diff options
Diffstat (limited to '3.2.71/1070_linux-3.2.71.patch')
| -rw-r--r-- | 3.2.71/1070_linux-3.2.71.patch | 3488 |
1 files changed, 0 insertions, 3488 deletions
diff --git a/3.2.71/1070_linux-3.2.71.patch b/3.2.71/1070_linux-3.2.71.patch deleted file mode 100644 index 8702e84..0000000 --- a/3.2.71/1070_linux-3.2.71.patch +++ /dev/null @@ -1,3488 +0,0 @@ -diff --git a/Makefile b/Makefile -index 41a626b..9d5fea7 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 3 - PATCHLEVEL = 2 --SUBLEVEL = 70 -+SUBLEVEL = 71 - EXTRAVERSION = - NAME = Saber-toothed Squirrel - -diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c -index 53088e2..2ba1226 100644 ---- a/arch/s390/kernel/process.c -+++ b/arch/s390/kernel/process.c -@@ -250,7 +250,7 @@ asmlinkage void execve_tail(void) - { - current->thread.fp_regs.fpc = 0; - if (MACHINE_HAS_IEEE) -- asm volatile("sfpc %0,%0" : : "d" (0)); -+ asm volatile("sfpc %0" : : "d" (0)); - } - - /* -diff --git a/arch/s390/kernel/sclp.S b/arch/s390/kernel/sclp.S -index 95792d8..51ca1c3 100644 ---- a/arch/s390/kernel/sclp.S -+++ b/arch/s390/kernel/sclp.S -@@ -270,6 +270,8 @@ ENTRY(_sclp_print_early) - jno .Lesa2 - ahi %r15,-80 - stmh %r6,%r15,96(%r15) # store upper register halves -+ basr %r13,0 -+ lmh %r0,%r15,.Lzeroes-.(%r13) # clear upper register halves - .Lesa2: - #endif - lr %r10,%r2 # save string pointer -@@ -293,6 +295,8 @@ ENTRY(_sclp_print_early) - #endif - lm %r6,%r15,120(%r15) # restore registers - br %r14 -+.Lzeroes: -+ .fill 64,4,0 - - .LwritedataS4: - .long 0x00760005 # SCLP command for write data -diff --git a/arch/tile/kernel/setup.c b/arch/tile/kernel/setup.c -index a09b6c3..bf3e71a 100644 ---- a/arch/tile/kernel/setup.c -+++ b/arch/tile/kernel/setup.c -@@ -973,7 +973,7 @@ static void __init load_hv_initrd(void) - - void __init free_initrd_mem(unsigned long begin, unsigned long end) - { -- free_bootmem(__pa(begin), end - begin); -+ free_bootmem_late(__pa(begin), end - begin); - } - - #else -diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h -index 9171618..93ce7e4 100644 ---- a/arch/x86/include/asm/kvm_host.h -+++ b/arch/x86/include/asm/kvm_host.h -@@ -472,7 +472,7 @@ struct kvm_arch { - struct kvm_pic *vpic; - struct kvm_ioapic *vioapic; - struct kvm_pit *vpit; -- int vapics_in_nmi_mode; -+ atomic_t vapics_in_nmi_mode; - - unsigned int tss_addr; - struct page *apic_access_page; -diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c -index cced57f..ab98fe5 100644 ---- a/arch/x86/kvm/i8254.c -+++ b/arch/x86/kvm/i8254.c -@@ -318,7 +318,7 @@ static void pit_do_work(struct work_struct *work) - * LVT0 to NMI delivery. Other PIC interrupts are just sent to - * VCPU0, and only if its LVT0 is in EXTINT mode. - */ -- if (kvm->arch.vapics_in_nmi_mode > 0) -+ if (atomic_read(&kvm->arch.vapics_in_nmi_mode) > 0) - kvm_for_each_vcpu(i, vcpu, kvm) - kvm_apic_nmi_wd_deliver(vcpu); - } -diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c -index 176205a..055cc49 100644 ---- a/arch/x86/kvm/lapic.c -+++ b/arch/x86/kvm/lapic.c -@@ -757,10 +757,10 @@ static void apic_manage_nmi_watchdog(struct kvm_lapic *apic, u32 lvt0_val) - if (!nmi_wd_enabled) { - apic_debug("Receive NMI setting on APIC_LVT0 " - "for cpu %d\n", apic->vcpu->vcpu_id); -- apic->vcpu->kvm->arch.vapics_in_nmi_mode++; -+ atomic_inc(&apic->vcpu->kvm->arch.vapics_in_nmi_mode); - } - } else if (nmi_wd_enabled) -- apic->vcpu->kvm->arch.vapics_in_nmi_mode--; -+ atomic_dec(&apic->vcpu->kvm->arch.vapics_in_nmi_mode); - } - - static int apic_reg_write(struct kvm_lapic *apic, u32 reg, u32 val) -@@ -1253,6 +1253,7 @@ void kvm_apic_post_state_restore(struct kvm_vcpu *vcpu) - - apic_update_ppr(apic); - hrtimer_cancel(&apic->lapic_timer.timer); -+ apic_manage_nmi_watchdog(apic, apic_get_reg(apic, APIC_LVT0)); - update_divide_count(apic); - start_apic_timer(apic); - apic->irr_pending = true; -diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c -index 5189fe8..81afe1b 100644 ---- a/arch/x86/xen/enlighten.c -+++ b/arch/x86/xen/enlighten.c -@@ -321,6 +321,7 @@ static void set_aliased_prot(void *v, pgprot_t prot) - pte_t pte; - unsigned long pfn; - struct page *page; -+ unsigned char dummy; - - ptep = lookup_address((unsigned long)v, &level); - BUG_ON(ptep == NULL); -@@ -330,6 +331,32 @@ static void set_aliased_prot(void *v, pgprot_t prot) - - pte = pfn_pte(pfn, prot); - -+ /* -+ * Careful: update_va_mapping() will fail if the virtual address -+ * we're poking isn't populated in the page tables. We don't -+ * need to worry about the direct map (that's always in the page -+ * tables), but we need to be careful about vmap space. In -+ * particular, the top level page table can lazily propagate -+ * entries between processes, so if we've switched mms since we -+ * vmapped the target in the first place, we might not have the -+ * top-level page table entry populated. -+ * -+ * We disable preemption because we want the same mm active when -+ * we probe the target and when we issue the hypercall. We'll -+ * have the same nominal mm, but if we're a kernel thread, lazy -+ * mm dropping could change our pgd. -+ * -+ * Out of an abundance of caution, this uses __get_user() to fault -+ * in the target address just in case there's some obscure case -+ * in which the target address isn't readable. -+ */ -+ -+ preempt_disable(); -+ -+ pagefault_disable(); /* Avoid warnings due to being atomic. */ -+ __get_user(dummy, (unsigned char __user __force *)v); -+ pagefault_enable(); -+ - if (HYPERVISOR_update_va_mapping((unsigned long)v, pte, 0)) - BUG(); - -@@ -341,6 +368,8 @@ static void set_aliased_prot(void *v, pgprot_t prot) - BUG(); - } else - kmap_flush_unused(); -+ -+ preempt_enable(); - } - - static void xen_alloc_ldt(struct desc_struct *ldt, unsigned entries) -@@ -348,6 +377,17 @@ static void xen_alloc_ldt(struct desc_struct *ldt, unsigned entries) - const unsigned entries_per_page = PAGE_SIZE / LDT_ENTRY_SIZE; - int i; - -+ /* -+ * We need to mark the all aliases of the LDT pages RO. We -+ * don't need to call vm_flush_aliases(), though, since that's -+ * only responsible for flushing aliases out the TLBs, not the -+ * page tables, and Xen will flush the TLB for us if needed. -+ * -+ * To avoid confusing future readers: none of this is necessary -+ * to load the LDT. The hypervisor only checks this when the -+ * LDT is faulted in due to subsequent descriptor access. -+ */ -+ - for(i = 0; i < entries; i += entries_per_page) - set_aliased_prot(ldt + i, PAGE_KERNEL_RO); - } -diff --git a/drivers/acpi/acpica/utxface.c b/drivers/acpi/acpica/utxface.c -index 420ebfe..ecc428e 100644 ---- a/drivers/acpi/acpica/utxface.c -+++ b/drivers/acpi/acpica/utxface.c -@@ -163,10 +163,12 @@ acpi_status acpi_enable_subsystem(u32 flags) - * Obtain a permanent mapping for the FACS. This is required for the - * Global Lock and the Firmware Waking Vector - */ -- status = acpi_tb_initialize_facs(); -- if (ACPI_FAILURE(status)) { -- ACPI_WARNING((AE_INFO, "Could not map the FACS table")); -- return_ACPI_STATUS(status); -+ if (!(flags & ACPI_NO_FACS_INIT)) { -+ status = acpi_tb_initialize_facs(); -+ if (ACPI_FAILURE(status)) { -+ ACPI_WARNING((AE_INFO, "Could not map the FACS table")); -+ return_ACPI_STATUS(status); -+ } - } - - /* -diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c -index fcd8586..4e9beff 100644 ---- a/drivers/ata/libata-core.c -+++ b/drivers/ata/libata-core.c -@@ -4107,9 +4107,10 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { - { "ST3320[68]13AS", "SD1[5-9]", ATA_HORKAGE_NONCQ | - ATA_HORKAGE_FIRMWARE_WARN }, - -- /* Seagate Momentus SpinPoint M8 seem to have FPMDA_AA issues */ -+ /* drives which fail FPDMA_AA activation (some may freeze afterwards) */ - { "ST1000LM024 HN-M101MBB", "2AR10001", ATA_HORKAGE_BROKEN_FPDMA_AA }, - { "ST1000LM024 HN-M101MBB", "2BA30001", ATA_HORKAGE_BROKEN_FPDMA_AA }, -+ { "VB0250EAVER", "HPG7", ATA_HORKAGE_BROKEN_FPDMA_AA }, - - /* Blacklist entries taken from Silicon Image 3124/3132 - Windows driver .inf file - also several Linux problem reports */ -@@ -4154,6 +4155,9 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { - { "PIONEER DVD-RW DVR-212D", NULL, ATA_HORKAGE_NOSETXFER }, - { "PIONEER DVD-RW DVR-216D", NULL, ATA_HORKAGE_NOSETXFER }, - -+ /* devices that don't properly handle TRIM commands */ -+ { "SuperSSpeed S238*", NULL, ATA_HORKAGE_NOTRIM, }, -+ - /* - * Some WD SATA-I drives spin up and down erratically when the link - * is put into the slumber mode. We don't have full list of the -@@ -4458,7 +4462,8 @@ static unsigned int ata_dev_set_xfermode(struct ata_device *dev) - else /* In the ancient relic department - skip all of this */ - return 0; - -- err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 0); -+ /* On some disks, this command causes spin-up, so we need longer timeout */ -+ err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 15000); - - DPRINTK("EXIT, err_mask=%x\n", err_mask); - return err_mask; -diff --git a/drivers/ata/libata-pmp.c b/drivers/ata/libata-pmp.c -index 0ba32fe..93ea335 100644 ---- a/drivers/ata/libata-pmp.c -+++ b/drivers/ata/libata-pmp.c -@@ -460,6 +460,13 @@ static void sata_pmp_quirks(struct ata_port *ap) - ATA_LFLAG_NO_SRST | - ATA_LFLAG_ASSUME_ATA; - } -+ } else if (vendor == 0x11ab && devid == 0x4140) { -+ /* Marvell 4140 quirks */ -+ ata_for_each_link(link, ap, EDGE) { -+ /* port 4 is for SEMB device and it doesn't like SRST */ -+ if (link->pmp == 4) -+ link->flags |= ATA_LFLAG_DISABLED; -+ } - } - } - -diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c -index 8460e62..0ac7a5e 100644 ---- a/drivers/ata/libata-scsi.c -+++ b/drivers/ata/libata-scsi.c -@@ -2473,7 +2473,8 @@ static unsigned int ata_scsiop_read_cap(struct ata_scsi_args *args, u8 *rbuf) - rbuf[14] = (lowest_aligned >> 8) & 0x3f; - rbuf[15] = lowest_aligned; - -- if (ata_id_has_trim(args->id)) { -+ if (ata_id_has_trim(args->id) && -+ !(dev->horkage & ATA_HORKAGE_NOTRIM)) { - rbuf[14] |= 0x80; /* TPE */ - - if (ata_id_has_zero_after_trim(args->id)) -diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c -index 9f32f43..e9e8f3b 100644 ---- a/drivers/bluetooth/ath3k.c -+++ b/drivers/bluetooth/ath3k.c -@@ -78,6 +78,7 @@ static struct usb_device_id ath3k_table[] = { - { USB_DEVICE(0x0489, 0xe057) }, - { USB_DEVICE(0x0489, 0xe056) }, - { USB_DEVICE(0x0489, 0xe05f) }, -+ { USB_DEVICE(0x0489, 0xe076) }, - { USB_DEVICE(0x0489, 0xe078) }, - { USB_DEVICE(0x04c5, 0x1330) }, - { USB_DEVICE(0x04CA, 0x3004) }, -@@ -86,6 +87,7 @@ static struct usb_device_id ath3k_table[] = { - { USB_DEVICE(0x04CA, 0x3007) }, - { USB_DEVICE(0x04CA, 0x3008) }, - { USB_DEVICE(0x04CA, 0x300b) }, -+ { USB_DEVICE(0x04CA, 0x300f) }, - { USB_DEVICE(0x04CA, 0x3010) }, - { USB_DEVICE(0x0930, 0x0219) }, - { USB_DEVICE(0x0930, 0x0220) }, -@@ -109,6 +111,7 @@ static struct usb_device_id ath3k_table[] = { - { USB_DEVICE(0x13d3, 0x3408) }, - { USB_DEVICE(0x13d3, 0x3423) }, - { USB_DEVICE(0x13d3, 0x3432) }, -+ { USB_DEVICE(0x13d3, 0x3474) }, - - /* Atheros AR5BBU12 with sflash firmware */ - { USB_DEVICE(0x0489, 0xE02C) }, -@@ -133,6 +136,7 @@ static struct usb_device_id ath3k_blist_tbl[] = { - { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 }, -@@ -141,6 +145,7 @@ static struct usb_device_id ath3k_blist_tbl[] = { - { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 }, -@@ -164,6 +169,7 @@ static struct usb_device_id ath3k_blist_tbl[] = { - { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 }, - - /* Atheros AR5BBU22 with sflash firmware */ - { USB_DEVICE(0x0489, 0xE036), .driver_info = BTUSB_ATH3012 }, -diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c -index 92973a3..c5e400b 100644 ---- a/drivers/bluetooth/btusb.c -+++ b/drivers/bluetooth/btusb.c -@@ -163,6 +163,7 @@ static struct usb_device_id blacklist_table[] = { - { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 }, -@@ -171,6 +172,7 @@ static struct usb_device_id blacklist_table[] = { - { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 }, -@@ -194,6 +196,7 @@ static struct usb_device_id blacklist_table[] = { - { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 }, - - /* Atheros AR5BBU12 with sflash firmware */ - { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE }, -diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c -index 43c4ec3..59d4697 100644 ---- a/drivers/char/agp/intel-gtt.c -+++ b/drivers/char/agp/intel-gtt.c -@@ -1195,7 +1195,7 @@ static inline int needs_idle_maps(void) - /* Query intel_iommu to see if we need the workaround. Presumably that - * was loaded first. - */ -- if ((gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB || -+ if ((gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_D_IG || - gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_M_IG) && - intel_iommu_gfx_mapped) - return 1; -diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c -index dbe76b5..90c76fc 100644 ---- a/drivers/crypto/talitos.c -+++ b/drivers/crypto/talitos.c -@@ -2384,6 +2384,7 @@ static struct talitos_crypto_alg *talitos_alg_alloc(struct device *dev, - break; - default: - dev_err(dev, "unknown algorithm type %d\n", t_alg->algt.type); -+ kfree(t_alg); - return ERR_PTR(-EINVAL); - } - -diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c -index 9b01145..a258101 100644 ---- a/drivers/dma/mv_xor.c -+++ b/drivers/dma/mv_xor.c -@@ -386,7 +386,8 @@ static void __mv_xor_slot_cleanup(struct mv_xor_chan *mv_chan) - dma_cookie_t cookie = 0; - int busy = mv_chan_is_busy(mv_chan); - u32 current_desc = mv_chan_get_current_desc(mv_chan); -- int seen_current = 0; -+ int current_cleaned = 0; -+ struct mv_xor_desc *hw_desc; - - dev_dbg(mv_chan->device->common.dev, "%s %d\n", __func__, __LINE__); - dev_dbg(mv_chan->device->common.dev, "current_desc %x\n", current_desc); -@@ -398,38 +399,57 @@ static void __mv_xor_slot_cleanup(struct mv_xor_chan *mv_chan) - - list_for_each_entry_safe(iter, _iter, &mv_chan->chain, - chain_node) { -- prefetch(_iter); -- prefetch(&_iter->async_tx); - -- /* do not advance past the current descriptor loaded into the -- * hardware channel, subsequent descriptors are either in -- * process or have not been submitted -- */ -- if (seen_current) -- break; -+ /* clean finished descriptors */ -+ hw_desc = iter->hw_desc; -+ if (hw_desc->status & XOR_DESC_SUCCESS) { -+ cookie = mv_xor_run_tx_complete_actions(iter, mv_chan, -+ cookie); - -- /* stop the search if we reach the current descriptor and the -- * channel is busy -- */ -- if (iter->async_tx.phys == current_desc) { -- seen_current = 1; -- if (busy) -+ /* done processing desc, clean slot */ -+ mv_xor_clean_slot(iter, mv_chan); -+ -+ /* break if we did cleaned the current */ -+ if (iter->async_tx.phys == current_desc) { -+ current_cleaned = 1; -+ break; -+ } -+ } else { -+ if (iter->async_tx.phys == current_desc) { -+ current_cleaned = 0; - break; -+ } - } -- -- cookie = mv_xor_run_tx_complete_actions(iter, mv_chan, cookie); -- -- if (mv_xor_clean_slot(iter, mv_chan)) -- break; - } - - if ((busy == 0) && !list_empty(&mv_chan->chain)) { -- struct mv_xor_desc_slot *chain_head; -- chain_head = list_entry(mv_chan->chain.next, -- struct mv_xor_desc_slot, -- chain_node); -- -- mv_xor_start_new_chain(mv_chan, chain_head); -+ if (current_cleaned) { -+ /* -+ * current descriptor cleaned and removed, run -+ * from list head -+ */ -+ iter = list_entry(mv_chan->chain.next, -+ struct mv_xor_desc_slot, -+ chain_node); -+ mv_xor_start_new_chain(mv_chan, iter); -+ } else { -+ if (!list_is_last(&iter->chain_node, &mv_chan->chain)) { -+ /* -+ * descriptors are still waiting after -+ * current, trigger them -+ */ -+ iter = list_entry(iter->chain_node.next, -+ struct mv_xor_desc_slot, -+ chain_node); -+ mv_xor_start_new_chain(mv_chan, iter); -+ } else { -+ /* -+ * some descriptors are still waiting -+ * to be cleaned -+ */ -+ tasklet_schedule(&mv_chan->irq_tasklet); -+ } -+ } - } - - if (cookie > 0) -diff --git a/drivers/dma/mv_xor.h b/drivers/dma/mv_xor.h -index 977b592..ae2cfba 100644 ---- a/drivers/dma/mv_xor.h -+++ b/drivers/dma/mv_xor.h -@@ -30,6 +30,7 @@ - #define XOR_OPERATION_MODE_XOR 0 - #define XOR_OPERATION_MODE_MEMCPY 2 - #define XOR_OPERATION_MODE_MEMSET 4 -+#define XOR_DESC_SUCCESS 0x40000000 - - #define XOR_CURR_DESC(chan) (chan->mmr_base + 0x210 + (chan->idx * 4)) - #define XOR_NEXT_DESC(chan) (chan->mmr_base + 0x200 + (chan->idx * 4)) -diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c -index 09851ce..20110b4 100644 ---- a/drivers/gpu/drm/drm_crtc.c -+++ b/drivers/gpu/drm/drm_crtc.c -@@ -1505,6 +1505,13 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, - if (!drm_core_check_feature(dev, DRIVER_MODESET)) - return -EINVAL; - -+ /* -+ * Universal plane src offsets are only 16.16, prevent havoc for -+ * drivers using universal plane code internally. -+ */ -+ if (crtc_req->x & 0xffff0000 || crtc_req->y & 0xffff0000) -+ return -ERANGE; -+ - mutex_lock(&dev->mode_config.mutex); - obj = drm_mode_object_find(dev, crtc_req->crtc_id, - DRM_MODE_OBJECT_CRTC); -diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c -index 8115557..21e689d 100644 ---- a/drivers/gpu/drm/radeon/radeon_combios.c -+++ b/drivers/gpu/drm/radeon/radeon_combios.c -@@ -1259,10 +1259,15 @@ struct radeon_encoder_lvds *radeon_combios_get_lvds_info(struct radeon_encoder - - if ((RBIOS16(tmp) == lvds->native_mode.hdisplay) && - (RBIOS16(tmp + 2) == lvds->native_mode.vdisplay)) { -+ u32 hss = (RBIOS16(tmp + 21) - RBIOS16(tmp + 19) - 1) * 8; -+ -+ if (hss > lvds->native_mode.hdisplay) -+ hss = (10 - 1) * 8; -+ - lvds->native_mode.htotal = lvds->native_mode.hdisplay + - (RBIOS16(tmp + 17) - RBIOS16(tmp + 19)) * 8; - lvds->native_mode.hsync_start = lvds->native_mode.hdisplay + -- (RBIOS16(tmp + 21) - RBIOS16(tmp + 19) - 1) * 8; -+ hss; - lvds->native_mode.hsync_end = lvds->native_mode.hsync_start + - (RBIOS8(tmp + 23) * 8); - -diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c -index ba7ab79..d2572108 100644 ---- a/drivers/gpu/drm/radeon/radeon_gart.c -+++ b/drivers/gpu/drm/radeon/radeon_gart.c -@@ -171,8 +171,10 @@ void radeon_gart_unbind(struct radeon_device *rdev, unsigned offset, - } - } - } -- mb(); -- radeon_gart_tlb_flush(rdev); -+ if (rdev->gart.ptr) { -+ mb(); -+ radeon_gart_tlb_flush(rdev); -+ } - } - - int radeon_gart_bind(struct radeon_device *rdev, unsigned offset, -@@ -217,8 +219,10 @@ int radeon_gart_bind(struct radeon_device *rdev, unsigned offset, - } - } - } -- mb(); -- radeon_gart_tlb_flush(rdev); -+ if (rdev->gart.ptr) { -+ mb(); -+ radeon_gart_tlb_flush(rdev); -+ } - return 0; - } - -diff --git a/drivers/gpu/drm/radeon/radeon_irq_kms.c b/drivers/gpu/drm/radeon/radeon_irq_kms.c -index 4f9496e..42f5a2b 100644 ---- a/drivers/gpu/drm/radeon/radeon_irq_kms.c -+++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c -@@ -51,10 +51,12 @@ static void radeon_hotplug_work_func(struct work_struct *work) - struct drm_mode_config *mode_config = &dev->mode_config; - struct drm_connector *connector; - -+ mutex_lock(&mode_config->mutex); - if (mode_config->num_connector) { - list_for_each_entry(connector, &mode_config->connector_list, head) - radeon_connector_hotplug(connector); - } -+ mutex_unlock(&mode_config->mutex); - /* Just fire off a uevent and let userspace tell us what to do */ - drm_helper_hpd_irq_event(dev); - } -diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c -index 73fd664..e26a7c3 100644 ---- a/drivers/input/touchscreen/usbtouchscreen.c -+++ b/drivers/input/touchscreen/usbtouchscreen.c -@@ -528,6 +528,9 @@ static int dmc_tsc10_init(struct usbtouch_usb *usbtouch) - goto err_out; - } - -+ /* TSC-25 data sheet specifies a delay after the RESET command */ -+ msleep(150); -+ - /* set coordinate output rate */ - buf[0] = buf[1] = 0xFF; - ret = usb_control_msg(dev, usb_rcvctrlpipe (dev, 0), -diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c -index 80f8bd5..d9f23a4 100644 ---- a/drivers/md/dm-thin.c -+++ b/drivers/md/dm-thin.c -@@ -13,6 +13,7 @@ - #include <linux/init.h> - #include <linux/module.h> - #include <linux/slab.h> -+#include <linux/vmalloc.h> - - #define DM_MSG_PREFIX "thin" - -@@ -158,9 +159,7 @@ static struct bio_prison *prison_create(unsigned nr_cells) - { - unsigned i; - uint32_t nr_buckets = calc_nr_buckets(nr_cells); -- size_t len = sizeof(struct bio_prison) + -- (sizeof(struct hlist_head) * nr_buckets); -- struct bio_prison *prison = kmalloc(len, GFP_KERNEL); -+ struct bio_prison *prison = kmalloc(sizeof(*prison), GFP_KERNEL); - - if (!prison) - return NULL; -@@ -173,9 +172,15 @@ static struct bio_prison *prison_create(unsigned nr_cells) - return NULL; - } - -+ prison->cells = vmalloc(sizeof(*prison->cells) * nr_buckets); -+ if (!prison->cells) { -+ mempool_destroy(prison->cell_pool); -+ kfree(prison); -+ return NULL; -+ } -+ - prison->nr_buckets = nr_buckets; - prison->hash_mask = nr_buckets - 1; -- prison->cells = (struct hlist_head *) (prison + 1); - for (i = 0; i < nr_buckets; i++) - INIT_HLIST_HEAD(prison->cells + i); - -@@ -184,6 +189,7 @@ static struct bio_prison *prison_create(unsigned nr_cells) - - static void prison_destroy(struct bio_prison *prison) - { -+ vfree(prison->cells); - mempool_destroy(prison->cell_pool); - kfree(prison); - } -diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c -index 1de0f5f..6e79c11 100644 ---- a/drivers/md/persistent-data/dm-btree-remove.c -+++ b/drivers/md/persistent-data/dm-btree-remove.c -@@ -309,8 +309,8 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent, - - if (s < 0 && nr_center < -s) { - /* not enough in central node */ -- shift(left, center, nr_center); -- s = nr_center - target; -+ shift(left, center, -nr_center); -+ s += nr_center; - shift(left, right, s); - nr_right += s; - } else -@@ -323,7 +323,7 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent, - if (s > 0 && nr_center < s) { - /* not enough in central node */ - shift(center, right, nr_center); -- s = target - nr_center; -+ s -= nr_center; - shift(left, right, s); - nr_left -= s; - } else -diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c -index bbb2ec5..18f37e0 100644 ---- a/drivers/md/persistent-data/dm-btree.c -+++ b/drivers/md/persistent-data/dm-btree.c -@@ -236,7 +236,7 @@ int dm_btree_del(struct dm_btree_info *info, dm_block_t root) - int r; - struct del_stack *s; - -- s = kmalloc(sizeof(*s), GFP_KERNEL); -+ s = kmalloc(sizeof(*s), GFP_NOIO); - if (!s) - return -ENOMEM; - s->tm = info->tm; -diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c -index aec029a..6e7b002 100644 ---- a/drivers/md/raid1.c -+++ b/drivers/md/raid1.c -@@ -313,7 +313,7 @@ static void raid1_end_read_request(struct bio *bio, int error) - spin_lock_irqsave(&conf->device_lock, flags); - if (r1_bio->mddev->degraded == conf->raid_disks || - (r1_bio->mddev->degraded == conf->raid_disks-1 && -- !test_bit(Faulty, &conf->mirrors[mirror].rdev->flags))) -+ test_bit(In_sync, &conf->mirrors[mirror].rdev->flags))) - uptodate = 1; - spin_unlock_irqrestore(&conf->device_lock, flags); - } -diff --git a/drivers/media/dvb/frontends/cx24116.c b/drivers/media/dvb/frontends/cx24116.c -index ccd0525..4ff6d15 100644 ---- a/drivers/media/dvb/frontends/cx24116.c -+++ b/drivers/media/dvb/frontends/cx24116.c -@@ -963,6 +963,10 @@ static int cx24116_send_diseqc_msg(struct dvb_frontend *fe, - struct cx24116_state *state = fe->demodulator_priv; - int i, ret; - -+ /* Validate length */ -+ if (d->msg_len > sizeof(d->msg)) -+ return -EINVAL; -+ - /* Dump DiSEqC message */ - if (debug) { - printk(KERN_INFO "cx24116: %s(", __func__); -@@ -974,10 +978,6 @@ static int cx24116_send_diseqc_msg(struct dvb_frontend *fe, - printk(") toneburst=%d\n", toneburst); - } - -- /* Validate length */ -- if (d->msg_len > (CX24116_ARGLEN - CX24116_DISEQC_MSGOFS)) -- return -EINVAL; -- - /* DiSEqC message */ - for (i = 0; i < d->msg_len; i++) - state->dsec_cmd.args[CX24116_DISEQC_MSGOFS + i] = d->msg[i]; -diff --git a/drivers/media/dvb/frontends/s5h1420.c b/drivers/media/dvb/frontends/s5h1420.c -index 3879d2e..507ccae 100644 ---- a/drivers/media/dvb/frontends/s5h1420.c -+++ b/drivers/media/dvb/frontends/s5h1420.c -@@ -180,7 +180,7 @@ static int s5h1420_send_master_cmd (struct dvb_frontend* fe, - int result = 0; - - dprintk("enter %s\n", __func__); -- if (cmd->msg_len > 8) -+ if (cmd->msg_len > sizeof(cmd->msg)) - return -EINVAL; - - /* setup for DISEQC */ -diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c -index 4802f7f..f53d5c8 100644 ---- a/drivers/mmc/card/block.c -+++ b/drivers/mmc/card/block.c -@@ -1285,9 +1285,11 @@ static int mmc_blk_issue_rw_rq(struct mmc_queue *mq, struct request *rqc) - break; - case MMC_BLK_CMD_ERR: - ret = mmc_blk_cmd_err(md, card, brq, req, ret); -- if (!mmc_blk_reset(md, card->host, type)) -- break; -- goto cmd_abort; -+ if (mmc_blk_reset(md, card->host, type)) -+ goto cmd_abort; -+ if (!ret) -+ goto start_new_req; -+ break; - case MMC_BLK_RETRY: - if (retry++ < 5) - break; -diff --git a/drivers/mtd/maps/dc21285.c b/drivers/mtd/maps/dc21285.c -index f43b365..9af1528 100644 ---- a/drivers/mtd/maps/dc21285.c -+++ b/drivers/mtd/maps/dc21285.c -@@ -38,9 +38,9 @@ static void nw_en_write(void) - * we want to write a bit pattern XXX1 to Xilinx to enable - * the write gate, which will be open for about the next 2ms. - */ -- spin_lock_irqsave(&nw_gpio_lock, flags); -+ raw_spin_lock_irqsave(&nw_gpio_lock, flags); - nw_cpld_modify(CPLD_FLASH_WR_ENABLE, CPLD_FLASH_WR_ENABLE); -- spin_unlock_irqrestore(&nw_gpio_lock, flags); -+ raw_spin_unlock_irqrestore(&nw_gpio_lock, flags); - - /* - * let the ISA bus to catch on... -diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c -index 424ca5f..df58db3 100644 ---- a/drivers/mtd/mtd_blkdevs.c -+++ b/drivers/mtd/mtd_blkdevs.c -@@ -214,6 +214,7 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode) - return -ERESTARTSYS; /* FIXME: busy loop! -arnd*/ - - mutex_lock(&dev->lock); -+ mutex_lock(&mtd_table_mutex); - - if (dev->open) - goto unlock; -@@ -236,6 +237,7 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode) - - unlock: - dev->open++; -+ mutex_unlock(&mtd_table_mutex); - mutex_unlock(&dev->lock); - blktrans_dev_put(dev); - return ret; -@@ -246,6 +248,7 @@ error_release: - error_put: - module_put(dev->tr->owner); - kref_put(&dev->ref, blktrans_dev_release); -+ mutex_unlock(&mtd_table_mutex); - mutex_unlock(&dev->lock); - blktrans_dev_put(dev); - return ret; -@@ -260,6 +263,7 @@ static int blktrans_release(struct gendisk *disk, fmode_t mode) - return ret; - - mutex_lock(&dev->lock); -+ mutex_lock(&mtd_table_mutex); - - if (--dev->open) - goto unlock; -@@ -272,6 +276,7 @@ static int blktrans_release(struct gendisk *disk, fmode_t mode) - __put_mtd_device(dev->mtd); - } - unlock: -+ mutex_unlock(&mtd_table_mutex); - mutex_unlock(&dev->lock); - blktrans_dev_put(dev); - return ret; -diff --git a/drivers/net/ethernet/stmicro/stmmac/descs.h b/drivers/net/ethernet/stmicro/stmmac/descs.h -index 9820ec8..e93a0bf 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/descs.h -+++ b/drivers/net/ethernet/stmicro/stmmac/descs.h -@@ -153,6 +153,8 @@ struct dma_desc { - u32 buffer2_size:13; - u32 reserved4:3; - } etx; /* -- enhanced -- */ -+ -+ u64 all_flags; - } des01; - unsigned int des2; - unsigned int des3; -diff --git a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c -index d879763..73e647b 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c -+++ b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c -@@ -232,6 +232,7 @@ static void enh_desc_init_rx_desc(struct dma_desc *p, unsigned int ring_size, - { - int i; - for (i = 0; i < ring_size; i++) { -+ p->des01.all_flags = 0; - p->des01.erx.own = 1; - p->des01.erx.buffer1_size = BUF_SIZE_8KiB - 1; - -@@ -248,7 +249,7 @@ static void enh_desc_init_tx_desc(struct dma_desc *p, unsigned int ring_size) - int i; - - for (i = 0; i < ring_size; i++) { -- p->des01.etx.own = 0; -+ p->des01.all_flags = 0; - ehn_desc_tx_set_on_ring_chain(p, (i == ring_size - 1)); - p++; - } -diff --git a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c -index fda5d2b..5bf9c37 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c -+++ b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c -@@ -126,6 +126,7 @@ static void ndesc_init_rx_desc(struct dma_desc *p, unsigned int ring_size, - { - int i; - for (i = 0; i < ring_size; i++) { -+ p->des01.all_flags = 0; - p->des01.rx.own = 1; - p->des01.rx.buffer1_size = BUF_SIZE_2KiB - 1; - -@@ -141,7 +142,7 @@ static void ndesc_init_tx_desc(struct dma_desc *p, unsigned int ring_size) - { - int i; - for (i = 0; i < ring_size; i++) { -- p->des01.tx.own = 0; -+ p->des01.all_flags = 0; - ndesc_tx_set_on_ring_chain(p, (i == (ring_size - 1))); - p++; - } -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -index d4d2bc1..05852e3 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -@@ -441,19 +441,17 @@ static void init_dma_desc_rings(struct net_device *dev) - priv->rx_skbuff = - kmalloc(sizeof(struct sk_buff *) * rxsize, GFP_KERNEL); - priv->dma_rx = -- (struct dma_desc *)dma_alloc_coherent(priv->device, -- rxsize * -- sizeof(struct dma_desc), -- &priv->dma_rx_phy, -- GFP_KERNEL); -+ (struct dma_desc *)dma_zalloc_coherent(priv->device, rxsize * -+ sizeof(struct dma_desc), -+ &priv->dma_rx_phy, -+ GFP_KERNEL); - priv->tx_skbuff = kmalloc(sizeof(struct sk_buff *) * txsize, - GFP_KERNEL); - priv->dma_tx = -- (struct dma_desc *)dma_alloc_coherent(priv->device, -- txsize * -- sizeof(struct dma_desc), -- &priv->dma_tx_phy, -- GFP_KERNEL); -+ (struct dma_desc *)dma_zalloc_coherent(priv->device, txsize * -+ sizeof(struct dma_desc), -+ &priv->dma_tx_phy, -+ GFP_KERNEL); - - if ((priv->dma_rx == NULL) || (priv->dma_tx == NULL)) { - pr_err("%s:ERROR allocating the DMA Tx/Rx desc\n", __func__); -diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c -index 73c7081..c646a49 100644 ---- a/drivers/net/ethernet/sun/niu.c -+++ b/drivers/net/ethernet/sun/niu.c -@@ -6670,10 +6670,8 @@ static netdev_tx_t niu_start_xmit(struct sk_buff *skb, - struct sk_buff *skb_new; - - skb_new = skb_realloc_headroom(skb, len); -- if (!skb_new) { -- rp->tx_errors++; -+ if (!skb_new) - goto out_drop; -- } - kfree_skb(skb); - skb = skb_new; - } else -diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c -index ad33126..8d64c16 100644 ---- a/drivers/net/wireless/ath/ath9k/main.c -+++ b/drivers/net/wireless/ath/ath9k/main.c -@@ -235,7 +235,7 @@ static bool ath_prepare_reset(struct ath_softc *sc, bool retry_tx, bool flush) - { - struct ath_hw *ah = sc->sc_ah; - struct ath_common *common = ath9k_hw_common(ah); -- bool ret; -+ bool ret = true; - - ieee80211_stop_queues(sc->hw); - -@@ -245,10 +245,13 @@ static bool ath_prepare_reset(struct ath_softc *sc, bool retry_tx, bool flush) - ath9k_debug_samp_bb_mac(sc); - ath9k_hw_disable_interrupts(ah); - -- ret = ath_drain_all_txq(sc, retry_tx); -- -- if (!ath_stoprecv(sc)) -- ret = false; -+ if (AR_SREV_9300_20_OR_LATER(ah)) { -+ ret &= ath_stoprecv(sc); -+ ret &= ath_drain_all_txq(sc, retry_tx); -+ } else { -+ ret &= ath_drain_all_txq(sc, retry_tx); -+ ret &= ath_stoprecv(sc); -+ } - - if (!flush) { - if (ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) -diff --git a/drivers/pcmcia/topic.h b/drivers/pcmcia/topic.h -index 615a45a..582688fe 100644 ---- a/drivers/pcmcia/topic.h -+++ b/drivers/pcmcia/topic.h -@@ -104,6 +104,9 @@ - #define TOPIC_EXCA_IF_CONTROL 0x3e /* 8 bit */ - #define TOPIC_EXCA_IFC_33V_ENA 0x01 - -+#define TOPIC_PCI_CFG_PPBCN 0x3e /* 16-bit */ -+#define TOPIC_PCI_CFG_PPBCN_WBEN 0x0400 -+ - static void topic97_zoom_video(struct pcmcia_socket *sock, int onoff) - { - struct yenta_socket *socket = container_of(sock, struct yenta_socket, socket); -@@ -138,6 +141,7 @@ static int topic97_override(struct yenta_socket *socket) - static int topic95_override(struct yenta_socket *socket) - { - u8 fctrl; -+ u16 ppbcn; - - /* enable 3.3V support for 16bit cards */ - fctrl = exca_readb(socket, TOPIC_EXCA_IF_CONTROL); -@@ -146,6 +150,18 @@ static int topic95_override(struct yenta_socket *socket) - /* tell yenta to use exca registers to power 16bit cards */ - socket->flags |= YENTA_16BIT_POWER_EXCA | YENTA_16BIT_POWER_DF; - -+ /* Disable write buffers to prevent lockups under load with numerous -+ Cardbus cards, observed on Tecra 500CDT and reported elsewhere on the -+ net. This is not a power-on default according to the datasheet -+ but some BIOSes seem to set it. */ -+ if (pci_read_config_word(socket->dev, TOPIC_PCI_CFG_PPBCN, &ppbcn) == 0 -+ && socket->dev->revision <= 7 -+ && (ppbcn & TOPIC_PCI_CFG_PPBCN_WBEN)) { -+ ppbcn &= ~TOPIC_PCI_CFG_PPBCN_WBEN; -+ pci_write_config_word(socket->dev, TOPIC_PCI_CFG_PPBCN, ppbcn); -+ dev_info(&socket->dev->dev, "Disabled ToPIC95 Cardbus write buffers.\n"); -+ } -+ - return 0; - } - -diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c -index 1d3bcce..e57f5de 100644 ---- a/drivers/platform/x86/dell-laptop.c -+++ b/drivers/platform/x86/dell-laptop.c -@@ -215,7 +215,6 @@ static struct dmi_system_id __devinitdata dell_quirks[] = { - }; - - static struct calling_interface_buffer *buffer; --static struct page *bufferpage; - static DEFINE_MUTEX(buffer_mutex); - - static int hwswitch_state; -@@ -715,11 +714,10 @@ static int __init dell_init(void) - * Allocate buffer below 4GB for SMI data--only 32-bit physical addr - * is passed to SMI handler. - */ -- bufferpage = alloc_page(GFP_KERNEL | GFP_DMA32); -+ buffer = (void *)__get_free_page(GFP_KERNEL | GFP_DMA32); - -- if (!bufferpage) -+ if (!buffer) - goto fail_buffer; -- buffer = page_address(bufferpage); - - ret = dell_setup_rfkill(); - -@@ -788,7 +786,7 @@ fail_backlight: - fail_filter: - dell_cleanup_rfkill(); - fail_rfkill: -- free_page((unsigned long)bufferpage); -+ free_page((unsigned long)buffer); - fail_buffer: - platform_device_del(platform_device); - fail_platform_device2: -diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c -index a36addf..04a6928 100644 ---- a/drivers/platform/x86/ideapad-laptop.c -+++ b/drivers/platform/x86/ideapad-laptop.c -@@ -407,7 +407,8 @@ const struct ideapad_rfk_data ideapad_rfk_data[] = { - - static int ideapad_rfk_set(void *data, bool blocked) - { -- unsigned long opcode = (unsigned long)data; -+ unsigned long dev = (unsigned long)data; -+ int opcode = ideapad_rfk_data[dev].opcode; - - return write_ec_cmd(ideapad_handle, opcode, !blocked); - } -diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c -index adba3d6..2dd9838 100644 ---- a/drivers/regulator/core.c -+++ b/drivers/regulator/core.c -@@ -726,7 +726,7 @@ static int suspend_prepare(struct regulator_dev *rdev, suspend_state_t state) - static void print_constraints(struct regulator_dev *rdev) - { - struct regulation_constraints *constraints = rdev->constraints; -- char buf[80] = ""; -+ char buf[160] = ""; - int count = 0; - int ret; - -diff --git a/drivers/scsi/ipr.h b/drivers/scsi/ipr.h -index ac84736..a9932bd 100644 ---- a/drivers/scsi/ipr.h -+++ b/drivers/scsi/ipr.h -@@ -251,7 +251,7 @@ - #define IPR_RUNTIME_RESET 0x40000000 - - #define IPR_IPL_INIT_MIN_STAGE_TIME 5 --#define IPR_IPL_INIT_DEFAULT_STAGE_TIME 15 -+#define IPR_IPL_INIT_DEFAULT_STAGE_TIME 30 - #define IPR_IPL_INIT_STAGE_UNKNOWN 0x0 - #define IPR_IPL_INIT_STAGE_TRANSOP 0xB0000000 - #define IPR_IPL_INIT_STAGE_MASK 0xff000000 -diff --git a/drivers/staging/iio/dac/ad5624r_spi.c b/drivers/staging/iio/dac/ad5624r_spi.c -index 284d8790..8e81fce 100644 ---- a/drivers/staging/iio/dac/ad5624r_spi.c -+++ b/drivers/staging/iio/dac/ad5624r_spi.c -@@ -49,7 +49,7 @@ static const struct ad5624r_chip_info ad5624r_chip_info_tbl[] = { - }; - - static int ad5624r_spi_write(struct spi_device *spi, -- u8 cmd, u8 addr, u16 val, u8 len) -+ u8 cmd, u8 addr, u16 val, u8 shift) - { - u32 data; - u8 msg[3]; -@@ -62,7 +62,7 @@ static int ad5624r_spi_write(struct spi_device *spi, - * 14-, 12-bit input code followed by 0, 2, or 4 don't care bits, - * for the AD5664R, AD5644R, and AD5624R, respectively. - */ -- data = (0 << 22) | (cmd << 19) | (addr << 16) | (val << (16 - len)); -+ data = (0 << 22) | (cmd << 19) | (addr << 16) | (val << shift); - msg[0] = data >> 16; - msg[1] = data >> 8; - msg[2] = data; -diff --git a/drivers/staging/rtl8712/rtl8712_recv.c b/drivers/staging/rtl8712/rtl8712_recv.c -index 6d69265..a33bece 100644 ---- a/drivers/staging/rtl8712/rtl8712_recv.c -+++ b/drivers/staging/rtl8712/rtl8712_recv.c -@@ -1076,7 +1076,8 @@ static int recvbuf2recvframe(struct _adapter *padapter, struct sk_buff *pskb) - /* for first fragment packet, driver need allocate 1536 + - * drvinfo_sz + RXDESC_SIZE to defrag packet. */ - if ((mf == 1) && (frag == 0)) -- alloc_sz = 1658;/*1658+6=1664, 1664 is 128 alignment.*/ -+ /*1658+6=1664, 1664 is 128 alignment.*/ -+ alloc_sz = max_t(u16, tmp_len, 1658); - else - alloc_sz = tmp_len; - /* 2 is for IP header 4 bytes alignment in QoS packet case. -diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c -index d540a06..077c506 100644 ---- a/drivers/staging/vt6655/device_main.c -+++ b/drivers/staging/vt6655/device_main.c -@@ -1602,6 +1602,10 @@ static int device_rx_srv(PSDevice pDevice, unsigned int uIdx) { - // DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "pDevice->pCurrRD = %x, works = %d\n", pRD, works); - if (works++>15) - break; -+ -+ if (!pRD->pRDInfo->skb) -+ break; -+ - if (device_receive_frame(pDevice, pRD)) { - if (!device_alloc_rx_buf(pDevice,pRD)) { - DBG_PRT(MSG_LEVEL_ERR, KERN_ERR -diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c -index ae4e7da..59fb984 100644 ---- a/drivers/target/iscsi/iscsi_target.c -+++ b/drivers/target/iscsi/iscsi_target.c -@@ -4509,6 +4509,7 @@ int iscsit_release_sessions_for_tpg(struct iscsi_portal_group *tpg, int force) - struct iscsi_session *sess; - struct se_portal_group *se_tpg = &tpg->tpg_se_tpg; - struct se_session *se_sess, *se_sess_tmp; -+ LIST_HEAD(free_list); - int session_count = 0; - - spin_lock_bh(&se_tpg->session_lock); -@@ -4530,14 +4531,17 @@ int iscsit_release_sessions_for_tpg(struct iscsi_portal_group *tpg, int force) - } - atomic_set(&sess->session_reinstatement, 1); - spin_unlock(&sess->conn_lock); -- spin_unlock_bh(&se_tpg->session_lock); - -- iscsit_free_session(sess); -- spin_lock_bh(&se_tpg->session_lock); -+ list_move_tail(&se_sess->sess_list, &free_list); -+ } -+ spin_unlock_bh(&se_tpg->session_lock); - -+ list_for_each_entry_safe(se_sess, se_sess_tmp, &free_list, sess_list) { -+ sess = (struct iscsi_session *)se_sess->fabric_sess_ptr; -+ -+ iscsit_free_session(sess); - session_count++; - } -- spin_unlock_bh(&se_tpg->session_lock); - - pr_debug("Released %d iSCSI Session(s) from Target Portal" - " Group: %hu\n", session_count, tpg->tpgt); -diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c -index 99fcb8c..9645186 100644 ---- a/drivers/tty/serial/atmel_serial.c -+++ b/drivers/tty/serial/atmel_serial.c -@@ -229,8 +229,7 @@ void atmel_config_rs485(struct uart_port *port, struct serial_rs485 *rs485conf) - if (rs485conf->flags & SER_RS485_ENABLED) { - dev_dbg(port->dev, "Setting UART to RS485\n"); - atmel_port->tx_done_mask = ATMEL_US_TXEMPTY; -- if ((rs485conf->delay_rts_after_send) > 0) -- UART_PUT_TTGR(port, rs485conf->delay_rts_after_send); -+ UART_PUT_TTGR(port, rs485conf->delay_rts_after_send); - mode |= ATMEL_US_USMODE_RS485; - } else { - dev_dbg(port->dev, "Setting UART to RS232\n"); -@@ -305,9 +304,7 @@ static void atmel_set_mctrl(struct uart_port *port, u_int mctrl) - - if (atmel_port->rs485.flags & SER_RS485_ENABLED) { - dev_dbg(port->dev, "Setting UART to RS485\n"); -- if ((atmel_port->rs485.delay_rts_after_send) > 0) -- UART_PUT_TTGR(port, -- atmel_port->rs485.delay_rts_after_send); -+ UART_PUT_TTGR(port, atmel_port->rs485.delay_rts_after_send); - mode |= ATMEL_US_USMODE_RS485; - } else { - dev_dbg(port->dev, "Setting UART to RS232\n"); -@@ -1229,9 +1226,7 @@ static void atmel_set_termios(struct uart_port *port, struct ktermios *termios, - - if (atmel_port->rs485.flags & SER_RS485_ENABLED) { - dev_dbg(port->dev, "Setting UART to RS485\n"); -- if ((atmel_port->rs485.delay_rts_after_send) > 0) -- UART_PUT_TTGR(port, -- atmel_port->rs485.delay_rts_after_send); -+ UART_PUT_TTGR(port, atmel_port->rs485.delay_rts_after_send); - mode |= ATMEL_US_USMODE_RS485; - } else { - dev_dbg(port->dev, "Setting UART to RS232\n"); -diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c -index 57d6302..ca666d0 100644 ---- a/drivers/usb/class/cdc-acm.c -+++ b/drivers/usb/class/cdc-acm.c -@@ -1295,6 +1295,11 @@ skip_countries: - - acm_table[minor] = acm; - -+ if (quirks & CLEAR_HALT_CONDITIONS) { -+ usb_clear_halt(usb_dev, usb_rcvbulkpipe(usb_dev, epread->bEndpointAddress)); -+ usb_clear_halt(usb_dev, usb_sndbulkpipe(usb_dev, epwrite->bEndpointAddress)); -+ } -+ - return 0; - alloc_fail7: - for (i = 0; i < ACM_NW; i++) -@@ -1574,6 +1579,10 @@ static const struct usb_device_id acm_ids[] = { - .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */ - }, - -+ { USB_DEVICE(0x2912, 0x0001), /* ATOL FPrint */ -+ .driver_info = CLEAR_HALT_CONDITIONS, -+ }, -+ - /* Nokia S60 phones expose two ACM channels. The first is - * a modem and is picked up by the standard AT-command - * information below. The second is 'vendor-specific' but -diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h -index c3f1b36..7aa5e9a 100644 ---- a/drivers/usb/class/cdc-acm.h -+++ b/drivers/usb/class/cdc-acm.h -@@ -127,3 +127,4 @@ struct acm { - #define NO_CAP_LINE 4 - #define NOT_A_MODEM 8 - #define NO_DATA_INTERFACE 16 -+#define CLEAR_HALT_CONDITIONS BIT(7) -diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c -index 18286ce..7cfe286 100644 ---- a/drivers/usb/core/hub.c -+++ b/drivers/usb/core/hub.c -@@ -2157,9 +2157,6 @@ static unsigned hub_is_wusb(struct usb_hub *hub) - #define HUB_LONG_RESET_TIME 200 - #define HUB_RESET_TIMEOUT 800 - --static int hub_port_reset(struct usb_hub *hub, int port1, -- struct usb_device *udev, unsigned int delay, bool warm); -- - /* Is a USB 3.0 port in the Inactive or Complinance Mode state? - * Port worm reset is required to recover - */ -@@ -2239,44 +2236,6 @@ delay: - return -EBUSY; - } - --static void hub_port_finish_reset(struct usb_hub *hub, int port1, -- struct usb_device *udev, int *status) --{ -- switch (*status) { -- case 0: -- /* TRSTRCY = 10 ms; plus some extra */ -- msleep(10 + 40); -- if (udev) { -- struct usb_hcd *hcd = bus_to_hcd(udev->bus); -- -- update_devnum(udev, 0); -- /* The xHC may think the device is already reset, -- * so ignore the status. -- */ -- if (hcd->driver->reset_device) -- hcd->driver->reset_device(hcd, udev); -- } -- /* FALL THROUGH */ -- case -ENOTCONN: -- case -ENODEV: -- clear_port_feature(hub->hdev, -- port1, USB_PORT_FEAT_C_RESET); -- if (hub_is_superspeed(hub->hdev)) { -- clear_port_feature(hub->hdev, port1, -- USB_PORT_FEAT_C_BH_PORT_RESET); -- clear_port_feature(hub->hdev, port1, -- USB_PORT_FEAT_C_PORT_LINK_STATE); -- clear_port_feature(hub->hdev, port1, -- USB_PORT_FEAT_C_CONNECTION); -- } -- if (udev) -- usb_set_device_state(udev, *status -- ? USB_STATE_NOTATTACHED -- : USB_STATE_DEFAULT); -- break; -- } --} -- - /* Handle port reset and port warm(BH) reset (for USB3 protocol ports) */ - static int hub_port_reset(struct usb_hub *hub, int port1, - struct usb_device *udev, unsigned int delay, bool warm) -@@ -2299,13 +2258,9 @@ static int hub_port_reset(struct usb_hub *hub, int port1, - * If the caller hasn't explicitly requested a warm reset, - * double check and see if one is needed. - */ -- status = hub_port_status(hub, port1, -- &portstatus, &portchange); -- if (status < 0) -- goto done; -- -- if (hub_port_warm_reset_required(hub, portstatus)) -- warm = true; -+ if (hub_port_status(hub, port1, &portstatus, &portchange) == 0) -+ if (hub_port_warm_reset_required(hub, portstatus)) -+ warm = true; - } - - /* Reset the port */ -@@ -2328,11 +2283,19 @@ static int hub_port_reset(struct usb_hub *hub, int port1, - - /* Check for disconnect or reset */ - if (status == 0 || status == -ENOTCONN || status == -ENODEV) { -- hub_port_finish_reset(hub, port1, udev, &status); -+ clear_port_feature(hub->hdev, port1, -+ USB_PORT_FEAT_C_RESET); - - if (!hub_is_superspeed(hub->hdev)) - goto done; - -+ clear_port_feature(hub->hdev, port1, -+ USB_PORT_FEAT_C_BH_PORT_RESET); -+ clear_port_feature(hub->hdev, port1, -+ USB_PORT_FEAT_C_PORT_LINK_STATE); -+ clear_port_feature(hub->hdev, port1, -+ USB_PORT_FEAT_C_CONNECTION); -+ - /* - * If a USB 3.0 device migrates from reset to an error - * state, re-issue the warm reset. -@@ -2366,6 +2329,26 @@ static int hub_port_reset(struct usb_hub *hub, int port1, - port1); - - done: -+ if (status == 0) { -+ /* TRSTRCY = 10 ms; plus some extra */ -+ msleep(10 + 40); -+ if (udev) { -+ struct usb_hcd *hcd = bus_to_hcd(udev->bus); -+ -+ update_devnum(udev, 0); -+ /* The xHC may think the device is already reset, -+ * so ignore the status. -+ */ -+ if (hcd->driver->reset_device) -+ hcd->driver->reset_device(hcd, udev); -+ -+ usb_set_device_state(udev, USB_STATE_DEFAULT); -+ } -+ } else { -+ if (udev) -+ usb_set_device_state(udev, USB_STATE_NOTATTACHED); -+ } -+ - if (!hub_is_superspeed(hub->hdev)) - up_read(&ehci_cf_port_reset_rwsem); - -diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c -index c4134e8..24864d4 100644 ---- a/drivers/usb/dwc3/ep0.c -+++ b/drivers/usb/dwc3/ep0.c -@@ -498,6 +498,10 @@ static int dwc3_ep0_std_request(struct dwc3 *dwc, struct usb_ctrlrequest *ctrl) - dev_vdbg(dwc->dev, "USB_REQ_SET_CONFIGURATION\n"); - ret = dwc3_ep0_set_config(dwc, ctrl); - break; -+ case USB_REQ_SET_INTERFACE: -+ dev_vdbg(dwc->dev ,"USB_REQ_SET_INTERFACE"); -+ dwc->start_config_issued = false; -+ /* Fall through */ - default: - dev_vdbg(dwc->dev, "Forwarding to gadget driver\n"); - ret = dwc3_ep0_delegate_req(dwc, ctrl); -diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c -index 5f2e3d0..b4623f1 100644 ---- a/drivers/usb/dwc3/gadget.c -+++ b/drivers/usb/dwc3/gadget.c -@@ -171,6 +171,8 @@ int dwc3_send_gadget_ep_cmd(struct dwc3 *dwc, unsigned ep, - if (!(reg & DWC3_DEPCMD_CMDACT)) { - dev_vdbg(dwc->dev, "Command Complete --> %d\n", - DWC3_DEPCMD_STATUS(reg)); -+ if (DWC3_DEPCMD_STATUS(reg)) -+ return -EINVAL; - return 0; - } - -diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c -index c1fa92e..8605813 100644 ---- a/drivers/usb/host/xhci-hub.c -+++ b/drivers/usb/host/xhci-hub.c -@@ -449,10 +449,13 @@ static void xhci_hub_report_link_state(struct xhci_hcd *xhci, - u32 pls = status_reg & PORT_PLS_MASK; - - /* resume state is a xHCI internal state. -- * Do not report it to usb core. -+ * Do not report it to usb core, instead, pretend to be U3, -+ * thus usb core knows it's not ready for transfer - */ -- if (pls == XDEV_RESUME) -+ if (pls == XDEV_RESUME) { -+ *status |= USB_SS_PORT_LS_U3; - return; -+ } - - /* When the CAS bit is set then warm reset - * should be performed on port -@@ -592,7 +595,14 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, - status |= USB_PORT_STAT_C_RESET << 16; - /* USB3.0 only */ - if (hcd->speed == HCD_USB3) { -- if ((temp & PORT_PLC)) -+ /* Port link change with port in resume state should not be -+ * reported to usbcore, as this is an internal state to be -+ * handled by xhci driver. Reporting PLC to usbcore may -+ * cause usbcore clearing PLC first and port change event -+ * irq won't be generated. -+ */ -+ if ((temp & PORT_PLC) && -+ (temp & PORT_PLS_MASK) != XDEV_RESUME) - status |= USB_PORT_STAT_C_LINK_STATE << 16; - if ((temp & PORT_WRC)) - status |= USB_PORT_STAT_C_BH_RESET << 16; -diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c -index 0f4a41d..d5d2af5 100644 ---- a/drivers/usb/host/xhci-mem.c -+++ b/drivers/usb/host/xhci-mem.c -@@ -1330,10 +1330,10 @@ int xhci_endpoint_init(struct xhci_hcd *xhci, - /* Attempt to use the ring cache */ - if (virt_dev->num_rings_cached == 0) - return -ENOMEM; -+ virt_dev->num_rings_cached--; - virt_dev->eps[ep_index].new_ring = - virt_dev->ring_cache[virt_dev->num_rings_cached]; - virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL; -- virt_dev->num_rings_cached--; - xhci_reinit_cached_ring(xhci, virt_dev->eps[ep_index].new_ring, - usb_endpoint_xfer_isoc(&ep->desc) ? true : false); - } -diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c -index 5c535a8..950a8cc 100644 ---- a/drivers/usb/host/xhci.c -+++ b/drivers/usb/host/xhci.c -@@ -3361,6 +3361,9 @@ int xhci_discover_or_reset_device(struct usb_hcd *hcd, struct usb_device *udev) - return -EINVAL; - } - -+ if (virt_dev->tt_info) -+ old_active_eps = virt_dev->tt_info->active_eps; -+ - if (virt_dev->udev != udev) { - /* If the virt_dev and the udev does not match, this virt_dev - * may belong to another udev. -diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c -index 073a0f98..1a19724 100644 ---- a/drivers/usb/serial/cp210x.c -+++ b/drivers/usb/serial/cp210x.c -@@ -193,6 +193,7 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(0x1FB9, 0x0602) }, /* Lake Shore Model 648 Magnet Power Supply */ - { USB_DEVICE(0x1FB9, 0x0700) }, /* Lake Shore Model 737 VSM Controller */ - { USB_DEVICE(0x1FB9, 0x0701) }, /* Lake Shore Model 776 Hall Matrix */ -+ { USB_DEVICE(0x2626, 0xEA60) }, /* Aruba Networks 7xxx USB Serial Console */ - { USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */ - { USB_DEVICE(0x3195, 0xF280) }, /* Link Instruments MSO-28 */ - { USB_DEVICE(0x3195, 0xF281) }, /* Link Instruments MSO-28 */ -diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h -index 68e8552..a0c4cc4 100644 ---- a/drivers/usb/storage/unusual_devs.h -+++ b/drivers/usb/storage/unusual_devs.h -@@ -2019,6 +2019,18 @@ UNUSUAL_DEV( 0x1908, 0x3335, 0x0200, 0x0200, - USB_SC_DEVICE, USB_PR_DEVICE, NULL, - US_FL_NO_READ_DISC_INFO ), - -+/* Reported by Oliver Neukum <oneukum@suse.com> -+ * This device morphes spontaneously into another device if the access -+ * pattern of Windows isn't followed. Thus writable media would be dirty -+ * if the initial instance is used. So the device is limited to its -+ * virtual CD. -+ * And yes, the concept that BCD goes up to 9 is not heeded */ -+UNUSUAL_DEV( 0x19d2, 0x1225, 0x0000, 0xffff, -+ "ZTE,Incorporated", -+ "ZTE WCDMA Technologies MSM", -+ USB_SC_DEVICE, USB_PR_DEVICE, NULL, -+ US_FL_SINGLE_LUN ), -+ - /* Reported by Sven Geggus <sven-usbst@geggus.net> - * This encrypted pen drive returns bogus data for the initial READ(10). - */ -diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c -index be32b1b..738707a 100644 ---- a/drivers/vhost/vhost.c -+++ b/drivers/vhost/vhost.c -@@ -883,6 +883,7 @@ long vhost_dev_ioctl(struct vhost_dev *d, unsigned int ioctl, unsigned long arg) - } - if (eventfp != d->log_file) { - filep = d->log_file; -+ d->log_file = eventfp; - ctx = d->log_ctx; - d->log_ctx = eventfp ? - eventfd_ctx_fileget(eventfp) : NULL; -diff --git a/drivers/watchdog/omap_wdt.c b/drivers/watchdog/omap_wdt.c -index 2b4acb8..8a93753 100644 ---- a/drivers/watchdog/omap_wdt.c -+++ b/drivers/watchdog/omap_wdt.c -@@ -150,6 +150,13 @@ static int omap_wdt_open(struct inode *inode, struct file *file) - - pm_runtime_get_sync(wdev->dev); - -+ /* -+ * Make sure the watchdog is disabled. This is unfortunately required -+ * because writing to various registers with the watchdog running has no -+ * effect. -+ */ -+ omap_wdt_disable(wdev); -+ - /* initialize prescaler */ - while (__raw_readl(base + OMAP_WATCHDOG_WPS) & 0x01) - cpu_relax(); -diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c -index 879ed88..bf1df72 100644 ---- a/fs/9p/vfs_inode.c -+++ b/fs/9p/vfs_inode.c -@@ -527,8 +527,7 @@ static struct inode *v9fs_qid_iget(struct super_block *sb, - unlock_new_inode(inode); - return inode; - error: -- unlock_new_inode(inode); -- iput(inode); -+ iget_failed(inode); - return ERR_PTR(retval); - - } -diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c -index 30d4fa8..dbbc83f 100644 ---- a/fs/9p/vfs_inode_dotl.c -+++ b/fs/9p/vfs_inode_dotl.c -@@ -169,8 +169,7 @@ static struct inode *v9fs_qid_iget_dotl(struct super_block *sb, - unlock_new_inode(inode); - return inode; - error: -- unlock_new_inode(inode); -- iput(inode); -+ iget_failed(inode); - return ERR_PTR(retval); - - } -diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c -index a1fee6f..b3d1efe 100644 ---- a/fs/btrfs/inode-map.c -+++ b/fs/btrfs/inode-map.c -@@ -244,6 +244,7 @@ void btrfs_unpin_free_ino(struct btrfs_root *root) - { - struct btrfs_free_space_ctl *ctl = root->free_ino_ctl; - struct rb_root *rbroot = &root->free_ino_pinned->free_space_offset; -+ spinlock_t *rbroot_lock = &root->free_ino_pinned->tree_lock; - struct btrfs_free_space *info; - struct rb_node *n; - u64 count; -@@ -252,24 +253,30 @@ void btrfs_unpin_free_ino(struct btrfs_root *root) - return; - - while (1) { -+ bool add_to_ctl = true; -+ -+ spin_lock(rbroot_lock); - n = rb_first(rbroot); -- if (!n) -+ if (!n) { -+ spin_unlock(rbroot_lock); - break; -+ } - - info = rb_entry(n, struct btrfs_free_space, offset_index); - BUG_ON(info->bitmap); - - if (info->offset > root->cache_progress) -- goto free; -+ add_to_ctl = false; - else if (info->offset + info->bytes > root->cache_progress) - count = root->cache_progress - info->offset + 1; - else - count = info->bytes; - -- __btrfs_add_free_space(ctl, info->offset, count); --free: - rb_erase(&info->offset_index, rbroot); -- kfree(info); -+ spin_unlock(rbroot_lock); -+ if (add_to_ctl) -+ __btrfs_add_free_space(ctl, info->offset, count); -+ kmem_cache_free(btrfs_free_space_cachep, info); - } - } - -diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c -index 52bacff..ba26540 100644 ---- a/fs/btrfs/ioctl.c -+++ b/fs/btrfs/ioctl.c -@@ -2448,6 +2448,20 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd, - new_key.offset += skip; - } - -+ /* -+ * Don't copy an inline extent into an offset -+ * greater than zero. Having an inline extent -+ * at such an offset results in chaos as btrfs -+ * isn't prepared for such cases. Just skip -+ * this case for the same reasons as commented -+ * at btrfs_ioctl_clone(). -+ */ -+ if (new_key.offset > 0) { -+ ret = -EOPNOTSUPP; -+ btrfs_end_transaction(trans, root); -+ goto out; -+ } -+ - if (key.offset + datal > off+len) - trim = key.offset + datal - (off+len); - -diff --git a/fs/buffer.c b/fs/buffer.c -index c457f84..7eb4da4 100644 ---- a/fs/buffer.c -+++ b/fs/buffer.c -@@ -1002,7 +1002,7 @@ init_page_buffers(struct page *page, struct block_device *bdev, - */ - static int - grow_dev_page(struct block_device *bdev, sector_t block, -- pgoff_t index, int size, int sizebits) -+ pgoff_t index, int size, int sizebits, gfp_t gfp) - { - struct inode *inode = bdev->bd_inode; - struct page *page; -@@ -1011,7 +1011,7 @@ grow_dev_page(struct block_device *bdev, sector_t block, - int ret = 0; /* Will call free_more_memory() */ - - page = find_or_create_page(inode->i_mapping, index, -- (mapping_gfp_mask(inode->i_mapping) & ~__GFP_FS)|__GFP_MOVABLE); -+ (mapping_gfp_mask(inode->i_mapping) & ~__GFP_FS) | gfp); - if (!page) - return ret; - -@@ -1059,7 +1059,7 @@ failed: - * that page was dirty, the buffers are set dirty also. - */ - static int --grow_buffers(struct block_device *bdev, sector_t block, int size) -+grow_buffers(struct block_device *bdev, sector_t block, int size, gfp_t gfp) - { - pgoff_t index; - int sizebits; -@@ -1086,11 +1086,12 @@ grow_buffers(struct block_device *bdev, sector_t block, int size) - } - - /* Create a page with the proper size buffers.. */ -- return grow_dev_page(bdev, block, index, size, sizebits); -+ return grow_dev_page(bdev, block, index, size, sizebits, gfp); - } - --static struct buffer_head * --__getblk_slow(struct block_device *bdev, sector_t block, int size) -+struct buffer_head * -+__getblk_slow(struct block_device *bdev, sector_t block, -+ unsigned size, gfp_t gfp) - { - /* Size must be multiple of hard sectorsize */ - if (unlikely(size & (bdev_logical_block_size(bdev)-1) || -@@ -1112,13 +1113,14 @@ __getblk_slow(struct block_device *bdev, sector_t block, int size) - if (bh) - return bh; - -- ret = grow_buffers(bdev, block, size); -+ ret = grow_buffers(bdev, block, size, gfp); - if (ret < 0) - return NULL; - if (ret == 0) - free_more_memory(); - } - } -+EXPORT_SYMBOL(__getblk_slow); - - /* - * The relationship between dirty buffers and dirty pages: -@@ -1369,24 +1371,25 @@ __find_get_block(struct block_device *bdev, sector_t block, unsigned size) - EXPORT_SYMBOL(__find_get_block); - - /* -- * __getblk will locate (and, if necessary, create) the buffer_head -+ * __getblk_gfp() will locate (and, if necessary, create) the buffer_head - * which corresponds to the passed block_device, block and size. The - * returned buffer has its reference count incremented. - * -- * __getblk() will lock up the machine if grow_dev_page's try_to_free_buffers() -- * attempt is failing. FIXME, perhaps? -+ * __getblk_gfp() will lock up the machine if grow_dev_page's -+ * try_to_free_buffers() attempt is failing. FIXME, perhaps? - */ - struct buffer_head * --__getblk(struct block_device *bdev, sector_t block, unsigned size) -+__getblk_gfp(struct block_device *bdev, sector_t block, -+ unsigned size, gfp_t gfp) - { - struct buffer_head *bh = __find_get_block(bdev, block, size); - - might_sleep(); - if (bh == NULL) -- bh = __getblk_slow(bdev, block, size); -+ bh = __getblk_slow(bdev, block, size, gfp); - return bh; - } --EXPORT_SYMBOL(__getblk); -+EXPORT_SYMBOL(__getblk_gfp); - - /* - * Do async read-ahead on a buffer.. -@@ -1402,24 +1405,28 @@ void __breadahead(struct block_device *bdev, sector_t block, unsigned size) - EXPORT_SYMBOL(__breadahead); - - /** -- * __bread() - reads a specified block and returns the bh -+ * __bread_gfp() - reads a specified block and returns the bh - * @bdev: the block_device to read from - * @block: number of block - * @size: size (in bytes) to read -- * -+ * @gfp: page allocation flag -+ * - * Reads a specified block, and returns buffer head that contains it. -+ * The page cache can be allocated from non-movable area -+ * not to prevent page migration if you set gfp to zero. - * It returns NULL if the block was unreadable. - */ - struct buffer_head * --__bread(struct block_device *bdev, sector_t block, unsigned size) -+__bread_gfp(struct block_device *bdev, sector_t block, -+ unsigned size, gfp_t gfp) - { -- struct buffer_head *bh = __getblk(bdev, block, size); -+ struct buffer_head *bh = __getblk_gfp(bdev, block, size, gfp); - - if (likely(bh) && !buffer_uptodate(bh)) - bh = __bread_slow(bh); - return bh; - } --EXPORT_SYMBOL(__bread); -+EXPORT_SYMBOL(__bread_gfp); - - /* - * invalidate_bh_lrus() is called rarely - but not only at unmount. -diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c -index 2da63ab..e3d65ab 100644 ---- a/fs/ext4/extents.c -+++ b/fs/ext4/extents.c -@@ -700,7 +700,8 @@ ext4_ext_find_extent(struct inode *inode, ext4_lblk_t block, - path[ppos].p_depth = i; - path[ppos].p_ext = NULL; - -- bh = sb_getblk(inode->i_sb, path[ppos].p_block); -+ bh = sb_getblk_gfp(inode->i_sb, path[ppos].p_block, -+ __GFP_MOVABLE | GFP_NOFS); - if (unlikely(!bh)) { - ret = -ENOMEM; - goto err; -@@ -905,7 +906,7 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode, - err = -EIO; - goto cleanup; - } -- bh = sb_getblk(inode->i_sb, newblock); -+ bh = sb_getblk_gfp(inode->i_sb, newblock, __GFP_MOVABLE | GFP_NOFS); - if (!bh) { - err = -ENOMEM; - goto cleanup; -@@ -1089,7 +1090,7 @@ static int ext4_ext_grow_indepth(handle_t *handle, struct inode *inode, - if (newblock == 0) - return err; - -- bh = sb_getblk(inode->i_sb, newblock); -+ bh = sb_getblk_gfp(inode->i_sb, newblock, __GFP_MOVABLE | GFP_NOFS); - if (!bh) - return -ENOMEM; - lock_buffer(bh); -diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c -index 26d6dbf..ae1425a 100644 ---- a/fs/ext4/indirect.c -+++ b/fs/ext4/indirect.c -@@ -706,7 +706,7 @@ int ext4_ind_map_blocks(handle_t *handle, struct inode *inode, - EXT4_FEATURE_RO_COMPAT_BIGALLOC)) { - EXT4_ERROR_INODE(inode, "Can't allocate blocks for " - "non-extent mapped inodes with bigalloc"); -- return -ENOSPC; -+ return -EUCLEAN; - } - - goal = ext4_find_goal(inode, map->m_lblk, partial); -diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c -index f06857b..0610766 100644 ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -1849,18 +1849,31 @@ static int __ext4_journalled_writepage(struct page *page, - page_bufs = page_buffers(page); - BUG_ON(!page_bufs); - walk_page_buffers(handle, page_bufs, 0, len, NULL, bget_one); -- /* As soon as we unlock the page, it can go away, but we have -- * references to buffers so we are safe */ -+ /* -+ * We need to release the page lock before we start the -+ * journal, so grab a reference so the page won't disappear -+ * out from under us. -+ */ -+ get_page(page); - unlock_page(page); - - handle = ext4_journal_start(inode, ext4_writepage_trans_blocks(inode)); - if (IS_ERR(handle)) { - ret = PTR_ERR(handle); -- goto out; -+ put_page(page); -+ goto out_no_pagelock; - } -- - BUG_ON(!ext4_handle_valid(handle)); - -+ lock_page(page); -+ put_page(page); -+ if (page->mapping != mapping) { -+ /* The page got truncated from under us */ -+ ext4_journal_stop(handle); -+ ret = 0; -+ goto out; -+ } -+ - ret = walk_page_buffers(handle, page_bufs, 0, len, NULL, - do_journal_get_write_access); - -@@ -1876,6 +1889,8 @@ static int __ext4_journalled_writepage(struct page *page, - walk_page_buffers(handle, page_bufs, 0, len, NULL, bput_one); - ext4_set_inode_state(inode, EXT4_STATE_JDATA); - out: -+ unlock_page(page); -+out_no_pagelock: - return ret; - } - -diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c -index 5baa7ba..7c03826 100644 ---- a/fs/ext4/mballoc.c -+++ b/fs/ext4/mballoc.c -@@ -4720,18 +4720,12 @@ do_more: - /* - * blocks being freed are metadata. these blocks shouldn't - * be used until this transaction is committed -+ * -+ * We use __GFP_NOFAIL because ext4_free_blocks() is not allowed -+ * to fail. - */ -- retry: -- new_entry = kmem_cache_alloc(ext4_free_ext_cachep, GFP_NOFS); -- if (!new_entry) { -- /* -- * We use a retry loop because -- * ext4_free_blocks() is not allowed to fail. -- */ -- cond_resched(); -- congestion_wait(BLK_RW_ASYNC, HZ/50); -- goto retry; -- } -+ new_entry = kmem_cache_alloc(ext4_free_ext_cachep, -+ GFP_NOFS|__GFP_NOFAIL); - new_entry->start_cluster = bit; - new_entry->group = block_group; - new_entry->count = count_clusters; -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index 422be11..be4db0e 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -857,6 +857,7 @@ static void ext4_put_super(struct super_block *sb) - dump_orphan_list(sb, sbi); - J_ASSERT(list_empty(&sbi->s_orphan)); - -+ sync_blockdev(sb->s_bdev); - invalidate_bdev(sb->s_bdev); - if (sbi->journal_bdev && sbi->journal_bdev != sb->s_bdev) { - /* -diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c -index afc0f706..e613870 100644 ---- a/fs/fuse/inode.c -+++ b/fs/fuse/inode.c -@@ -993,6 +993,7 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent) - goto err_fput; - - fuse_conn_init(fc); -+ fc->release = fuse_free_conn; - - fc->dev = sb->s_dev; - fc->sb = sb; -@@ -1007,7 +1008,6 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent) - fc->dont_mask = 1; - sb->s_flags |= MS_POSIXACL; - -- fc->release = fuse_free_conn; - fc->flags = d.flags; - fc->user_id = d.user_id; - fc->group_id = d.group_id; -diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c -index 16a698b..39c7059 100644 ---- a/fs/jbd2/checkpoint.c -+++ b/fs/jbd2/checkpoint.c -@@ -478,80 +478,28 @@ out: - - int jbd2_cleanup_journal_tail(journal_t *journal) - { -- transaction_t * transaction; - tid_t first_tid; -- unsigned long blocknr, freed; -+ unsigned long blocknr; - - if (is_journal_aborted(journal)) -- return 1; -- -- /* OK, work out the oldest transaction remaining in the log, and -- * the log block it starts at. -- * -- * If the log is now empty, we need to work out which is the -- * next transaction ID we will write, and where it will -- * start. */ -+ return -EIO; - -- write_lock(&journal->j_state_lock); -- spin_lock(&journal->j_list_lock); -- transaction = journal->j_checkpoint_transactions; -- if (transaction) { -- first_tid = transaction->t_tid; -- blocknr = transaction->t_log_start; -- } else if ((transaction = journal->j_committing_transaction) != NULL) { -- first_tid = transaction->t_tid; -- blocknr = transaction->t_log_start; -- } else if ((transaction = journal->j_running_transaction) != NULL) { -- first_tid = transaction->t_tid; -- blocknr = journal->j_head; -- } else { -- first_tid = journal->j_transaction_sequence; -- blocknr = journal->j_head; -- } -- spin_unlock(&journal->j_list_lock); -- J_ASSERT(blocknr != 0); -- -- /* If the oldest pinned transaction is at the tail of the log -- already then there's not much we can do right now. */ -- if (journal->j_tail_sequence == first_tid) { -- write_unlock(&journal->j_state_lock); -+ if (!jbd2_journal_get_log_tail(journal, &first_tid, &blocknr)) - return 1; -- } -- -- /* OK, update the superblock to recover the freed space. -- * Physical blocks come first: have we wrapped beyond the end of -- * the log? */ -- freed = blocknr - journal->j_tail; -- if (blocknr < journal->j_tail) -- freed = freed + journal->j_last - journal->j_first; -- -- trace_jbd2_cleanup_journal_tail(journal, first_tid, blocknr, freed); -- jbd_debug(1, -- "Cleaning journal tail from %d to %d (offset %lu), " -- "freeing %lu\n", -- journal->j_tail_sequence, first_tid, blocknr, freed); -- -- journal->j_free += freed; -- journal->j_tail_sequence = first_tid; -- journal->j_tail = blocknr; -- write_unlock(&journal->j_state_lock); -+ J_ASSERT(blocknr != 0); - - /* -- * If there is an external journal, we need to make sure that -- * any data blocks that were recently written out --- perhaps -- * by jbd2_log_do_checkpoint() --- are flushed out before we -- * drop the transactions from the external journal. It's -- * unlikely this will be necessary, especially with a -- * appropriately sized journal, but we need this to guarantee -- * correctness. Fortunately jbd2_cleanup_journal_tail() -- * doesn't get called all that often. -+ * We need to make sure that any blocks that were recently written out -+ * --- perhaps by jbd2_log_do_checkpoint() --- are flushed out before -+ * we drop the transactions from the journal. It's unlikely this will -+ * be necessary, especially with an appropriately sized journal, but we -+ * need this to guarantee correctness. Fortunately -+ * jbd2_cleanup_journal_tail() doesn't get called all that often. - */ -- if ((journal->j_fs_dev != journal->j_dev) && -- (journal->j_flags & JBD2_BARRIER)) -- blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL); -- if (!(journal->j_flags & JBD2_ABORT)) -- jbd2_journal_update_superblock(journal, 1); -- return 0; -+ if (journal->j_flags & JBD2_BARRIER) -+ blkdev_issue_flush(journal->j_fs_dev, GFP_NOFS, NULL); -+ -+ return __jbd2_update_log_tail(journal, first_tid, blocknr); - } - - -diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c -index ab9463a..bccb605 100644 ---- a/fs/jbd2/commit.c -+++ b/fs/jbd2/commit.c -@@ -340,7 +340,16 @@ void jbd2_journal_commit_transaction(journal_t *journal) - /* Do we need to erase the effects of a prior jbd2_journal_flush? */ - if (journal->j_flags & JBD2_FLUSHED) { - jbd_debug(3, "super block updated\n"); -- jbd2_journal_update_superblock(journal, 1); -+ /* -+ * We hold j_checkpoint_mutex so tail cannot change under us. -+ * We don't need any special data guarantees for writing sb -+ * since journal is empty and it is ok for write to be -+ * flushed only with transaction commit. -+ */ -+ jbd2_journal_update_sb_log_tail(journal, -+ journal->j_tail_sequence, -+ journal->j_tail, -+ WRITE_SYNC); - } else { - jbd_debug(3, "superblock not updated\n"); - } -diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c -index 17b04fc..9532dac 100644 ---- a/fs/jbd2/journal.c -+++ b/fs/jbd2/journal.c -@@ -775,6 +775,92 @@ struct journal_head *jbd2_journal_get_descriptor_buffer(journal_t *journal) - return jbd2_journal_add_journal_head(bh); - } - -+/* -+ * Return tid of the oldest transaction in the journal and block in the journal -+ * where the transaction starts. -+ * -+ * If the journal is now empty, return which will be the next transaction ID -+ * we will write and where will that transaction start. -+ * -+ * The return value is 0 if journal tail cannot be pushed any further, 1 if -+ * it can. -+ */ -+int jbd2_journal_get_log_tail(journal_t *journal, tid_t *tid, -+ unsigned long *block) -+{ -+ transaction_t *transaction; -+ int ret; -+ -+ read_lock(&journal->j_state_lock); -+ spin_lock(&journal->j_list_lock); -+ transaction = journal->j_checkpoint_transactions; -+ if (transaction) { -+ *tid = transaction->t_tid; -+ *block = transaction->t_log_start; -+ } else if ((transaction = journal->j_committing_transaction) != NULL) { -+ *tid = transaction->t_tid; -+ *block = transaction->t_log_start; -+ } else if ((transaction = journal->j_running_transaction) != NULL) { -+ *tid = transaction->t_tid; -+ *block = journal->j_head; -+ } else { -+ *tid = journal->j_transaction_sequence; -+ *block = journal->j_head; -+ } -+ ret = tid_gt(*tid, journal->j_tail_sequence); -+ spin_unlock(&journal->j_list_lock); -+ read_unlock(&journal->j_state_lock); -+ -+ return ret; -+} -+ -+/* -+ * Update information in journal structure and in on disk journal superblock -+ * about log tail. This function does not check whether information passed in -+ * really pushes log tail further. It's responsibility of the caller to make -+ * sure provided log tail information is valid (e.g. by holding -+ * j_checkpoint_mutex all the time between computing log tail and calling this -+ * function as is the case with jbd2_cleanup_journal_tail()). -+ * -+ * Requires j_checkpoint_mutex -+ */ -+int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block) -+{ -+ unsigned long freed; -+ int ret; -+ -+ BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex)); -+ -+ /* -+ * We cannot afford for write to remain in drive's caches since as -+ * soon as we update j_tail, next transaction can start reusing journal -+ * space and if we lose sb update during power failure we'd replay -+ * old transaction with possibly newly overwritten data. -+ */ -+ ret = jbd2_journal_update_sb_log_tail(journal, tid, block, WRITE_FUA); -+ if (ret) -+ goto out; -+ -+ write_lock(&journal->j_state_lock); -+ freed = block - journal->j_tail; -+ if (block < journal->j_tail) -+ freed += journal->j_last - journal->j_first; -+ -+ trace_jbd2_update_log_tail(journal, tid, block, freed); -+ jbd_debug(1, -+ "Cleaning journal tail from %d to %d (offset %lu), " -+ "freeing %lu\n", -+ journal->j_tail_sequence, tid, block, freed); -+ -+ journal->j_free += freed; -+ journal->j_tail_sequence = tid; -+ journal->j_tail = block; -+ write_unlock(&journal->j_state_lock); -+ -+out: -+ return ret; -+} -+ - struct jbd2_stats_proc_session { - journal_t *journal; - struct transaction_stats_s *stats; -@@ -1143,40 +1229,41 @@ static int journal_reset(journal_t *journal) - - journal->j_max_transaction_buffers = journal->j_maxlen / 4; - -- /* Add the dynamic fields and write it to disk. */ -- jbd2_journal_update_superblock(journal, 1); -- return jbd2_journal_start_thread(journal); --} -- --/** -- * void jbd2_journal_update_superblock() - Update journal sb on disk. -- * @journal: The journal to update. -- * @wait: Set to '0' if you don't want to wait for IO completion. -- * -- * Update a journal's dynamic superblock fields and write it to disk, -- * optionally waiting for the IO to complete. -- */ --void jbd2_journal_update_superblock(journal_t *journal, int wait) --{ -- journal_superblock_t *sb = journal->j_superblock; -- struct buffer_head *bh = journal->j_sb_buffer; -- - /* - * As a special case, if the on-disk copy is already marked as needing -- * no recovery (s_start == 0) and there are no outstanding transactions -- * in the filesystem, then we can safely defer the superblock update -- * until the next commit by setting JBD2_FLUSHED. This avoids -+ * no recovery (s_start == 0), then we can safely defer the superblock -+ * update until the next commit by setting JBD2_FLUSHED. This avoids - * attempting a write to a potential-readonly device. - */ -- if (sb->s_start == 0 && journal->j_tail_sequence == -- journal->j_transaction_sequence) { -+ if (sb->s_start == 0) { - jbd_debug(1, "JBD2: Skipping superblock update on recovered sb " - "(start %ld, seq %d, errno %d)\n", - journal->j_tail, journal->j_tail_sequence, - journal->j_errno); -- goto out; -+ journal->j_flags |= JBD2_FLUSHED; -+ } else { -+ /* -+ * Update log tail information. We use WRITE_FUA since new -+ * transaction will start reusing journal space and so we -+ * must make sure information about current log tail is on -+ * disk before that. -+ */ -+ jbd2_journal_update_sb_log_tail(journal, -+ journal->j_tail_sequence, -+ journal->j_tail, -+ WRITE_FUA); - } -+ return jbd2_journal_start_thread(journal); -+} - -+static int jbd2_write_superblock(journal_t *journal, int write_op) -+{ -+ struct buffer_head *bh = journal->j_sb_buffer; -+ int ret; -+ -+ if (!(journal->j_flags & JBD2_BARRIER)) -+ write_op &= ~(REQ_FUA | REQ_FLUSH); -+ lock_buffer(bh); - if (buffer_write_io_error(bh)) { - /* - * Oh, dear. A previous attempt to write the journal -@@ -1192,48 +1279,112 @@ void jbd2_journal_update_superblock(journal_t *journal, int wait) - clear_buffer_write_io_error(bh); - set_buffer_uptodate(bh); - } -+ get_bh(bh); -+ bh->b_end_io = end_buffer_write_sync; -+ ret = submit_bh(write_op, bh); -+ wait_on_buffer(bh); -+ if (buffer_write_io_error(bh)) { -+ clear_buffer_write_io_error(bh); -+ set_buffer_uptodate(bh); -+ ret = -EIO; -+ } -+ if (ret) { -+ printk(KERN_ERR "JBD2: Error %d detected when updating " -+ "journal superblock for %s.\n", ret, -+ journal->j_devname); -+ jbd2_journal_abort(journal, ret); -+ } -+ -+ return ret; -+} -+ -+/** -+ * jbd2_journal_update_sb_log_tail() - Update log tail in journal sb on disk. -+ * @journal: The journal to update. -+ * @tail_tid: TID of the new transaction at the tail of the log -+ * @tail_block: The first block of the transaction at the tail of the log -+ * @write_op: With which operation should we write the journal sb -+ * -+ * Update a journal's superblock information about log tail and write it to -+ * disk, waiting for the IO to complete. -+ */ -+int jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid, -+ unsigned long tail_block, int write_op) -+{ -+ journal_superblock_t *sb = journal->j_superblock; -+ int ret; -+ -+ jbd_debug(1, "JBD2: updating superblock (start %lu, seq %u)\n", -+ tail_block, tail_tid); -+ -+ sb->s_sequence = cpu_to_be32(tail_tid); -+ sb->s_start = cpu_to_be32(tail_block); -+ -+ ret = jbd2_write_superblock(journal, write_op); -+ if (ret) -+ goto out; -+ /* Log is no longer empty */ -+ write_lock(&journal->j_state_lock); -+ WARN_ON(!sb->s_sequence); -+ journal->j_flags &= ~JBD2_FLUSHED; -+ write_unlock(&journal->j_state_lock); -+ -+out: -+ return ret; -+} -+ -+/** -+ * jbd2_mark_journal_empty() - Mark on disk journal as empty. -+ * @journal: The journal to update. -+ * -+ * Update a journal's dynamic superblock fields to show that journal is empty. -+ * Write updated superblock to disk waiting for IO to complete. -+ */ -+static void jbd2_mark_journal_empty(journal_t *journal) -+{ -+ journal_superblock_t *sb = journal->j_superblock; - - read_lock(&journal->j_state_lock); -- jbd_debug(1, "JBD2: updating superblock (start %ld, seq %d, errno %d)\n", -- journal->j_tail, journal->j_tail_sequence, journal->j_errno); -+ jbd_debug(1, "JBD2: Marking journal as empty (seq %d)\n", -+ journal->j_tail_sequence); - - sb->s_sequence = cpu_to_be32(journal->j_tail_sequence); -- sb->s_start = cpu_to_be32(journal->j_tail); -- sb->s_errno = cpu_to_be32(journal->j_errno); -+ sb->s_start = cpu_to_be32(0); - read_unlock(&journal->j_state_lock); - -- BUFFER_TRACE(bh, "marking dirty"); -- mark_buffer_dirty(bh); -- if (wait) { -- sync_dirty_buffer(bh); -- if (buffer_write_io_error(bh)) { -- printk(KERN_ERR "JBD2: I/O error detected " -- "when updating journal superblock for %s.\n", -- journal->j_devname); -- clear_buffer_write_io_error(bh); -- set_buffer_uptodate(bh); -- } -- } else -- write_dirty_buffer(bh, WRITE); -- --out: -- /* If we have just flushed the log (by marking s_start==0), then -- * any future commit will have to be careful to update the -- * superblock again to re-record the true start of the log. */ -+ jbd2_write_superblock(journal, WRITE_FUA); - -+ /* Log is no longer empty */ - write_lock(&journal->j_state_lock); -- if (sb->s_start) -- journal->j_flags &= ~JBD2_FLUSHED; -- else -- journal->j_flags |= JBD2_FLUSHED; -+ journal->j_flags |= JBD2_FLUSHED; - write_unlock(&journal->j_state_lock); - } - -+ -+/** -+ * jbd2_journal_update_sb_errno() - Update error in the journal. -+ * @journal: The journal to update. -+ * -+ * Update a journal's errno. Write updated superblock to disk waiting for IO -+ * to complete. -+ */ -+static void jbd2_journal_update_sb_errno(journal_t *journal) -+{ -+ journal_superblock_t *sb = journal->j_superblock; -+ -+ read_lock(&journal->j_state_lock); -+ jbd_debug(1, "JBD2: updating superblock error (errno %d)\n", -+ journal->j_errno); -+ sb->s_errno = cpu_to_be32(journal->j_errno); -+ read_unlock(&journal->j_state_lock); -+ -+ jbd2_write_superblock(journal, WRITE_SYNC); -+} -+ - /* - * Read the superblock for a given journal, performing initial - * validation of the format. - */ -- - static int journal_get_superblock(journal_t *journal) - { - struct buffer_head *bh; -@@ -1426,15 +1577,10 @@ int jbd2_journal_destroy(journal_t *journal) - spin_unlock(&journal->j_list_lock); - - if (journal->j_sb_buffer) { -- if (!is_journal_aborted(journal)) { -- /* We can now mark the journal as empty. */ -- journal->j_tail = 0; -- journal->j_tail_sequence = -- ++journal->j_transaction_sequence; -- jbd2_journal_update_superblock(journal, 1); -- } else { -+ if (!is_journal_aborted(journal)) -+ jbd2_mark_journal_empty(journal); -+ else - err = -EIO; -- } - brelse(journal->j_sb_buffer); - } - -@@ -1648,7 +1794,6 @@ int jbd2_journal_flush(journal_t *journal) - { - int err = 0; - transaction_t *transaction = NULL; -- unsigned long old_tail; - - write_lock(&journal->j_state_lock); - -@@ -1683,28 +1828,28 @@ int jbd2_journal_flush(journal_t *journal) - if (is_journal_aborted(journal)) - return -EIO; - -- jbd2_cleanup_journal_tail(journal); -+ if (!err) { -+ err = jbd2_cleanup_journal_tail(journal); -+ if (err < 0) -+ goto out; -+ err = 0; -+ } - - /* Finally, mark the journal as really needing no recovery. - * This sets s_start==0 in the underlying superblock, which is - * the magic code for a fully-recovered superblock. Any future - * commits of data to the journal will restore the current - * s_start value. */ -+ jbd2_mark_journal_empty(journal); - write_lock(&journal->j_state_lock); -- old_tail = journal->j_tail; -- journal->j_tail = 0; -- write_unlock(&journal->j_state_lock); -- jbd2_journal_update_superblock(journal, 1); -- write_lock(&journal->j_state_lock); -- journal->j_tail = old_tail; -- - J_ASSERT(!journal->j_running_transaction); - J_ASSERT(!journal->j_committing_transaction); - J_ASSERT(!journal->j_checkpoint_transactions); - J_ASSERT(journal->j_head == journal->j_tail); - J_ASSERT(journal->j_tail_sequence == journal->j_transaction_sequence); - write_unlock(&journal->j_state_lock); -- return 0; -+out: -+ return err; - } - - /** -@@ -1738,7 +1883,7 @@ int jbd2_journal_wipe(journal_t *journal, int write) - - err = jbd2_journal_skip_recovery(journal); - if (write) -- jbd2_journal_update_superblock(journal, 1); -+ jbd2_mark_journal_empty(journal); - - no_recovery: - return err; -@@ -1788,7 +1933,7 @@ static void __journal_abort_soft (journal_t *journal, int errno) - __jbd2_journal_abort_hard(journal); - - if (errno) -- jbd2_journal_update_superblock(journal, 1); -+ jbd2_journal_update_sb_errno(journal); - } - - /** -diff --git a/fs/jbd2/recovery.c b/fs/jbd2/recovery.c -index 421834b..875df5f 100644 ---- a/fs/jbd2/recovery.c -+++ b/fs/jbd2/recovery.c -@@ -21,6 +21,7 @@ - #include <linux/jbd2.h> - #include <linux/errno.h> - #include <linux/crc32.h> -+#include <linux/blkdev.h> - #endif - - /* -@@ -265,7 +266,9 @@ int jbd2_journal_recover(journal_t *journal) - err2 = sync_blockdev(journal->j_fs_dev); - if (!err) - err = err2; -- -+ /* Make sure all replayed data is on permanent storage */ -+ if (journal->j_flags & JBD2_BARRIER) -+ blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL); - return err; - } - -diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c -index 183c6b1..bee14a3 100644 ---- a/fs/nfs/nfs3xdr.c -+++ b/fs/nfs/nfs3xdr.c -@@ -1333,7 +1333,7 @@ static void nfs3_xdr_enc_setacl3args(struct rpc_rqst *req, - if (args->npages != 0) - xdr_write_pages(xdr, args->pages, 0, args->len); - else -- xdr_reserve_space(xdr, NFS_ACL_INLINE_BUFSIZE); -+ xdr_reserve_space(xdr, args->len); - - error = nfsacl_encode(xdr->buf, base, args->inode, - (args->mask & NFS_ACL) ? -diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c -index ce4168a..cd55214 100644 ---- a/fs/nfs/nfs4state.c -+++ b/fs/nfs/nfs4state.c -@@ -1192,6 +1192,8 @@ restart: - } - spin_unlock(&state->state_lock); - nfs4_put_open_state(state); -+ clear_bit(NFS4CLNT_RECLAIM_NOGRACE, -+ &state->flags); - goto restart; - } - } -diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h -index b0d7ef8..31a0f4b 100644 ---- a/include/acpi/actypes.h -+++ b/include/acpi/actypes.h -@@ -495,6 +495,7 @@ typedef u64 acpi_integer; - #define ACPI_NO_ACPI_ENABLE 0x10 - #define ACPI_NO_DEVICE_INIT 0x20 - #define ACPI_NO_OBJECT_INIT 0x40 -+#define ACPI_NO_FACS_INIT 0x80 - - /* - * Initialization state -diff --git a/include/linux/buffer_head.h b/include/linux/buffer_head.h -index 458f497..fed3f3a 100644 ---- a/include/linux/buffer_head.h -+++ b/include/linux/buffer_head.h -@@ -166,12 +166,13 @@ void __wait_on_buffer(struct buffer_head *); - wait_queue_head_t *bh_waitq_head(struct buffer_head *bh); - struct buffer_head *__find_get_block(struct block_device *bdev, sector_t block, - unsigned size); --struct buffer_head *__getblk(struct block_device *bdev, sector_t block, -- unsigned size); -+struct buffer_head *__getblk_gfp(struct block_device *bdev, sector_t block, -+ unsigned size, gfp_t gfp); - void __brelse(struct buffer_head *); - void __bforget(struct buffer_head *); - void __breadahead(struct block_device *, sector_t block, unsigned int size); --struct buffer_head *__bread(struct block_device *, sector_t block, unsigned size); -+struct buffer_head *__bread_gfp(struct block_device *, -+ sector_t block, unsigned size, gfp_t gfp); - void invalidate_bh_lrus(void); - struct buffer_head *alloc_buffer_head(gfp_t gfp_flags); - void free_buffer_head(struct buffer_head * bh); -@@ -286,7 +287,13 @@ static inline void bforget(struct buffer_head *bh) - static inline struct buffer_head * - sb_bread(struct super_block *sb, sector_t block) - { -- return __bread(sb->s_bdev, block, sb->s_blocksize); -+ return __bread_gfp(sb->s_bdev, block, sb->s_blocksize, __GFP_MOVABLE); -+} -+ -+static inline struct buffer_head * -+sb_bread_unmovable(struct super_block *sb, sector_t block) -+{ -+ return __bread_gfp(sb->s_bdev, block, sb->s_blocksize, 0); - } - - static inline void -@@ -298,7 +305,14 @@ sb_breadahead(struct super_block *sb, sector_t block) - static inline struct buffer_head * - sb_getblk(struct super_block *sb, sector_t block) - { -- return __getblk(sb->s_bdev, block, sb->s_blocksize); -+ return __getblk_gfp(sb->s_bdev, block, sb->s_blocksize, __GFP_MOVABLE); -+} -+ -+ -+static inline struct buffer_head * -+sb_getblk_gfp(struct super_block *sb, sector_t block, gfp_t gfp) -+{ -+ return __getblk_gfp(sb->s_bdev, block, sb->s_blocksize, gfp); - } - - static inline struct buffer_head * -@@ -335,6 +349,36 @@ static inline void lock_buffer(struct buffer_head *bh) - __lock_buffer(bh); - } - -+static inline struct buffer_head *getblk_unmovable(struct block_device *bdev, -+ sector_t block, -+ unsigned size) -+{ -+ return __getblk_gfp(bdev, block, size, 0); -+} -+ -+static inline struct buffer_head *__getblk(struct block_device *bdev, -+ sector_t block, -+ unsigned size) -+{ -+ return __getblk_gfp(bdev, block, size, __GFP_MOVABLE); -+} -+ -+/** -+ * __bread() - reads a specified block and returns the bh -+ * @bdev: the block_device to read from -+ * @block: number of block -+ * @size: size (in bytes) to read -+ * -+ * Reads a specified block, and returns buffer head that contains it. -+ * The page cache is allocated from movable area so that it can be migrated. -+ * It returns NULL if the block was unreadable. -+ */ -+static inline struct buffer_head * -+__bread(struct block_device *bdev, sector_t block, unsigned size) -+{ -+ return __bread_gfp(bdev, block, size, __GFP_MOVABLE); -+} -+ - extern int __set_page_dirty_buffers(struct page *page); - - #else /* CONFIG_BLOCK */ -diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h -index a153ed5..4920c55 100644 ---- a/include/linux/jbd2.h -+++ b/include/linux/jbd2.h -@@ -972,6 +972,9 @@ extern void __journal_clean_data_list(transaction_t *transaction); - /* Log buffer allocation */ - extern struct journal_head * jbd2_journal_get_descriptor_buffer(journal_t *); - int jbd2_journal_next_log_block(journal_t *, unsigned long long *); -+int jbd2_journal_get_log_tail(journal_t *journal, tid_t *tid, -+ unsigned long *block); -+int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block); - - /* Commit management */ - extern void jbd2_journal_commit_transaction(journal_t *); -@@ -1083,7 +1086,8 @@ extern int jbd2_journal_destroy (journal_t *); - extern int jbd2_journal_recover (journal_t *journal); - extern int jbd2_journal_wipe (journal_t *, int); - extern int jbd2_journal_skip_recovery (journal_t *); --extern void jbd2_journal_update_superblock (journal_t *, int); -+extern int jbd2_journal_update_sb_log_tail (journal_t *, tid_t, -+ unsigned long, int); - extern void __jbd2_journal_abort_hard (journal_t *); - extern void jbd2_journal_abort (journal_t *, int); - extern int jbd2_journal_errno (journal_t *); -diff --git a/include/linux/libata.h b/include/linux/libata.h -index 3d4b5b6..000434e 100644 ---- a/include/linux/libata.h -+++ b/include/linux/libata.h -@@ -403,6 +403,8 @@ enum { - ATA_HORKAGE_MAX_SEC_LBA48 = (1 << 17), /* Set max sects to 65535 */ - ATA_HORKAGE_NOLPM = (1 << 20), /* don't use LPM */ - ATA_HORKAGE_WD_BROKEN_LPM = (1 << 21), /* some WDs have broken LPM */ -+ ATA_HORKAGE_NOTRIM = (1 << 24), /* don't use TRIM */ -+ - - /* DMA mask for user DMA control: User visible values; DO NOT - renumber */ -diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h -index 41116ab..d2abc34 100644 ---- a/include/linux/nfs_xdr.h -+++ b/include/linux/nfs_xdr.h -@@ -1056,7 +1056,7 @@ struct nfs_impl_id4 { - struct nfstime4 date; - }; - --#define NFS4_EXCHANGE_ID_LEN (48) -+#define NFS4_EXCHANGE_ID_LEN (127) - struct nfs41_exchange_id_args { - struct nfs_client *client; - nfs4_verifier *verifier; -diff --git a/include/trace/events/jbd2.h b/include/trace/events/jbd2.h -index 7596441..5c74007 100644 ---- a/include/trace/events/jbd2.h -+++ b/include/trace/events/jbd2.h -@@ -200,7 +200,7 @@ TRACE_EVENT(jbd2_checkpoint_stats, - __entry->forced_to_close, __entry->written, __entry->dropped) - ); - --TRACE_EVENT(jbd2_cleanup_journal_tail, -+TRACE_EVENT(jbd2_update_log_tail, - - TP_PROTO(journal_t *journal, tid_t first_tid, - unsigned long block_nr, unsigned long freed), -diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c -index 20e88af..d9ce3d4 100644 ---- a/kernel/hrtimer.c -+++ b/kernel/hrtimer.c -@@ -848,6 +848,9 @@ u64 hrtimer_forward(struct hrtimer *timer, ktime_t now, ktime_t interval) - if (delta.tv64 < 0) - return 0; - -+ if (WARN_ON(timer->state & HRTIMER_STATE_ENQUEUED)) -+ return 0; -+ - if (interval.tv64 < timer->base->resolution.tv64) - interval.tv64 = timer->base->resolution.tv64; - -@@ -1260,11 +1263,14 @@ static void __run_hrtimer(struct hrtimer *timer, ktime_t *now) - * Note: We clear the CALLBACK bit after enqueue_hrtimer and - * we do not reprogramm the event hardware. Happens either in - * hrtimer_start_range_ns() or in hrtimer_interrupt() -+ * -+ * Note: Because we dropped the cpu_base->lock above, -+ * hrtimer_start_range_ns() can have popped in and enqueued the timer -+ * for us already. - */ -- if (restart != HRTIMER_NORESTART) { -- BUG_ON(timer->state != HRTIMER_STATE_CALLBACK); -+ if (restart != HRTIMER_NORESTART && -+ !(timer->state & HRTIMER_STATE_ENQUEUED)) - enqueue_hrtimer(timer, base); -- } - - WARN_ON_ONCE(!(timer->state & HRTIMER_STATE_CALLBACK)); - -diff --git a/kernel/rcutiny.c b/kernel/rcutiny.c -index 636af6d..bc84596 100644 ---- a/kernel/rcutiny.c -+++ b/kernel/rcutiny.c -@@ -160,6 +160,11 @@ static void __rcu_process_callbacks(struct rcu_ctrlblk *rcp) - - /* Move the ready-to-invoke callbacks to a local list. */ - local_irq_save(flags); -+ if (rcp->donetail == &rcp->rcucblist) { -+ /* No callbacks ready, so just leave. */ -+ local_irq_restore(flags); -+ return; -+ } - RCU_TRACE(trace_rcu_batch_start(rcp->name, 0, -1)); - list = rcp->rcucblist; - rcp->rcucblist = *rcp->donetail; -diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c -index 47343cc..bfeb725 100644 ---- a/kernel/trace/trace_events_filter.c -+++ b/kernel/trace/trace_events_filter.c -@@ -1027,6 +1027,9 @@ static void parse_init(struct filter_parse_state *ps, - - static char infix_next(struct filter_parse_state *ps) - { -+ if (!ps->infix.cnt) -+ return 0; -+ - ps->infix.cnt--; - - return ps->infix.string[ps->infix.tail++]; -@@ -1042,6 +1045,9 @@ static char infix_peek(struct filter_parse_state *ps) - - static void infix_advance(struct filter_parse_state *ps) - { -+ if (!ps->infix.cnt) -+ return; -+ - ps->infix.cnt--; - ps->infix.tail++; - } -@@ -1358,7 +1364,9 @@ static int check_preds(struct filter_parse_state *ps) - } - cnt--; - n_normal_preds++; -- WARN_ON_ONCE(cnt < 0); -+ /* all ops should have operands */ -+ if (cnt < 0) -+ break; - } - - if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) { -diff --git a/lib/bitmap.c b/lib/bitmap.c -index dbc526f..389e75e 100644 ---- a/lib/bitmap.c -+++ b/lib/bitmap.c -@@ -601,12 +601,12 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen, - unsigned a, b; - int c, old_c, totaldigits; - const char __user __force *ubuf = (const char __user __force *)buf; -- int exp_digit, in_range; -+ int at_start, in_range; - - totaldigits = c = 0; - bitmap_zero(maskp, nmaskbits); - do { -- exp_digit = 1; -+ at_start = 1; - in_range = 0; - a = b = 0; - -@@ -635,11 +635,10 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen, - break; - - if (c == '-') { -- if (exp_digit || in_range) -+ if (at_start || in_range) - return -EINVAL; - b = 0; - in_range = 1; -- exp_digit = 1; - continue; - } - -@@ -649,16 +648,18 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen, - b = b * 10 + (c - '0'); - if (!in_range) - a = b; -- exp_digit = 0; -+ at_start = 0; - totaldigits++; - } - if (!(a <= b)) - return -EINVAL; - if (b >= nmaskbits) - return -ERANGE; -- while (a <= b) { -- set_bit(a, maskp); -- a++; -+ if (!at_start) { -+ while (a <= b) { -+ set_bit(a, maskp); -+ a++; -+ } - } - } while (buflen && c == ','); - return 0; -diff --git a/mm/filemap.c b/mm/filemap.c -index 556858c..6c009c2 100644 ---- a/mm/filemap.c -+++ b/mm/filemap.c -@@ -2007,8 +2007,8 @@ int file_remove_suid(struct file *file) - error = security_inode_killpriv(dentry); - if (!error && killsuid) - error = __remove_suid(dentry, killsuid); -- if (!error && (inode->i_sb->s_flags & MS_NOSEC)) -- inode->i_flags |= S_NOSEC; -+ if (!error) -+ inode_has_no_xattr(inode); - - return error; - } -diff --git a/mm/kmemleak.c b/mm/kmemleak.c -index cc8cf1d..cbae846 100644 ---- a/mm/kmemleak.c -+++ b/mm/kmemleak.c -@@ -192,6 +192,8 @@ static struct kmem_cache *scan_area_cache; - - /* set if tracing memory operations is enabled */ - static atomic_t kmemleak_enabled = ATOMIC_INIT(0); -+/* same as above but only for the kmemleak_free() callback */ -+static int kmemleak_free_enabled; - /* set in the late_initcall if there were no errors */ - static atomic_t kmemleak_initialized = ATOMIC_INIT(0); - /* enables or disables early logging of the memory operations */ -@@ -885,7 +887,7 @@ void __ref kmemleak_free(const void *ptr) - { - pr_debug("%s(0x%p)\n", __func__, ptr); - -- if (atomic_read(&kmemleak_enabled) && ptr && !IS_ERR(ptr)) -+ if (kmemleak_free_enabled && ptr && !IS_ERR(ptr)) - delete_object_full((unsigned long)ptr); - else if (atomic_read(&kmemleak_early_log)) - log_early(KMEMLEAK_FREE, ptr, 0, 0); -@@ -1614,6 +1616,13 @@ static void kmemleak_do_cleanup(struct work_struct *work) - mutex_lock(&scan_mutex); - stop_scan_thread(); - -+ /* -+ * Once the scan thread has stopped, it is safe to no longer track -+ * object freeing. Ordering of the scan thread stopping and the memory -+ * accesses below is guaranteed by the kthread_stop() function. -+ */ -+ kmemleak_free_enabled = 0; -+ - rcu_read_lock(); - list_for_each_entry_rcu(object, &object_list, object_list) - delete_object_full(object->pointer); -@@ -1640,6 +1649,8 @@ static void kmemleak_disable(void) - /* check whether it is too early for a kernel thread */ - if (atomic_read(&kmemleak_initialized)) - schedule_work(&cleanup_work); -+ else -+ kmemleak_free_enabled = 0; - - pr_info("Kernel memory leak detector disabled\n"); - } -@@ -1688,6 +1699,7 @@ void __init kmemleak_init(void) - if (!atomic_read(&kmemleak_error)) { - atomic_set(&kmemleak_enabled, 1); - atomic_set(&kmemleak_early_log, 0); -+ kmemleak_free_enabled = 1; - } - local_irq_restore(flags); - -diff --git a/mm/memory.c b/mm/memory.c -index 452b8ba..7762b1d 100644 ---- a/mm/memory.c -+++ b/mm/memory.c -@@ -3153,6 +3153,10 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma, - - pte_unmap(page_table); - -+ /* File mapping without ->vm_ops ? */ -+ if (vma->vm_flags & VM_SHARED) -+ return VM_FAULT_SIGBUS; -+ - /* Check if we need to add a guard page to the stack */ - if (check_stack_guard_page(vma, address) < 0) - return VM_FAULT_SIGSEGV; -@@ -3412,6 +3416,9 @@ static int do_linear_fault(struct mm_struct *mm, struct vm_area_struct *vma, - - vma->vm_start) >> PAGE_SHIFT) + vma->vm_pgoff; - - pte_unmap(page_table); -+ /* The VMA was not fully populated on mmap() or missing VM_DONTEXPAND */ -+ if (!vma->vm_ops->fault) -+ return VM_FAULT_SIGBUS; - return __do_fault(mm, vma, address, pmd, pgoff, flags, orig_pte); - } - -@@ -3470,11 +3477,9 @@ int handle_pte_fault(struct mm_struct *mm, - entry = *pte; - if (!pte_present(entry)) { - if (pte_none(entry)) { -- if (vma->vm_ops) { -- if (likely(vma->vm_ops->fault)) -- return do_linear_fault(mm, vma, address, -+ if (vma->vm_ops) -+ return do_linear_fault(mm, vma, address, - pte, pmd, flags, entry); -- } - return do_anonymous_page(mm, vma, address, - pte, pmd, flags); - } -diff --git a/net/9p/client.c b/net/9p/client.c -index 854ca7a..e958178 100644 ---- a/net/9p/client.c -+++ b/net/9p/client.c -@@ -824,7 +824,8 @@ static struct p9_req_t *p9_client_zc_rpc(struct p9_client *c, int8_t type, - if (err < 0) { - if (err == -EIO) - c->status = Disconnected; -- goto reterr; -+ if (err != -ERESTARTSYS) -+ goto reterr; - } - if (req->status == REQ_STATUS_ERROR) { - P9_DPRINTK(P9_DEBUG_ERROR, "req_status error %d\n", req->t_err); -diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c -index 1bd197f..5f21e53 100644 ---- a/net/bridge/br_multicast.c -+++ b/net/bridge/br_multicast.c -@@ -36,6 +36,9 @@ - #define mlock_dereference(X, br) \ - rcu_dereference_protected(X, lockdep_is_held(&br->multicast_lock)) - -+static void br_multicast_add_router(struct net_bridge *br, -+ struct net_bridge_port *port); -+ - #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) - static inline int ipv6_is_transient_multicast(const struct in6_addr *addr) - { -@@ -842,6 +845,8 @@ void br_multicast_enable_port(struct net_bridge_port *port) - goto out; - - __br_multicast_enable_port(port); -+ if (port->multicast_router == 2 && hlist_unhashed(&port->rlist)) -+ br_multicast_add_router(br, port); - - out: - spin_unlock(&br->multicast_lock); -diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c -index 7c1745d..6cdd3af 100644 ---- a/net/bridge/br_netfilter.c -+++ b/net/bridge/br_netfilter.c -@@ -822,12 +822,15 @@ static int br_nf_dev_queue_xmit(struct sk_buff *skb) - !skb_is_gso(skb)) { - if (br_parse_ip_options(skb)) - /* Drop invalid packet */ -- return NF_DROP; -+ goto drop; - ret = ip_fragment(skb, br_dev_queue_push_xmit); - } else - ret = br_dev_queue_push_xmit(skb); - - return ret; -+ drop: -+ kfree_skb(skb); -+ return 0; - } - #else - static int br_nf_dev_queue_xmit(struct sk_buff *skb) -diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c -index fd863fe7..bb38a3c 100644 ---- a/net/ceph/osdmap.c -+++ b/net/ceph/osdmap.c -@@ -102,7 +102,7 @@ static int crush_decode_tree_bucket(void **p, void *end, - { - int j; - dout("crush_decode_tree_bucket %p to %p\n", *p, end); -- ceph_decode_32_safe(p, end, b->num_nodes, bad); -+ ceph_decode_8_safe(p, end, b->num_nodes, bad); - b->node_weights = kcalloc(b->num_nodes, sizeof(u32), GFP_NOFS); - if (b->node_weights == NULL) - return -ENOMEM; -diff --git a/net/core/datagram.c b/net/core/datagram.c -index 68bbf9f..6f54d0a 100644 ---- a/net/core/datagram.c -+++ b/net/core/datagram.c -@@ -180,18 +180,19 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned flags, - * However, this function was correct in any case. 8) - */ - unsigned long cpu_flags; -+ struct sk_buff_head *queue = &sk->sk_receive_queue; - -- spin_lock_irqsave(&sk->sk_receive_queue.lock, cpu_flags); -- skb = skb_peek(&sk->sk_receive_queue); -+ spin_lock_irqsave(&queue->lock, cpu_flags); -+ skb = skb_peek(queue); - if (skb) { - *peeked = skb->peeked; - if (flags & MSG_PEEK) { - skb->peeked = 1; - atomic_inc(&skb->users); - } else -- __skb_unlink(skb, &sk->sk_receive_queue); -+ __skb_unlink(skb, queue); - } -- spin_unlock_irqrestore(&sk->sk_receive_queue.lock, cpu_flags); -+ spin_unlock_irqrestore(&queue->lock, cpu_flags); - - if (skb) - return skb; -diff --git a/net/core/dev.c b/net/core/dev.c -index 1c0d862..7f43202 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -2947,6 +2947,8 @@ static int enqueue_to_backlog(struct sk_buff *skb, int cpu, - local_irq_save(flags); - - rps_lock(sd); -+ if (!netif_running(skb->dev)) -+ goto drop; - if (skb_queue_len(&sd->input_pkt_queue) <= netdev_max_backlog) { - if (skb_queue_len(&sd->input_pkt_queue)) { - enqueue: -@@ -2967,6 +2969,7 @@ enqueue: - goto enqueue; - } - -+drop: - sd->dropped++; - rps_unlock(sd); - -@@ -3258,8 +3261,6 @@ static int __netif_receive_skb(struct sk_buff *skb) - - pt_prev = NULL; - -- rcu_read_lock(); -- - another_round: - - __this_cpu_inc(softnet_data.processed); -@@ -3354,7 +3355,6 @@ ncls: - } - - out: -- rcu_read_unlock(); - return ret; - } - -@@ -3375,34 +3375,31 @@ out: - */ - int netif_receive_skb(struct sk_buff *skb) - { -+ int ret; -+ - if (netdev_tstamp_prequeue) - net_timestamp_check(skb); - - if (skb_defer_rx_timestamp(skb)) - return NET_RX_SUCCESS; - -+ rcu_read_lock(); -+ - #ifdef CONFIG_RPS - { - struct rps_dev_flow voidflow, *rflow = &voidflow; -- int cpu, ret; -- -- rcu_read_lock(); -- -- cpu = get_rps_cpu(skb->dev, skb, &rflow); -+ int cpu = get_rps_cpu(skb->dev, skb, &rflow); - - if (cpu >= 0) { - ret = enqueue_to_backlog(skb, cpu, &rflow->last_qtail); - rcu_read_unlock(); -- } else { -- rcu_read_unlock(); -- ret = __netif_receive_skb(skb); -+ return ret; - } -- -- return ret; - } --#else -- return __netif_receive_skb(skb); - #endif -+ ret = __netif_receive_skb(skb); -+ rcu_read_unlock(); -+ return ret; - } - EXPORT_SYMBOL(netif_receive_skb); - -@@ -3793,8 +3790,10 @@ static int process_backlog(struct napi_struct *napi, int quota) - unsigned int qlen; - - while ((skb = __skb_dequeue(&sd->process_queue))) { -+ rcu_read_lock(); - local_irq_enable(); - __netif_receive_skb(skb); -+ rcu_read_unlock(); - local_irq_disable(); - input_queue_head_incr(sd); - if (++work >= quota) { -@@ -5305,6 +5304,7 @@ static void rollback_registered_many(struct list_head *head) - unlist_netdevice(dev); - - dev->reg_state = NETREG_UNREGISTERING; -+ on_each_cpu(flush_backlog, dev, 1); - } - - synchronize_net(); -@@ -5877,8 +5877,6 @@ void netdev_run_todo(void) - - dev->reg_state = NETREG_UNREGISTERED; - -- on_each_cpu(flush_backlog, dev, 1); -- - netdev_wait_allrefs(dev); - - /* paranoia */ -diff --git a/net/core/pktgen.c b/net/core/pktgen.c -index 80aeac9..9dd65a9 100644 ---- a/net/core/pktgen.c -+++ b/net/core/pktgen.c -@@ -568,7 +568,7 @@ static int pktgen_if_show(struct seq_file *seq, void *v) - " dst_min: %s dst_max: %s\n", - pkt_dev->dst_min, pkt_dev->dst_max); - seq_printf(seq, -- " src_min: %s src_max: %s\n", -+ " src_min: %s src_max: %s\n", - pkt_dev->src_min, pkt_dev->src_max); - } - -diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c -index 5b412f0..e77373a 100644 ---- a/net/core/rtnetlink.c -+++ b/net/core/rtnetlink.c -@@ -1147,10 +1147,6 @@ static const struct nla_policy ifla_info_policy[IFLA_INFO_MAX+1] = { - [IFLA_INFO_DATA] = { .type = NLA_NESTED }, - }; - --static const struct nla_policy ifla_vfinfo_policy[IFLA_VF_INFO_MAX+1] = { -- [IFLA_VF_INFO] = { .type = NLA_NESTED }, --}; -- - static const struct nla_policy ifla_vf_policy[IFLA_VF_MAX+1] = { - [IFLA_VF_MAC] = { .len = sizeof(struct ifla_vf_mac) }, - [IFLA_VF_VLAN] = { .len = sizeof(struct ifla_vf_vlan) }, -@@ -1224,58 +1220,53 @@ static int validate_linkmsg(struct net_device *dev, struct nlattr *tb[]) - return 0; - } - --static int do_setvfinfo(struct net_device *dev, struct nlattr *attr) -+static int do_setvfinfo(struct net_device *dev, struct nlattr **tb) - { -- int rem, err = -EINVAL; -- struct nlattr *vf; - const struct net_device_ops *ops = dev->netdev_ops; -+ int err = -EINVAL; - -- nla_for_each_nested(vf, attr, rem) { -- switch (nla_type(vf)) { -- case IFLA_VF_MAC: { -- struct ifla_vf_mac *ivm; -- ivm = nla_data(vf); -- err = -EOPNOTSUPP; -- if (ops->ndo_set_vf_mac) -- err = ops->ndo_set_vf_mac(dev, ivm->vf, -- ivm->mac); -- break; -- } -- case IFLA_VF_VLAN: { -- struct ifla_vf_vlan *ivv; -- ivv = nla_data(vf); -- err = -EOPNOTSUPP; -- if (ops->ndo_set_vf_vlan) -- err = ops->ndo_set_vf_vlan(dev, ivv->vf, -- ivv->vlan, -- ivv->qos); -- break; -- } -- case IFLA_VF_TX_RATE: { -- struct ifla_vf_tx_rate *ivt; -- ivt = nla_data(vf); -- err = -EOPNOTSUPP; -- if (ops->ndo_set_vf_tx_rate) -- err = ops->ndo_set_vf_tx_rate(dev, ivt->vf, -- ivt->rate); -- break; -- } -- case IFLA_VF_SPOOFCHK: { -- struct ifla_vf_spoofchk *ivs; -- ivs = nla_data(vf); -- err = -EOPNOTSUPP; -- if (ops->ndo_set_vf_spoofchk) -- err = ops->ndo_set_vf_spoofchk(dev, ivs->vf, -- ivs->setting); -- break; -- } -- default: -- err = -EINVAL; -- break; -- } -- if (err) -- break; -+ if (tb[IFLA_VF_MAC]) { -+ struct ifla_vf_mac *ivm = nla_data(tb[IFLA_VF_MAC]); -+ err = -EOPNOTSUPP; -+ if (ops->ndo_set_vf_mac) -+ err = ops->ndo_set_vf_mac(dev, ivm->vf, -+ ivm->mac); -+ if (err < 0) -+ return err; - } -+ -+ if (tb[IFLA_VF_VLAN]) { -+ struct ifla_vf_vlan *ivv = nla_data(tb[IFLA_VF_VLAN]); -+ -+ err = -EOPNOTSUPP; -+ if (ops->ndo_set_vf_vlan) -+ err = ops->ndo_set_vf_vlan(dev, ivv->vf, ivv->vlan, -+ ivv->qos); -+ if (err < 0) -+ return err; -+ } -+ -+ if (tb[IFLA_VF_TX_RATE]) { -+ struct ifla_vf_tx_rate *ivt = nla_data(tb[IFLA_VF_TX_RATE]); -+ -+ if (ops->ndo_set_vf_tx_rate) -+ err = ops->ndo_set_vf_tx_rate(dev, ivt->vf, -+ ivt->rate); -+ if (err < 0) -+ return err; -+ } -+ -+ if (tb[IFLA_VF_SPOOFCHK]) { -+ struct ifla_vf_spoofchk *ivs = nla_data(tb[IFLA_VF_SPOOFCHK]); -+ -+ err = -EOPNOTSUPP; -+ if (ops->ndo_set_vf_spoofchk) -+ err = ops->ndo_set_vf_spoofchk(dev, ivs->vf, -+ ivs->setting); -+ if (err < 0) -+ return err; -+ } -+ - return err; - } - -@@ -1458,14 +1449,21 @@ static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm, - } - - if (tb[IFLA_VFINFO_LIST]) { -+ struct nlattr *vfinfo[IFLA_VF_MAX + 1]; - struct nlattr *attr; - int rem; -+ - nla_for_each_nested(attr, tb[IFLA_VFINFO_LIST], rem) { -- if (nla_type(attr) != IFLA_VF_INFO) { -+ if (nla_type(attr) != IFLA_VF_INFO || -+ nla_len(attr) < NLA_HDRLEN) { - err = -EINVAL; - goto errout; - } -- err = do_setvfinfo(dev, attr); -+ err = nla_parse_nested(vfinfo, IFLA_VF_MAX, attr, -+ ifla_vf_policy); -+ if (err < 0) -+ goto errout; -+ err = do_setvfinfo(dev, vfinfo); - if (err < 0) - goto errout; - modified = 1; -diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c -index 16e25a4..c20c356 100644 ---- a/net/ipv4/ip_fragment.c -+++ b/net/ipv4/ip_fragment.c -@@ -385,7 +385,7 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb) - ihl = ip_hdrlen(skb); - - /* Determine the position of this fragment. */ -- end = offset + skb->len - ihl; -+ end = offset + skb->len - skb_network_offset(skb) - ihl; - err = -EINVAL; - - /* Is this the final fragment? */ -@@ -415,7 +415,7 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb) - goto err; - - err = -ENOMEM; -- if (pskb_pull(skb, ihl) == NULL) -+ if (!pskb_pull(skb, skb_network_offset(skb) + ihl)) - goto err; - - err = pskb_trim_rcsum(skb, end - offset); -@@ -638,6 +638,8 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev, - iph->frag_off = 0; - iph->tot_len = htons(len); - iph->tos |= ecn; -+ ip_send_check(iph); -+ - IP_INC_STATS_BH(net, IPSTATS_MIB_REASMOKS); - qp->q.fragments = NULL; - qp->q.fragments_tail = NULL; -diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c -index 880a55d..0228ecb 100644 ---- a/net/mac80211/debugfs_netdev.c -+++ b/net/mac80211/debugfs_netdev.c -@@ -598,6 +598,7 @@ void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata) - - debugfs_remove_recursive(sdata->debugfs.dir); - sdata->debugfs.dir = NULL; -+ sdata->debugfs.subdir_stations = NULL; - } - - void ieee80211_debugfs_rename_netdev(struct ieee80211_sub_if_data *sdata) -diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c -index 7918eb7..cec0ed5 100644 ---- a/net/netfilter/nf_conntrack_expect.c -+++ b/net/netfilter/nf_conntrack_expect.c -@@ -205,7 +205,8 @@ static inline int expect_clash(const struct nf_conntrack_expect *a, - a->mask.src.u3.all[count] & b->mask.src.u3.all[count]; - } - -- return nf_ct_tuple_mask_cmp(&a->tuple, &b->tuple, &intersect_mask); -+ return nf_ct_tuple_mask_cmp(&a->tuple, &b->tuple, &intersect_mask) && -+ nf_ct_zone(a->master) == nf_ct_zone(b->master); - } - - static inline int expect_matches(const struct nf_conntrack_expect *a, -diff --git a/net/rds/ib_rdma.c b/net/rds/ib_rdma.c -index e8fdb17..a985158 100644 ---- a/net/rds/ib_rdma.c -+++ b/net/rds/ib_rdma.c -@@ -759,8 +759,10 @@ void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents, - } - - ibmr = rds_ib_alloc_fmr(rds_ibdev); -- if (IS_ERR(ibmr)) -+ if (IS_ERR(ibmr)) { -+ rds_ib_dev_put(rds_ibdev); - return ibmr; -+ } - - ret = rds_ib_map_fmr(rds_ibdev, ibmr, sg, nents); - if (ret == 0) -diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c -index 686fb1a..233dbe6 100644 ---- a/net/rose/af_rose.c -+++ b/net/rose/af_rose.c -@@ -195,7 +195,8 @@ static void rose_kill_by_device(struct net_device *dev) - - if (rose->device == dev) { - rose_disconnect(s, ENETUNREACH, ROSE_OUT_OF_ORDER, 0); -- rose->neighbour->use--; -+ if (rose->neighbour) -+ rose->neighbour->use--; - rose->device = NULL; - } - } -diff --git a/net/sunrpc/backchannel_rqst.c b/net/sunrpc/backchannel_rqst.c -index 3ad435a..b56f23e 100644 ---- a/net/sunrpc/backchannel_rqst.c -+++ b/net/sunrpc/backchannel_rqst.c -@@ -59,7 +59,7 @@ static void xprt_free_allocation(struct rpc_rqst *req) - - dprintk("RPC: free allocations for req= %p\n", req); - BUG_ON(test_bit(RPC_BC_PA_IN_USE, &req->rq_bc_pa_state)); -- xbufp = &req->rq_private_buf; -+ xbufp = &req->rq_rcv_buf; - free_page((unsigned long)xbufp->head[0].iov_base); - xbufp = &req->rq_snd_buf; - free_page((unsigned long)xbufp->head[0].iov_base); -diff --git a/sound/soc/codecs/wm8737.c b/sound/soc/codecs/wm8737.c -index f6aef58..2a012d3 100644 ---- a/sound/soc/codecs/wm8737.c -+++ b/sound/soc/codecs/wm8737.c -@@ -485,7 +485,8 @@ static int wm8737_set_bias_level(struct snd_soc_codec *codec, - - /* Fast VMID ramp at 2*2.5k */ - snd_soc_update_bits(codec, WM8737_MISC_BIAS_CONTROL, -- WM8737_VMIDSEL_MASK, 0x4); -+ WM8737_VMIDSEL_MASK, -+ 2 << WM8737_VMIDSEL_SHIFT); - - /* Bring VMID up */ - snd_soc_update_bits(codec, WM8737_POWER_MANAGEMENT, -@@ -499,7 +500,8 @@ static int wm8737_set_bias_level(struct snd_soc_codec *codec, - - /* VMID at 2*300k */ - snd_soc_update_bits(codec, WM8737_MISC_BIAS_CONTROL, -- WM8737_VMIDSEL_MASK, 2); -+ WM8737_VMIDSEL_MASK, -+ 1 << WM8737_VMIDSEL_SHIFT); - - break; - -diff --git a/sound/soc/codecs/wm8903.h b/sound/soc/codecs/wm8903.h -index db94931..0bb4a64 100644 ---- a/sound/soc/codecs/wm8903.h -+++ b/sound/soc/codecs/wm8903.h -@@ -172,7 +172,7 @@ extern int wm8903_mic_detect(struct snd_soc_codec *codec, - #define WM8903_VMID_BUF_ENA_WIDTH 1 /* VMID_BUF_ENA */ - - #define WM8903_VMID_RES_50K 2 --#define WM8903_VMID_RES_250K 3 -+#define WM8903_VMID_RES_250K 4 - #define WM8903_VMID_RES_5K 6 - - /* -diff --git a/sound/soc/codecs/wm8955.c b/sound/soc/codecs/wm8955.c -index 77ff1d7..f8b9930 100644 ---- a/sound/soc/codecs/wm8955.c -+++ b/sound/soc/codecs/wm8955.c -@@ -282,7 +282,7 @@ static int wm8955_configure_clocking(struct snd_soc_codec *codec) - snd_soc_update_bits(codec, WM8955_PLL_CONTROL_2, - WM8955_K_17_9_MASK, - (pll.k >> 9) & WM8955_K_17_9_MASK); -- snd_soc_update_bits(codec, WM8955_PLL_CONTROL_2, -+ snd_soc_update_bits(codec, WM8955_PLL_CONTROL_3, - WM8955_K_8_0_MASK, - pll.k & WM8955_K_8_0_MASK); - if (pll.k) -diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c -index 8d26104..c7911fd 100644 ---- a/sound/soc/codecs/wm8960.c -+++ b/sound/soc/codecs/wm8960.c -@@ -186,7 +186,7 @@ SOC_SINGLE("PCM Playback -6dB Switch", WM8960_DACCTL1, 7, 1, 0), - SOC_ENUM("ADC Polarity", wm8960_enum[0]), - SOC_SINGLE("ADC High Pass Filter Switch", WM8960_DACCTL1, 0, 1, 0), - --SOC_ENUM("DAC Polarity", wm8960_enum[2]), -+SOC_ENUM("DAC Polarity", wm8960_enum[1]), - SOC_SINGLE_BOOL_EXT("DAC Deemphasis Switch", 0, - wm8960_get_deemph, wm8960_put_deemph), - -diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c -index 851786f..893b750 100644 ---- a/sound/usb/mixer_maps.c -+++ b/sound/usb/mixer_maps.c -@@ -312,6 +312,20 @@ static const struct usbmix_name_map scms_usb3318_map[] = { - { 0 } - }; - -+/* Bose companion 5, the dB conversion factor is 16 instead of 256 */ -+static struct usbmix_dB_map bose_companion5_dB = {-5006, -6}; -+static struct usbmix_name_map bose_companion5_map[] = { -+ { 3, NULL, .dB = &bose_companion5_dB }, -+ { 0 } /* terminator */ -+}; -+ -+/* Dragonfly DAC 1.2, the dB conversion factor is 1 instead of 256 */ -+static struct usbmix_dB_map dragonfly_1_2_dB = {0, 5000}; -+static struct usbmix_name_map dragonfly_1_2_map[] = { -+ { 7, NULL, .dB = &dragonfly_1_2_dB }, -+ { 0 } /* terminator */ -+}; -+ - /* - * Control map entries - */ -@@ -394,6 +408,16 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = { - .id = USB_ID(0x25c4, 0x0003), - .map = scms_usb3318_map, - }, -+ { -+ /* Bose Companion 5 */ -+ .id = USB_ID(0x05a7, 0x1020), -+ .map = bose_companion5_map, -+ }, -+ { -+ /* Dragonfly DAC 1.2 */ -+ .id = USB_ID(0x21b4, 0x0081), -+ .map = dragonfly_1_2_map, -+ }, - { 0 } /* terminator */ - }; - -diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h -index b38dde0..c014f00 100644 ---- a/sound/usb/quirks-table.h -+++ b/sound/usb/quirks-table.h -@@ -2383,6 +2383,74 @@ YAMAHA_DEVICE(0x7010, "UB99"), - } - }, - -+/* Steinberg devices */ -+{ -+ /* Steinberg MI2 */ -+ USB_DEVICE_VENDOR_SPEC(0x0a4e, 0x2040), -+ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { -+ .ifnum = QUIRK_ANY_INTERFACE, -+ .type = QUIRK_COMPOSITE, -+ .data = & (const struct snd_usb_audio_quirk[]) { -+ { -+ .ifnum = 0, -+ .type = QUIRK_AUDIO_STANDARD_INTERFACE -+ }, -+ { -+ .ifnum = 1, -+ .type = QUIRK_AUDIO_STANDARD_INTERFACE -+ }, -+ { -+ .ifnum = 2, -+ .type = QUIRK_AUDIO_STANDARD_INTERFACE -+ }, -+ { -+ .ifnum = 3, -+ .type = QUIRK_MIDI_FIXED_ENDPOINT, -+ .data = &(const struct snd_usb_midi_endpoint_info) { -+ .out_cables = 0x0001, -+ .in_cables = 0x0001 -+ } -+ }, -+ { -+ .ifnum = -1 -+ } -+ } -+ } -+}, -+{ -+ /* Steinberg MI4 */ -+ USB_DEVICE_VENDOR_SPEC(0x0a4e, 0x4040), -+ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { -+ .ifnum = QUIRK_ANY_INTERFACE, -+ .type = QUIRK_COMPOSITE, -+ .data = & (const struct snd_usb_audio_quirk[]) { -+ { -+ .ifnum = 0, -+ .type = QUIRK_AUDIO_STANDARD_INTERFACE -+ }, -+ { -+ .ifnum = 1, -+ .type = QUIRK_AUDIO_STANDARD_INTERFACE -+ }, -+ { -+ .ifnum = 2, -+ .type = QUIRK_AUDIO_STANDARD_INTERFACE -+ }, -+ { -+ .ifnum = 3, -+ .type = QUIRK_MIDI_FIXED_ENDPOINT, -+ .data = &(const struct snd_usb_midi_endpoint_info) { -+ .out_cables = 0x0001, -+ .in_cables = 0x0001 -+ } -+ }, -+ { -+ .ifnum = -1 -+ } -+ } -+ } -+}, -+ - /* TerraTec devices */ - { - USB_DEVICE_VENDOR_SPEC(0x0ccd, 0x0012), |