diff options
| author |   Mike Pagano <mpagano@gentoo.org> | 2015-02-20 18:57:35 -0500 |
|---|---|---|
| committer | Mike Pagano <mpagano@gentoo.org> | 2015-02-20 18:57:35 -0500 |
| commit | fbf84540a233182292abbe51e05dddebe95c79bc (patch) | |
| tree | 6ede78d9d8e05a56357f09009ce51cef9c2fc5f6 | |
| parent | Enable link security restrictions by default (diff) | |
| download | linux-patches-fbf84540a233182292abbe51e05dddebe95c79bc.tar.gz linux-patches-fbf84540a233182292abbe51e05dddebe95c79bc.tar.bz2 linux-patches-fbf84540a233182292abbe51e05dddebe95c79bc.zip | |
Linux patch 3.12.383.12-38
| -rw-r--r-- | 0000_README | 4 | ||||
| -rw-r--r-- | 1037_linux-3.12.38.patch | 4295 |
2 files changed, 4299 insertions, 0 deletions
diff --git a/0000_README b/0000_README index edcb42aa..12b42452 100644 --- a/0000_README +++ b/0000_README @@ -190,6 +190,10 @@ Patch: 1036_linux-3.12.37.patch From: http://www.kernel.org Desc: Linux 3.12.37 +Patch: 1037_linux-3.12.38.patch +From: http://www.kernel.org +Desc: Linux 3.12.38 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1037_linux-3.12.38.patch b/1037_linux-3.12.38.patch new file mode 100644 index 00000000..97d0b111 --- /dev/null +++ b/1037_linux-3.12.38.patch @@ -0,0 +1,4295 @@ +diff --git a/Makefile b/Makefile +index e3c56b405ffe..0cd1625c4fae 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 12 +-SUBLEVEL = 37 ++SUBLEVEL = 38 + EXTRAVERSION = + NAME = One Giant Leap for Frogkind + +diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c +index a2d0f91c5bd7..79cff8fdbaf3 100644 +--- a/arch/arm/mm/dma-mapping.c ++++ b/arch/arm/mm/dma-mapping.c +@@ -429,12 +429,21 @@ void __init dma_contiguous_remap(void) + map.type = MT_MEMORY_DMA_READY; + + /* +- * Clear previous low-memory mapping ++ * Clear previous low-memory mapping to ensure that the ++ * TLB does not see any conflicting entries, then flush ++ * the TLB of the old entries before creating new mappings. ++ * ++ * This ensures that any speculatively loaded TLB entries ++ * (even though they may be rare) can not cause any problems, ++ * and ensures that this code is architecturally compliant. + */ + for (addr = __phys_to_virt(start); addr < __phys_to_virt(end); + addr += PMD_SIZE) + pmd_clear(pmd_off_k(addr)); + ++ flush_tlb_kernel_range(__phys_to_virt(start), ++ __phys_to_virt(end)); ++ + iotable_init(&map, 1); + } + } +diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h +index 5fe138e0b828..cfcf04d22fd2 100644 +--- a/arch/arm64/include/asm/cputype.h ++++ b/arch/arm64/include/asm/cputype.h +@@ -77,6 +77,8 @@ static inline u32 __attribute_const__ read_cpuid_cachetype(void) + return read_cpuid(ID_CTR_EL0); + } + ++void cpuinfo_store_cpu(void); ++ + #endif /* __ASSEMBLY__ */ + + #endif +diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c +index 055cfb80e05c..24bf1563c3bd 100644 +--- a/arch/arm64/kernel/setup.c ++++ b/arch/arm64/kernel/setup.c +@@ -41,6 +41,7 @@ + #include <linux/memblock.h> + #include <linux/of_fdt.h> + #include <linux/of_platform.h> ++#include <linux/personality.h> + + #include <asm/cputype.h> + #include <asm/elf.h> +@@ -97,6 +98,19 @@ void __init early_print(const char *str, ...) + printk("%s", buf); + } + ++struct cpuinfo_arm64 { ++ struct cpu cpu; ++ u32 reg_midr; ++}; ++ ++static DEFINE_PER_CPU(struct cpuinfo_arm64, cpu_data); ++ ++void cpuinfo_store_cpu(void) ++{ ++ struct cpuinfo_arm64 *info = this_cpu_ptr(&cpu_data); ++ info->reg_midr = read_cpuid_id(); ++} ++ + static void __init setup_processor(void) + { + struct cpu_info *cpu_info; +@@ -127,6 +141,8 @@ static void __init setup_machine_fdt(phys_addr_t dt_phys) + struct boot_param_header *devtree; + unsigned long dt_root; + ++ cpuinfo_store_cpu(); ++ + /* Check we have a non-NULL DT pointer */ + if (!dt_phys) { + early_print("\n" +@@ -285,14 +301,12 @@ static int __init arm64_device_init(void) + } + arch_initcall(arm64_device_init); + +-static DEFINE_PER_CPU(struct cpu, cpu_data); +- + static int __init topology_init(void) + { + int i; + + for_each_possible_cpu(i) { +- struct cpu *cpu = &per_cpu(cpu_data, i); ++ struct cpu *cpu = &per_cpu(cpu_data.cpu, i); + cpu->hotpluggable = 1; + register_cpu(cpu, i); + } +@@ -307,14 +321,41 @@ static const char *hwcap_str[] = { + NULL + }; + ++#ifdef CONFIG_COMPAT ++static const char *compat_hwcap_str[] = { ++ "swp", ++ "half", ++ "thumb", ++ "26bit", ++ "fastmult", ++ "fpa", ++ "vfp", ++ "edsp", ++ "java", ++ "iwmmxt", ++ "crunch", ++ "thumbee", ++ "neon", ++ "vfpv3", ++ "vfpv3d16", ++ "tls", ++ "vfpv4", ++ "idiva", ++ "idivt", ++ "vfpd32", ++ "lpae", ++ "evtstrm" ++}; ++#endif /* CONFIG_COMPAT */ ++ + static int c_show(struct seq_file *m, void *v) + { +- int i; +- +- seq_printf(m, "Processor\t: %s rev %d (%s)\n", +- cpu_name, read_cpuid_id() & 15, ELF_PLATFORM); ++ int i, j; + + for_each_online_cpu(i) { ++ struct cpuinfo_arm64 *cpuinfo = &per_cpu(cpu_data, i); ++ u32 midr = cpuinfo->reg_midr; ++ + /* + * glibc reads /proc/cpuinfo to determine the number of + * online processors, looking for lines beginning with +@@ -323,24 +364,33 @@ static int c_show(struct seq_file *m, void *v) + #ifdef CONFIG_SMP + seq_printf(m, "processor\t: %d\n", i); + #endif +- } +- +- /* dump out the processor features */ +- seq_puts(m, "Features\t: "); +- +- for (i = 0; hwcap_str[i]; i++) +- if (elf_hwcap & (1 << i)) +- seq_printf(m, "%s ", hwcap_str[i]); + +- seq_printf(m, "\nCPU implementer\t: 0x%02x\n", read_cpuid_id() >> 24); +- seq_printf(m, "CPU architecture: AArch64\n"); +- seq_printf(m, "CPU variant\t: 0x%x\n", (read_cpuid_id() >> 20) & 15); +- seq_printf(m, "CPU part\t: 0x%03x\n", (read_cpuid_id() >> 4) & 0xfff); +- seq_printf(m, "CPU revision\t: %d\n", read_cpuid_id() & 15); +- +- seq_puts(m, "\n"); +- +- seq_printf(m, "Hardware\t: %s\n", machine_name); ++ /* ++ * Dump out the common processor features in a single line. ++ * Userspace should read the hwcaps with getauxval(AT_HWCAP) ++ * rather than attempting to parse this, but there's a body of ++ * software which does already (at least for 32-bit). ++ */ ++ seq_puts(m, "Features\t:"); ++ if (personality(current->personality) == PER_LINUX32) { ++#ifdef CONFIG_COMPAT ++ for (j = 0; compat_hwcap_str[j]; j++) ++ if (COMPAT_ELF_HWCAP & (1 << j)) ++ seq_printf(m, " %s", compat_hwcap_str[j]); ++#endif /* CONFIG_COMPAT */ ++ } else { ++ for (j = 0; hwcap_str[j]; j++) ++ if (elf_hwcap & (1 << j)) ++ seq_printf(m, " %s", hwcap_str[j]); ++ } ++ seq_puts(m, "\n"); ++ ++ seq_printf(m, "CPU implementer\t: 0x%02x\n", (midr >> 24)); ++ seq_printf(m, "CPU architecture: 8\n"); ++ seq_printf(m, "CPU variant\t: 0x%x\n", ((midr >> 20) & 0xf)); ++ seq_printf(m, "CPU part\t: 0x%03x\n", ((midr >> 4) & 0xfff)); ++ seq_printf(m, "CPU revision\t: %d\n\n", (midr & 0xf)); ++ } + + return 0; + } +diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c +index 78db90dcc910..8130993a0d8b 100644 +--- a/arch/arm64/kernel/smp.c ++++ b/arch/arm64/kernel/smp.c +@@ -200,6 +200,11 @@ asmlinkage void secondary_start_kernel(void) + raw_spin_unlock(&boot_lock); + + /* ++ * Log the CPU info before it is marked online and might get read. ++ */ ++ cpuinfo_store_cpu(); ++ ++ /* + * OK, now it's safe to let the boot CPU continue. Wait for + * the CPU migration code to notice that the CPU is online + * before we continue. +diff --git a/arch/mips/kernel/irq_cpu.c b/arch/mips/kernel/irq_cpu.c +index 72ef2d25cbf2..ab941a366012 100644 +--- a/arch/mips/kernel/irq_cpu.c ++++ b/arch/mips/kernel/irq_cpu.c +@@ -56,6 +56,8 @@ static struct irq_chip mips_cpu_irq_controller = { + .irq_mask_ack = mask_mips_irq, + .irq_unmask = unmask_mips_irq, + .irq_eoi = unmask_mips_irq, ++ .irq_disable = mask_mips_irq, ++ .irq_enable = unmask_mips_irq, + }; + + /* +@@ -92,6 +94,8 @@ static struct irq_chip mips_mt_cpu_irq_controller = { + .irq_mask_ack = mips_mt_cpu_irq_ack, + .irq_unmask = unmask_mips_irq, + .irq_eoi = unmask_mips_irq, ++ .irq_disable = mask_mips_irq, ++ .irq_enable = unmask_mips_irq, + }; + + void __init mips_cpu_irq_init(void) +diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c +index 5c208ed8f856..57b89cba1624 100644 +--- a/arch/mips/kernel/smp.c ++++ b/arch/mips/kernel/smp.c +@@ -109,10 +109,10 @@ asmlinkage void start_secondary(void) + else + #endif /* CONFIG_MIPS_MT_SMTC */ + cpu_probe(); +- cpu_report(); + per_cpu_trap_init(false); + mips_clockevent_init(); + mp_ops->init_secondary(); ++ cpu_report(); + + /* + * XXX parity protection should be folded in here when it's converted +diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c +index 489820356f2d..eb7ae28009f5 100644 +--- a/arch/powerpc/xmon/xmon.c ++++ b/arch/powerpc/xmon/xmon.c +@@ -288,6 +288,7 @@ static inline void disable_surveillance(void) + args.token = rtas_token("set-indicator"); + if (args.token == RTAS_UNKNOWN_SERVICE) + return; ++ args.token = cpu_to_be32(args.token); + args.nargs = cpu_to_be32(3); + args.nret = cpu_to_be32(1); + args.rets = &args.args[3]; +diff --git a/arch/x86/kernel/acpi/cstate.c b/arch/x86/kernel/acpi/cstate.c +index d2b7f27781bc..40df29f2b87f 100644 +--- a/arch/x86/kernel/acpi/cstate.c ++++ b/arch/x86/kernel/acpi/cstate.c +@@ -87,7 +87,9 @@ static long acpi_processor_ffh_cstate_probe_cpu(void *_cx) + num_cstate_subtype = edx_part & MWAIT_SUBSTATE_MASK; + + retval = 0; +- if (num_cstate_subtype < (cx->address & MWAIT_SUBSTATE_MASK)) { ++ /* If the HW does not support any sub-states in this C-state */ ++ if (num_cstate_subtype == 0) { ++ pr_warn(FW_BUG "ACPI MWAIT C-state 0x%x not supported by HW (0x%x)\n", cx->address, edx_part); + retval = -1; + goto out; + } +diff --git a/arch/x86/kernel/early-quirks.c b/arch/x86/kernel/early-quirks.c +index 7eb30af8c7a2..69b06c7411ab 100644 +--- a/arch/x86/kernel/early-quirks.c ++++ b/arch/x86/kernel/early-quirks.c +@@ -317,8 +317,8 @@ static struct pci_device_id intel_stolen_ids[] __initdata = { + INTEL_I915GM_IDS(gen3_stolen_size), + INTEL_I945G_IDS(gen3_stolen_size), + INTEL_I945GM_IDS(gen3_stolen_size), +- INTEL_VLV_M_IDS(gen3_stolen_size), +- INTEL_VLV_D_IDS(gen3_stolen_size), ++ INTEL_VLV_M_IDS(gen6_stolen_size), ++ INTEL_VLV_D_IDS(gen6_stolen_size), + INTEL_PINEVIEW_IDS(gen3_stolen_size), + INTEL_I965G_IDS(gen3_stolen_size), + INTEL_G33_IDS(gen3_stolen_size), +diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c +index b110fe6c03d4..b132551528e5 100644 +--- a/arch/x86/kvm/cpuid.c ++++ b/arch/x86/kvm/cpuid.c +@@ -23,14 +23,14 @@ + #include "mmu.h" + #include "trace.h" + +-void kvm_update_cpuid(struct kvm_vcpu *vcpu) ++int kvm_update_cpuid(struct kvm_vcpu *vcpu) + { + struct kvm_cpuid_entry2 *best; + struct kvm_lapic *apic = vcpu->arch.apic; + + best = kvm_find_cpuid_entry(vcpu, 1, 0); + if (!best) +- return; ++ return 0; + + /* Update OSXSAVE bit */ + if (cpu_has_xsave && best->function == 0x1) { +@@ -46,7 +46,15 @@ void kvm_update_cpuid(struct kvm_vcpu *vcpu) + apic->lapic_timer.timer_mode_mask = 1 << 17; + } + ++ /* The existing code assumes virtual address is 48-bit in the canonical ++ * address checks; exit if it is ever changed */ ++ best = kvm_find_cpuid_entry(vcpu, 0x80000008, 0); ++ if (best && ((best->eax & 0xff00) >> 8) != 48 && ++ ((best->eax & 0xff00) >> 8) != 0) ++ return -EINVAL; ++ + kvm_pmu_cpuid_update(vcpu); ++ return 0; + } + + static int is_efer_nx(void) +@@ -109,10 +117,9 @@ int kvm_vcpu_ioctl_set_cpuid(struct kvm_vcpu *vcpu, + } + vcpu->arch.cpuid_nent = cpuid->nent; + cpuid_fix_nx_cap(vcpu); +- r = 0; + kvm_apic_set_version(vcpu); + kvm_x86_ops->cpuid_update(vcpu); +- kvm_update_cpuid(vcpu); ++ r = kvm_update_cpuid(vcpu); + + out_free: + vfree(cpuid_entries); +@@ -136,9 +143,7 @@ int kvm_vcpu_ioctl_set_cpuid2(struct kvm_vcpu *vcpu, + vcpu->arch.cpuid_nent = cpuid->nent; + kvm_apic_set_version(vcpu); + kvm_x86_ops->cpuid_update(vcpu); +- kvm_update_cpuid(vcpu); +- return 0; +- ++ r = kvm_update_cpuid(vcpu); + out: + return r; + } +diff --git a/arch/x86/kvm/cpuid.h b/arch/x86/kvm/cpuid.h +index b7fd07984888..6c458e37defb 100644 +--- a/arch/x86/kvm/cpuid.h ++++ b/arch/x86/kvm/cpuid.h +@@ -3,7 +3,7 @@ + + #include "x86.h" + +-void kvm_update_cpuid(struct kvm_vcpu *vcpu); ++int kvm_update_cpuid(struct kvm_vcpu *vcpu); + struct kvm_cpuid_entry2 *kvm_find_cpuid_entry(struct kvm_vcpu *vcpu, + u32 function, u32 index); + int kvm_dev_ioctl_get_supported_cpuid(struct kvm_cpuid2 *cpuid, +diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c +index ab1d45928ce7..8ab43ac68f06 100644 +--- a/arch/x86/kvm/emulate.c ++++ b/arch/x86/kvm/emulate.c +@@ -161,6 +161,7 @@ + #define Fastop ((u64)1 << 44) /* Use opcode::u.fastop */ + #define NoWrite ((u64)1 << 45) /* No writeback */ + #define SrcWrite ((u64)1 << 46) /* Write back src operand */ ++#define NearBranch ((u64)1 << 52) /* Near branches */ + + #define DstXacc (DstAccLo | SrcAccHi | SrcWrite) + +@@ -1443,7 +1444,8 @@ static int write_segment_descriptor(struct x86_emulate_ctxt *ctxt, + + /* Does not support long mode */ + static int load_segment_descriptor(struct x86_emulate_ctxt *ctxt, +- u16 selector, int seg) ++ u16 selector, int seg, ++ struct desc_struct *desc) + { + struct desc_struct seg_desc, old_desc; + u8 dpl, rpl, cpl; +@@ -1531,6 +1533,15 @@ static int load_segment_descriptor(struct x86_emulate_ctxt *ctxt, + if (rpl > cpl || dpl != cpl) + goto exception; + } ++ /* in long-mode d/b must be clear if l is set */ ++ if (seg_desc.d && seg_desc.l) { ++ u64 efer = 0; ++ ++ ctxt->ops->get_msr(ctxt, MSR_EFER, &efer); ++ if (efer & EFER_LMA) ++ goto exception; ++ } ++ + /* CS(RPL) <- CPL */ + selector = (selector & 0xfffc) | cpl; + break; +@@ -1570,6 +1581,8 @@ static int load_segment_descriptor(struct x86_emulate_ctxt *ctxt, + } + load: + ctxt->ops->set_segment(ctxt, selector, &seg_desc, 0, seg); ++ if (desc) ++ *desc = seg_desc; + return X86EMUL_CONTINUE; + exception: + emulate_exception(ctxt, err_vec, err_code, true); +@@ -1776,7 +1789,7 @@ static int em_pop_sreg(struct x86_emulate_ctxt *ctxt) + if (rc != X86EMUL_CONTINUE) + return rc; + +- rc = load_segment_descriptor(ctxt, (u16)selector, seg); ++ rc = load_segment_descriptor(ctxt, (u16)selector, seg, NULL); + return rc; + } + +@@ -1865,7 +1878,7 @@ static int __emulate_int_real(struct x86_emulate_ctxt *ctxt, int irq) + if (rc != X86EMUL_CONTINUE) + return rc; + +- rc = load_segment_descriptor(ctxt, cs, VCPU_SREG_CS); ++ rc = load_segment_descriptor(ctxt, cs, VCPU_SREG_CS, NULL); + if (rc != X86EMUL_CONTINUE) + return rc; + +@@ -1931,7 +1944,7 @@ static int emulate_iret_real(struct x86_emulate_ctxt *ctxt) + if (rc != X86EMUL_CONTINUE) + return rc; + +- rc = load_segment_descriptor(ctxt, (u16)cs, VCPU_SREG_CS); ++ rc = load_segment_descriptor(ctxt, (u16)cs, VCPU_SREG_CS, NULL); + + if (rc != X86EMUL_CONTINUE) + return rc; +@@ -1970,44 +1983,47 @@ static int em_iret(struct x86_emulate_ctxt *ctxt) + static int em_jmp_far(struct x86_emulate_ctxt *ctxt) + { + int rc; +- unsigned short sel; ++ unsigned short sel, old_sel; ++ struct desc_struct old_desc, new_desc; ++ const struct x86_emulate_ops *ops = ctxt->ops; ++ ++ /* Assignment of RIP may only fail in 64-bit mode */ ++ if (ctxt->mode == X86EMUL_MODE_PROT64) ++ ops->get_segment(ctxt, &old_sel, &old_desc, NULL, ++ VCPU_SREG_CS); + + memcpy(&sel, ctxt->src.valptr + ctxt->op_bytes, 2); + +- rc = load_segment_descriptor(ctxt, sel, VCPU_SREG_CS); ++ rc = load_segment_descriptor(ctxt, sel, VCPU_SREG_CS, &new_desc); + if (rc != X86EMUL_CONTINUE) + return rc; + +- ctxt->_eip = 0; +- memcpy(&ctxt->_eip, ctxt->src.valptr, ctxt->op_bytes); +- return X86EMUL_CONTINUE; ++ rc = assign_eip_far(ctxt, ctxt->src.val, new_desc.l); ++ if (rc != X86EMUL_CONTINUE) { ++ WARN_ON(!ctxt->mode != X86EMUL_MODE_PROT64); ++ /* assigning eip failed; restore the old cs */ ++ ops->set_segment(ctxt, old_sel, &old_desc, 0, VCPU_SREG_CS); ++ return rc; ++ } ++ return rc; + } + +-static int em_grp45(struct x86_emulate_ctxt *ctxt) ++static int em_jmp_abs(struct x86_emulate_ctxt *ctxt) + { +- int rc = X86EMUL_CONTINUE; ++ return assign_eip_near(ctxt, ctxt->src.val); ++} + +- switch (ctxt->modrm_reg) { +- case 2: /* call near abs */ { +- long int old_eip; +- old_eip = ctxt->_eip; +- rc = assign_eip_near(ctxt, ctxt->src.val); +- if (rc != X86EMUL_CONTINUE) +- break; +- ctxt->src.val = old_eip; +- rc = em_push(ctxt); +- break; +- } +- case 4: /* jmp abs */ +- rc = assign_eip_near(ctxt, ctxt->src.val); +- break; +- case 5: /* jmp far */ +- rc = em_jmp_far(ctxt); +- break; +- case 6: /* push */ +- rc = em_push(ctxt); +- break; +- } ++static int em_call_near_abs(struct x86_emulate_ctxt *ctxt) ++{ ++ int rc; ++ long int old_eip; ++ ++ old_eip = ctxt->_eip; ++ rc = assign_eip_near(ctxt, ctxt->src.val); ++ if (rc != X86EMUL_CONTINUE) ++ return rc; ++ ctxt->src.val = old_eip; ++ rc = em_push(ctxt); + return rc; + } + +@@ -2044,21 +2060,33 @@ static int em_ret(struct x86_emulate_ctxt *ctxt) + static int em_ret_far(struct x86_emulate_ctxt *ctxt) + { + int rc; +- unsigned long cs; ++ unsigned long eip, cs; ++ u16 old_cs; + int cpl = ctxt->ops->cpl(ctxt); ++ struct desc_struct old_desc, new_desc; ++ const struct x86_emulate_ops *ops = ctxt->ops; ++ ++ if (ctxt->mode == X86EMUL_MODE_PROT64) ++ ops->get_segment(ctxt, &old_cs, &old_desc, NULL, ++ VCPU_SREG_CS); + +- rc = emulate_pop(ctxt, &ctxt->_eip, ctxt->op_bytes); ++ rc = emulate_pop(ctxt, &eip, ctxt->op_bytes); + if (rc != X86EMUL_CONTINUE) + return rc; +- if (ctxt->op_bytes == 4) +- ctxt->_eip = (u32)ctxt->_eip; + rc = emulate_pop(ctxt, &cs, ctxt->op_bytes); + if (rc != X86EMUL_CONTINUE) + return rc; + /* Outer-privilege level return is not implemented */ + if (ctxt->mode >= X86EMUL_MODE_PROT16 && (cs & 3) > cpl) + return X86EMUL_UNHANDLEABLE; +- rc = load_segment_descriptor(ctxt, (u16)cs, VCPU_SREG_CS); ++ rc = load_segment_descriptor(ctxt, (u16)cs, VCPU_SREG_CS, &new_desc); ++ if (rc != X86EMUL_CONTINUE) ++ return rc; ++ rc = assign_eip_far(ctxt, eip, new_desc.l); ++ if (rc != X86EMUL_CONTINUE) { ++ WARN_ON(!ctxt->mode != X86EMUL_MODE_PROT64); ++ ops->set_segment(ctxt, old_cs, &old_desc, 0, VCPU_SREG_CS); ++ } + return rc; + } + +@@ -2099,7 +2127,7 @@ static int em_lseg(struct x86_emulate_ctxt *ctxt) + + memcpy(&sel, ctxt->src.valptr + ctxt->op_bytes, 2); + +- rc = load_segment_descriptor(ctxt, sel, seg); ++ rc = load_segment_descriptor(ctxt, sel, seg, NULL); + if (rc != X86EMUL_CONTINUE) + return rc; + +@@ -2344,6 +2372,8 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt) + if ((msr_data & 0xfffc) == 0x0) + return emulate_gp(ctxt, 0); + ss_sel = (u16)(msr_data + 24); ++ rcx = (u32)rcx; ++ rdx = (u32)rdx; + break; + case X86EMUL_MODE_PROT64: + cs_sel = (u16)(msr_data + 32); +@@ -2479,19 +2509,19 @@ static int load_state_from_tss16(struct x86_emulate_ctxt *ctxt, + * Now load segment descriptors. If fault happens at this stage + * it is handled in a context of new task + */ +- ret = load_segment_descriptor(ctxt, tss->ldt, VCPU_SREG_LDTR); ++ ret = load_segment_descriptor(ctxt, tss->ldt, VCPU_SREG_LDTR, NULL); + if (ret != X86EMUL_CONTINUE) + return ret; +- ret = load_segment_descriptor(ctxt, tss->es, VCPU_SREG_ES); ++ ret = load_segment_descriptor(ctxt, tss->es, VCPU_SREG_ES, NULL); + if (ret != X86EMUL_CONTINUE) + return ret; +- ret = load_segment_descriptor(ctxt, tss->cs, VCPU_SREG_CS); ++ ret = load_segment_descriptor(ctxt, tss->cs, VCPU_SREG_CS, NULL); + if (ret != X86EMUL_CONTINUE) + return ret; +- ret = load_segment_descriptor(ctxt, tss->ss, VCPU_SREG_SS); ++ ret = load_segment_descriptor(ctxt, tss->ss, VCPU_SREG_SS, NULL); + if (ret != X86EMUL_CONTINUE) + return ret; +- ret = load_segment_descriptor(ctxt, tss->ds, VCPU_SREG_DS); ++ ret = load_segment_descriptor(ctxt, tss->ds, VCPU_SREG_DS, NULL); + if (ret != X86EMUL_CONTINUE) + return ret; + +@@ -2620,25 +2650,26 @@ static int load_state_from_tss32(struct x86_emulate_ctxt *ctxt, + * Now load segment descriptors. If fault happenes at this stage + * it is handled in a context of new task + */ +- ret = load_segment_descriptor(ctxt, tss->ldt_selector, VCPU_SREG_LDTR); ++ ret = load_segment_descriptor(ctxt, tss->ldt_selector, VCPU_SREG_LDTR, ++ NULL); + if (ret != X86EMUL_CONTINUE) + return ret; +- ret = load_segment_descriptor(ctxt, tss->es, VCPU_SREG_ES); ++ ret = load_segment_descriptor(ctxt, tss->es, VCPU_SREG_ES, NULL); + if (ret != X86EMUL_CONTINUE) + return ret; +- ret = load_segment_descriptor(ctxt, tss->cs, VCPU_SREG_CS); ++ ret = load_segment_descriptor(ctxt, tss->cs, VCPU_SREG_CS, NULL); + if (ret != X86EMUL_CONTINUE) + return ret; +- ret = load_segment_descriptor(ctxt, tss->ss, VCPU_SREG_SS); ++ ret = load_segment_descriptor(ctxt, tss->ss, VCPU_SREG_SS, NULL); + if (ret != X86EMUL_CONTINUE) + return ret; +- ret = load_segment_descriptor(ctxt, tss->ds, VCPU_SREG_DS); ++ ret = load_segment_descriptor(ctxt, tss->ds, VCPU_SREG_DS, NULL); + if (ret != X86EMUL_CONTINUE) + return ret; +- ret = load_segment_descriptor(ctxt, tss->fs, VCPU_SREG_FS); ++ ret = load_segment_descriptor(ctxt, tss->fs, VCPU_SREG_FS, NULL); + if (ret != X86EMUL_CONTINUE) + return ret; +- ret = load_segment_descriptor(ctxt, tss->gs, VCPU_SREG_GS); ++ ret = load_segment_descriptor(ctxt, tss->gs, VCPU_SREG_GS, NULL); + if (ret != X86EMUL_CONTINUE) + return ret; + +@@ -2918,24 +2949,37 @@ static int em_call_far(struct x86_emulate_ctxt *ctxt) + u16 sel, old_cs; + ulong old_eip; + int rc; ++ struct desc_struct old_desc, new_desc; ++ const struct x86_emulate_ops *ops = ctxt->ops; + +- old_cs = get_segment_selector(ctxt, VCPU_SREG_CS); + old_eip = ctxt->_eip; ++ ops->get_segment(ctxt, &old_cs, &old_desc, NULL, VCPU_SREG_CS); + + memcpy(&sel, ctxt->src.valptr + ctxt->op_bytes, 2); +- if (load_segment_descriptor(ctxt, sel, VCPU_SREG_CS)) ++ rc = load_segment_descriptor(ctxt, sel, VCPU_SREG_CS, &new_desc); ++ if (rc != X86EMUL_CONTINUE) + return X86EMUL_CONTINUE; + +- ctxt->_eip = 0; +- memcpy(&ctxt->_eip, ctxt->src.valptr, ctxt->op_bytes); ++ rc = assign_eip_far(ctxt, ctxt->src.val, new_desc.l); ++ if (rc != X86EMUL_CONTINUE) ++ goto fail; + + ctxt->src.val = old_cs; + rc = em_push(ctxt); + if (rc != X86EMUL_CONTINUE) +- return rc; ++ goto fail; + + ctxt->src.val = old_eip; +- return em_push(ctxt); ++ rc = em_push(ctxt); ++ /* If we failed, we tainted the memory, but the very least we should ++ restore cs */ ++ if (rc != X86EMUL_CONTINUE) ++ goto fail; ++ return rc; ++fail: ++ ops->set_segment(ctxt, old_cs, &old_desc, 0, VCPU_SREG_CS); ++ return rc; ++ + } + + static int em_ret_near_imm(struct x86_emulate_ctxt *ctxt) +@@ -3081,7 +3125,7 @@ static int em_mov_sreg_rm(struct x86_emulate_ctxt *ctxt) + + /* Disable writeback. */ + ctxt->dst.type = OP_NONE; +- return load_segment_descriptor(ctxt, sel, ctxt->modrm_reg); ++ return load_segment_descriptor(ctxt, sel, ctxt->modrm_reg, NULL); + } + + static int em_lldt(struct x86_emulate_ctxt *ctxt) +@@ -3090,7 +3134,7 @@ static int em_lldt(struct x86_emulate_ctxt *ctxt) + + /* Disable writeback. */ + ctxt->dst.type = OP_NONE; +- return load_segment_descriptor(ctxt, sel, VCPU_SREG_LDTR); ++ return load_segment_descriptor(ctxt, sel, VCPU_SREG_LDTR, NULL); + } + + static int em_ltr(struct x86_emulate_ctxt *ctxt) +@@ -3099,7 +3143,7 @@ static int em_ltr(struct x86_emulate_ctxt *ctxt) + + /* Disable writeback. */ + ctxt->dst.type = OP_NONE; +- return load_segment_descriptor(ctxt, sel, VCPU_SREG_TR); ++ return load_segment_descriptor(ctxt, sel, VCPU_SREG_TR, NULL); + } + + static int em_invlpg(struct x86_emulate_ctxt *ctxt) +@@ -3614,11 +3658,11 @@ static const struct opcode group4[] = { + static const struct opcode group5[] = { + F(DstMem | SrcNone | Lock, em_inc), + F(DstMem | SrcNone | Lock, em_dec), +- I(SrcMem | Stack, em_grp45), ++ I(SrcMem | NearBranch, em_call_near_abs), + I(SrcMemFAddr | ImplicitOps | Stack, em_call_far), +- I(SrcMem | Stack, em_grp45), +- I(SrcMemFAddr | ImplicitOps, em_grp45), +- I(SrcMem | Stack, em_grp45), D(Undefined), ++ I(SrcMem | NearBranch, em_jmp_abs), ++ I(SrcMemFAddr | ImplicitOps, em_jmp_far), ++ I(SrcMem | Stack, em_push), D(Undefined), + }; + + static const struct opcode group6[] = { +@@ -3780,7 +3824,7 @@ static const struct opcode opcode_table[256] = { + I2bvIP(DstDI | SrcDX | Mov | String | Unaligned, em_in, ins, check_perm_in), /* insb, insw/insd */ + I2bvIP(SrcSI | DstDX | String, em_out, outs, check_perm_out), /* outsb, outsw/outsd */ + /* 0x70 - 0x7F */ +- X16(D(SrcImmByte)), ++ X16(D(SrcImmByte | NearBranch)), + /* 0x80 - 0x87 */ + G(ByteOp | DstMem | SrcImm, group1), + G(DstMem | SrcImm, group1), +@@ -3818,8 +3862,8 @@ static const struct opcode opcode_table[256] = { + X8(I(DstReg | SrcImm64 | Mov, em_mov)), + /* 0xC0 - 0xC7 */ + G(ByteOp | Src2ImmByte, group2), G(Src2ImmByte, group2), +- I(ImplicitOps | Stack | SrcImmU16, em_ret_near_imm), +- I(ImplicitOps | Stack, em_ret), ++ I(ImplicitOps | NearBranch | SrcImmU16, em_ret_near_imm), ++ I(ImplicitOps | NearBranch, em_ret), + I(DstReg | SrcMemFAddr | ModRM | No64 | Src2ES, em_lseg), + I(DstReg | SrcMemFAddr | ModRM | No64 | Src2DS, em_lseg), + G(ByteOp, group11), G(0, group11), +@@ -3840,11 +3884,11 @@ static const struct opcode opcode_table[256] = { + N, E(0, &escape_d9), N, E(0, &escape_db), N, E(0, &escape_dd), N, N, + /* 0xE0 - 0xE7 */ + X3(I(SrcImmByte, em_loop)), +- I(SrcImmByte, em_jcxz), ++ I(SrcImmByte | NearBranch, em_jcxz), + I2bvIP(SrcImmUByte | DstAcc, em_in, in, check_perm_in), + I2bvIP(SrcAcc | DstImmUByte, em_out, out, check_perm_out), + /* 0xE8 - 0xEF */ +- I(SrcImm | Stack, em_call), D(SrcImm | ImplicitOps), ++ I(SrcImm | NearBranch, em_call), D(SrcImm | ImplicitOps), + I(SrcImmFAddr | No64, em_jmp_far), D(SrcImmByte | ImplicitOps), + I2bvIP(SrcDX | DstAcc, em_in, in, check_perm_in), + I2bvIP(SrcAcc | DstDX, em_out, out, check_perm_out), +@@ -4324,8 +4368,12 @@ done_prefixes: + if (!(ctxt->d & VendorSpecific) && ctxt->only_vendor_specific_insn) + return EMULATION_FAILED; + +- if (mode == X86EMUL_MODE_PROT64 && (ctxt->d & Stack)) +- ctxt->op_bytes = 8; ++ if (mode == X86EMUL_MODE_PROT64) { ++ if (ctxt->op_bytes == 4 && (ctxt->d & Stack)) ++ ctxt->op_bytes = 8; ++ else if (ctxt->d & NearBranch) ++ ctxt->op_bytes = 8; ++ } + + if (ctxt->d & Op3264) { + if (mode == X86EMUL_MODE_PROT64) +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index c7663b16cdbe..f5ddacc4c885 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -439,6 +439,7 @@ struct vcpu_vmx { + #endif + int gs_ldt_reload_needed; + int fs_reload_needed; ++ unsigned long vmcs_host_cr4; /* May not match real cr4 */ + } host_state; + struct { + int vm86_active; +@@ -2519,6 +2520,8 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) + break; + case MSR_IA32_CR_PAT: + if (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_IA32_PAT) { ++ if (!kvm_mtrr_valid(vcpu, MSR_IA32_CR_PAT, data)) ++ return 1; + vmcs_write64(GUEST_IA32_PAT, data); + vcpu->arch.pat = data; + break; +@@ -4127,11 +4130,16 @@ static void vmx_set_constant_host_state(struct vcpu_vmx *vmx) + u32 low32, high32; + unsigned long tmpl; + struct desc_ptr dt; ++ unsigned long cr4; + + vmcs_writel(HOST_CR0, read_cr0() & ~X86_CR0_TS); /* 22.2.3 */ +- vmcs_writel(HOST_CR4, read_cr4()); /* 22.2.3, 22.2.5 */ + vmcs_writel(HOST_CR3, read_cr3()); /* 22.2.3 FIXME: shadow tables */ + ++ /* Save the most likely value for this task's CR4 in the VMCS. */ ++ cr4 = read_cr4(); ++ vmcs_writel(HOST_CR4, cr4); /* 22.2.3, 22.2.5 */ ++ vmx->host_state.vmcs_host_cr4 = cr4; ++ + vmcs_write16(HOST_CS_SELECTOR, __KERNEL_CS); /* 22.2.4 */ + #ifdef CONFIG_X86_64 + /* +@@ -7124,7 +7132,7 @@ static void atomic_switch_perf_msrs(struct vcpu_vmx *vmx) + static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu) + { + struct vcpu_vmx *vmx = to_vmx(vcpu); +- unsigned long debugctlmsr; ++ unsigned long debugctlmsr, cr4; + + /* Record the guest's net vcpu time for enforced NMI injections. */ + if (unlikely(!cpu_has_virtual_nmis() && vmx->soft_vnmi_blocked)) +@@ -7145,6 +7153,12 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu) + if (test_bit(VCPU_REGS_RIP, (unsigned long *)&vcpu->arch.regs_dirty)) + vmcs_writel(GUEST_RIP, vcpu->arch.regs[VCPU_REGS_RIP]); + ++ cr4 = read_cr4(); ++ if (unlikely(cr4 != vmx->host_state.vmcs_host_cr4)) { ++ vmcs_writel(HOST_CR4, cr4); ++ vmx->host_state.vmcs_host_cr4 = cr4; ++ } ++ + /* When single-stepping over STI and MOV SS, we must clear the + * corresponding interruptibility bits in the guest state. Otherwise + * vmentry fails as it then expects bit 14 (BS) in pending debug +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 790551bc4f15..fabb62bad47c 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -1707,7 +1707,7 @@ static bool valid_mtrr_type(unsigned t) + return t < 8 && (1 << t) & 0x73; /* 0, 1, 4, 5, 6 */ + } + +-static bool mtrr_valid(struct kvm_vcpu *vcpu, u32 msr, u64 data) ++bool kvm_mtrr_valid(struct kvm_vcpu *vcpu, u32 msr, u64 data) + { + int i; + +@@ -1733,12 +1733,13 @@ static bool mtrr_valid(struct kvm_vcpu *vcpu, u32 msr, u64 data) + /* variable MTRRs */ + return valid_mtrr_type(data & 0xff); + } ++EXPORT_SYMBOL_GPL(kvm_mtrr_valid); + + static int set_msr_mtrr(struct kvm_vcpu *vcpu, u32 msr, u64 data) + { + u64 *p = (u64 *)&vcpu->arch.mtrr_state.fixed_ranges; + +- if (!mtrr_valid(vcpu, msr, data)) ++ if (!kvm_mtrr_valid(vcpu, msr, data)) + return 1; + + if (msr == MSR_MTRRdefType) { +diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h +index 7626d3efa064..e2968a500c4e 100644 +--- a/arch/x86/kvm/x86.h ++++ b/arch/x86/kvm/x86.h +@@ -132,6 +132,8 @@ int kvm_write_guest_virt_system(struct x86_emulate_ctxt *ctxt, + gva_t addr, void *val, unsigned int bytes, + struct x86_exception *exception); + ++bool kvm_mtrr_valid(struct kvm_vcpu *vcpu, u32 msr, u64 data); ++ + extern u64 host_xcr0; + + extern unsigned int min_timer_period_us; +diff --git a/arch/x86/pci/common.c b/arch/x86/pci/common.c +index 981c2dbd72cc..88f143d9754e 100644 +--- a/arch/x86/pci/common.c ++++ b/arch/x86/pci/common.c +@@ -448,6 +448,22 @@ static const struct dmi_system_id pciprobe_dmi_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "ftServer"), + }, + }, ++ { ++ .callback = set_scan_all, ++ .ident = "Stratus/NEC ftServer", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "NEC"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Express5800/R32"), ++ }, ++ }, ++ { ++ .callback = set_scan_all, ++ .ident = "Stratus/NEC ftServer", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "NEC"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Express5800/R31"), ++ }, ++ }, + {} + }; + +diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c +index efe4d7220397..a6b5affb024a 100644 +--- a/arch/x86/platform/uv/tlb_uv.c ++++ b/arch/x86/platform/uv/tlb_uv.c +@@ -1367,6 +1367,10 @@ static int ptc_seq_show(struct seq_file *file, void *data) + } + if (cpu < num_possible_cpus() && cpu_online(cpu)) { + bcp = &per_cpu(bau_control, cpu); ++ if (bcp->nobau) { ++ seq_printf(file, "cpu %d bau disabled\n", cpu); ++ return 0; ++ } + stat = bcp->statp; + /* source side statistics */ + seq_printf(file, +diff --git a/crypto/crc32c.c b/crypto/crc32c.c +index 06f7018c9d95..238f0e627ef3 100644 +--- a/crypto/crc32c.c ++++ b/crypto/crc32c.c +@@ -170,3 +170,4 @@ module_exit(crc32c_mod_fini); + MODULE_AUTHOR("Clay Haapala <chaapala@cisco.com>"); + MODULE_DESCRIPTION("CRC32c (Castagnoli) calculations wrapper for lib/crc32c"); + MODULE_LICENSE("GPL"); ++MODULE_ALIAS_CRYPTO("crc32c"); +diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c +index d73f85247272..ebe0ea2dff69 100644 +--- a/drivers/acpi/osl.c ++++ b/drivers/acpi/osl.c +@@ -1748,6 +1748,16 @@ acpi_status __init acpi_os_initialize(void) + acpi_os_map_generic_address(&acpi_gbl_FADT.xpm1b_event_block); + acpi_os_map_generic_address(&acpi_gbl_FADT.xgpe0_block); + acpi_os_map_generic_address(&acpi_gbl_FADT.xgpe1_block); ++ if (acpi_gbl_FADT.flags & ACPI_FADT_RESET_REGISTER) { ++ /* ++ * Use acpi_os_map_generic_address to pre-map the reset ++ * register if it's in system memory. ++ */ ++ int rv; ++ ++ rv = acpi_os_map_generic_address(&acpi_gbl_FADT.reset_register); ++ pr_debug(PREFIX "%s: map reset_reg status %d\n", __func__, rv); ++ } + + return AE_OK; + } +@@ -1776,6 +1786,8 @@ acpi_status acpi_os_terminate(void) + acpi_os_unmap_generic_address(&acpi_gbl_FADT.xgpe0_block); + acpi_os_unmap_generic_address(&acpi_gbl_FADT.xpm1b_event_block); + acpi_os_unmap_generic_address(&acpi_gbl_FADT.xpm1a_event_block); ++ if (acpi_gbl_FADT.flags & ACPI_FADT_RESET_REGISTER) ++ acpi_os_unmap_generic_address(&acpi_gbl_FADT.reset_register); + + destroy_workqueue(kacpid_wq); + destroy_workqueue(kacpi_notify_wq); +diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c +index a86841886acc..2eb4458f4ba8 100644 +--- a/drivers/block/rbd.c ++++ b/drivers/block/rbd.c +@@ -1945,32 +1945,26 @@ static void rbd_dev_parent_put(struct rbd_device *rbd_dev) + * If an image has a non-zero parent overlap, get a reference to its + * parent. + * +- * We must get the reference before checking for the overlap to +- * coordinate properly with zeroing the parent overlap in +- * rbd_dev_v2_parent_info() when an image gets flattened. We +- * drop it again if there is no overlap. +- * + * Returns true if the rbd device has a parent with a non-zero + * overlap and a reference for it was successfully taken, or + * false otherwise. + */ + static bool rbd_dev_parent_get(struct rbd_device *rbd_dev) + { +- int counter; ++ int counter = 0; + + if (!rbd_dev->parent_spec) + return false; + +- counter = atomic_inc_return_safe(&rbd_dev->parent_ref); +- if (counter > 0 && rbd_dev->parent_overlap) +- return true; +- +- /* Image was flattened, but parent is not yet torn down */ ++ down_read(&rbd_dev->header_rwsem); ++ if (rbd_dev->parent_overlap) ++ counter = atomic_inc_return_safe(&rbd_dev->parent_ref); ++ up_read(&rbd_dev->header_rwsem); + + if (counter < 0) + rbd_warn(rbd_dev, "parent reference overflow\n"); + +- return false; ++ return counter > 0; + } + + /* +@@ -2143,7 +2137,6 @@ static void rbd_img_obj_callback(struct rbd_obj_request *obj_request) + rbd_assert(img_request->obj_request_count > 0); + rbd_assert(which != BAD_WHICH); + rbd_assert(which < img_request->obj_request_count); +- rbd_assert(which >= img_request->next_completion); + + spin_lock_irq(&img_request->completion_lock); + if (which != img_request->next_completion) +@@ -3894,7 +3887,6 @@ static int rbd_dev_v2_parent_info(struct rbd_device *rbd_dev) + */ + if (rbd_dev->parent_overlap) { + rbd_dev->parent_overlap = 0; +- smp_mb(); + rbd_dev_parent_put(rbd_dev); + pr_info("%s: clone image has been flattened\n", + rbd_dev->disk->disk_name); +@@ -3938,7 +3930,6 @@ static int rbd_dev_v2_parent_info(struct rbd_device *rbd_dev) + * treat it specially. + */ + rbd_dev->parent_overlap = overlap; +- smp_mb(); + if (!overlap) { + + /* A null parent_spec indicates it's the initial probe */ +@@ -4782,10 +4773,7 @@ static void rbd_dev_unprobe(struct rbd_device *rbd_dev) + { + struct rbd_image_header *header; + +- /* Drop parent reference unless it's already been done (or none) */ +- +- if (rbd_dev->parent_overlap) +- rbd_dev_parent_put(rbd_dev); ++ rbd_dev_parent_put(rbd_dev); + + /* Free dynamic fields from the header, then zero it out */ + +diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c +index 1685b3c50db1..fa6a79009724 100644 +--- a/drivers/bluetooth/ath3k.c ++++ b/drivers/bluetooth/ath3k.c +@@ -168,6 +168,8 @@ static struct usb_device_id ath3k_blist_tbl[] = { + #define USB_REQ_DFU_DNLOAD 1 + #define BULK_SIZE 4096 + #define FW_HDR_SIZE 20 ++#define TIMEGAP_USEC_MIN 50 ++#define TIMEGAP_USEC_MAX 100 + + static int ath3k_load_firmware(struct usb_device *udev, + const struct firmware *firmware) +@@ -198,6 +200,9 @@ static int ath3k_load_firmware(struct usb_device *udev, + count -= 20; + + while (count) { ++ /* workaround the compatibility issue with xHCI controller*/ ++ usleep_range(TIMEGAP_USEC_MIN, TIMEGAP_USEC_MAX); ++ + size = min_t(uint, count, BULK_SIZE); + pipe = usb_sndbulkpipe(udev, 0x02); + memcpy(send_buf, firmware->data + sent, size); +@@ -294,6 +299,9 @@ static int ath3k_load_fwfile(struct usb_device *udev, + count -= size; + + while (count) { ++ /* workaround the compatibility issue with xHCI controller*/ ++ usleep_range(TIMEGAP_USEC_MIN, TIMEGAP_USEC_MAX); ++ + size = min_t(uint, count, BULK_SIZE); + pipe = usb_sndbulkpipe(udev, 0x02); + +diff --git a/drivers/firmware/iscsi_ibft.c b/drivers/firmware/iscsi_ibft.c +index 3ee852c9925b..071c2c969eec 100644 +--- a/drivers/firmware/iscsi_ibft.c ++++ b/drivers/firmware/iscsi_ibft.c +@@ -756,6 +756,7 @@ static const struct { + */ + { ACPI_SIG_IBFT }, + { "iBFT" }, ++ { "BIFT" }, /* Broadcom iSCSI Offload */ + }; + + static void __init acpi_find_ibft_region(void) +diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c +index e66d1cdb637d..8a9b61adcd87 100644 +--- a/drivers/gpio/gpiolib.c ++++ b/drivers/gpio/gpiolib.c +@@ -864,6 +864,7 @@ static int gpiod_export_link(struct device *dev, const char *name, + if (tdev != NULL) { + status = sysfs_create_link(&dev->kobj, &tdev->kobj, + name); ++ put_device(tdev); + } else { + status = -ENODEV; + } +@@ -917,7 +918,7 @@ static int gpiod_sysfs_set_active_low(struct gpio_desc *desc, int value) + } + + status = sysfs_set_active_low(desc, dev, value); +- ++ put_device(dev); + unlock: + mutex_unlock(&sysfs_lock); + +diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c +index 7e4e6896fa81..f97d221194a2 100644 +--- a/drivers/gpu/drm/i915/i915_gem.c ++++ b/drivers/gpu/drm/i915/i915_gem.c +@@ -2788,6 +2788,13 @@ static void i965_write_fence_reg(struct drm_device *dev, int reg, + u32 size = i915_gem_obj_ggtt_size(obj); + uint64_t val; + ++ /* Adjust fence size to match tiled area */ ++ if (obj->tiling_mode != I915_TILING_NONE) { ++ uint32_t row_size = obj->stride * ++ (obj->tiling_mode == I915_TILING_Y ? 32 : 8); ++ size = (size / row_size) * row_size; ++ } ++ + val = (uint64_t)((i915_gem_obj_ggtt_offset(obj) + size - 4096) & + 0xfffff000) << 32; + val |= i915_gem_obj_ggtt_offset(obj) & 0xfffff000; +diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c +index f7d572363f6c..ce09bf932831 100644 +--- a/drivers/i2c/busses/i2c-s3c2410.c ++++ b/drivers/i2c/busses/i2c-s3c2410.c +@@ -711,14 +711,16 @@ static int s3c24xx_i2c_xfer(struct i2c_adapter *adap, + int ret; + + pm_runtime_get_sync(&adap->dev); +- clk_prepare_enable(i2c->clk); ++ ret = clk_enable(i2c->clk); ++ if (ret) ++ return ret; + + for (retry = 0; retry < adap->retries; retry++) { + + ret = s3c24xx_i2c_doxfer(i2c, msgs, num); + + if (ret != -EAGAIN) { +- clk_disable_unprepare(i2c->clk); ++ clk_disable(i2c->clk); + pm_runtime_put(&adap->dev); + return ret; + } +@@ -728,7 +730,7 @@ static int s3c24xx_i2c_xfer(struct i2c_adapter *adap, + udelay(100); + } + +- clk_disable_unprepare(i2c->clk); ++ clk_disable(i2c->clk); + pm_runtime_put(&adap->dev); + return -EREMOTEIO; + } +@@ -1108,7 +1110,7 @@ static int s3c24xx_i2c_probe(struct platform_device *pdev) + + clk_prepare_enable(i2c->clk); + ret = s3c24xx_i2c_init(i2c); +- clk_disable_unprepare(i2c->clk); ++ clk_disable(i2c->clk); + if (ret != 0) { + dev_err(&pdev->dev, "I2C controller init failed\n"); + return ret; +@@ -1120,6 +1122,7 @@ static int s3c24xx_i2c_probe(struct platform_device *pdev) + i2c->irq = ret = platform_get_irq(pdev, 0); + if (ret <= 0) { + dev_err(&pdev->dev, "cannot find IRQ\n"); ++ clk_unprepare(i2c->clk); + return ret; + } + +@@ -1128,12 +1131,14 @@ static int s3c24xx_i2c_probe(struct platform_device *pdev) + + if (ret != 0) { + dev_err(&pdev->dev, "cannot claim IRQ %d\n", i2c->irq); ++ clk_unprepare(i2c->clk); + return ret; + } + + ret = s3c24xx_i2c_register_cpufreq(i2c); + if (ret < 0) { + dev_err(&pdev->dev, "failed to register cpufreq notifier\n"); ++ clk_unprepare(i2c->clk); + return ret; + } + +@@ -1150,6 +1155,7 @@ static int s3c24xx_i2c_probe(struct platform_device *pdev) + if (ret < 0) { + dev_err(&pdev->dev, "failed to add bus to i2c core\n"); + s3c24xx_i2c_deregister_cpufreq(i2c); ++ clk_unprepare(i2c->clk); + return ret; + } + +@@ -1171,6 +1177,8 @@ static int s3c24xx_i2c_remove(struct platform_device *pdev) + { + struct s3c24xx_i2c *i2c = platform_get_drvdata(pdev); + ++ clk_unprepare(i2c->clk); ++ + pm_runtime_disable(&i2c->adap.dev); + pm_runtime_disable(&pdev->dev); + +@@ -1199,10 +1207,13 @@ static int s3c24xx_i2c_resume(struct device *dev) + { + struct platform_device *pdev = to_platform_device(dev); + struct s3c24xx_i2c *i2c = platform_get_drvdata(pdev); ++ int ret; + +- clk_prepare_enable(i2c->clk); ++ ret = clk_enable(i2c->clk); ++ if (ret) ++ return ret; + s3c24xx_i2c_init(i2c); +- clk_disable_unprepare(i2c->clk); ++ clk_disable(i2c->clk); + i2c->suspended = 0; + + return 0; +diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c +index a3769cf84381..b00e282ef166 100644 +--- a/drivers/input/mouse/synaptics.c ++++ b/drivers/input/mouse/synaptics.c +@@ -132,8 +132,9 @@ static const struct min_max_quirk min_max_pnpid_table[] = { + 1232, 5710, 1156, 4696 + }, + { +- (const char * const []){"LEN0034", "LEN0036", "LEN0039", +- "LEN2002", "LEN2004", NULL}, ++ (const char * const []){"LEN0034", "LEN0036", "LEN0037", ++ "LEN0039", "LEN2002", "LEN2004", ++ NULL}, + 1024, 5112, 2024, 4832 + }, + { +@@ -162,7 +163,7 @@ static const char * const topbuttonpad_pnp_ids[] = { + "LEN0034", /* T431s, L440, L540, T540, W540, X1 Carbon 2nd */ + "LEN0035", /* X240 */ + "LEN0036", /* T440 */ +- "LEN0037", ++ "LEN0037", /* X1 Carbon 2nd */ + "LEN0038", + "LEN0039", /* T440s */ + "LEN0041", +diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h +index c1d156aad8fc..0254ed97c16e 100644 +--- a/drivers/input/serio/i8042-x86ia64io.h ++++ b/drivers/input/serio/i8042-x86ia64io.h +@@ -152,6 +152,14 @@ static const struct dmi_system_id __initconst i8042_dmi_noloop_table[] = { + }, + }, + { ++ /* Medion Akoya E7225 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Medion"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Akoya E7225"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "1.0"), ++ }, ++ }, ++ { + /* Blue FB5601 */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "blue"), +diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c +index 0bfd9c0611a0..f86bd4511351 100644 +--- a/drivers/md/dm-cache-metadata.c ++++ b/drivers/md/dm-cache-metadata.c +@@ -664,7 +664,7 @@ static struct dm_cache_metadata *metadata_open(struct block_device *bdev, + cmd = kzalloc(sizeof(*cmd), GFP_KERNEL); + if (!cmd) { + DMERR("could not allocate metadata struct"); +- return NULL; ++ return ERR_PTR(-ENOMEM); + } + + atomic_set(&cmd->ref_count, 1); +@@ -726,7 +726,7 @@ static struct dm_cache_metadata *lookup_or_open(struct block_device *bdev, + return cmd; + + cmd = metadata_open(bdev, data_block_size, may_format_device, policy_hint_size); +- if (cmd) { ++ if (!IS_ERR(cmd)) { + mutex_lock(&table_lock); + cmd2 = lookup(bdev); + if (cmd2) { +@@ -761,9 +761,10 @@ struct dm_cache_metadata *dm_cache_metadata_open(struct block_device *bdev, + { + struct dm_cache_metadata *cmd = lookup_or_open(bdev, data_block_size, + may_format_device, policy_hint_size); +- if (cmd && !same_params(cmd, data_block_size)) { ++ ++ if (!IS_ERR(cmd) && !same_params(cmd, data_block_size)) { + dm_cache_metadata_close(cmd); +- return NULL; ++ return ERR_PTR(-EINVAL); + } + + return cmd; +diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c +index 0396d7fc1d8b..d2b3563129c2 100644 +--- a/drivers/md/dm-thin.c ++++ b/drivers/md/dm-thin.c +@@ -2507,6 +2507,12 @@ static int pool_message(struct dm_target *ti, unsigned argc, char **argv) + struct pool_c *pt = ti->private; + struct pool *pool = pt->pool; + ++ if (get_pool_mode(pool) >= PM_READ_ONLY) { ++ DMERR("%s: unable to service pool target messages in READ_ONLY or FAIL mode", ++ dm_device_name(pool->pool_md)); ++ return -EINVAL; ++ } ++ + if (!strcasecmp(argv[0], "create_thin")) + r = process_create_thin_mesg(argc, argv, pool); + +diff --git a/drivers/md/dm.c b/drivers/md/dm.c +index a562d5a4fa9d..2f03e8e10c24 100644 +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -2253,7 +2253,8 @@ static struct dm_table *__bind(struct mapped_device *md, struct dm_table *t, + set_bit(DMF_MERGE_IS_OPTIONAL, &md->flags); + else + clear_bit(DMF_MERGE_IS_OPTIONAL, &md->flags); +- dm_sync_table(md); ++ if (old_map) ++ dm_sync_table(md); + + return old_map; + } +@@ -2694,7 +2695,8 @@ int dm_suspend(struct mapped_device *md, unsigned suspend_flags) + * flush_workqueue(md->wq). + */ + set_bit(DMF_BLOCK_IO_FOR_SUSPEND, &md->flags); +- synchronize_srcu(&md->io_barrier); ++ if (map) ++ synchronize_srcu(&md->io_barrier); + + /* + * Stop md->queue before flushing md->wq in case request-based +@@ -2714,7 +2716,8 @@ int dm_suspend(struct mapped_device *md, unsigned suspend_flags) + + if (noflush) + clear_bit(DMF_NOFLUSH_SUSPENDING, &md->flags); +- synchronize_srcu(&md->io_barrier); ++ if (map) ++ synchronize_srcu(&md->io_barrier); + + /* were we interrupted ? */ + if (r < 0) { +diff --git a/drivers/media/rc/ir-lirc-codec.c b/drivers/media/rc/ir-lirc-codec.c +index ed2c8a1ed8ca..98893a8332c7 100644 +--- a/drivers/media/rc/ir-lirc-codec.c ++++ b/drivers/media/rc/ir-lirc-codec.c +@@ -42,11 +42,17 @@ static int ir_lirc_decode(struct rc_dev *dev, struct ir_raw_event ev) + return -EINVAL; + + /* Packet start */ +- if (ev.reset) +- return 0; ++ if (ev.reset) { ++ /* Userspace expects a long space event before the start of ++ * the signal to use as a sync. This may be done with repeat ++ * packets and normal samples. But if a reset has been sent ++ * then we assume that a long time has passed, so we send a ++ * space with the maximum time value. */ ++ sample = LIRC_SPACE(LIRC_VALUE_MASK); ++ IR_dprintk(2, "delivering reset sync space to lirc_dev\n"); + + /* Carrier reports */ +- if (ev.carrier_report) { ++ } else if (ev.carrier_report) { + sample = LIRC_FREQUENCY(ev.carrier); + IR_dprintk(2, "carrier report (freq: %d)\n", sample); + +diff --git a/drivers/mmc/host/sdhci-acpi.c b/drivers/mmc/host/sdhci-acpi.c +index cdd4ce0d7c90..854fcfbd7574 100644 +--- a/drivers/mmc/host/sdhci-acpi.c ++++ b/drivers/mmc/host/sdhci-acpi.c +@@ -119,9 +119,11 @@ static const struct sdhci_acpi_slot sdhci_acpi_slot_int_emmc = { + .caps = MMC_CAP_8_BIT_DATA | MMC_CAP_NONREMOVABLE | MMC_CAP_HW_RESET, + .caps2 = MMC_CAP2_HC_ERASE_SZ, + .flags = SDHCI_ACPI_RUNTIME_PM, ++ .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN, + }; + + static const struct sdhci_acpi_slot sdhci_acpi_slot_int_sdio = { ++ .quirks = SDHCI_QUIRK_BROKEN_CARD_DETECTION, + .quirks2 = SDHCI_QUIRK2_HOST_OFF_CARD_ON, + .caps = MMC_CAP_NONREMOVABLE | MMC_CAP_POWER_OFF_CARD, + .flags = SDHCI_ACPI_RUNTIME_PM, +@@ -142,16 +144,23 @@ struct sdhci_acpi_uid_slot { + static const struct sdhci_acpi_uid_slot sdhci_acpi_uids[] = { + { "80860F14" , "1" , &sdhci_acpi_slot_int_emmc }, + { "80860F14" , "3" , &sdhci_acpi_slot_int_sd }, ++ { "80860F16" , NULL, &sdhci_acpi_slot_int_sd }, + { "INT33BB" , "2" , &sdhci_acpi_slot_int_sdio }, ++ { "INT33BB" , "3" , &sdhci_acpi_slot_int_sd }, + { "INT33C6" , NULL, &sdhci_acpi_slot_int_sdio }, ++ { "INT3436" , NULL, &sdhci_acpi_slot_int_sdio }, ++ { "INT344D" , NULL, &sdhci_acpi_slot_int_sdio }, + { "PNP0D40" }, + { }, + }; + + static const struct acpi_device_id sdhci_acpi_ids[] = { + { "80860F14" }, ++ { "80860F16" }, + { "INT33BB" }, + { "INT33C6" }, ++ { "INT3436" }, ++ { "INT344D" }, + { "PNP0D40" }, + { }, + }; +diff --git a/drivers/mmc/host/sdhci-pci.c b/drivers/mmc/host/sdhci-pci.c +index b2a4c22507d9..a49f41b50b16 100644 +--- a/drivers/mmc/host/sdhci-pci.c ++++ b/drivers/mmc/host/sdhci-pci.c +@@ -27,81 +27,7 @@ + #include <linux/mmc/sdhci-pci-data.h> + + #include "sdhci.h" +- +-/* +- * PCI device IDs +- */ +-#define PCI_DEVICE_ID_INTEL_PCH_SDIO0 0x8809 +-#define PCI_DEVICE_ID_INTEL_PCH_SDIO1 0x880a +-#define PCI_DEVICE_ID_INTEL_BYT_EMMC 0x0f14 +-#define PCI_DEVICE_ID_INTEL_BYT_SDIO 0x0f15 +-#define PCI_DEVICE_ID_INTEL_BYT_SD 0x0f16 +-#define PCI_DEVICE_ID_INTEL_BYT_EMMC2 0x0f50 +-#define PCI_DEVICE_ID_INTEL_MRFL_MMC 0x1190 +-#define PCI_DEVICE_ID_INTEL_CLV_SDIO0 0x08f9 +-#define PCI_DEVICE_ID_INTEL_CLV_SDIO1 0x08fa +-#define PCI_DEVICE_ID_INTEL_CLV_SDIO2 0x08fb +-#define PCI_DEVICE_ID_INTEL_CLV_EMMC0 0x08e5 +-#define PCI_DEVICE_ID_INTEL_CLV_EMMC1 0x08e6 +-#define PCI_DEVICE_ID_INTEL_QRK_SD 0x08A7 +- +-/* +- * PCI registers +- */ +- +-#define PCI_SDHCI_IFPIO 0x00 +-#define PCI_SDHCI_IFDMA 0x01 +-#define PCI_SDHCI_IFVENDOR 0x02 +- +-#define PCI_SLOT_INFO 0x40 /* 8 bits */ +-#define PCI_SLOT_INFO_SLOTS(x) ((x >> 4) & 7) +-#define PCI_SLOT_INFO_FIRST_BAR_MASK 0x07 +- +-#define MAX_SLOTS 8 +- +-struct sdhci_pci_chip; +-struct sdhci_pci_slot; +- +-struct sdhci_pci_fixes { +- unsigned int quirks; +- unsigned int quirks2; +- bool allow_runtime_pm; +- bool own_cd_for_runtime_pm; +- +- int (*probe) (struct sdhci_pci_chip *); +- +- int (*probe_slot) (struct sdhci_pci_slot *); +- void (*remove_slot) (struct sdhci_pci_slot *, int); +- +- int (*suspend) (struct sdhci_pci_chip *); +- int (*resume) (struct sdhci_pci_chip *); +-}; +- +-struct sdhci_pci_slot { +- struct sdhci_pci_chip *chip; +- struct sdhci_host *host; +- struct sdhci_pci_data *data; +- +- int pci_bar; +- int rst_n_gpio; +- int cd_gpio; +- int cd_irq; +- +- void (*hw_reset)(struct sdhci_host *host); +-}; +- +-struct sdhci_pci_chip { +- struct pci_dev *pdev; +- +- unsigned int quirks; +- unsigned int quirks2; +- bool allow_runtime_pm; +- const struct sdhci_pci_fixes *fixes; +- +- int num_slots; /* Slots on controller */ +- struct sdhci_pci_slot *slots[MAX_SLOTS]; /* Pointers to host slots */ +-}; +- ++#include "sdhci-pci.h" + + /*****************************************************************************\ + * * +@@ -344,6 +270,8 @@ static int byt_emmc_probe_slot(struct sdhci_pci_slot *slot) + MMC_CAP_HW_RESET; + slot->host->mmc->caps2 |= MMC_CAP2_HC_ERASE_SZ; + slot->hw_reset = sdhci_pci_int_hw_reset; ++ if (slot->chip->pdev->device == PCI_DEVICE_ID_INTEL_BSW_EMMC) ++ slot->host->timeout_clk = 1000; /* 1000 kHz i.e. 1 MHz */ + return 0; + } + +@@ -356,6 +284,7 @@ static int byt_sdio_probe_slot(struct sdhci_pci_slot *slot) + static const struct sdhci_pci_fixes sdhci_intel_byt_emmc = { + .allow_runtime_pm = true, + .probe_slot = byt_emmc_probe_slot, ++ .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN, + }; + + static const struct sdhci_pci_fixes sdhci_intel_byt_sdio = { +@@ -389,6 +318,7 @@ static int intel_mrfl_mmc_probe_slot(struct sdhci_pci_slot *slot) + + static const struct sdhci_pci_fixes sdhci_intel_mrfl_mmc = { + .quirks = SDHCI_QUIRK_NO_ENDATTR_IN_NOPDESC, ++ .quirks2 = SDHCI_QUIRK2_BROKEN_HS200, + .probe_slot = intel_mrfl_mmc_probe_slot, + }; + +@@ -742,6 +672,18 @@ static const struct sdhci_pci_fixes sdhci_via = { + .probe = via_probe, + }; + ++static int rtsx_probe_slot(struct sdhci_pci_slot *slot) ++{ ++ slot->host->mmc->caps2 |= MMC_CAP2_HS200; ++ return 0; ++} ++ ++static const struct sdhci_pci_fixes sdhci_rtsx = { ++ .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN | ++ SDHCI_QUIRK2_BROKEN_DDR50, ++ .probe_slot = rtsx_probe_slot, ++}; ++ + static const struct pci_device_id pci_ids[] = { + { + .vendor = PCI_VENDOR_ID_RICOH, +@@ -864,6 +806,14 @@ static const struct pci_device_id pci_ids[] = { + }, + + { ++ .vendor = PCI_VENDOR_ID_REALTEK, ++ .device = 0x5250, ++ .subvendor = PCI_ANY_ID, ++ .subdevice = PCI_ANY_ID, ++ .driver_data = (kernel_ulong_t)&sdhci_rtsx, ++ }, ++ ++ { + .vendor = PCI_VENDOR_ID_INTEL, + .device = PCI_DEVICE_ID_INTEL_QRK_SD, + .subvendor = PCI_ANY_ID, +@@ -983,6 +933,29 @@ static const struct pci_device_id pci_ids[] = { + .driver_data = (kernel_ulong_t)&sdhci_intel_byt_emmc, + }, + ++ { ++ .vendor = PCI_VENDOR_ID_INTEL, ++ .device = PCI_DEVICE_ID_INTEL_BSW_EMMC, ++ .subvendor = PCI_ANY_ID, ++ .subdevice = PCI_ANY_ID, ++ .driver_data = (kernel_ulong_t)&sdhci_intel_byt_emmc, ++ }, ++ ++ { ++ .vendor = PCI_VENDOR_ID_INTEL, ++ .device = PCI_DEVICE_ID_INTEL_BSW_SDIO, ++ .subvendor = PCI_ANY_ID, ++ .subdevice = PCI_ANY_ID, ++ .driver_data = (kernel_ulong_t)&sdhci_intel_byt_sdio, ++ }, ++ ++ { ++ .vendor = PCI_VENDOR_ID_INTEL, ++ .device = PCI_DEVICE_ID_INTEL_BSW_SD, ++ .subvendor = PCI_ANY_ID, ++ .subdevice = PCI_ANY_ID, ++ .driver_data = (kernel_ulong_t)&sdhci_intel_byt_sd, ++ }, + + { + .vendor = PCI_VENDOR_ID_INTEL, +@@ -1031,6 +1004,31 @@ static const struct pci_device_id pci_ids[] = { + .subdevice = PCI_ANY_ID, + .driver_data = (kernel_ulong_t)&sdhci_intel_mrfl_mmc, + }, ++ ++ { ++ .vendor = PCI_VENDOR_ID_INTEL, ++ .device = PCI_DEVICE_ID_INTEL_SPT_EMMC, ++ .subvendor = PCI_ANY_ID, ++ .subdevice = PCI_ANY_ID, ++ .driver_data = (kernel_ulong_t)&sdhci_intel_byt_emmc, ++ }, ++ ++ { ++ .vendor = PCI_VENDOR_ID_INTEL, ++ .device = PCI_DEVICE_ID_INTEL_SPT_SDIO, ++ .subvendor = PCI_ANY_ID, ++ .subdevice = PCI_ANY_ID, ++ .driver_data = (kernel_ulong_t)&sdhci_intel_byt_sdio, ++ }, ++ ++ { ++ .vendor = PCI_VENDOR_ID_INTEL, ++ .device = PCI_DEVICE_ID_INTEL_SPT_SD, ++ .subvendor = PCI_ANY_ID, ++ .subdevice = PCI_ANY_ID, ++ .driver_data = (kernel_ulong_t)&sdhci_intel_byt_sd, ++ }, ++ + { + .vendor = PCI_VENDOR_ID_O2, + .device = PCI_DEVICE_ID_O2_8120, +diff --git a/drivers/mmc/host/sdhci-pci.h b/drivers/mmc/host/sdhci-pci.h +new file mode 100644 +index 000000000000..3fd813cca3cd +--- /dev/null ++++ b/drivers/mmc/host/sdhci-pci.h +@@ -0,0 +1,85 @@ ++#ifndef __SDHCI_PCI_H ++#define __SDHCI_PCI_H ++ ++/* ++ * PCI device IDs ++ */ ++ ++#define PCI_DEVICE_ID_INTEL_PCH_SDIO0 0x8809 ++#define PCI_DEVICE_ID_INTEL_PCH_SDIO1 0x880a ++#define PCI_DEVICE_ID_INTEL_BYT_EMMC 0x0f14 ++#define PCI_DEVICE_ID_INTEL_BYT_SDIO 0x0f15 ++#define PCI_DEVICE_ID_INTEL_BYT_SD 0x0f16 ++#define PCI_DEVICE_ID_INTEL_BYT_EMMC2 0x0f50 ++#define PCI_DEVICE_ID_INTEL_BSW_EMMC 0x2294 ++#define PCI_DEVICE_ID_INTEL_BSW_SDIO 0x2295 ++#define PCI_DEVICE_ID_INTEL_BSW_SD 0x2296 ++#define PCI_DEVICE_ID_INTEL_MRFL_MMC 0x1190 ++#define PCI_DEVICE_ID_INTEL_CLV_SDIO0 0x08f9 ++#define PCI_DEVICE_ID_INTEL_CLV_SDIO1 0x08fa ++#define PCI_DEVICE_ID_INTEL_CLV_SDIO2 0x08fb ++#define PCI_DEVICE_ID_INTEL_CLV_EMMC0 0x08e5 ++#define PCI_DEVICE_ID_INTEL_CLV_EMMC1 0x08e6 ++#define PCI_DEVICE_ID_INTEL_QRK_SD 0x08A7 ++#define PCI_DEVICE_ID_INTEL_SPT_EMMC 0x9d2b ++#define PCI_DEVICE_ID_INTEL_SPT_SDIO 0x9d2c ++#define PCI_DEVICE_ID_INTEL_SPT_SD 0x9d2d ++ ++/* ++ * PCI registers ++ */ ++ ++#define PCI_SDHCI_IFPIO 0x00 ++#define PCI_SDHCI_IFDMA 0x01 ++#define PCI_SDHCI_IFVENDOR 0x02 ++ ++#define PCI_SLOT_INFO 0x40 /* 8 bits */ ++#define PCI_SLOT_INFO_SLOTS(x) ((x >> 4) & 7) ++#define PCI_SLOT_INFO_FIRST_BAR_MASK 0x07 ++ ++#define MAX_SLOTS 8 ++ ++struct sdhci_pci_chip; ++struct sdhci_pci_slot; ++ ++struct sdhci_pci_fixes { ++ unsigned int quirks; ++ unsigned int quirks2; ++ bool allow_runtime_pm; ++ bool own_cd_for_runtime_pm; ++ ++ int (*probe) (struct sdhci_pci_chip *); ++ ++ int (*probe_slot) (struct sdhci_pci_slot *); ++ void (*remove_slot) (struct sdhci_pci_slot *, int); ++ ++ int (*suspend) (struct sdhci_pci_chip *); ++ int (*resume) (struct sdhci_pci_chip *); ++}; ++ ++struct sdhci_pci_slot { ++ struct sdhci_pci_chip *chip; ++ struct sdhci_host *host; ++ struct sdhci_pci_data *data; ++ ++ int pci_bar; ++ int rst_n_gpio; ++ int cd_gpio; ++ int cd_irq; ++ ++ void (*hw_reset)(struct sdhci_host *host); ++}; ++ ++struct sdhci_pci_chip { ++ struct pci_dev *pdev; ++ ++ unsigned int quirks; ++ unsigned int quirks2; ++ bool allow_runtime_pm; ++ const struct sdhci_pci_fixes *fixes; ++ ++ int num_slots; /* Slots on controller */ ++ struct sdhci_pci_slot *slots[MAX_SLOTS]; /* Pointers to host slots */ ++}; ++ ++#endif /* __SDHCI_PCI_H */ +diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c +index ff6e822d2b78..bd2538d84f5d 100644 +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -3006,11 +3006,13 @@ int sdhci_add_host(struct sdhci_host *host) + /* SD3.0: SDR104 is supported so (for eMMC) the caps2 + * field can be promoted to support HS200. + */ +- mmc->caps2 |= MMC_CAP2_HS200; ++ if (!(host->quirks2 & SDHCI_QUIRK2_BROKEN_HS200)) ++ mmc->caps2 |= MMC_CAP2_HS200; + } else if (caps[1] & SDHCI_SUPPORT_SDR50) + mmc->caps |= MMC_CAP_UHS_SDR50; + +- if (caps[1] & SDHCI_SUPPORT_DDR50) ++ if ((caps[1] & SDHCI_SUPPORT_DDR50) && ++ !(host->quirks2 & SDHCI_QUIRK2_BROKEN_DDR50)) + mmc->caps |= MMC_CAP_UHS_DDR50; + + /* Does the host need tuning for SDR50? */ +diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c +index 63fb90b006ba..a3fb8b51038a 100644 +--- a/drivers/net/can/usb/kvaser_usb.c ++++ b/drivers/net/can/usb/kvaser_usb.c +@@ -579,7 +579,7 @@ static int kvaser_usb_simple_msg_async(struct kvaser_usb_net_priv *priv, + usb_sndbulkpipe(dev->udev, + dev->bulk_out->bEndpointAddress), + buf, msg->len, +- kvaser_usb_simple_msg_callback, priv); ++ kvaser_usb_simple_msg_callback, netdev); + usb_anchor_urb(urb, &priv->tx_submitted); + + err = usb_submit_urb(urb, GFP_ATOMIC); +@@ -654,11 +654,6 @@ static void kvaser_usb_rx_error(const struct kvaser_usb *dev, + priv = dev->nets[channel]; + stats = &priv->netdev->stats; + +- if (status & M16C_STATE_BUS_RESET) { +- kvaser_usb_unlink_tx_urbs(priv); +- return; +- } +- + skb = alloc_can_err_skb(priv->netdev, &cf); + if (!skb) { + stats->rx_dropped++; +@@ -669,7 +664,7 @@ static void kvaser_usb_rx_error(const struct kvaser_usb *dev, + + netdev_dbg(priv->netdev, "Error status: 0x%02x\n", status); + +- if (status & M16C_STATE_BUS_OFF) { ++ if (status & (M16C_STATE_BUS_OFF | M16C_STATE_BUS_RESET)) { + cf->can_id |= CAN_ERR_BUSOFF; + + priv->can.can_stats.bus_off++; +@@ -695,9 +690,7 @@ static void kvaser_usb_rx_error(const struct kvaser_usb *dev, + } + + new_state = CAN_STATE_ERROR_PASSIVE; +- } +- +- if (status == M16C_STATE_BUS_ERROR) { ++ } else if (status & M16C_STATE_BUS_ERROR) { + if ((priv->can.state < CAN_STATE_ERROR_WARNING) && + ((txerr >= 96) || (rxerr >= 96))) { + cf->can_id |= CAN_ERR_CRTL; +@@ -707,7 +700,8 @@ static void kvaser_usb_rx_error(const struct kvaser_usb *dev, + + priv->can.can_stats.error_warning++; + new_state = CAN_STATE_ERROR_WARNING; +- } else if (priv->can.state > CAN_STATE_ERROR_ACTIVE) { ++ } else if ((priv->can.state > CAN_STATE_ERROR_ACTIVE) && ++ ((txerr < 96) && (rxerr < 96))) { + cf->can_id |= CAN_ERR_PROT; + cf->data[2] = CAN_ERR_PROT_ACTIVE; + +@@ -1583,7 +1577,7 @@ static int kvaser_usb_probe(struct usb_interface *intf, + { + struct kvaser_usb *dev; + int err = -ENOMEM; +- int i; ++ int i, retry = 3; + + dev = devm_kzalloc(&intf->dev, sizeof(*dev), GFP_KERNEL); + if (!dev) +@@ -1601,7 +1595,15 @@ static int kvaser_usb_probe(struct usb_interface *intf, + + usb_set_intfdata(intf, dev); + +- err = kvaser_usb_get_software_info(dev); ++ /* On some x86 laptops, plugging a Kvaser device again after ++ * an unplug makes the firmware always ignore the very first ++ * command. For such a case, provide some room for retries ++ * instead of completely exiting the driver. ++ */ ++ do { ++ err = kvaser_usb_get_software_info(dev); ++ } while (--retry && err == -ETIMEDOUT); ++ + if (err) { + dev_err(&intf->dev, + "Cannot get software infos, error %d\n", err); +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +index c3ba4bf20363..d643c18b0f15 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +@@ -3087,7 +3087,7 @@ int bnx2x_poll(struct napi_struct *napi, int budget) + } + #endif + if (!bnx2x_fp_lock_napi(fp)) +- return work_done; ++ return budget; + + for_each_cos_in_tx_queue(fp, cos) + if (bnx2x_tx_queue_has_work(fp->txdata_ptr[cos])) +diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c +index cbd75f97ffb3..03707c1edc2a 100644 +--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c ++++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c +@@ -2366,7 +2366,10 @@ static int netxen_nic_poll(struct napi_struct *napi, int budget) + + work_done = netxen_process_rcv_ring(sds_ring, budget); + +- if ((work_done < budget) && tx_complete) { ++ if (!tx_complete) ++ work_done = budget; ++ ++ if (work_done < budget) { + napi_complete(&sds_ring->napi); + if (test_bit(__NX_DEV_UP, &adapter->state)) + netxen_nic_enable_int(sds_ring); +diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c +index 07cd14d586dc..ba25ca049310 100644 +--- a/drivers/net/ethernet/ti/cpsw.c ++++ b/drivers/net/ethernet/ti/cpsw.c +@@ -1514,6 +1514,19 @@ static int cpsw_ndo_vlan_rx_add_vid(struct net_device *ndev, + if (vid == priv->data.default_vlan) + return 0; + ++ if (priv->data.dual_emac) { ++ /* In dual EMAC, reserved VLAN id should not be used for ++ * creating VLAN interfaces as this can break the dual ++ * EMAC port separation ++ */ ++ int i; ++ ++ for (i = 0; i < priv->data.slaves; i++) { ++ if (vid == priv->slaves[i].port_vlan) ++ return -EINVAL; ++ } ++ } ++ + dev_info(priv->dev, "Adding vlanid %d to vlan filter\n", vid); + return cpsw_add_vlan_ale_entry(priv, vid); + } +@@ -1527,6 +1540,15 @@ static int cpsw_ndo_vlan_rx_kill_vid(struct net_device *ndev, + if (vid == priv->data.default_vlan) + return 0; + ++ if (priv->data.dual_emac) { ++ int i; ++ ++ for (i = 0; i < priv->data.slaves; i++) { ++ if (vid == priv->slaves[i].port_vlan) ++ return -EINVAL; ++ } ++ } ++ + dev_info(priv->dev, "removing vlanid %d from vlan filter\n", vid); + ret = cpsw_ale_del_vlan(priv->ale, vid, 0); + if (ret != 0) +diff --git a/drivers/net/ppp/ppp_deflate.c b/drivers/net/ppp/ppp_deflate.c +index 602c625d95d5..b5edc7f96a39 100644 +--- a/drivers/net/ppp/ppp_deflate.c ++++ b/drivers/net/ppp/ppp_deflate.c +@@ -246,7 +246,7 @@ static int z_compress(void *arg, unsigned char *rptr, unsigned char *obuf, + /* + * See if we managed to reduce the size of the packet. + */ +- if (olen < isize) { ++ if (olen < isize && olen <= osize) { + state->stats.comp_bytes += olen; + state->stats.comp_packets++; + } else { +diff --git a/drivers/parport/parport_pc.c b/drivers/parport/parport_pc.c +index b0a0d5389f41..ae50d99883cf 100644 +--- a/drivers/parport/parport_pc.c ++++ b/drivers/parport/parport_pc.c +@@ -3312,13 +3312,14 @@ static void __exit parport_pc_exit(void) + while (!list_empty(&ports_list)) { + struct parport_pc_private *priv; + struct parport *port; ++ struct device *dev; + priv = list_entry(ports_list.next, + struct parport_pc_private, list); + port = priv->port; +- if (port->dev && port->dev->bus == &platform_bus_type) +- platform_device_unregister( +- to_platform_device(port->dev)); ++ dev = port->dev; + parport_pc_unregister_port(port); ++ if (dev && dev->bus == &platform_bus_type) ++ platform_device_unregister(to_platform_device(dev)); + } + } + +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index 563f59efa669..d9c958666784 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -70,10 +70,14 @@ static struct quirk_entry quirk_asus_x55u = { + .no_display_toggle = true, + }; + +-static struct quirk_entry quirk_asus_x401u = { ++static struct quirk_entry quirk_asus_wapf4 = { + .wapf = 4, + }; + ++static struct quirk_entry quirk_asus_x200ca = { ++ .wapf = 2, ++}; ++ + static int dmi_matched(const struct dmi_system_id *dmi) + { + quirks = dmi->driver_data; +@@ -83,6 +87,20 @@ static int dmi_matched(const struct dmi_system_id *dmi) + static struct dmi_system_id asus_quirks[] = { + { + .callback = dmi_matched, ++ .ident = "ASUSTeK COMPUTER INC. U32U", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "U32U"), ++ }, ++ /* ++ * Note this machine has a Brazos APU, and most Brazos Asus ++ * machines need quirk_asus_x55u / wmi_backlight_power but ++ * here acpi-video seems to work fine for backlight control. ++ */ ++ .driver_data = &quirk_asus_wapf4, ++ }, ++ { ++ .callback = dmi_matched, + .ident = "ASUSTeK COMPUTER INC. X401U", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), +@@ -97,7 +115,7 @@ static struct dmi_system_id asus_quirks[] = { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_PRODUCT_NAME, "X401A"), + }, +- .driver_data = &quirk_asus_x401u, ++ .driver_data = &quirk_asus_wapf4, + }, + { + .callback = dmi_matched, +@@ -106,7 +124,7 @@ static struct dmi_system_id asus_quirks[] = { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_PRODUCT_NAME, "X401A1"), + }, +- .driver_data = &quirk_asus_x401u, ++ .driver_data = &quirk_asus_wapf4, + }, + { + .callback = dmi_matched, +@@ -124,7 +142,7 @@ static struct dmi_system_id asus_quirks[] = { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_PRODUCT_NAME, "X501A"), + }, +- .driver_data = &quirk_asus_x401u, ++ .driver_data = &quirk_asus_wapf4, + }, + { + .callback = dmi_matched, +@@ -133,7 +151,52 @@ static struct dmi_system_id asus_quirks[] = { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_PRODUCT_NAME, "X501A1"), + }, +- .driver_data = &quirk_asus_x401u, ++ .driver_data = &quirk_asus_wapf4, ++ }, ++ { ++ .callback = dmi_matched, ++ .ident = "ASUSTeK COMPUTER INC. X550CA", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "X550CA"), ++ }, ++ .driver_data = &quirk_asus_wapf4, ++ }, ++ { ++ .callback = dmi_matched, ++ .ident = "ASUSTeK COMPUTER INC. X550CC", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "X550CC"), ++ }, ++ .driver_data = &quirk_asus_wapf4, ++ }, ++ { ++ .callback = dmi_matched, ++ .ident = "ASUSTeK COMPUTER INC. X550CL", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "X550CL"), ++ }, ++ .driver_data = &quirk_asus_wapf4, ++ }, ++ { ++ .callback = dmi_matched, ++ .ident = "ASUSTeK COMPUTER INC. X550VB", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "X550VB"), ++ }, ++ .driver_data = &quirk_asus_wapf4, ++ }, ++ { ++ .callback = dmi_matched, ++ .ident = "ASUSTeK COMPUTER INC. X551CA", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "X551CA"), ++ }, ++ .driver_data = &quirk_asus_wapf4, + }, + { + .callback = dmi_matched, +@@ -142,7 +205,7 @@ static struct dmi_system_id asus_quirks[] = { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_PRODUCT_NAME, "X55A"), + }, +- .driver_data = &quirk_asus_x401u, ++ .driver_data = &quirk_asus_wapf4, + }, + { + .callback = dmi_matched, +@@ -151,7 +214,7 @@ static struct dmi_system_id asus_quirks[] = { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_PRODUCT_NAME, "X55C"), + }, +- .driver_data = &quirk_asus_x401u, ++ .driver_data = &quirk_asus_wapf4, + }, + { + .callback = dmi_matched, +@@ -169,7 +232,7 @@ static struct dmi_system_id asus_quirks[] = { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_PRODUCT_NAME, "X55VD"), + }, +- .driver_data = &quirk_asus_x401u, ++ .driver_data = &quirk_asus_wapf4, + }, + { + .callback = dmi_matched, +@@ -178,7 +241,16 @@ static struct dmi_system_id asus_quirks[] = { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_PRODUCT_NAME, "X75A"), + }, +- .driver_data = &quirk_asus_x401u, ++ .driver_data = &quirk_asus_wapf4, ++ }, ++ { ++ .callback = dmi_matched, ++ .ident = "ASUSTeK COMPUTER INC. X75VBP", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "X75VBP"), ++ }, ++ .driver_data = &quirk_asus_wapf4, + }, + { + .callback = dmi_matched, +@@ -187,7 +259,7 @@ static struct dmi_system_id asus_quirks[] = { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_PRODUCT_NAME, "1015E"), + }, +- .driver_data = &quirk_asus_x401u, ++ .driver_data = &quirk_asus_wapf4, + }, + { + .callback = dmi_matched, +@@ -196,7 +268,16 @@ static struct dmi_system_id asus_quirks[] = { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_PRODUCT_NAME, "1015U"), + }, +- .driver_data = &quirk_asus_x401u, ++ .driver_data = &quirk_asus_wapf4, ++ }, ++ { ++ .callback = dmi_matched, ++ .ident = "ASUSTeK COMPUTER INC. X200CA", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "X200CA"), ++ }, ++ .driver_data = &quirk_asus_x200ca, + }, + {}, + }; +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index ea83084cb7d9..a2ce8e86ced7 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -1474,7 +1474,7 @@ struct regulator *devm_regulator_get_optional(struct device *dev, + } + EXPORT_SYMBOL_GPL(devm_regulator_get_optional); + +-/* Locks held by regulator_put() */ ++/* regulator_list_mutex lock held by regulator_put() */ + static void _regulator_put(struct regulator *regulator) + { + struct regulator_dev *rdev; +@@ -1489,12 +1489,14 @@ static void _regulator_put(struct regulator *regulator) + /* remove any sysfs entries */ + if (regulator->dev) + sysfs_remove_link(&rdev->dev.kobj, regulator->supply_name); ++ mutex_lock(&rdev->mutex); + kfree(regulator->supply_name); + list_del(®ulator->list); + kfree(regulator); + + rdev->open_count--; + rdev->exclusive = 0; ++ mutex_unlock(&rdev->mutex); + + module_put(rdev->owner); + } +diff --git a/drivers/spi/spi-dw-mid.c b/drivers/spi/spi-dw-mid.c +index 0791c92e8c50..1389fefe8814 100644 +--- a/drivers/spi/spi-dw-mid.c ++++ b/drivers/spi/spi-dw-mid.c +@@ -222,7 +222,6 @@ int dw_spi_mid_init(struct dw_spi *dws) + iounmap(clk_reg); + + dws->num_cs = 16; +- dws->fifo_len = 40; /* FIFO has 40 words buffer */ + + #ifdef CONFIG_SPI_DW_MID_DMA + dws->dma_priv = kzalloc(sizeof(struct mid_dma), GFP_KERNEL); +diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c +index 5b0e57210066..d01ae4d353d4 100644 +--- a/drivers/spi/spi-pxa2xx.c ++++ b/drivers/spi/spi-pxa2xx.c +@@ -400,8 +400,8 @@ static void giveback(struct driver_data *drv_data) + cs_deassert(drv_data); + } + +- spi_finalize_current_message(drv_data->master); + drv_data->cur_chip = NULL; ++ spi_finalize_current_message(drv_data->master); + } + + static void reset_sccr1(struct driver_data *drv_data) +diff --git a/drivers/target/loopback/tcm_loop.c b/drivers/target/loopback/tcm_loop.c +index 0f6d69dabca1..c54dd828431f 100644 +--- a/drivers/target/loopback/tcm_loop.c ++++ b/drivers/target/loopback/tcm_loop.c +@@ -179,7 +179,7 @@ static void tcm_loop_submission_work(struct work_struct *work) + goto out_done; + } + +- tl_nexus = tl_hba->tl_nexus; ++ tl_nexus = tl_tpg->tl_nexus; + if (!tl_nexus) { + scmd_printk(KERN_ERR, sc, "TCM_Loop I_T Nexus" + " does not exist\n"); +@@ -258,20 +258,20 @@ static int tcm_loop_device_reset(struct scsi_cmnd *sc) + */ + tl_hba = *(struct tcm_loop_hba **)shost_priv(sc->device->host); + /* ++ * Locate the tl_tpg and se_tpg pointers from TargetID in sc->device->id ++ */ ++ tl_tpg = &tl_hba->tl_hba_tpgs[sc->device->id]; ++ se_tpg = &tl_tpg->tl_se_tpg; ++ /* + * Locate the tl_nexus and se_sess pointers + */ +- tl_nexus = tl_hba->tl_nexus; ++ tl_nexus = tl_tpg->tl_nexus; + if (!tl_nexus) { + pr_err("Unable to perform device reset without" + " active I_T Nexus\n"); + return FAILED; + } + se_sess = tl_nexus->se_sess; +- /* +- * Locate the tl_tpg and se_tpg pointers from TargetID in sc->device->id +- */ +- tl_tpg = &tl_hba->tl_hba_tpgs[sc->device->id]; +- se_tpg = &tl_tpg->tl_se_tpg; + + tl_cmd = kmem_cache_zalloc(tcm_loop_cmd_cache, GFP_KERNEL); + if (!tl_cmd) { +@@ -878,8 +878,8 @@ static int tcm_loop_make_nexus( + struct tcm_loop_nexus *tl_nexus; + int ret = -ENOMEM; + +- if (tl_tpg->tl_hba->tl_nexus) { +- pr_debug("tl_tpg->tl_hba->tl_nexus already exists\n"); ++ if (tl_tpg->tl_nexus) { ++ pr_debug("tl_tpg->tl_nexus already exists\n"); + return -EEXIST; + } + se_tpg = &tl_tpg->tl_se_tpg; +@@ -914,7 +914,7 @@ static int tcm_loop_make_nexus( + */ + __transport_register_session(se_tpg, tl_nexus->se_sess->se_node_acl, + tl_nexus->se_sess, tl_nexus); +- tl_tpg->tl_hba->tl_nexus = tl_nexus; ++ tl_tpg->tl_nexus = tl_nexus; + pr_debug("TCM_Loop_ConfigFS: Established I_T Nexus to emulated" + " %s Initiator Port: %s\n", tcm_loop_dump_proto_id(tl_hba), + name); +@@ -930,9 +930,8 @@ static int tcm_loop_drop_nexus( + { + struct se_session *se_sess; + struct tcm_loop_nexus *tl_nexus; +- struct tcm_loop_hba *tl_hba = tpg->tl_hba; + +- tl_nexus = tpg->tl_hba->tl_nexus; ++ tl_nexus = tpg->tl_nexus; + if (!tl_nexus) + return -ENODEV; + +@@ -948,13 +947,13 @@ static int tcm_loop_drop_nexus( + } + + pr_debug("TCM_Loop_ConfigFS: Removing I_T Nexus to emulated" +- " %s Initiator Port: %s\n", tcm_loop_dump_proto_id(tl_hba), ++ " %s Initiator Port: %s\n", tcm_loop_dump_proto_id(tpg->tl_hba), + tl_nexus->se_sess->se_node_acl->initiatorname); + /* + * Release the SCSI I_T Nexus to the emulated SAS Target Port + */ + transport_deregister_session(tl_nexus->se_sess); +- tpg->tl_hba->tl_nexus = NULL; ++ tpg->tl_nexus = NULL; + kfree(tl_nexus); + return 0; + } +@@ -970,7 +969,7 @@ static ssize_t tcm_loop_tpg_show_nexus( + struct tcm_loop_nexus *tl_nexus; + ssize_t ret; + +- tl_nexus = tl_tpg->tl_hba->tl_nexus; ++ tl_nexus = tl_tpg->tl_nexus; + if (!tl_nexus) + return -ENODEV; + +diff --git a/drivers/target/loopback/tcm_loop.h b/drivers/target/loopback/tcm_loop.h +index dd7a84ee78e1..4ed85886a1ee 100644 +--- a/drivers/target/loopback/tcm_loop.h ++++ b/drivers/target/loopback/tcm_loop.h +@@ -25,11 +25,6 @@ struct tcm_loop_tmr { + }; + + struct tcm_loop_nexus { +- int it_nexus_active; +- /* +- * Pointer to Linux/SCSI HBA from linux/include/scsi_host.h +- */ +- struct scsi_host *sh; + /* + * Pointer to TCM session for I_T Nexus + */ +@@ -45,6 +40,7 @@ struct tcm_loop_tpg { + atomic_t tl_tpg_port_count; + struct se_portal_group tl_se_tpg; + struct tcm_loop_hba *tl_hba; ++ struct tcm_loop_nexus *tl_nexus; + }; + + struct tcm_loop_hba { +@@ -53,7 +49,6 @@ struct tcm_loop_hba { + struct se_hba_s *se_hba; + struct se_lun *tl_hba_lun; + struct se_port *tl_hba_lun_sep; +- struct tcm_loop_nexus *tl_nexus; + struct device dev; + struct Scsi_Host *sh; + struct tcm_loop_tpg tl_hba_tpgs[TL_TPGS_PER_HBA]; +diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c +index a3ce91234b77..c67a56e7ee1c 100644 +--- a/drivers/target/target_core_device.c ++++ b/drivers/target/target_core_device.c +@@ -1066,10 +1066,10 @@ int se_dev_set_optimal_sectors(struct se_device *dev, u32 optimal_sectors) + " changed for TCM/pSCSI\n", dev); + return -EINVAL; + } +- if (optimal_sectors > dev->dev_attrib.fabric_max_sectors) { ++ if (optimal_sectors > dev->dev_attrib.hw_max_sectors) { + pr_err("dev[%p]: Passed optimal_sectors %u cannot be" +- " greater than fabric_max_sectors: %u\n", dev, +- optimal_sectors, dev->dev_attrib.fabric_max_sectors); ++ " greater than hw_max_sectors: %u\n", dev, ++ optimal_sectors, dev->dev_attrib.hw_max_sectors); + return -EINVAL; + } + +@@ -1474,7 +1474,6 @@ struct se_device *target_alloc_device(struct se_hba *hba, const char *name) + DA_UNMAP_GRANULARITY_ALIGNMENT_DEFAULT; + dev->dev_attrib.max_write_same_len = DA_MAX_WRITE_SAME_LEN; + dev->dev_attrib.fabric_max_sectors = DA_FABRIC_MAX_SECTORS; +- dev->dev_attrib.optimal_sectors = DA_FABRIC_MAX_SECTORS; + + return dev; + } +@@ -1507,6 +1506,7 @@ int target_configure_device(struct se_device *dev) + dev->dev_attrib.hw_max_sectors = + se_dev_align_max_sectors(dev->dev_attrib.hw_max_sectors, + dev->dev_attrib.hw_block_size); ++ dev->dev_attrib.optimal_sectors = dev->dev_attrib.hw_max_sectors; + + dev->dev_index = scsi_get_new_index(SCSI_DEVICE_INDEX); + dev->creation_time = get_jiffies_64(); +diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c +index 55725f5f56a2..174815c88b7c 100644 +--- a/drivers/target/target_core_file.c ++++ b/drivers/target/target_core_file.c +@@ -552,7 +552,16 @@ fd_execute_rw(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents, + { + struct se_device *dev = cmd->se_dev; + int ret = 0; +- ++ /* ++ * We are currently limited by the number of iovecs (2048) per ++ * single vfs_[writev,readv] call. ++ */ ++ if (cmd->data_length > FD_MAX_BYTES) { ++ pr_err("FILEIO: Not able to process I/O of %u bytes due to" ++ "FD_MAX_BYTES: %u iovec count limitiation\n", ++ cmd->data_length, FD_MAX_BYTES); ++ return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE; ++ } + /* + * Call vectorized fileio functions to map struct scatterlist + * physical memory addresses to struct iovec virtual memory. +diff --git a/drivers/target/target_core_iblock.c b/drivers/target/target_core_iblock.c +index b9a3394fe479..9c403f6d3317 100644 +--- a/drivers/target/target_core_iblock.c ++++ b/drivers/target/target_core_iblock.c +@@ -122,7 +122,7 @@ static int iblock_configure_device(struct se_device *dev) + q = bdev_get_queue(bd); + + dev->dev_attrib.hw_block_size = bdev_logical_block_size(bd); +- dev->dev_attrib.hw_max_sectors = UINT_MAX; ++ dev->dev_attrib.hw_max_sectors = queue_max_hw_sectors(q); + dev->dev_attrib.hw_queue_depth = q->nr_requests; + + /* +diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c +index 214522282c19..d83aea80d83c 100644 +--- a/drivers/target/target_core_sbc.c ++++ b/drivers/target/target_core_sbc.c +@@ -829,21 +829,6 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops) + if (cmd->se_cmd_flags & SCF_SCSI_DATA_CDB) { + unsigned long long end_lba; + +- if (sectors > dev->dev_attrib.fabric_max_sectors) { +- printk_ratelimited(KERN_ERR "SCSI OP %02xh with too" +- " big sectors %u exceeds fabric_max_sectors:" +- " %u\n", cdb[0], sectors, +- dev->dev_attrib.fabric_max_sectors); +- return TCM_INVALID_CDB_FIELD; +- } +- if (sectors > dev->dev_attrib.hw_max_sectors) { +- printk_ratelimited(KERN_ERR "SCSI OP %02xh with too" +- " big sectors %u exceeds backend hw_max_sectors:" +- " %u\n", cdb[0], sectors, +- dev->dev_attrib.hw_max_sectors); +- return TCM_INVALID_CDB_FIELD; +- } +- + end_lba = dev->transport->get_blocks(dev) + 1; + if (cmd->t_task_lba + sectors > end_lba) { + pr_err("cmd exceeds last lba %llu " +diff --git a/drivers/target/target_core_spc.c b/drivers/target/target_core_spc.c +index ee400df1fea2..a8113d44d1e3 100644 +--- a/drivers/target/target_core_spc.c ++++ b/drivers/target/target_core_spc.c +@@ -450,7 +450,6 @@ static sense_reason_t + spc_emulate_evpd_b0(struct se_cmd *cmd, unsigned char *buf) + { + struct se_device *dev = cmd->se_dev; +- u32 max_sectors; + int have_tp = 0; + + /* +@@ -480,9 +479,7 @@ spc_emulate_evpd_b0(struct se_cmd *cmd, unsigned char *buf) + /* + * Set MAXIMUM TRANSFER LENGTH + */ +- max_sectors = min(dev->dev_attrib.fabric_max_sectors, +- dev->dev_attrib.hw_max_sectors); +- put_unaligned_be32(max_sectors, &buf[8]); ++ put_unaligned_be32(dev->dev_attrib.hw_max_sectors, &buf[8]); + + /* + * Set OPTIMAL TRANSFER LENGTH +diff --git a/fs/cifs/file.c b/fs/cifs/file.c +index f9715276a257..ead2473f6839 100644 +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -366,6 +366,7 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file) + struct cifsLockInfo *li, *tmp; + struct cifs_fid fid; + struct cifs_pending_open open; ++ bool oplock_break_cancelled; + + spin_lock(&cifs_file_list_lock); + if (--cifs_file->count > 0) { +@@ -397,7 +398,7 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file) + } + spin_unlock(&cifs_file_list_lock); + +- cancel_work_sync(&cifs_file->oplock_break); ++ oplock_break_cancelled = cancel_work_sync(&cifs_file->oplock_break); + + if (!tcon->need_reconnect && !cifs_file->invalidHandle) { + struct TCP_Server_Info *server = tcon->ses->server; +@@ -409,6 +410,9 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file) + _free_xid(xid); + } + ++ if (oplock_break_cancelled) ++ cifs_done_oplock_break(cifsi); ++ + cifs_del_pending_open(&open); + + /* +diff --git a/fs/ext4/file.c b/fs/ext4/file.c +index 7b316011bfef..716e9dbb56d5 100644 +--- a/fs/ext4/file.c ++++ b/fs/ext4/file.c +@@ -100,7 +100,7 @@ ext4_file_dio_write(struct kiocb *iocb, const struct iovec *iov, + struct blk_plug plug; + int unaligned_aio = 0; + ssize_t ret; +- int overwrite = 0; ++ int *overwrite = iocb->private; + size_t length = iov_length(iov, nr_segs); + + if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS) && +@@ -118,8 +118,6 @@ ext4_file_dio_write(struct kiocb *iocb, const struct iovec *iov, + mutex_lock(&inode->i_mutex); + blk_start_plug(&plug); + +- iocb->private = &overwrite; +- + /* check whether we do a DIO overwrite or not */ + if (ext4_should_dioread_nolock(inode) && !unaligned_aio && + !file->f_mapping->nrpages && pos + length <= i_size_read(inode)) { +@@ -143,7 +141,7 @@ ext4_file_dio_write(struct kiocb *iocb, const struct iovec *iov, + * So we should check these two conditions. + */ + if (err == len && (map.m_flags & EXT4_MAP_MAPPED)) +- overwrite = 1; ++ *overwrite = 1; + } + + ret = __generic_file_aio_write(iocb, iov, nr_segs, &iocb->ki_pos); +@@ -170,6 +168,7 @@ ext4_file_write(struct kiocb *iocb, const struct iovec *iov, + { + struct inode *inode = file_inode(iocb->ki_filp); + ssize_t ret; ++ int overwrite = 0; + + /* + * If we have encountered a bitmap-format file, the size limit +@@ -190,6 +189,7 @@ ext4_file_write(struct kiocb *iocb, const struct iovec *iov, + } + } + ++ iocb->private = &overwrite; + if (unlikely(iocb->ki_filp->f_flags & O_DIRECT)) + ret = ext4_file_dio_write(iocb, iov, nr_segs, pos); + else +diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c +index d751a2383c24..db6245c1cd33 100644 +--- a/fs/nfs/direct.c ++++ b/fs/nfs/direct.c +@@ -123,6 +123,12 @@ static inline int put_dreq(struct nfs_direct_req *dreq) + */ + ssize_t nfs_direct_IO(int rw, struct kiocb *iocb, const struct iovec *iov, loff_t pos, unsigned long nr_segs) + { ++ struct inode *inode = iocb->ki_filp->f_mapping->host; ++ ++ /* we only support swap file calling nfs_direct_IO */ ++ if (!IS_SWAPFILE(inode)) ++ return 0; ++ + #ifndef CONFIG_NFS_SWAP + dprintk("NFS: nfs_direct_IO (%s) off/no(%Ld/%lu) EINVAL\n", + iocb->ki_filp->f_path.dentry->d_name.name, +diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c +index ce036f071302..28e1f211600d 100644 +--- a/fs/nfs/nfs4client.c ++++ b/fs/nfs/nfs4client.c +@@ -629,7 +629,7 @@ int nfs41_walk_client_list(struct nfs_client *new, + prev = pos; + + status = nfs_wait_client_init_complete(pos); +- if (status == 0) { ++ if (pos->cl_cons_state == NFS_CS_SESSION_INITING) { + nfs4_schedule_lease_recovery(pos); + status = nfs4_wait_clnt_recover(pos); + } +diff --git a/fs/nilfs2/nilfs.h b/fs/nilfs2/nilfs.h +index 9bc72dec3fa6..b02c202223a6 100644 +--- a/fs/nilfs2/nilfs.h ++++ b/fs/nilfs2/nilfs.h +@@ -141,7 +141,6 @@ enum { + * @ti_save: Backup of journal_info field of task_struct + * @ti_flags: Flags + * @ti_count: Nest level +- * @ti_garbage: List of inode to be put when releasing semaphore + */ + struct nilfs_transaction_info { + u32 ti_magic; +@@ -150,7 +149,6 @@ struct nilfs_transaction_info { + one of other filesystems has a bug. */ + unsigned short ti_flags; + unsigned short ti_count; +- struct list_head ti_garbage; + }; + + /* ti_magic */ +diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c +index 0b7d2cad0426..a0c815b71e6a 100644 +--- a/fs/nilfs2/segment.c ++++ b/fs/nilfs2/segment.c +@@ -305,7 +305,6 @@ static void nilfs_transaction_lock(struct super_block *sb, + ti->ti_count = 0; + ti->ti_save = cur_ti; + ti->ti_magic = NILFS_TI_MAGIC; +- INIT_LIST_HEAD(&ti->ti_garbage); + current->journal_info = ti; + + for (;;) { +@@ -332,8 +331,6 @@ static void nilfs_transaction_unlock(struct super_block *sb) + + up_write(&nilfs->ns_segctor_sem); + current->journal_info = ti->ti_save; +- if (!list_empty(&ti->ti_garbage)) +- nilfs_dispose_list(nilfs, &ti->ti_garbage, 0); + } + + static void *nilfs_segctor_map_segsum_entry(struct nilfs_sc_info *sci, +@@ -746,6 +743,15 @@ static void nilfs_dispose_list(struct the_nilfs *nilfs, + } + } + ++static void nilfs_iput_work_func(struct work_struct *work) ++{ ++ struct nilfs_sc_info *sci = container_of(work, struct nilfs_sc_info, ++ sc_iput_work); ++ struct the_nilfs *nilfs = sci->sc_super->s_fs_info; ++ ++ nilfs_dispose_list(nilfs, &sci->sc_iput_queue, 0); ++} ++ + static int nilfs_test_metadata_dirty(struct the_nilfs *nilfs, + struct nilfs_root *root) + { +@@ -1900,8 +1906,8 @@ static int nilfs_segctor_collect_dirty_files(struct nilfs_sc_info *sci, + static void nilfs_segctor_drop_written_files(struct nilfs_sc_info *sci, + struct the_nilfs *nilfs) + { +- struct nilfs_transaction_info *ti = current->journal_info; + struct nilfs_inode_info *ii, *n; ++ int defer_iput = false; + + spin_lock(&nilfs->ns_inode_lock); + list_for_each_entry_safe(ii, n, &sci->sc_dirty_files, i_dirty) { +@@ -1912,9 +1918,24 @@ static void nilfs_segctor_drop_written_files(struct nilfs_sc_info *sci, + clear_bit(NILFS_I_BUSY, &ii->i_state); + brelse(ii->i_bh); + ii->i_bh = NULL; +- list_move_tail(&ii->i_dirty, &ti->ti_garbage); ++ list_del_init(&ii->i_dirty); ++ if (!ii->vfs_inode.i_nlink) { ++ /* ++ * Defer calling iput() to avoid a deadlock ++ * over I_SYNC flag for inodes with i_nlink == 0 ++ */ ++ list_add_tail(&ii->i_dirty, &sci->sc_iput_queue); ++ defer_iput = true; ++ } else { ++ spin_unlock(&nilfs->ns_inode_lock); ++ iput(&ii->vfs_inode); ++ spin_lock(&nilfs->ns_inode_lock); ++ } + } + spin_unlock(&nilfs->ns_inode_lock); ++ ++ if (defer_iput) ++ schedule_work(&sci->sc_iput_work); + } + + /* +@@ -2583,6 +2604,8 @@ static struct nilfs_sc_info *nilfs_segctor_new(struct super_block *sb, + INIT_LIST_HEAD(&sci->sc_segbufs); + INIT_LIST_HEAD(&sci->sc_write_logs); + INIT_LIST_HEAD(&sci->sc_gc_inodes); ++ INIT_LIST_HEAD(&sci->sc_iput_queue); ++ INIT_WORK(&sci->sc_iput_work, nilfs_iput_work_func); + init_timer(&sci->sc_timer); + + sci->sc_interval = HZ * NILFS_SC_DEFAULT_TIMEOUT; +@@ -2609,6 +2632,8 @@ static void nilfs_segctor_write_out(struct nilfs_sc_info *sci) + ret = nilfs_segctor_construct(sci, SC_LSEG_SR); + nilfs_transaction_unlock(sci->sc_super); + ++ flush_work(&sci->sc_iput_work); ++ + } while (ret && retrycount-- > 0); + } + +@@ -2633,6 +2658,9 @@ static void nilfs_segctor_destroy(struct nilfs_sc_info *sci) + || sci->sc_seq_request != sci->sc_seq_done); + spin_unlock(&sci->sc_state_lock); + ++ if (flush_work(&sci->sc_iput_work)) ++ flag = true; ++ + if (flag || !nilfs_segctor_confirm(sci)) + nilfs_segctor_write_out(sci); + +@@ -2642,6 +2670,12 @@ static void nilfs_segctor_destroy(struct nilfs_sc_info *sci) + nilfs_dispose_list(nilfs, &sci->sc_dirty_files, 1); + } + ++ if (!list_empty(&sci->sc_iput_queue)) { ++ nilfs_warning(sci->sc_super, __func__, ++ "iput queue is not empty\n"); ++ nilfs_dispose_list(nilfs, &sci->sc_iput_queue, 1); ++ } ++ + WARN_ON(!list_empty(&sci->sc_segbufs)); + WARN_ON(!list_empty(&sci->sc_write_logs)); + +diff --git a/fs/nilfs2/segment.h b/fs/nilfs2/segment.h +index 38a1d0013314..a48d6de1e02c 100644 +--- a/fs/nilfs2/segment.h ++++ b/fs/nilfs2/segment.h +@@ -26,6 +26,7 @@ + #include <linux/types.h> + #include <linux/fs.h> + #include <linux/buffer_head.h> ++#include <linux/workqueue.h> + #include <linux/nilfs2_fs.h> + #include "nilfs.h" + +@@ -92,6 +93,8 @@ struct nilfs_segsum_pointer { + * @sc_nblk_inc: Block count of current generation + * @sc_dirty_files: List of files to be written + * @sc_gc_inodes: List of GC inodes having blocks to be written ++ * @sc_iput_queue: list of inodes for which iput should be done ++ * @sc_iput_work: work struct to defer iput call + * @sc_freesegs: array of segment numbers to be freed + * @sc_nfreesegs: number of segments on @sc_freesegs + * @sc_dsync_inode: inode whose data pages are written for a sync operation +@@ -135,6 +138,8 @@ struct nilfs_sc_info { + + struct list_head sc_dirty_files; + struct list_head sc_gc_inodes; ++ struct list_head sc_iput_queue; ++ struct work_struct sc_iput_work; + + __u64 *sc_freesegs; + size_t sc_nfreesegs; +diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c +index f07941160515..cc6e925749de 100644 +--- a/fs/ocfs2/file.c ++++ b/fs/ocfs2/file.c +@@ -2376,9 +2376,7 @@ out_dio: + if (ret < 0) + written = ret; + +- if (!ret && ((old_size != i_size_read(inode)) || +- (old_clusters != OCFS2_I(inode)->ip_clusters) || +- has_refcount)) { ++ if (!ret) { + ret = jbd2_journal_force_commit(osb->journal->j_journal); + if (ret < 0) + written = ret; +diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c +index e7d95f959333..fe68d8ac4d3d 100644 +--- a/fs/pstore/ram.c ++++ b/fs/pstore/ram.c +@@ -92,6 +92,7 @@ struct ramoops_context { + struct persistent_ram_ecc_info ecc_info; + unsigned int max_dump_cnt; + unsigned int dump_write_cnt; ++ /* _read_cnt need clear on ramoops_pstore_open */ + unsigned int dump_read_cnt; + unsigned int console_read_cnt; + unsigned int ftrace_read_cnt; +@@ -107,6 +108,7 @@ static int ramoops_pstore_open(struct pstore_info *psi) + + cxt->dump_read_cnt = 0; + cxt->console_read_cnt = 0; ++ cxt->ftrace_read_cnt = 0; + return 0; + } + +@@ -123,13 +125,15 @@ ramoops_get_next_prz(struct persistent_ram_zone *przs[], uint *c, uint max, + return NULL; + + prz = przs[i]; ++ if (!prz) ++ return NULL; + +- if (update) { +- /* Update old/shadowed buffer. */ ++ /* Update old/shadowed buffer. */ ++ if (update) + persistent_ram_save_old(prz); +- if (!persistent_ram_old_size(prz)) +- return NULL; +- } ++ ++ if (!persistent_ram_old_size(prz)) ++ return NULL; + + *typep = type; + *id = i; +@@ -435,7 +439,6 @@ static int ramoops_probe(struct platform_device *pdev) + if (pdata->ftrace_size && !is_power_of_2(pdata->ftrace_size)) + pdata->ftrace_size = rounddown_pow_of_two(pdata->ftrace_size); + +- cxt->dump_read_cnt = 0; + cxt->size = pdata->mem_size; + cxt->phys_addr = pdata->mem_address; + cxt->memtype = pdata->mem_type; +diff --git a/fs/udf/dir.c b/fs/udf/dir.c +index a012c51caffd..a7690b46ce0a 100644 +--- a/fs/udf/dir.c ++++ b/fs/udf/dir.c +@@ -167,7 +167,8 @@ static int udf_readdir(struct file *file, struct dir_context *ctx) + continue; + } + +- flen = udf_get_filename(dir->i_sb, nameptr, fname, lfi); ++ flen = udf_get_filename(dir->i_sb, nameptr, lfi, fname, ++ UDF_NAME_LEN); + if (!flen) + continue; + +diff --git a/fs/udf/inode.c b/fs/udf/inode.c +index 47cacfd2c9af..6ba11cdfbc0b 100644 +--- a/fs/udf/inode.c ++++ b/fs/udf/inode.c +@@ -1495,6 +1495,24 @@ static void udf_fill_inode(struct inode *inode, struct buffer_head *bh) + iinfo->i_checkpoint = le32_to_cpu(efe->checkpoint); + } + ++ /* Sanity checks for files in ICB so that we don't get confused later */ ++ if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) { ++ /* ++ * For file in ICB data is stored in allocation descriptor ++ * so sizes should match ++ */ ++ if (iinfo->i_lenAlloc != inode->i_size) { ++ make_bad_inode(inode); ++ return; ++ } ++ /* File in ICB has to fit in there... */ ++ if (inode->i_size > inode->i_sb->s_blocksize - ++ udf_file_entry_alloc_offset(inode)) { ++ make_bad_inode(inode); ++ return; ++ } ++ } ++ + switch (fe->icbTag.fileType) { + case ICBTAG_FILE_TYPE_DIRECTORY: + inode->i_op = &udf_dir_inode_operations; +diff --git a/fs/udf/namei.c b/fs/udf/namei.c +index 5f6fc17d6bc5..6de89a4347e1 100644 +--- a/fs/udf/namei.c ++++ b/fs/udf/namei.c +@@ -233,7 +233,8 @@ static struct fileIdentDesc *udf_find_entry(struct inode *dir, + if (!lfi) + continue; + +- flen = udf_get_filename(dir->i_sb, nameptr, fname, lfi); ++ flen = udf_get_filename(dir->i_sb, nameptr, lfi, fname, ++ UDF_NAME_LEN); + if (flen && udf_match(flen, fname, child->len, child->name)) + goto out_ok; + } +diff --git a/fs/udf/symlink.c b/fs/udf/symlink.c +index d89f324bc387..0422b7b8369f 100644 +--- a/fs/udf/symlink.c ++++ b/fs/udf/symlink.c +@@ -30,49 +30,73 @@ + #include <linux/buffer_head.h> + #include "udf_i.h" + +-static void udf_pc_to_char(struct super_block *sb, unsigned char *from, +- int fromlen, unsigned char *to) ++static int udf_pc_to_char(struct super_block *sb, unsigned char *from, ++ int fromlen, unsigned char *to, int tolen) + { + struct pathComponent *pc; + int elen = 0; ++ int comp_len; + unsigned char *p = to; + ++ /* Reserve one byte for terminating \0 */ ++ tolen--; + while (elen < fromlen) { + pc = (struct pathComponent *)(from + elen); ++ elen += sizeof(struct pathComponent); + switch (pc->componentType) { + case 1: + /* + * Symlink points to some place which should be agreed + * upon between originator and receiver of the media. Ignore. + */ +- if (pc->lengthComponentIdent > 0) ++ if (pc->lengthComponentIdent > 0) { ++ elen += pc->lengthComponentIdent; + break; ++ } + /* Fall through */ + case 2: ++ if (tolen == 0) ++ return -ENAMETOOLONG; + p = to; + *p++ = '/'; ++ tolen--; + break; + case 3: ++ if (tolen < 3) ++ return -ENAMETOOLONG; + memcpy(p, "../", 3); + p += 3; ++ tolen -= 3; + break; + case 4: ++ if (tolen < 2) ++ return -ENAMETOOLONG; + memcpy(p, "./", 2); + p += 2; ++ tolen -= 2; + /* that would be . - just ignore */ + break; + case 5: +- p += udf_get_filename(sb, pc->componentIdent, p, +- pc->lengthComponentIdent); ++ elen += pc->lengthComponentIdent; ++ if (elen > fromlen) ++ return -EIO; ++ comp_len = udf_get_filename(sb, pc->componentIdent, ++ pc->lengthComponentIdent, ++ p, tolen); ++ p += comp_len; ++ tolen -= comp_len; ++ if (tolen == 0) ++ return -ENAMETOOLONG; + *p++ = '/'; ++ tolen--; + break; + } +- elen += sizeof(struct pathComponent) + pc->lengthComponentIdent; + } + if (p > to + 1) + p[-1] = '\0'; + else + p[0] = '\0'; ++ return 0; + } + + static int udf_symlink_filler(struct file *file, struct page *page) +@@ -108,8 +132,10 @@ static int udf_symlink_filler(struct file *file, struct page *page) + symlink = bh->b_data; + } + +- udf_pc_to_char(inode->i_sb, symlink, inode->i_size, p); ++ err = udf_pc_to_char(inode->i_sb, symlink, inode->i_size, p, PAGE_SIZE); + brelse(bh); ++ if (err) ++ goto out_unlock_inode; + + up_read(&iinfo->i_data_sem); + SetPageUptodate(page); +diff --git a/fs/udf/udfdecl.h b/fs/udf/udfdecl.h +index be7dabbbcb49..55d1d194d472 100644 +--- a/fs/udf/udfdecl.h ++++ b/fs/udf/udfdecl.h +@@ -201,7 +201,8 @@ udf_get_lb_pblock(struct super_block *sb, struct kernel_lb_addr *loc, + } + + /* unicode.c */ +-extern int udf_get_filename(struct super_block *, uint8_t *, uint8_t *, int); ++extern int udf_get_filename(struct super_block *, uint8_t *, int, uint8_t *, ++ int); + extern int udf_put_filename(struct super_block *, const uint8_t *, uint8_t *, + int); + extern int udf_build_ustr(struct ustr *, dstring *, int); +diff --git a/fs/udf/unicode.c b/fs/udf/unicode.c +index 44b815e57f94..d29c06fbf4ce 100644 +--- a/fs/udf/unicode.c ++++ b/fs/udf/unicode.c +@@ -28,7 +28,8 @@ + + #include "udf_sb.h" + +-static int udf_translate_to_linux(uint8_t *, uint8_t *, int, uint8_t *, int); ++static int udf_translate_to_linux(uint8_t *, int, uint8_t *, int, uint8_t *, ++ int); + + static int udf_char_to_ustr(struct ustr *dest, const uint8_t *src, int strlen) + { +@@ -333,8 +334,8 @@ try_again: + return u_len + 1; + } + +-int udf_get_filename(struct super_block *sb, uint8_t *sname, uint8_t *dname, +- int flen) ++int udf_get_filename(struct super_block *sb, uint8_t *sname, int slen, ++ uint8_t *dname, int dlen) + { + struct ustr *filename, *unifilename; + int len = 0; +@@ -347,7 +348,7 @@ int udf_get_filename(struct super_block *sb, uint8_t *sname, uint8_t *dname, + if (!unifilename) + goto out1; + +- if (udf_build_ustr_exact(unifilename, sname, flen)) ++ if (udf_build_ustr_exact(unifilename, sname, slen)) + goto out2; + + if (UDF_QUERY_FLAG(sb, UDF_FLAG_UTF8)) { +@@ -366,7 +367,8 @@ int udf_get_filename(struct super_block *sb, uint8_t *sname, uint8_t *dname, + } else + goto out2; + +- len = udf_translate_to_linux(dname, filename->u_name, filename->u_len, ++ len = udf_translate_to_linux(dname, dlen, ++ filename->u_name, filename->u_len, + unifilename->u_name, unifilename->u_len); + out2: + kfree(unifilename); +@@ -403,10 +405,12 @@ int udf_put_filename(struct super_block *sb, const uint8_t *sname, + #define EXT_MARK '.' + #define CRC_MARK '#' + #define EXT_SIZE 5 ++/* Number of chars we need to store generated CRC to make filename unique */ ++#define CRC_LEN 5 + +-static int udf_translate_to_linux(uint8_t *newName, uint8_t *udfName, +- int udfLen, uint8_t *fidName, +- int fidNameLen) ++static int udf_translate_to_linux(uint8_t *newName, int newLen, ++ uint8_t *udfName, int udfLen, ++ uint8_t *fidName, int fidNameLen) + { + int index, newIndex = 0, needsCRC = 0; + int extIndex = 0, newExtIndex = 0, hasExt = 0; +@@ -440,7 +444,7 @@ static int udf_translate_to_linux(uint8_t *newName, uint8_t *udfName, + newExtIndex = newIndex; + } + } +- if (newIndex < 256) ++ if (newIndex < newLen) + newName[newIndex++] = curr; + else + needsCRC = 1; +@@ -468,13 +472,13 @@ static int udf_translate_to_linux(uint8_t *newName, uint8_t *udfName, + } + ext[localExtIndex++] = curr; + } +- maxFilenameLen = 250 - localExtIndex; ++ maxFilenameLen = newLen - CRC_LEN - localExtIndex; + if (newIndex > maxFilenameLen) + newIndex = maxFilenameLen; + else + newIndex = newExtIndex; +- } else if (newIndex > 250) +- newIndex = 250; ++ } else if (newIndex > newLen - CRC_LEN) ++ newIndex = newLen - CRC_LEN; + newName[newIndex++] = CRC_MARK; + valueCRC = crc_itu_t(0, fidName, fidNameLen); + newName[newIndex++] = hexChar[(valueCRC & 0xf000) >> 12]; +diff --git a/include/linux/compat.h b/include/linux/compat.h +index 0f62cb7a4ff0..afea0d19b37a 100644 +--- a/include/linux/compat.h ++++ b/include/linux/compat.h +@@ -318,7 +318,7 @@ asmlinkage long compat_sys_semctl(int semid, int semnum, int cmd, int arg); + asmlinkage long compat_sys_msgsnd(int msqid, compat_uptr_t msgp, + compat_ssize_t msgsz, int msgflg); + asmlinkage long compat_sys_msgrcv(int msqid, compat_uptr_t msgp, +- compat_ssize_t msgsz, long msgtyp, int msgflg); ++ compat_ssize_t msgsz, compat_long_t msgtyp, int msgflg); + long compat_sys_msgctl(int first, int second, void __user *uptr); + long compat_sys_shmctl(int first, int second, void __user *uptr); + long compat_sys_semtimedop(int semid, struct sembuf __user *tsems, +diff --git a/include/linux/mmc/sdhci.h b/include/linux/mmc/sdhci.h +index 3e781b8c0be7..7be12b883485 100644 +--- a/include/linux/mmc/sdhci.h ++++ b/include/linux/mmc/sdhci.h +@@ -98,6 +98,10 @@ struct sdhci_host { + #define SDHCI_QUIRK2_CARD_ON_NEEDS_BUS_ON (1<<4) + /* Controller has a non-standard host control register */ + #define SDHCI_QUIRK2_BROKEN_HOST_CONTROL (1<<5) ++/* Controller does not support HS200 */ ++#define SDHCI_QUIRK2_BROKEN_HS200 (1<<6) ++/* Controller does not support DDR50 */ ++#define SDHCI_QUIRK2_BROKEN_DDR50 (1<<7) + + int irq; /* Device IRQ */ + void __iomem *ioaddr; /* Mapped address */ +diff --git a/include/net/ip.h b/include/net/ip.h +index 53573e06cf87..1b1269e13596 100644 +--- a/include/net/ip.h ++++ b/include/net/ip.h +@@ -37,11 +37,12 @@ struct inet_skb_parm { + struct ip_options opt; /* Compiled IP options */ + unsigned char flags; + +-#define IPSKB_FORWARDED 1 +-#define IPSKB_XFRM_TUNNEL_SIZE 2 +-#define IPSKB_XFRM_TRANSFORMED 4 +-#define IPSKB_FRAG_COMPLETE 8 +-#define IPSKB_REROUTED 16 ++#define IPSKB_FORWARDED BIT(0) ++#define IPSKB_XFRM_TUNNEL_SIZE BIT(1) ++#define IPSKB_XFRM_TRANSFORMED BIT(2) ++#define IPSKB_FRAG_COMPLETE BIT(3) ++#define IPSKB_REROUTED BIT(4) ++#define IPSKB_DOREDIRECT BIT(5) + + u16 frag_max_size; + }; +@@ -162,7 +163,7 @@ static inline __u8 ip_reply_arg_flowi_flags(const struct ip_reply_arg *arg) + return (arg->flags & IP_REPLY_ARG_NOSRCCHECK) ? FLOWI_FLAG_ANYSRC : 0; + } + +-void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr, ++void ip_send_unicast_reply(struct sock *sk, struct sk_buff *skb, __be32 daddr, + __be32 saddr, const struct ip_reply_arg *arg, + unsigned int len); + +diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h +index bf2ec2202c56..51f347064b53 100644 +--- a/include/net/netns/ipv4.h ++++ b/include/net/netns/ipv4.h +@@ -43,6 +43,7 @@ struct netns_ipv4 { + struct inet_peer_base *peers; + struct tcpm_hash_bucket *tcp_metrics_hash; + unsigned int tcp_metrics_hash_log; ++ struct sock * __percpu *tcp_sk; + struct netns_frags frags; + #ifdef CONFIG_NETFILTER + struct xt_table *iptable_filter; +diff --git a/include/sound/ak4113.h b/include/sound/ak4113.h +index 2609048c1d44..3a34f6edc2d1 100644 +--- a/include/sound/ak4113.h ++++ b/include/sound/ak4113.h +@@ -286,7 +286,7 @@ struct ak4113 { + ak4113_write_t *write; + ak4113_read_t *read; + void *private_data; +- unsigned int init:1; ++ atomic_t wq_processing; + spinlock_t lock; + unsigned char regmap[AK4113_WRITABLE_REGS]; + struct snd_kcontrol *kctls[AK4113_CONTROLS]; +diff --git a/include/sound/ak4114.h b/include/sound/ak4114.h +index 3ce69fd92523..69441161009c 100644 +--- a/include/sound/ak4114.h ++++ b/include/sound/ak4114.h +@@ -168,7 +168,7 @@ struct ak4114 { + ak4114_write_t * write; + ak4114_read_t * read; + void * private_data; +- unsigned int init: 1; ++ atomic_t wq_processing; + spinlock_t lock; + unsigned char regmap[7]; + unsigned char txcsb[5]; +diff --git a/ipc/compat.c b/ipc/compat.c +index 892f6585dd60..e0012184f65e 100644 +--- a/ipc/compat.c ++++ b/ipc/compat.c +@@ -381,7 +381,7 @@ COMPAT_SYSCALL_DEFINE6(ipc, u32, call, int, first, int, second, + uptr = compat_ptr(ipck.msgp); + fifth = ipck.msgtyp; + } +- return do_msgrcv(first, uptr, second, fifth, third, ++ return do_msgrcv(first, uptr, second, (s32)fifth, third, + compat_do_msg_fill); + } + case MSGGET: +@@ -430,9 +430,9 @@ COMPAT_SYSCALL_DEFINE4(msgsnd, int, msqid, compat_uptr_t, msgp, + } + + COMPAT_SYSCALL_DEFINE5(msgrcv, int, msqid, compat_uptr_t, msgp, +- compat_ssize_t, msgsz, long, msgtyp, int, msgflg) ++ compat_ssize_t, msgsz, compat_long_t, msgtyp, int, msgflg) + { +- return do_msgrcv(msqid, compat_ptr(msgp), (ssize_t)msgsz, msgtyp, ++ return do_msgrcv(msqid, compat_ptr(msgp), (ssize_t)msgsz, (long)msgtyp, + msgflg, compat_do_msg_fill); + } + +diff --git a/ipc/sem.c b/ipc/sem.c +index db9d241af133..0c312ac04e49 100644 +--- a/ipc/sem.c ++++ b/ipc/sem.c +@@ -326,10 +326,17 @@ static inline int sem_lock(struct sem_array *sma, struct sembuf *sops, + + /* Then check that the global lock is free */ + if (!spin_is_locked(&sma->sem_perm.lock)) { +- /* spin_is_locked() is not a memory barrier */ +- smp_mb(); ++ /* ++ * The ipc object lock check must be visible on all ++ * cores before rechecking the complex count. Otherwise ++ * we can race with another thread that does: ++ * complex_count++; ++ * spin_unlock(sem_perm.lock); ++ */ ++ smp_rmb(); + +- /* Now repeat the test of complex_count: ++ /* ++ * Now repeat the test of complex_count: + * It can't change anymore until we drop sem->lock. + * Thus: if is now 0, then it will stay 0. + */ +diff --git a/kernel/smpboot.c b/kernel/smpboot.c +index eb89e1807408..60d35ac5d3f1 100644 +--- a/kernel/smpboot.c ++++ b/kernel/smpboot.c +@@ -279,6 +279,7 @@ int smpboot_register_percpu_thread(struct smp_hotplug_thread *plug_thread) + unsigned int cpu; + int ret = 0; + ++ get_online_cpus(); + mutex_lock(&smpboot_threads_lock); + for_each_online_cpu(cpu) { + ret = __smpboot_create_thread(plug_thread, cpu); +@@ -291,6 +292,7 @@ int smpboot_register_percpu_thread(struct smp_hotplug_thread *plug_thread) + list_add(&plug_thread->list, &hotplug_threads); + out: + mutex_unlock(&smpboot_threads_lock); ++ put_online_cpus(); + return ret; + } + EXPORT_SYMBOL_GPL(smpboot_register_percpu_thread); +diff --git a/kernel/workqueue.c b/kernel/workqueue.c +index 3fafbbb31927..d10cc05bfbc6 100644 +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -1954,17 +1954,13 @@ static void pool_mayday_timeout(unsigned long __pool) + * spin_lock_irq(pool->lock) which may be released and regrabbed + * multiple times. Does GFP_KERNEL allocations. Called only from + * manager. +- * +- * Return: +- * %false if no action was taken and pool->lock stayed locked, %true +- * otherwise. + */ +-static bool maybe_create_worker(struct worker_pool *pool) ++static void maybe_create_worker(struct worker_pool *pool) + __releases(&pool->lock) + __acquires(&pool->lock) + { + if (!need_to_create_worker(pool)) +- return false; ++ return; + restart: + spin_unlock_irq(&pool->lock); + +@@ -1981,7 +1977,7 @@ restart: + start_worker(worker); + if (WARN_ON_ONCE(need_to_create_worker(pool))) + goto restart; +- return true; ++ return; + } + + if (!need_to_create_worker(pool)) +@@ -1998,7 +1994,7 @@ restart: + spin_lock_irq(&pool->lock); + if (need_to_create_worker(pool)) + goto restart; +- return true; ++ return; + } + + /** +@@ -2011,15 +2007,9 @@ restart: + * LOCKING: + * spin_lock_irq(pool->lock) which may be released and regrabbed + * multiple times. Called only from manager. +- * +- * Return: +- * %false if no action was taken and pool->lock stayed locked, %true +- * otherwise. + */ +-static bool maybe_destroy_workers(struct worker_pool *pool) ++static void maybe_destroy_workers(struct worker_pool *pool) + { +- bool ret = false; +- + while (too_many_workers(pool)) { + struct worker *worker; + unsigned long expires; +@@ -2033,10 +2023,7 @@ static bool maybe_destroy_workers(struct worker_pool *pool) + } + + destroy_worker(worker); +- ret = true; + } +- +- return ret; + } + + /** +@@ -2056,16 +2043,14 @@ static bool maybe_destroy_workers(struct worker_pool *pool) + * multiple times. Does GFP_KERNEL allocations. + * + * Return: +- * %false if the pool don't need management and the caller can safely start +- * processing works, %true indicates that the function released pool->lock +- * and reacquired it to perform some management function and that the +- * conditions that the caller verified while holding the lock before +- * calling the function might no longer be true. ++ * %false if the pool doesn't need management and the caller can safely ++ * start processing works, %true if management function was performed and ++ * the conditions that the caller verified before calling the function may ++ * no longer be true. + */ + static bool manage_workers(struct worker *worker) + { + struct worker_pool *pool = worker->pool; +- bool ret = false; + + /* + * Managership is governed by two mutexes - manager_arb and +@@ -2089,7 +2074,7 @@ static bool manage_workers(struct worker *worker) + * manager_mutex. + */ + if (!mutex_trylock(&pool->manager_arb)) +- return ret; ++ return false; + + /* + * With manager arbitration won, manager_mutex would be free in +@@ -2099,7 +2084,6 @@ static bool manage_workers(struct worker *worker) + spin_unlock_irq(&pool->lock); + mutex_lock(&pool->manager_mutex); + spin_lock_irq(&pool->lock); +- ret = true; + } + + pool->flags &= ~POOL_MANAGE_WORKERS; +@@ -2108,12 +2092,12 @@ static bool manage_workers(struct worker *worker) + * Destroy and then create so that may_start_working() is true + * on return. + */ +- ret |= maybe_destroy_workers(pool); +- ret |= maybe_create_worker(pool); ++ maybe_destroy_workers(pool); ++ maybe_create_worker(pool); + + mutex_unlock(&pool->manager_mutex); + mutex_unlock(&pool->manager_arb); +- return ret; ++ return true; + } + + /** +diff --git a/lib/checksum.c b/lib/checksum.c +index 129775eb6de6..8b39e86dbab5 100644 +--- a/lib/checksum.c ++++ b/lib/checksum.c +@@ -181,6 +181,15 @@ csum_partial_copy(const void *src, void *dst, int len, __wsum sum) + EXPORT_SYMBOL(csum_partial_copy); + + #ifndef csum_tcpudp_nofold ++static inline u32 from64to32(u64 x) ++{ ++ /* add up 32-bit and 32-bit for 32+c bit */ ++ x = (x & 0xffffffff) + (x >> 32); ++ /* add up carry.. */ ++ x = (x & 0xffffffff) + (x >> 32); ++ return (u32)x; ++} ++ + __wsum csum_tcpudp_nofold(__be32 saddr, __be32 daddr, + unsigned short len, + unsigned short proto, +@@ -195,8 +204,7 @@ __wsum csum_tcpudp_nofold(__be32 saddr, __be32 daddr, + #else + s += (proto + len) << 8; + #endif +- s += (s >> 32); +- return (__force __wsum)s; ++ return (__force __wsum)from64to32(s); + } + EXPORT_SYMBOL(csum_tcpudp_nofold); + #endif +diff --git a/mm/pagewalk.c b/mm/pagewalk.c +index 2beeabf502c5..9056d22d2880 100644 +--- a/mm/pagewalk.c ++++ b/mm/pagewalk.c +@@ -199,7 +199,10 @@ int walk_page_range(unsigned long addr, unsigned long end, + */ + if ((vma->vm_start <= addr) && + (vma->vm_flags & VM_PFNMAP)) { +- next = vma->vm_end; ++ if (walk->pte_hole) ++ err = walk->pte_hole(addr, next, walk); ++ if (err) ++ break; + pgd = pgd_offset(walk->mm, next); + continue; + } +diff --git a/net/core/dev.c b/net/core/dev.c +index ece49db4f265..249ab7d67254 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -6405,10 +6405,20 @@ static int dev_cpu_callback(struct notifier_block *nfb, + oldsd->output_queue = NULL; + oldsd->output_queue_tailp = &oldsd->output_queue; + } +- /* Append NAPI poll list from offline CPU. */ +- if (!list_empty(&oldsd->poll_list)) { +- list_splice_init(&oldsd->poll_list, &sd->poll_list); +- raise_softirq_irqoff(NET_RX_SOFTIRQ); ++ /* Append NAPI poll list from offline CPU, with one exception : ++ * process_backlog() must be called by cpu owning percpu backlog. ++ * We properly handle process_queue & input_pkt_queue later. ++ */ ++ while (!list_empty(&oldsd->poll_list)) { ++ struct napi_struct *napi = list_first_entry(&oldsd->poll_list, ++ struct napi_struct, ++ poll_list); ++ ++ list_del_init(&napi->poll_list); ++ if (napi->poll == process_backlog) ++ napi->state = 0; ++ else ++ ____napi_schedule(sd, napi); + } + + raise_softirq_irqoff(NET_TX_SOFTIRQ); +@@ -6419,7 +6429,7 @@ static int dev_cpu_callback(struct notifier_block *nfb, + netif_rx(skb); + input_queue_head_incr(oldsd); + } +- while ((skb = __skb_dequeue(&oldsd->input_pkt_queue))) { ++ while ((skb = skb_dequeue(&oldsd->input_pkt_queue))) { + netif_rx(skb); + input_queue_head_incr(oldsd); + } +diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c +index f3224755b328..5874dfbb8d90 100644 +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -2542,12 +2542,16 @@ static int rtnl_bridge_notify(struct net_device *dev, u16 flags) + goto errout; + } + ++ if (!skb->len) ++ goto errout; ++ + rtnl_notify(skb, net, 0, RTNLGRP_LINK, NULL, GFP_ATOMIC); + return 0; + errout: + WARN_ON(err == -EMSGSIZE); + kfree_skb(skb); +- rtnl_set_sk_err(net, RTNLGRP_LINK, err); ++ if (err) ++ rtnl_set_sk_err(net, RTNLGRP_LINK, err); + return err; + } + +diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c +index bd1c5baf69be..31ee5c6033df 100644 +--- a/net/ipv4/ip_forward.c ++++ b/net/ipv4/ip_forward.c +@@ -175,7 +175,8 @@ int ip_forward(struct sk_buff *skb) + * We now generate an ICMP HOST REDIRECT giving the route + * we calculated. + */ +- if (rt->rt_flags&RTCF_DOREDIRECT && !opt->srr && !skb_sec_path(skb)) ++ if (IPCB(skb)->flags & IPSKB_DOREDIRECT && !opt->srr && ++ !skb_sec_path(skb)) + ip_rt_send_redirect(skb); + + skb->priority = rt_tos2priority(iph->tos); +diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c +index c2dcee28d071..52e82e1709e6 100644 +--- a/net/ipv4/ip_output.c ++++ b/net/ipv4/ip_output.c +@@ -1451,23 +1451,8 @@ static int ip_reply_glue_bits(void *dptr, char *to, int offset, + /* + * Generic function to send a packet as reply to another packet. + * Used to send some TCP resets/acks so far. +- * +- * Use a fake percpu inet socket to avoid false sharing and contention. + */ +-static DEFINE_PER_CPU(struct inet_sock, unicast_sock) = { +- .sk = { +- .__sk_common = { +- .skc_refcnt = ATOMIC_INIT(1), +- }, +- .sk_wmem_alloc = ATOMIC_INIT(1), +- .sk_allocation = GFP_ATOMIC, +- .sk_flags = (1UL << SOCK_USE_WRITE_QUEUE), +- }, +- .pmtudisc = IP_PMTUDISC_WANT, +- .uc_ttl = -1, +-}; +- +-void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr, ++void ip_send_unicast_reply(struct sock *sk, struct sk_buff *skb, __be32 daddr, + __be32 saddr, const struct ip_reply_arg *arg, + unsigned int len) + { +@@ -1475,9 +1460,8 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr, + struct ipcm_cookie ipc; + struct flowi4 fl4; + struct rtable *rt = skb_rtable(skb); ++ struct net *net = sock_net(sk); + struct sk_buff *nskb; +- struct sock *sk; +- struct inet_sock *inet; + int err; + + if (ip_options_echo(&replyopts.opt.opt, skb)) +@@ -1505,15 +1489,11 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr, + if (IS_ERR(rt)) + return; + +- inet = &get_cpu_var(unicast_sock); ++ inet_sk(sk)->tos = arg->tos; + +- inet->tos = arg->tos; +- sk = &inet->sk; + sk->sk_priority = skb->priority; + sk->sk_protocol = ip_hdr(skb)->protocol; + sk->sk_bound_dev_if = arg->bound_dev_if; +- sock_net_set(sk, net); +- __skb_queue_head_init(&sk->sk_write_queue); + sk->sk_sndbuf = sysctl_wmem_default; + err = ip_append_data(sk, &fl4, ip_reply_glue_bits, arg->iov->iov_base, + len, 0, &ipc, &rt, MSG_DONTWAIT); +@@ -1529,13 +1509,10 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr, + arg->csumoffset) = csum_fold(csum_add(nskb->csum, + arg->csum)); + nskb->ip_summed = CHECKSUM_NONE; +- skb_orphan(nskb); + skb_set_queue_mapping(nskb, skb_get_queue_mapping(skb)); + ip_push_pending_frames(sk, &fl4); + } + out: +- put_cpu_var(unicast_sock); +- + ip_rt_put(rt); + } + +diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c +index 23e6ab0a2dc0..f6603142cb33 100644 +--- a/net/ipv4/ip_sockglue.c ++++ b/net/ipv4/ip_sockglue.c +@@ -410,15 +410,11 @@ int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len) + + memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err)); + sin = &errhdr.offender; +- sin->sin_family = AF_UNSPEC; ++ memset(sin, 0, sizeof(*sin)); + if (serr->ee.ee_origin == SO_EE_ORIGIN_ICMP) { +- struct inet_sock *inet = inet_sk(sk); +- + sin->sin_family = AF_INET; + sin->sin_addr.s_addr = ip_hdr(skb)->saddr; +- sin->sin_port = 0; +- memset(&sin->sin_zero, 0, sizeof(sin->sin_zero)); +- if (inet->cmsg_flags) ++ if (inet_sk(sk)->cmsg_flags) + ip_cmsg_recv(msg, skb); + } + +diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c +index 8bd51f49aa96..81c92f61d77c 100644 +--- a/net/ipv4/ping.c ++++ b/net/ipv4/ping.c +@@ -959,8 +959,11 @@ void ping_rcv(struct sk_buff *skb) + + sk = ping_lookup(net, skb, ntohs(icmph->un.echo.id)); + if (sk != NULL) { ++ struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC); ++ + pr_debug("rcv on socket %p\n", sk); +- ping_queue_rcv_skb(sk, skb_get(skb)); ++ if (skb2) ++ ping_queue_rcv_skb(sk, skb2); + sock_put(sk); + return; + } +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index f7fe946e534c..3663200b8dba 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -1561,11 +1561,10 @@ static int __mkroute_input(struct sk_buff *skb, + + do_cache = res->fi && !itag; + if (out_dev == in_dev && err && IN_DEV_TX_REDIRECTS(out_dev) && ++ skb->protocol == htons(ETH_P_IP) && + (IN_DEV_SHARED_MEDIA(out_dev) || +- inet_addr_onlink(out_dev, saddr, FIB_RES_GW(*res)))) { +- flags |= RTCF_DOREDIRECT; +- do_cache = false; +- } ++ inet_addr_onlink(out_dev, saddr, FIB_RES_GW(*res)))) ++ IPCB(skb)->flags |= IPSKB_DOREDIRECT; + + if (skb->protocol != htons(ETH_P_IP)) { + /* Not IP (i.e. ARP). Do not create route, if it is +@@ -2307,6 +2306,8 @@ static int rt_fill_info(struct net *net, __be32 dst, __be32 src, + r->rtm_flags = (rt->rt_flags & ~0xFFFF) | RTM_F_CLONED; + if (rt->rt_flags & RTCF_NOTIFY) + r->rtm_flags |= RTM_F_NOTIFY; ++ if (IPCB(skb)->flags & IPSKB_DOREDIRECT) ++ r->rtm_flags |= RTCF_DOREDIRECT; + + if (nla_put_be32(skb, RTA_DST, dst)) + goto nla_put_failure; +diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c +index 45f370302e4d..aae282839bde 100644 +--- a/net/ipv4/tcp_ipv4.c ++++ b/net/ipv4/tcp_ipv4.c +@@ -690,7 +690,8 @@ static void tcp_v4_send_reset(struct sock *sk, struct sk_buff *skb) + + net = dev_net(skb_dst(skb)->dev); + arg.tos = ip_hdr(skb)->tos; +- ip_send_unicast_reply(net, skb, ip_hdr(skb)->saddr, ++ ip_send_unicast_reply(*this_cpu_ptr(net->ipv4.tcp_sk), ++ skb, ip_hdr(skb)->saddr, + ip_hdr(skb)->daddr, &arg, arg.iov[0].iov_len); + + TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS); +@@ -773,7 +774,8 @@ static void tcp_v4_send_ack(struct sk_buff *skb, u32 seq, u32 ack, + if (oif) + arg.bound_dev_if = oif; + arg.tos = tos; +- ip_send_unicast_reply(net, skb, ip_hdr(skb)->saddr, ++ ip_send_unicast_reply(*this_cpu_ptr(net->ipv4.tcp_sk), ++ skb, ip_hdr(skb)->saddr, + ip_hdr(skb)->daddr, &arg, arg.iov[0].iov_len); + + TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS); +@@ -2828,14 +2830,39 @@ struct proto tcp_prot = { + }; + EXPORT_SYMBOL(tcp_prot); + ++static void __net_exit tcp_sk_exit(struct net *net) ++{ ++ int cpu; ++ ++ for_each_possible_cpu(cpu) ++ inet_ctl_sock_destroy(*per_cpu_ptr(net->ipv4.tcp_sk, cpu)); ++ free_percpu(net->ipv4.tcp_sk); ++} ++ + static int __net_init tcp_sk_init(struct net *net) + { ++ int res, cpu; ++ ++ net->ipv4.tcp_sk = alloc_percpu(struct sock *); ++ if (!net->ipv4.tcp_sk) ++ return -ENOMEM; ++ ++ for_each_possible_cpu(cpu) { ++ struct sock *sk; ++ ++ res = inet_ctl_sock_create(&sk, PF_INET, SOCK_RAW, ++ IPPROTO_TCP, net); ++ if (res) ++ goto fail; ++ *per_cpu_ptr(net->ipv4.tcp_sk, cpu) = sk; ++ } + net->ipv4.sysctl_tcp_ecn = 2; + return 0; +-} + +-static void __net_exit tcp_sk_exit(struct net *net) +-{ ++fail: ++ tcp_sk_exit(net); ++ ++ return res; + } + + static void __net_exit tcp_sk_exit_batch(struct list_head *net_exit_list) +diff --git a/net/ipv4/udp_diag.c b/net/ipv4/udp_diag.c +index 7927db0a9279..4a000f1dd757 100644 +--- a/net/ipv4/udp_diag.c ++++ b/net/ipv4/udp_diag.c +@@ -99,11 +99,13 @@ static void udp_dump(struct udp_table *table, struct sk_buff *skb, struct netlin + s_slot = cb->args[0]; + num = s_num = cb->args[1]; + +- for (slot = s_slot; slot <= table->mask; num = s_num = 0, slot++) { ++ for (slot = s_slot; slot <= table->mask; s_num = 0, slot++) { + struct sock *sk; + struct hlist_nulls_node *node; + struct udp_hslot *hslot = &table->hash[slot]; + ++ num = 0; ++ + if (hlist_nulls_empty(&hslot->head)) + continue; + +diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c +index c66c6df6e881..9f9ad99fcfdd 100644 +--- a/net/ipv6/datagram.c ++++ b/net/ipv6/datagram.c +@@ -374,11 +374,10 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len) + + memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err)); + sin = &errhdr.offender; +- sin->sin6_family = AF_UNSPEC; ++ memset(sin, 0, sizeof(*sin)); ++ + if (serr->ee.ee_origin != SO_EE_ORIGIN_LOCAL) { + sin->sin6_family = AF_INET6; +- sin->sin6_flowinfo = 0; +- sin->sin6_port = 0; + if (skb->protocol == htons(ETH_P_IPV6)) { + sin->sin6_addr = ipv6_hdr(skb)->saddr; + if (np->rxopt.all) +@@ -387,12 +386,9 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len) + ipv6_iface_scope_id(&sin->sin6_addr, + IP6CB(skb)->iif); + } else { +- struct inet_sock *inet = inet_sk(sk); +- + ipv6_addr_set_v4mapped(ip_hdr(skb)->saddr, + &sin->sin6_addr); +- sin->sin6_scope_id = 0; +- if (inet->cmsg_flags) ++ if (inet_sk(sk)->cmsg_flags) + ip_cmsg_recv(msg, skb); + } + } +diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c +index 5e30677953d7..c2ef79957ae0 100644 +--- a/net/ipv6/ip6_fib.c ++++ b/net/ipv6/ip6_fib.c +@@ -638,6 +638,29 @@ static inline bool rt6_qualify_for_ecmp(struct rt6_info *rt) + RTF_GATEWAY; + } + ++static void fib6_purge_rt(struct rt6_info *rt, struct fib6_node *fn, ++ struct net *net) ++{ ++ if (atomic_read(&rt->rt6i_ref) != 1) { ++ /* This route is used as dummy address holder in some split ++ * nodes. It is not leaked, but it still holds other resources, ++ * which must be released in time. So, scan ascendant nodes ++ * and replace dummy references to this route with references ++ * to still alive ones. ++ */ ++ while (fn) { ++ if (!(fn->fn_flags & RTN_RTINFO) && fn->leaf == rt) { ++ fn->leaf = fib6_find_prefix(net, fn); ++ atomic_inc(&fn->leaf->rt6i_ref); ++ rt6_release(rt); ++ } ++ fn = fn->parent; ++ } ++ /* No more references are possible at this point. */ ++ BUG_ON(atomic_read(&rt->rt6i_ref) != 1); ++ } ++} ++ + /* + * Insert routing information in a node. + */ +@@ -775,11 +798,12 @@ add: + rt->dst.rt6_next = iter->dst.rt6_next; + atomic_inc(&rt->rt6i_ref); + inet6_rt_notify(RTM_NEWROUTE, rt, info); +- rt6_release(iter); + if (!(fn->fn_flags & RTN_RTINFO)) { + info->nl_net->ipv6.rt6_stats->fib_route_nodes++; + fn->fn_flags |= RTN_RTINFO; + } ++ fib6_purge_rt(iter, fn, info->nl_net); ++ rt6_release(iter); + } + + return 0; +@@ -1284,24 +1308,7 @@ static void fib6_del_route(struct fib6_node *fn, struct rt6_info **rtp, + fn = fib6_repair_tree(net, fn); + } + +- if (atomic_read(&rt->rt6i_ref) != 1) { +- /* This route is used as dummy address holder in some split +- * nodes. It is not leaked, but it still holds other resources, +- * which must be released in time. So, scan ascendant nodes +- * and replace dummy references to this route with references +- * to still alive ones. +- */ +- while (fn) { +- if (!(fn->fn_flags & RTN_RTINFO) && fn->leaf == rt) { +- fn->leaf = fib6_find_prefix(net, fn); +- atomic_inc(&fn->leaf->rt6i_ref); +- rt6_release(rt); +- } +- fn = fn->parent; +- } +- /* No more references are possible at this point. */ +- BUG_ON(atomic_read(&rt->rt6i_ref) != 1); +- } ++ fib6_purge_rt(rt, fn, net); + + inet6_rt_notify(RTM_DELROUTE, rt, info); + rt6_release(rt); +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index b4bb6a29aa16..1d0c5d66d637 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -1144,12 +1144,9 @@ static void ip6_rt_update_pmtu(struct dst_entry *dst, struct sock *sk, + struct net *net = dev_net(dst->dev); + + rt6->rt6i_flags |= RTF_MODIFIED; +- if (mtu < IPV6_MIN_MTU) { +- u32 features = dst_metric(dst, RTAX_FEATURES); ++ if (mtu < IPV6_MIN_MTU) + mtu = IPV6_MIN_MTU; +- features |= RTAX_FEATURE_ALLFRAG; +- dst_metric_set(dst, RTAX_FEATURES, features); +- } ++ + dst_metric_set(dst, RTAX_MTU, mtu); + rt6_update_expires(rt6, net->ipv6.sysctl.ip6_rt_mtu_expires); + } +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index ef3bdba9309e..03146a15f4f9 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -261,7 +261,7 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local, + else if (rate && rate->flags & IEEE80211_RATE_ERP_G) + channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ; + else if (rate) +- channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ; ++ channel_flags |= IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ; + else + channel_flags |= IEEE80211_CHAN_2GHZ; + put_unaligned_le16(channel_flags, pos); +diff --git a/net/sctp/associola.c b/net/sctp/associola.c +index 737050f1b2b2..88ca530f1d1a 100644 +--- a/net/sctp/associola.c ++++ b/net/sctp/associola.c +@@ -1282,7 +1282,6 @@ void sctp_assoc_update(struct sctp_association *asoc, + asoc->peer.peer_hmacs = new->peer.peer_hmacs; + new->peer.peer_hmacs = NULL; + +- sctp_auth_key_put(asoc->asoc_shared_key); + sctp_auth_asoc_init_active_key(asoc, GFP_ATOMIC); + } + +diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c +index d800160f974c..eb5012b03cfb 100644 +--- a/net/sctp/sm_make_chunk.c ++++ b/net/sctp/sm_make_chunk.c +@@ -2621,7 +2621,7 @@ do_addr_param: + + addr_param = param.v + sizeof(sctp_addip_param_t); + +- af = sctp_get_af_specific(param_type2af(param.p->type)); ++ af = sctp_get_af_specific(param_type2af(addr_param->p.type)); + if (af == NULL) + break; + +diff --git a/net/socket.c b/net/socket.c +index c8ca896a9a5a..3afb43efd3e5 100644 +--- a/net/socket.c ++++ b/net/socket.c +@@ -885,9 +885,6 @@ static ssize_t sock_splice_read(struct file *file, loff_t *ppos, + static struct sock_iocb *alloc_sock_iocb(struct kiocb *iocb, + struct sock_iocb *siocb) + { +- if (!is_sync_kiocb(iocb)) +- BUG(); +- + siocb->kiocb = iocb; + iocb->private = siocb; + return siocb; +diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c +index f318a95ec64d..8724ef857360 100644 +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -1637,10 +1637,12 @@ call_bind_status(struct rpc_task *task) + return; + case -ECONNREFUSED: /* connection problems */ + case -ECONNRESET: ++ case -ECONNABORTED: + case -ENOTCONN: + case -EHOSTDOWN: + case -EHOSTUNREACH: + case -ENETUNREACH: ++ case -ENOBUFS: + case -EPIPE: + dprintk("RPC: %5u remote rpcbind unreachable: %d\n", + task->tk_pid, task->tk_status); +@@ -1699,20 +1701,25 @@ call_connect_status(struct rpc_task *task) + dprint_status(task); + + trace_rpc_connect_status(task, status); ++ task->tk_status = 0; + switch (status) { +- /* if soft mounted, test if we've timed out */ +- case -ETIMEDOUT: +- task->tk_action = call_timeout; +- return; + case -ECONNREFUSED: + case -ECONNRESET: ++ case -ECONNABORTED: + case -ENETUNREACH: ++ case -EHOSTUNREACH: ++ case -ENOBUFS: ++ case -EPIPE: + if (RPC_IS_SOFTCONN(task)) + break; + /* retry with existing socket, after a delay */ +- case 0: ++ rpc_delay(task, 3*HZ); + case -EAGAIN: +- task->tk_status = 0; ++ /* Check for timeouts before looping back to call_bind */ ++ case -ETIMEDOUT: ++ task->tk_action = call_timeout; ++ return; ++ case 0: + clnt->cl_stats->netreconn++; + task->tk_action = call_transmit; + return; +@@ -1804,7 +1811,9 @@ call_transmit_status(struct rpc_task *task) + break; + } + case -ECONNRESET: ++ case -ECONNABORTED: + case -ENOTCONN: ++ case -ENOBUFS: + case -EPIPE: + rpc_task_force_reencode(task); + } +@@ -1913,9 +1922,11 @@ call_status(struct rpc_task *task) + xprt_conditional_disconnect(req->rq_xprt, + req->rq_connect_cookie); + break; +- case -ECONNRESET: + case -ECONNREFUSED: ++ case -ECONNRESET: ++ case -ECONNABORTED: + rpc_force_rebind(clnt); ++ case -ENOBUFS: + rpc_delay(task, 3*HZ); + case -EPIPE: + case -ENOTCONN: +diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c +index ff3cc4bf4b24..5fa4850be6f0 100644 +--- a/net/sunrpc/sched.c ++++ b/net/sunrpc/sched.c +@@ -831,7 +831,8 @@ static void rpc_async_schedule(struct work_struct *work) + * @size: requested byte size + * + * To prevent rpciod from hanging, this allocator never sleeps, +- * returning NULL if the request cannot be serviced immediately. ++ * returning NULL and suppressing warning if the request cannot be serviced ++ * immediately. + * The caller can arrange to sleep in a way that is safe for rpciod. + * + * Most requests are 'small' (under 2KiB) and can be serviced from a +@@ -844,7 +845,7 @@ static void rpc_async_schedule(struct work_struct *work) + void *rpc_malloc(struct rpc_task *task, size_t size) + { + struct rpc_buffer *buf; +- gfp_t gfp = GFP_NOWAIT; ++ gfp_t gfp = GFP_NOWAIT | __GFP_NOWARN; + + if (RPC_IS_SWAPPER(task)) + gfp |= __GFP_MEMALLOC; +diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c +index 42ce6bfc729d..8615b9df4968 100644 +--- a/net/sunrpc/xprt.c ++++ b/net/sunrpc/xprt.c +@@ -745,6 +745,12 @@ static void xprt_connect_status(struct rpc_task *task) + } + + switch (task->tk_status) { ++ case -ECONNREFUSED: ++ case -ECONNRESET: ++ case -ECONNABORTED: ++ case -ENETUNREACH: ++ case -EHOSTUNREACH: ++ case -EPIPE: + case -EAGAIN: + dprintk("RPC: %5u xprt_connect_status: retrying\n", task->tk_pid); + break; +diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c +index 1d034825fcc3..8f5c4da51a70 100644 +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -588,6 +588,7 @@ static int xs_local_send_request(struct rpc_task *task) + } + + switch (status) { ++ case -ENOBUFS: + case -EAGAIN: + status = xs_nospace(task); + break; +@@ -655,6 +656,7 @@ static int xs_udp_send_request(struct rpc_task *task) + dprintk("RPC: sendmsg returned unrecognized error %d\n", + -status); + case -ENETUNREACH: ++ case -ENOBUFS: + case -EPIPE: + case -ECONNREFUSED: + /* When the server has died, an ICMP port unreachable message +@@ -752,6 +754,7 @@ static int xs_tcp_send_request(struct rpc_task *task) + status = -ENOTCONN; + /* Should we call xs_close() here? */ + break; ++ case -ENOBUFS: + case -EAGAIN: + status = xs_nospace(task); + break; +@@ -1928,6 +1931,7 @@ static int xs_local_setup_socket(struct sock_xprt *transport) + dprintk("RPC: xprt %p connected to %s\n", + xprt, xprt->address_strings[RPC_DISPLAY_ADDR]); + xprt_set_connected(xprt); ++ case -ENOBUFS: + break; + case -ENOENT: + dprintk("RPC: xprt %p: socket %s does not exist\n", +@@ -2251,6 +2255,7 @@ static void xs_tcp_setup_socket(struct work_struct *work) + case -ECONNREFUSED: + case -ECONNRESET: + case -ENETUNREACH: ++ case -ENOBUFS: + /* retry with existing socket, after a delay */ + goto out; + } +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index c3ef31a96de9..388123667f1e 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -2659,6 +2659,9 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info) + if (!rdev->ops->get_key) + return -EOPNOTSUPP; + ++ if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)) ++ return -ENOENT; ++ + msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); + if (!msg) + return -ENOMEM; +@@ -2678,10 +2681,6 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info) + nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr)) + goto nla_put_failure; + +- if (pairwise && mac_addr && +- !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)) +- return -ENOENT; +- + err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie, + get_key_callback); + +@@ -2852,7 +2851,7 @@ static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info) + wdev_lock(dev->ieee80211_ptr); + err = nl80211_key_allowed(dev->ieee80211_ptr); + +- if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr && ++ if (key.type == NL80211_KEYTYPE_GROUP && mac_addr && + !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)) + err = -ENOENT; + +diff --git a/scripts/kconfig/menu.c b/scripts/kconfig/menu.c +index c1d53200c306..c81f055343b7 100644 +--- a/scripts/kconfig/menu.c ++++ b/scripts/kconfig/menu.c +@@ -544,7 +544,7 @@ static void get_prompt_str(struct gstr *r, struct property *prop, + { + int i, j; + struct menu *submenu[8], *menu, *location = NULL; +- struct jump_key *jump; ++ struct jump_key *jump = NULL; + + str_printf(r, _("Prompt: %s\n"), _(prop->text)); + menu = prop->menu->parent; +@@ -582,8 +582,8 @@ static void get_prompt_str(struct gstr *r, struct property *prop, + str_printf(r, _(" Location:\n")); + for (j = 4; --i >= 0; j += 2) { + menu = submenu[i]; +- if (head && location && menu == location) +- jump->offset = r->len - 1; ++ if (jump && menu == location) ++ jump->offset = strlen(r->s); + str_printf(r, "%*c-> %s", j, ' ', + _(menu_get_prompt(menu))); + if (menu->sym) { +diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c +index 4d35eb75f129..ee53ddca587b 100644 +--- a/security/selinux/ss/policydb.c ++++ b/security/selinux/ss/policydb.c +@@ -3215,9 +3215,8 @@ static int range_write_helper(void *key, void *data, void *ptr) + + static int range_write(struct policydb *p, void *fp) + { +- size_t nel; + __le32 buf[1]; +- int rc; ++ int rc, nel; + struct policy_data pd; + + pd.p = p; +diff --git a/sound/core/seq/seq_dummy.c b/sound/core/seq/seq_dummy.c +index dbc550716790..f60d81497f28 100644 +--- a/sound/core/seq/seq_dummy.c ++++ b/sound/core/seq/seq_dummy.c +@@ -82,36 +82,6 @@ struct snd_seq_dummy_port { + static int my_client = -1; + + /* +- * unuse callback - send ALL_SOUNDS_OFF and RESET_CONTROLLERS events +- * to subscribers. +- * Note: this callback is called only after all subscribers are removed. +- */ +-static int +-dummy_unuse(void *private_data, struct snd_seq_port_subscribe *info) +-{ +- struct snd_seq_dummy_port *p; +- int i; +- struct snd_seq_event ev; +- +- p = private_data; +- memset(&ev, 0, sizeof(ev)); +- if (p->duplex) +- ev.source.port = p->connect; +- else +- ev.source.port = p->port; +- ev.dest.client = SNDRV_SEQ_ADDRESS_SUBSCRIBERS; +- ev.type = SNDRV_SEQ_EVENT_CONTROLLER; +- for (i = 0; i < 16; i++) { +- ev.data.control.channel = i; +- ev.data.control.param = MIDI_CTL_ALL_SOUNDS_OFF; +- snd_seq_kernel_client_dispatch(p->client, &ev, 0, 0); +- ev.data.control.param = MIDI_CTL_RESET_CONTROLLERS; +- snd_seq_kernel_client_dispatch(p->client, &ev, 0, 0); +- } +- return 0; +-} +- +-/* + * event input callback - just redirect events to subscribers + */ + static int +@@ -175,7 +145,6 @@ create_port(int idx, int type) + | SNDRV_SEQ_PORT_TYPE_PORT; + memset(&pcb, 0, sizeof(pcb)); + pcb.owner = THIS_MODULE; +- pcb.unuse = dummy_unuse; + pcb.event_input = dummy_input; + pcb.private_free = dummy_free; + pcb.private_data = rec; +diff --git a/sound/i2c/other/ak4113.c b/sound/i2c/other/ak4113.c +index e04e750a77ed..7a9149bb2a38 100644 +--- a/sound/i2c/other/ak4113.c ++++ b/sound/i2c/other/ak4113.c +@@ -56,8 +56,7 @@ static inline unsigned char reg_read(struct ak4113 *ak4113, unsigned char reg) + + static void snd_ak4113_free(struct ak4113 *chip) + { +- chip->init = 1; /* don't schedule new work */ +- mb(); ++ atomic_inc(&chip->wq_processing); /* don't schedule new work */ + cancel_delayed_work_sync(&chip->work); + kfree(chip); + } +@@ -89,6 +88,7 @@ int snd_ak4113_create(struct snd_card *card, ak4113_read_t *read, + chip->write = write; + chip->private_data = private_data; + INIT_DELAYED_WORK(&chip->work, ak4113_stats); ++ atomic_set(&chip->wq_processing, 0); + + for (reg = 0; reg < AK4113_WRITABLE_REGS ; reg++) + chip->regmap[reg] = pgm[reg]; +@@ -139,13 +139,11 @@ static void ak4113_init_regs(struct ak4113 *chip) + + void snd_ak4113_reinit(struct ak4113 *chip) + { +- chip->init = 1; +- mb(); +- flush_delayed_work(&chip->work); ++ if (atomic_inc_return(&chip->wq_processing) == 1) ++ cancel_delayed_work_sync(&chip->work); + ak4113_init_regs(chip); + /* bring up statistics / event queing */ +- chip->init = 0; +- if (chip->kctls[0]) ++ if (atomic_dec_and_test(&chip->wq_processing)) + schedule_delayed_work(&chip->work, HZ / 10); + } + EXPORT_SYMBOL_GPL(snd_ak4113_reinit); +@@ -632,8 +630,9 @@ static void ak4113_stats(struct work_struct *work) + { + struct ak4113 *chip = container_of(work, struct ak4113, work.work); + +- if (!chip->init) ++ if (atomic_inc_return(&chip->wq_processing) == 1) + snd_ak4113_check_rate_and_errors(chip, chip->check_flags); + +- schedule_delayed_work(&chip->work, HZ / 10); ++ if (atomic_dec_and_test(&chip->wq_processing)) ++ schedule_delayed_work(&chip->work, HZ / 10); + } +diff --git a/sound/i2c/other/ak4114.c b/sound/i2c/other/ak4114.c +index 5bf4fca19e48..84a1ee7af552 100644 +--- a/sound/i2c/other/ak4114.c ++++ b/sound/i2c/other/ak4114.c +@@ -66,8 +66,7 @@ static void reg_dump(struct ak4114 *ak4114) + + static void snd_ak4114_free(struct ak4114 *chip) + { +- chip->init = 1; /* don't schedule new work */ +- mb(); ++ atomic_inc(&chip->wq_processing); /* don't schedule new work */ + cancel_delayed_work_sync(&chip->work); + kfree(chip); + } +@@ -100,6 +99,7 @@ int snd_ak4114_create(struct snd_card *card, + chip->write = write; + chip->private_data = private_data; + INIT_DELAYED_WORK(&chip->work, ak4114_stats); ++ atomic_set(&chip->wq_processing, 0); + + for (reg = 0; reg < 7; reg++) + chip->regmap[reg] = pgm[reg]; +@@ -152,13 +152,11 @@ static void ak4114_init_regs(struct ak4114 *chip) + + void snd_ak4114_reinit(struct ak4114 *chip) + { +- chip->init = 1; +- mb(); +- flush_delayed_work(&chip->work); ++ if (atomic_inc_return(&chip->wq_processing) == 1) ++ cancel_delayed_work_sync(&chip->work); + ak4114_init_regs(chip); + /* bring up statistics / event queing */ +- chip->init = 0; +- if (chip->kctls[0]) ++ if (atomic_dec_and_test(&chip->wq_processing)) + schedule_delayed_work(&chip->work, HZ / 10); + } + +@@ -612,10 +610,10 @@ static void ak4114_stats(struct work_struct *work) + { + struct ak4114 *chip = container_of(work, struct ak4114, work.work); + +- if (!chip->init) ++ if (atomic_inc_return(&chip->wq_processing) == 1) + snd_ak4114_check_rate_and_errors(chip, chip->check_flags); +- +- schedule_delayed_work(&chip->work, HZ / 10); ++ if (atomic_dec_and_test(&chip->wq_processing)) ++ schedule_delayed_work(&chip->work, HZ / 10); + } + + EXPORT_SYMBOL(snd_ak4114_create); +diff --git a/sound/soc/atmel/atmel_ssc_dai.c b/sound/soc/atmel/atmel_ssc_dai.c +index bb53dea85b17..eb8fa7c1aeee 100644 +--- a/sound/soc/atmel/atmel_ssc_dai.c ++++ b/sound/soc/atmel/atmel_ssc_dai.c +@@ -344,7 +344,6 @@ static int atmel_ssc_hw_params(struct snd_pcm_substream *substream, + struct atmel_pcm_dma_params *dma_params; + int dir, channels, bits; + u32 tfmr, rfmr, tcmr, rcmr; +- int start_event; + int ret; + + /* +@@ -451,19 +450,10 @@ static int atmel_ssc_hw_params(struct snd_pcm_substream *substream, + * The SSC transmit clock is obtained from the BCLK signal on + * on the TK line, and the SSC receive clock is + * generated from the transmit clock. +- * +- * For single channel data, one sample is transferred +- * on the falling edge of the LRC clock. +- * For two channel data, one sample is +- * transferred on both edges of the LRC clock. + */ +- start_event = ((channels == 1) +- ? SSC_START_FALLING_RF +- : SSC_START_EDGE_RF); +- + rcmr = SSC_BF(RCMR_PERIOD, 0) + | SSC_BF(RCMR_STTDLY, START_DELAY) +- | SSC_BF(RCMR_START, start_event) ++ | SSC_BF(RCMR_START, SSC_START_FALLING_RF) + | SSC_BF(RCMR_CKI, SSC_CKI_RISING) + | SSC_BF(RCMR_CKO, SSC_CKO_NONE) + | SSC_BF(RCMR_CKS, SSC_CKS_CLOCK); +@@ -471,14 +461,14 @@ static int atmel_ssc_hw_params(struct snd_pcm_substream *substream, + rfmr = SSC_BF(RFMR_FSEDGE, SSC_FSEDGE_POSITIVE) + | SSC_BF(RFMR_FSOS, SSC_FSOS_NONE) + | SSC_BF(RFMR_FSLEN, 0) +- | SSC_BF(RFMR_DATNB, 0) ++ | SSC_BF(RFMR_DATNB, (channels - 1)) + | SSC_BIT(RFMR_MSBF) + | SSC_BF(RFMR_LOOP, 0) + | SSC_BF(RFMR_DATLEN, (bits - 1)); + + tcmr = SSC_BF(TCMR_PERIOD, 0) + | SSC_BF(TCMR_STTDLY, START_DELAY) +- | SSC_BF(TCMR_START, start_event) ++ | SSC_BF(TCMR_START, SSC_START_FALLING_RF) + | SSC_BF(TCMR_CKI, SSC_CKI_FALLING) + | SSC_BF(TCMR_CKO, SSC_CKO_NONE) + | SSC_BF(TCMR_CKS, SSC_CKS_PIN); +@@ -487,7 +477,7 @@ static int atmel_ssc_hw_params(struct snd_pcm_substream *substream, + | SSC_BF(TFMR_FSDEN, 0) + | SSC_BF(TFMR_FSOS, SSC_FSOS_NONE) + | SSC_BF(TFMR_FSLEN, 0) +- | SSC_BF(TFMR_DATNB, 0) ++ | SSC_BF(TFMR_DATNB, (channels - 1)) + | SSC_BIT(TFMR_MSBF) + | SSC_BF(TFMR_DATDEF, 0) + | SSC_BF(TFMR_DATLEN, (bits - 1)); +diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c +index b76c6b619227..ba73f832e455 100644 +--- a/sound/soc/codecs/sgtl5000.c ++++ b/sound/soc/codecs/sgtl5000.c +@@ -1550,6 +1550,9 @@ static int sgtl5000_i2c_probe(struct i2c_client *client, + if (ret) + return ret; + ++ /* Need 8 clocks before I2C accesses */ ++ udelay(1); ++ + /* read chip information */ + ret = regmap_read(sgtl5000->regmap, SGTL5000_CHIP_ID, ®); + if (ret) +diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c +index f156010e52bc..942ef8427347 100644 +--- a/sound/soc/codecs/wm8960.c ++++ b/sound/soc/codecs/wm8960.c +@@ -555,7 +555,7 @@ static struct { + { 22050, 2 }, + { 24000, 2 }, + { 16000, 3 }, +- { 11250, 4 }, ++ { 11025, 4 }, + { 12000, 4 }, + { 8000, 5 }, + }; +diff --git a/sound/soc/omap/omap-mcbsp.c b/sound/soc/omap/omap-mcbsp.c +index 6c19bba23570..6a339fb55479 100644 +--- a/sound/soc/omap/omap-mcbsp.c ++++ b/sound/soc/omap/omap-mcbsp.c +@@ -436,7 +436,7 @@ static int omap_mcbsp_dai_set_dai_fmt(struct snd_soc_dai *cpu_dai, + case SND_SOC_DAIFMT_CBM_CFS: + /* McBSP slave. FS clock as output */ + regs->srgr2 |= FSGM; +- regs->pcr0 |= FSXM; ++ regs->pcr0 |= FSXM | FSRM; + break; + case SND_SOC_DAIFMT_CBM_CFM: + /* McBSP slave */ |