free_enabled = 1; + } + local_irq_restore(flags); + +diff --git a/mm/memory.c b/mm/memory.c +index 452b8ba..7762b1d 100644 +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -3153,6 +3153,10 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma, + + pte_unmap(page_table); + ++ /* File mapping without ->vm_ops ? */ ++ if (vma->vm_flags & VM_SHARED) ++ return VM_FAULT_SIGBUS; ++ + /* Check if we need to add a guard page to the stack */ + if (check_stack_guard_page(vma, address) < 0) + return VM_FAULT_SIGSEGV; +@@ -3412,6 +3416,9 @@ static int do_linear_fault(struct mm_struct *mm, struct vm_area_struct *vma, + - vma->vm_start) >> PAGE_SHIFT) + vma->vm_pgoff; + + pte_unmap(page_table); ++ /* The VMA was not fully populated on mmap() or missing VM_DONTEXPAND */ ++ if (!vma->vm_ops->fault) ++ return VM_FAULT_SIGBUS; + return __do_fault(mm, vma, address, pmd, pgoff, flags, orig_pte); + } + +@@ -3470,11 +3477,9 @@ int handle_pte_fault(struct mm_struct *mm, + entry = *pte; + if (!pte_present(entry)) { + if (pte_none(entry)) { +- if (vma->vm_ops) { +- if (likely(vma->vm_ops->fault)) +- return do_linear_fault(mm, vma, address, ++ if (vma->vm_ops) ++ return do_linear_fault(mm, vma, address, + pte, pmd, flags, entry); +- } + return do_anonymous_page(mm, vma, address, + pte, pmd, flags); + } +diff --git a/net/9p/client.c b/net/9p/client.c +index 854ca7a..e958178 100644 +--- a/net/9p/client.c ++++ b/net/9p/client.c +@@ -824,7 +824,8 @@ static struct p9_req_t *p9_client_zc_rpc(struct p9_client *c, int8_t type, + if (err < 0) { + if (err == -EIO) + c->status = Disconnected; +- goto reterr; ++ if (err != -ERESTARTSYS) ++ goto reterr; + } + if (req->status == REQ_STATUS_ERROR) { + P9_DPRINTK(P9_DEBUG_ERROR, "req_status error %d\n", req->t_err); +diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c +index 1bd197f..5f21e53 100644 +--- a/net/bridge/br_multicast.c ++++ b/net/bridge/br_multicast.c +@@ -36,6 +36,9 @@ + #define mlock_dereference(X, br) \ + rcu_dereference_protected(X, lockdep_is_held(&br->multicast_lock)) + ++static void br_multicast_add_router(struct net_bridge *br, ++ struct net_bridge_port *port); ++ + #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) + static inline int ipv6_is_transient_multicast(const struct in6_addr *addr) + { +@@ -842,6 +845,8 @@ void br_multicast_enable_port(struct net_bridge_port *port) + goto out; + + __br_multicast_enable_port(port); ++ if (port->multicast_router == 2 && hlist_unhashed(&port->rlist)) ++ br_multicast_add_router(br, port); + + out: + spin_unlock(&br->multicast_lock); +diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c +index 7c1745d..6cdd3af 100644 +--- a/net/bridge/br_netfilter.c ++++ b/net/bridge/br_netfilter.c +@@ -822,12 +822,15 @@ static int br_nf_dev_queue_xmit(struct sk_buff *skb) + !skb_is_gso(skb)) { + if (br_parse_ip_options(skb)) + /* Drop invalid packet */ +- return NF_DROP; ++ goto drop; + ret = ip_fragment(skb, br_dev_queue_push_xmit); + } else + ret = br_dev_queue_push_xmit(skb); + + return ret; ++ drop: ++ kfree_skb(skb); ++ return 0; + } + #else + static int br_nf_dev_queue_xmit(struct sk_buff *skb) +diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c +index fd863fe7..bb38a3c 100644 +--- a/net/ceph/osdmap.c ++++ b/net/ceph/osdmap.c +@@ -102,7 +102,7 @@ static int crush_decode_tree_bucket(void **p, void *end, + { + int j; + dout("crush_decode_tree_bucket %p to %p\n", *p, end); +- ceph_decode_32_safe(p, end, b->num_nodes, bad); ++ ceph_decode_8_safe(p, end, b->num_nodes, bad); + b->node_weights = kcalloc(b->num_nodes, sizeof(u32), GFP_NOFS); + if (b->node_weights == NULL) + return -ENOMEM; +diff --git a/net/core/datagram.c b/net/core/datagram.c +index 68bbf9f..6f54d0a 100644 +--- a/net/core/datagram.c ++++ b/net/core/datagram.c +@@ -180,18 +180,19 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned flags, + * However, this function was correct in any case. 8) + */ + unsigned long cpu_flags; ++ struct sk_buff_head *queue = &sk->sk_receive_queue; + +- spin_lock_irqsave(&sk->sk_receive_queue.lock, cpu_flags); +- skb = skb_peek(&sk->sk_receive_queue); ++ spin_lock_irqsave(&queue->lock, cpu_flags); ++ skb = skb_peek(queue); + if (skb) { + *peeked = skb->peeked; + if (flags & MSG_PEEK) { + skb->peeked = 1; + atomic_inc(&skb->users); + } else +- __skb_unlink(skb, &sk->sk_receive_queue); ++ __skb_unlink(skb, queue); + } +- spin_unlock_irqrestore(&sk->sk_receive_queue.lock, cpu_flags); ++ spin_unlock_irqrestore(&queue->lock, cpu_flags); + + if (skb) + return skb; +diff --git a/net/core/dev.c b/net/core/dev.c +index 1c0d862..7f43202 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -2947,6 +2947,8 @@ static int enqueue_to_backlog(struct sk_buff *skb, int cpu, + local_irq_save(flags); + + rps_lock(sd); ++ if (!netif_running(skb->dev)) ++ goto drop; + if (skb_queue_len(&sd->input_pkt_queue) <= netdev_max_backlog) { + if (skb_queue_len(&sd->input_pkt_queue)) { + enqueue: +@@ -2967,6 +2969,7 @@ enqueue: + goto enqueue; + } + ++drop: + sd->dropped++; + rps_unlock(sd); + +@@ -3258,8 +3261,6 @@ static int __netif_receive_skb(struct sk_buff *skb) + + pt_prev = NULL; + +- rcu_read_lock(); +- + another_round: + + __this_cpu_inc(softnet_data.processed); +@@ -3354,7 +3355,6 @@ ncls: + } + + out: +- rcu_read_unlock(); + return ret; + } + +@@ -3375,34 +3375,31 @@ out: + */ + int netif_receive_skb(struct sk_buff *skb) + { ++ int ret; ++ + if (netdev_tstamp_prequeue) + net_timestamp_check(skb); + + if (skb_defer_rx_timestamp(skb)) + return NET_RX_SUCCESS; + ++ rcu_read_lock(); ++ + #ifdef CONFIG_RPS + { + struct rps_dev_flow voidflow, *rflow = &voidflow; +- int cpu, ret; +- +- rcu_read_lock(); +- +- cpu = get_rps_cpu(skb->dev, skb, &rflow); ++ int cpu = get_rps_cpu(skb->dev, skb, &rflow); + + if (cpu >= 0) { + ret = enqueue_to_backlog(skb, cpu, &rflow->last_qtail); + rcu_read_unlock(); +- } else { +- rcu_read_unlock(); +- ret = __netif_receive_skb(skb); ++ return ret; + } +- +- return ret; + } +-#else +- return __netif_receive_skb(skb); + #endif ++ ret = __netif_receive_skb(skb); ++ rcu_read_unlock(); ++ return ret; + } + EXPORT_SYMBOL(netif_receive_skb); + +@@ -3793,8 +3790,10 @@ static int process_backlog(struct napi_struct *napi, int quota) + unsigned int qlen; + + while ((skb = __skb_dequeue(&sd->process_queue))) { ++ rcu_read_lock(); + local_irq_enable(); + __netif_receive_skb(skb); ++ rcu_read_unlock(); + local_irq_disable(); + input_queue_head_incr(sd); + if (++work >= quota) { +@@ -5305,6 +5304,7 @@ static void rollback_registered_many(struct list_head *head) + unlist_netdevice(dev); + + dev->reg_state = NETREG_UNREGISTERING; ++ on_each_cpu(flush_backlog, dev, 1); + } + + synchronize_net(); +@@ -5877,8 +5877,6 @@ void netdev_run_todo(void) + + dev->reg_state = NETREG_UNREGISTERED; + +- on_each_cpu(flush_backlog, dev, 1); +- + netdev_wait_allrefs(dev); + + /* paranoia */ +diff --git a/net/core/pktgen.c b/net/core/pktgen.c +index 80aeac9..9dd65a9 100644 +--- a/net/core/pktgen.c ++++ b/net/core/pktgen.c +@@ -568,7 +568,7 @@ static int pktgen_if_show(struct seq_file *seq, void *v) + " dst_min: %s dst_max: %s\n", + pkt_dev->dst_min, pkt_dev->dst_max); + seq_printf(seq, +- " src_min: %s src_max: %s\n", ++ " src_min: %s src_max: %s\n", + pkt_dev->src_min, pkt_dev->src_max); + } + +diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c +index 5b412f0..e77373a 100644 +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -1147,10 +1147,6 @@ static const struct nla_policy ifla_info_policy[IFLA_INFO_MAX+1] = { + [IFLA_INFO_DATA] = { .type = NLA_NESTED }, + }; + +-static const struct nla_policy ifla_vfinfo_policy[IFLA_VF_INFO_MAX+1] = { +- [IFLA_VF_INFO] = { .type = NLA_NESTED }, +-}; +- + static const struct nla_policy ifla_vf_policy[IFLA_VF_MAX+1] = { + [IFLA_VF_MAC] = { .len = sizeof(struct ifla_vf_mac) }, + [IFLA_VF_VLAN] = { .len = sizeof(struct ifla_vf_vlan) }, +@@ -1224,58 +1220,53 @@ static int validate_linkmsg(struct net_device *dev, struct nlattr *tb[]) + return 0; + } + +-static int do_setvfinfo(struct net_device *dev, struct nlattr *attr) ++static int do_setvfinfo(struct net_device *dev, struct nlattr **tb) + { +- int rem, err = -EINVAL; +- struct nlattr *vf; + const struct net_device_ops *ops = dev->netdev_ops; ++ int err = -EINVAL; + +- nla_for_each_nested(vf, attr, rem) { +- switch (nla_type(vf)) { +- case IFLA_VF_MAC: { +- struct ifla_vf_mac *ivm; +- ivm = nla_data(vf); +- err = -EOPNOTSUPP; +- if (ops->ndo_set_vf_mac) +- err = ops->ndo_set_vf_mac(dev, ivm->vf, +- ivm->mac); +- break; +- } +- case IFLA_VF_VLAN: { +- struct ifla_vf_vlan *ivv; +- ivv = nla_data(vf); +- err = -EOPNOTSUPP; +- if (ops->ndo_set_vf_vlan) +- err = ops->ndo_set_vf_vlan(dev, ivv->vf, +- ivv->vlan, +- ivv->qos); +- break; +- } +- case IFLA_VF_TX_RATE: { +- struct ifla_vf_tx_rate *ivt; +- ivt = nla_data(vf); +- err = -EOPNOTSUPP; +- if (ops->ndo_set_vf_tx_rate) +- err = ops->ndo_set_vf_tx_rate(dev, ivt->vf, +- ivt->rate); +- break; +- } +- case IFLA_VF_SPOOFCHK: { +- struct ifla_vf_spoofchk *ivs; +- ivs = nla_data(vf); +- err = -EOPNOTSUPP; +- if (ops->ndo_set_vf_spoofchk) +- err = ops->ndo_set_vf_spoofchk(dev, ivs->vf, +- ivs->setting); +- break; +- } +- default: +- err = -EINVAL; +- break; +- } +- if (err) +- break; ++ if (tb[IFLA_VF_MAC]) { ++ struct ifla_vf_mac *ivm = nla_data(tb[IFLA_VF_MAC]); ++ err = -EOPNOTSUPP; ++ if (ops->ndo_set_vf_mac) ++ err = ops->ndo_set_vf_mac(dev, ivm->vf, ++ ivm->mac); ++ if (err < 0) ++ return err; + } ++ ++ if (tb[IFLA_VF_VLAN]) { ++ struct ifla_vf_vlan *ivv = nla_data(tb[IFLA_VF_VLAN]); ++ ++ err = -EOPNOTSUPP; ++ if (ops->ndo_set_vf_vlan) ++ err = ops->ndo_set_vf_vlan(dev, ivv->vf, ivv->vlan, ++ ivv->qos); ++ if (err < 0) ++ return err; ++ } ++ ++ if (tb[IFLA_VF_TX_RATE]) { ++ struct ifla_vf_tx_rate *ivt = nla_data(tb[IFLA_VF_TX_RATE]); ++ ++ if (ops->ndo_set_vf_tx_rate) ++ err = ops->ndo_set_vf_tx_rate(dev, ivt->vf, ++ ivt->rate); ++ if (err < 0) ++ return err; ++ } ++ ++ if (tb[IFLA_VF_SPOOFCHK]) { ++ struct ifla_vf_spoofchk *ivs = nla_data(tb[IFLA_VF_SPOOFCHK]); ++ ++ err = -EOPNOTSUPP; ++ if (ops->ndo_set_vf_spoofchk) ++ err = ops->ndo_set_vf_spoofchk(dev, ivs->vf, ++ ivs->setting); ++ if (err < 0) ++ return err; ++ } ++ + return err; + } + +@@ -1458,14 +1449,21 @@ static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm, + } + + if (tb[IFLA_VFINFO_LIST]) { ++ struct nlattr *vfinfo[IFLA_VF_MAX + 1]; + struct nlattr *attr; + int rem; ++ + nla_for_each_nested(attr, tb[IFLA_VFINFO_LIST], rem) { +- if (nla_type(attr) != IFLA_VF_INFO) { ++ if (nla_type(attr) != IFLA_VF_INFO || ++ nla_len(attr) < NLA_HDRLEN) { + err = -EINVAL; + goto errout; + } +- err = do_setvfinfo(dev, attr); ++ err = nla_parse_nested(vfinfo, IFLA_VF_MAX, attr, ++ ifla_vf_policy); ++ if (err < 0) ++ goto errout; ++ err = do_setvfinfo(dev, vfinfo); + if (err < 0) + goto errout; + modified = 1; +diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c +index 16e25a4..c20c356 100644 +--- a/net/ipv4/ip_fragment.c ++++ b/net/ipv4/ip_fragment.c +@@ -385,7 +385,7 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb) + ihl = ip_hdrlen(skb); + + /* Determine the position of this fragment. */ +- end = offset + skb->len - ihl; ++ end = offset + skb->len - skb_network_offset(skb) - ihl; + err = -EINVAL; + + /* Is this the final fragment? */ +@@ -415,7 +415,7 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb) + goto err; + + err = -ENOMEM; +- if (pskb_pull(skb, ihl) == NULL) ++ if (!pskb_pull(skb, skb_network_offset(skb) + ihl)) + goto err; + + err = pskb_trim_rcsum(skb, end - offset); +@@ -638,6 +638,8 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev, + iph->frag_off = 0; + iph->tot_len = htons(len); + iph->tos |= ecn; ++ ip_send_check(iph); ++ + IP_INC_STATS_BH(net, IPSTATS_MIB_REASMOKS); + qp->q.fragments = NULL; + qp->q.fragments_tail = NULL; +diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c +index 880a55d..0228ecb 100644 +--- a/net/mac80211/debugfs_netdev.c ++++ b/net/mac80211/debugfs_netdev.c +@@ -598,6 +598,7 @@ void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata) + + debugfs_remove_recursive(sdata->debugfs.dir); + sdata->debugfs.dir = NULL; ++ sdata->debugfs.subdir_stations = NULL; + } + + void ieee80211_debugfs_rename_netdev(struct ieee80211_sub_if_data *sdata) +diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c +index 7918eb7..cec0ed5 100644 +--- a/net/netfilter/nf_conntrack_expect.c ++++ b/net/netfilter/nf_conntrack_expect.c +@@ -205,7 +205,8 @@ static inline int expect_clash(const struct nf_conntrack_expect *a, + a->mask.src.u3.all[count] & b->mask.src.u3.all[count]; + } + +- return nf_ct_tuple_mask_cmp(&a->tuple, &b->tuple, &intersect_mask); ++ return nf_ct_tuple_mask_cmp(&a->tuple, &b->tuple, &intersect_mask) && ++ nf_ct_zone(a->master) == nf_ct_zone(b->master); + } + + static inline int expect_matches(const struct nf_conntrack_expect *a, +diff --git a/net/rds/ib_rdma.c b/net/rds/ib_rdma.c +index e8fdb17..a985158 100644 +--- a/net/rds/ib_rdma.c ++++ b/net/rds/ib_rdma.c +@@ -759,8 +759,10 @@ void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents, + } + + ibmr = rds_ib_alloc_fmr(rds_ibdev); +- if (IS_ERR(ibmr)) ++ if (IS_ERR(ibmr)) { ++ rds_ib_dev_put(rds_ibdev); + return ibmr; ++ } + + ret = rds_ib_map_fmr(rds_ibdev, ibmr, sg, nents); + if (ret == 0) +diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c +index 686fb1a..233dbe6 100644 +--- a/net/rose/af_rose.c ++++ b/net/rose/af_rose.c +@@ -195,7 +195,8 @@ static void rose_kill_by_device(struct net_device *dev) + + if (rose->device == dev) { + rose_disconnect(s, ENETUNREACH, ROSE_OUT_OF_ORDER, 0); +- rose->neighbour->use--; ++ if (rose->neighbour) ++ rose->neighbour->use--; + rose->device = NULL; + } + } +diff --git a/net/sunrpc/backchannel_rqst.c b/net/sunrpc/backchannel_rqst.c +index 3ad435a..b56f23e 100644 +--- a/net/sunrpc/backchannel_rqst.c ++++ b/net/sunrpc/backchannel_rqst.c +@@ -59,7 +59,7 @@ static void xprt_free_allocation(struct rpc_rqst *req) + + dprintk("RPC: free allocations for req= %p\n", req); + BUG_ON(test_bit(RPC_BC_PA_IN_USE, &req->rq_bc_pa_state)); +- xbufp = &req->rq_private_buf; ++ xbufp = &req->rq_rcv_buf; + free_page((unsigned long)xbufp->head[0].iov_base); + xbufp = &req->rq_snd_buf; + free_page((unsigned long)xbufp->head[0].iov_base); +diff --git a/sound/soc/codecs/wm8737.c b/sound/soc/codecs/wm8737.c +index f6aef58..2a012d3 100644 +--- a/sound/soc/codecs/wm8737.c ++++ b/sound/soc/codecs/wm8737.c +@@ -485,7 +485,8 @@ static int wm8737_set_bias_level(struct snd_soc_codec *codec, + + /* Fast VMID ramp at 2*2.5k */ + snd_soc_update_bits(codec, WM8737_MISC_BIAS_CONTROL, +- WM8737_VMIDSEL_MASK, 0x4); ++ WM8737_VMIDSEL_MASK, ++ 2 << WM8737_VMIDSEL_SHIFT); + + /* Bring VMID up */ + snd_soc_update_bits(codec, WM8737_POWER_MANAGEMENT, +@@ -499,7 +500,8 @@ static int wm8737_set_bias_level(struct snd_soc_codec *codec, + + /* VMID at 2*300k */ + snd_soc_update_bits(codec, WM8737_MISC_BIAS_CONTROL, +- WM8737_VMIDSEL_MASK, 2); ++ WM8737_VMIDSEL_MASK, ++ 1 << WM8737_VMIDSEL_SHIFT); + + break; + +diff --git a/sound/soc/codecs/wm8903.h b/sound/soc/codecs/wm8903.h +index db94931..0bb4a64 100644 +--- a/sound/soc/codecs/wm8903.h ++++ b/sound/soc/codecs/wm8903.h +@@ -172,7 +172,7 @@ extern int wm8903_mic_detect(struct snd_soc_codec *codec, + #define WM8903_VMID_BUF_ENA_WIDTH 1 /* VMID_BUF_ENA */ + + #define WM8903_VMID_RES_50K 2 +-#define WM8903_VMID_RES_250K 3 ++#define WM8903_VMID_RES_250K 4 + #define WM8903_VMID_RES_5K 6 + + /* +diff --git a/sound/soc/codecs/wm8955.c b/sound/soc/codecs/wm8955.c +index 77ff1d7..f8b9930 100644 +--- a/sound/soc/codecs/wm8955.c ++++ b/sound/soc/codecs/wm8955.c +@@ -282,7 +282,7 @@ static int wm8955_configure_clocking(struct snd_soc_codec *codec) + snd_soc_update_bits(codec, WM8955_PLL_CONTROL_2, + WM8955_K_17_9_MASK, + (pll.k >> 9) & WM8955_K_17_9_MASK); +- snd_soc_update_bits(codec, WM8955_PLL_CONTROL_2, ++ snd_soc_update_bits(codec, WM8955_PLL_CONTROL_3, + WM8955_K_8_0_MASK, + pll.k & WM8955_K_8_0_MASK); + if (pll.k) +diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c +index 8d26104..c7911fd 100644 +--- a/sound/soc/codecs/wm8960.c ++++ b/sound/soc/codecs/wm8960.c +@@ -186,7 +186,7 @@ SOC_SINGLE("PCM Playback -6dB Switch", WM8960_DACCTL1, 7, 1, 0), + SOC_ENUM("ADC Polarity", wm8960_enum[0]), + SOC_SINGLE("ADC High Pass Filter Switch", WM8960_DACCTL1, 0, 1, 0), + +-SOC_ENUM("DAC Polarity", wm8960_enum[2]), ++SOC_ENUM("DAC Polarity", wm8960_enum[1]), + SOC_SINGLE_BOOL_EXT("DAC Deemphasis Switch", 0, + wm8960_get_deemph, wm8960_put_deemph), + +diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c +index 851786f..893b750 100644 +--- a/sound/usb/mixer_maps.c ++++ b/sound/usb/mixer_maps.c +@@ -312,6 +312,20 @@ static const struct usbmix_name_map scms_usb3318_map[] = { + { 0 } + }; + ++/* Bose companion 5, the dB conversion factor is 16 instead of 256 */ ++static struct usbmix_dB_map bose_companion5_dB = {-5006, -6}; ++static struct usbmix_name_map bose_companion5_map[] = { ++ { 3, NULL, .dB = &bose_companion5_dB }, ++ { 0 } /* terminator */ ++}; ++ ++/* Dragonfly DAC 1.2, the dB conversion factor is 1 instead of 256 */ ++static struct usbmix_dB_map dragonfly_1_2_dB = {0, 5000}; ++static struct usbmix_name_map dragonfly_1_2_map[] = { ++ { 7, NULL, .dB = &dragonfly_1_2_dB }, ++ { 0 } /* terminator */ ++}; ++ + /* + * Control map entries + */ +@@ -394,6 +408,16 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = { + .id = USB_ID(0x25c4, 0x0003), + .map = scms_usb3318_map, + }, ++ { ++ /* Bose Companion 5 */ ++ .id = USB_ID(0x05a7, 0x1020), ++ .map = bose_companion5_map, ++ }, ++ { ++ /* Dragonfly DAC 1.2 */ ++ .id = USB_ID(0x21b4, 0x0081), ++ .map = dragonfly_1_2_map, ++ }, + { 0 } /* terminator */ + }; + +diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h +index b38dde0..c014f00 100644 +--- a/sound/usb/quirks-table.h ++++ b/sound/usb/quirks-table.h +@@ -2383,6 +2383,74 @@ YAMAHA_DEVICE(0x7010, "UB99"), + } + }, + ++/* Steinberg devices */ ++{ ++ /* Steinberg MI2 */ ++ USB_DEVICE_VENDOR_SPEC(0x0a4e, 0x2040), ++ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { ++ .ifnum = QUIRK_ANY_INTERFACE, ++ .type = QUIRK_COMPOSITE, ++ .data = & (const struct snd_usb_audio_quirk[]) { ++ { ++ .ifnum = 0, ++ .type = QUIRK_AUDIO_STANDARD_INTERFACE ++ }, ++ { ++ .ifnum = 1, ++ .type = QUIRK_AUDIO_STANDARD_INTERFACE ++ }, ++ { ++ .ifnum = 2, ++ .type = QUIRK_AUDIO_STANDARD_INTERFACE ++ }, ++ { ++ .ifnum = 3, ++ .type = QUIRK_MIDI_FIXED_ENDPOINT, ++ .data = &(const struct snd_usb_midi_endpoint_info) { ++ .out_cables = 0x0001, ++ .in_cables = 0x0001 ++ } ++ }, ++ { ++ .ifnum = -1 ++ } ++ } ++ } ++}, ++{ ++ /* Steinberg MI4 */ ++ USB_DEVICE_VENDOR_SPEC(0x0a4e, 0x4040), ++ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { ++ .ifnum = QUIRK_ANY_INTERFACE, ++ .type = QUIRK_COMPOSITE, ++ .data = & (const struct snd_usb_audio_quirk[]) { ++ { ++ .ifnum = 0, ++ .type = QUIRK_AUDIO_STANDARD_INTERFACE ++ }, ++ { ++ .ifnum = 1, ++ .type = QUIRK_AUDIO_STANDARD_INTERFACE ++ }, ++ { ++ .ifnum = 2, ++ .type = QUIRK_AUDIO_STANDARD_INTERFACE ++ }, ++ { ++ .ifnum = 3, ++ .type = QUIRK_MIDI_FIXED_ENDPOINT, ++ .data = &(const struct snd_usb_midi_endpoint_info) { ++ .out_cables = 0x0001, ++ .in_cables = 0x0001 ++ } ++ }, ++ { ++ .ifnum = -1 ++ } ++ } ++ } ++}, ++ + /* TerraTec devices */ + { + USB_DEVICE_VENDOR_SPEC(0x0ccd, 0x0012), |