commit: 04c03de7a2870462c939837225541746df9057ea Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Thu Sep 10 00:02:49 2015 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Thu Sep 10 00:02:49 2015 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=04c03de7
Linux patch 3.18.21. 0000_README | 4 + 1020_linux-3.18.21.patch | 4025 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 4029 insertions(+) diff --git a/0000_README b/0000_README index 78fbad8..558f14f 100644 --- a/0000_README +++ b/0000_README @@ -123,6 +123,10 @@ Patch: 1019_linux-3.18.20.patch From: http://www.kernel.org Desc: Linux 3.18.20 +Patch: 1020_linux-3.18.21.patch +From: http://www.kernel.org +Desc: Linux 3.18.21 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1020_linux-3.18.21.patch b/1020_linux-3.18.21.patch new file mode 100644 index 0000000..46bb2db --- /dev/null +++ b/1020_linux-3.18.21.patch @@ -0,0 +1,4025 @@ +diff --git a/Documentation/ABI/testing/ima_policy b/Documentation/ABI/testing/ima_policy +index d0d0c578324c..724cd429eac6 100644 +--- a/Documentation/ABI/testing/ima_policy ++++ b/Documentation/ABI/testing/ima_policy +@@ -20,17 +20,19 @@ Description: + action: measure | dont_measure | appraise | dont_appraise | audit + condition:= base | lsm [option] + base: [[func=] [mask=] [fsmagic=] [fsuuid=] [uid=] +- [fowner]] ++ [euid=] [fowner=]] + lsm: [[subj_user=] [subj_role=] [subj_type=] + [obj_user=] [obj_role=] [obj_type=]] + option: [[appraise_type=]] [permit_directio] + + base: func:= [BPRM_CHECK][MMAP_CHECK][FILE_CHECK][MODULE_CHECK] + [FIRMWARE_CHECK] +- mask:= [MAY_READ] [MAY_WRITE] [MAY_APPEND] [MAY_EXEC] ++ mask:= [[^]MAY_READ] [[^]MAY_WRITE] [[^]MAY_APPEND] ++ [[^]MAY_EXEC] + fsmagic:= hex value + fsuuid:= file system UUID (e.g 8bcbe394-4f13-4144-be8e-5aa9ea2ce2f6) + uid:= decimal value ++ euid:= decimal value + fowner:=decimal value + lsm: are LSM specific + option: appraise_type:= [imasig] +diff --git a/Documentation/ABI/testing/sysfs-ata b/Documentation/ABI/testing/sysfs-ata +index 0a932155cbba..9231daef3813 100644 +--- a/Documentation/ABI/testing/sysfs-ata ++++ b/Documentation/ABI/testing/sysfs-ata +@@ -90,6 +90,17 @@ gscr + 130: SATA_PMP_GSCR_SII_GPIO + Only valid if the device is a PM. + ++trim ++ ++ Shows the DSM TRIM mode currently used by the device. Valid ++ values are: ++ unsupported: Drive does not support DSM TRIM ++ unqueued: Drive supports unqueued DSM TRIM only ++ queued: Drive supports queued DSM TRIM ++ forced_unqueued: Drive's unqueued DSM support is known to be ++ buggy and only unqueued TRIM commands ++ are sent ++ + spdn_cnt + + Number of time libata decided to lower the speed of link due to errors. +diff --git a/Documentation/devicetree/bindings/clock/keystone-pll.txt b/Documentation/devicetree/bindings/clock/keystone-pll.txt +index 225990f79b7c..47570d207215 100644 +--- a/Documentation/devicetree/bindings/clock/keystone-pll.txt ++++ b/Documentation/devicetree/bindings/clock/keystone-pll.txt +@@ -15,8 +15,8 @@ Required properties: + - compatible : shall be "ti,keystone,main-pll-clock" or "ti,keystone,pll-clock" + - clocks : parent clock phandle + - reg - pll control0 and pll multipler registers +-- reg-names : control and multiplier. The multiplier is applicable only for +- main pll clock ++- reg-names : control, multiplier and post-divider. The multiplier and ++ post-divider registers are applicable only for main pll clock + - fixed-postdiv : fixed post divider value. If absent, use clkod register bits + for postdiv + +@@ -25,8 +25,8 @@ Example: + #clock-cells = <0>; + compatible = "ti,keystone,main-pll-clock"; + clocks = <&refclksys>; +- reg = <0x02620350 4>, <0x02310110 4>; +- reg-names = "control", "multiplier"; ++ reg = <0x02620350 4>, <0x02310110 4>, <0x02310108 4>; ++ reg-names = "control", "multiplier", "post-divider"; + fixed-postdiv = <2>; + }; + +diff --git a/Documentation/i2c/busses/i2c-i801 b/Documentation/i2c/busses/i2c-i801 +index 793c83dac738..82f48f774afb 100644 +--- a/Documentation/i2c/busses/i2c-i801 ++++ b/Documentation/i2c/busses/i2c-i801 +@@ -29,6 +29,7 @@ Supported adapters: + * Intel Wildcat Point-LP (PCH) + * Intel BayTrail (SOC) + * Intel Sunrise Point-H (PCH) ++ * Intel Sunrise Point-LP (PCH) + Datasheets: Publicly available at the Intel website + + On Intel Patsburg and later chipsets, both the normal host SMBus controller +diff --git a/Makefile b/Makefile +index 3ef589539cca..6be90fab361b 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 18 +-SUBLEVEL = 20 ++SUBLEVEL = 21 + EXTRAVERSION = + NAME = Diseased Newt + +diff --git a/arch/arm/boot/dts/imx35.dtsi b/arch/arm/boot/dts/imx35.dtsi +index 6932928f3b45..667eb6a45f59 100644 +--- a/arch/arm/boot/dts/imx35.dtsi ++++ b/arch/arm/boot/dts/imx35.dtsi +@@ -286,8 +286,8 @@ + can1: can@53fe4000 { + compatible = "fsl,imx35-flexcan", "fsl,p1010-flexcan"; + reg = <0x53fe4000 0x1000>; +- clocks = <&clks 33>; +- clock-names = "ipg"; ++ clocks = <&clks 33>, <&clks 33>; ++ clock-names = "ipg", "per"; + interrupts = <43>; + status = "disabled"; + }; +@@ -295,8 +295,8 @@ + can2: can@53fe8000 { + compatible = "fsl,imx35-flexcan", "fsl,p1010-flexcan"; + reg = <0x53fe8000 0x1000>; +- clocks = <&clks 34>; +- clock-names = "ipg"; ++ clocks = <&clks 34>, <&clks 34>; ++ clock-names = "ipg", "per"; + interrupts = <44>; + status = "disabled"; + }; +diff --git a/arch/arm/boot/dts/k2e-clocks.dtsi b/arch/arm/boot/dts/k2e-clocks.dtsi +index 4773d6af66a0..d56d68fe7ffc 100644 +--- a/arch/arm/boot/dts/k2e-clocks.dtsi ++++ b/arch/arm/boot/dts/k2e-clocks.dtsi +@@ -13,9 +13,8 @@ clocks { + #clock-cells = <0>; + compatible = "ti,keystone,main-pll-clock"; + clocks = <&refclksys>; +- reg = <0x02620350 4>, <0x02310110 4>; +- reg-names = "control", "multiplier"; +- fixed-postdiv = <2>; ++ reg = <0x02620350 4>, <0x02310110 4>, <0x02310108 4>; ++ reg-names = "control", "multiplier", "post-divider"; + }; + + papllclk: papllclk@2620358 { +diff --git a/arch/arm/boot/dts/k2hk-clocks.dtsi b/arch/arm/boot/dts/k2hk-clocks.dtsi +index d5adee3c0067..af9b7190533a 100644 +--- a/arch/arm/boot/dts/k2hk-clocks.dtsi ++++ b/arch/arm/boot/dts/k2hk-clocks.dtsi +@@ -22,9 +22,8 @@ clocks { + #clock-cells = <0>; + compatible = "ti,keystone,main-pll-clock"; + clocks = <&refclksys>; +- reg = <0x02620350 4>, <0x02310110 4>; +- reg-names = "control", "multiplier"; +- fixed-postdiv = <2>; ++ reg = <0x02620350 4>, <0x02310110 4>, <0x02310108 4>; ++ reg-names = "control", "multiplier", "post-divider"; + }; + + papllclk: papllclk@2620358 { +diff --git a/arch/arm/boot/dts/k2l-clocks.dtsi b/arch/arm/boot/dts/k2l-clocks.dtsi +index eb1e3e29f073..ef8464bb11ff 100644 +--- a/arch/arm/boot/dts/k2l-clocks.dtsi ++++ b/arch/arm/boot/dts/k2l-clocks.dtsi +@@ -22,9 +22,8 @@ clocks { + #clock-cells = <0>; + compatible = "ti,keystone,main-pll-clock"; + clocks = <&refclksys>; +- reg = <0x02620350 4>, <0x02310110 4>; +- reg-names = "control", "multiplier"; +- fixed-postdiv = <2>; ++ reg = <0x02620350 4>, <0x02310110 4>, <0x02310108 4>; ++ reg-names = "control", "multiplier", "post-divider"; + }; + + papllclk: papllclk@2620358 { +diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c +index 716247ed9e0c..bb9a148af8cc 100644 +--- a/arch/arm/mach-omap2/omap_hwmod.c ++++ b/arch/arm/mach-omap2/omap_hwmod.c +@@ -2452,6 +2452,9 @@ static int of_dev_hwmod_lookup(struct device_node *np, + * registers. This address is needed early so the OCP registers that + * are part of the device's address space can be ioremapped properly. + * ++ * If SYSC access is not needed, the registers will not be remapped ++ * and non-availability of MPU access is not treated as an error. ++ * + * Returns 0 on success, -EINVAL if an invalid hwmod is passed, and + * -ENXIO on absent or invalid register target address space. + */ +@@ -2466,6 +2469,11 @@ static int __init _init_mpu_rt_base(struct omap_hwmod *oh, void *data, + + _save_mpu_port_index(oh); + ++ /* if we don't need sysc access we don't need to ioremap */ ++ if (!oh->class->sysc) ++ return 0; ++ ++ /* we can't continue without MPU PORT if we need sysc access */ + if (oh->_int_flags & _HWMOD_NO_MPU_PORT) + return -ENXIO; + +@@ -2475,8 +2483,10 @@ static int __init _init_mpu_rt_base(struct omap_hwmod *oh, void *data, + oh->name); + + /* Extract the IO space from device tree blob */ +- if (!np) ++ if (!np) { ++ pr_err("omap_hwmod: %s: no dt node\n", oh->name); + return -ENXIO; ++ } + + va_start = of_iomap(np, index + oh->mpu_rt_idx); + } else { +@@ -2535,13 +2545,11 @@ static int __init _init(struct omap_hwmod *oh, void *data) + oh->name, np->name); + } + +- if (oh->class->sysc) { +- r = _init_mpu_rt_base(oh, NULL, index, np); +- if (r < 0) { +- WARN(1, "omap_hwmod: %s: doesn't have mpu register target base\n", +- oh->name); +- return 0; +- } ++ r = _init_mpu_rt_base(oh, NULL, index, np); ++ if (r < 0) { ++ WARN(1, "omap_hwmod: %s: doesn't have mpu register target base\n", ++ oh->name); ++ return 0; + } + + r = _init_clocks(oh, NULL); +diff --git a/arch/arm64/kernel/signal32.c b/arch/arm64/kernel/signal32.c +index 76920d4040d4..b4efc2e38336 100644 +--- a/arch/arm64/kernel/signal32.c ++++ b/arch/arm64/kernel/signal32.c +@@ -168,7 +168,8 @@ int copy_siginfo_to_user32(compat_siginfo_t __user *to, const siginfo_t *from) + * Other callers might not initialize the si_lsb field, + * so check explicitely for the right codes here. + */ +- if (from->si_code == BUS_MCEERR_AR || from->si_code == BUS_MCEERR_AO) ++ if (from->si_signo == SIGBUS && ++ (from->si_code == BUS_MCEERR_AR || from->si_code == BUS_MCEERR_AO)) + err |= __put_user(from->si_addr_lsb, &to->si_addr_lsb); + #endif + break; +@@ -195,8 +196,6 @@ int copy_siginfo_to_user32(compat_siginfo_t __user *to, const siginfo_t *from) + + int copy_siginfo_from_user32(siginfo_t *to, compat_siginfo_t __user *from) + { +- memset(to, 0, sizeof *to); +- + if (copy_from_user(to, from, __ARCH_SI_PREAMBLE_SIZE) || + copy_from_user(to->_sifields._pad, + from->_sifields._pad, SI_PAD_SIZE)) +diff --git a/arch/arm64/mm/mmap.c b/arch/arm64/mm/mmap.c +index 1d73662f00ff..54922d1275b8 100644 +--- a/arch/arm64/mm/mmap.c ++++ b/arch/arm64/mm/mmap.c +@@ -47,22 +47,14 @@ static int mmap_is_legacy(void) + return sysctl_legacy_va_layout; + } + +-/* +- * Since get_random_int() returns the same value within a 1 jiffy window, we +- * will almost always get the same randomisation for the stack and mmap +- * region. This will mean the relative distance between stack and mmap will be +- * the same. +- * +- * To avoid this we can shift the randomness by 1 bit. +- */ + static unsigned long mmap_rnd(void) + { + unsigned long rnd = 0; + + if (current->flags & PF_RANDOMIZE) +- rnd = (long)get_random_int() & (STACK_RND_MASK >> 1); ++ rnd = (long)get_random_int() & STACK_RND_MASK; + +- return rnd << (PAGE_SHIFT + 1); ++ return rnd << PAGE_SHIFT; + } + + static unsigned long mmap_base(void) +diff --git a/arch/avr32/mach-at32ap/clock.c b/arch/avr32/mach-at32ap/clock.c +index 23b1a97fae7a..52c179bec0cc 100644 +--- a/arch/avr32/mach-at32ap/clock.c ++++ b/arch/avr32/mach-at32ap/clock.c +@@ -80,6 +80,9 @@ int clk_enable(struct clk *clk) + { + unsigned long flags; + ++ if (!clk) ++ return 0; ++ + spin_lock_irqsave(&clk_lock, flags); + __clk_enable(clk); + spin_unlock_irqrestore(&clk_lock, flags); +@@ -106,6 +109,9 @@ void clk_disable(struct clk *clk) + { + unsigned long flags; + ++ if (IS_ERR_OR_NULL(clk)) ++ return; ++ + spin_lock_irqsave(&clk_lock, flags); + __clk_disable(clk); + spin_unlock_irqrestore(&clk_lock, flags); +@@ -117,6 +123,9 @@ unsigned long clk_get_rate(struct clk *clk) + unsigned long flags; + unsigned long rate; + ++ if (!clk) ++ return 0; ++ + spin_lock_irqsave(&clk_lock, flags); + rate = clk->get_rate(clk); + spin_unlock_irqrestore(&clk_lock, flags); +@@ -129,6 +138,9 @@ long clk_round_rate(struct clk *clk, unsigned long rate) + { + unsigned long flags, actual_rate; + ++ if (!clk) ++ return 0; ++ + if (!clk->set_rate) + return -ENOSYS; + +@@ -145,6 +157,9 @@ int clk_set_rate(struct clk *clk, unsigned long rate) + unsigned long flags; + long ret; + ++ if (!clk) ++ return 0; ++ + if (!clk->set_rate) + return -ENOSYS; + +@@ -161,6 +176,9 @@ int clk_set_parent(struct clk *clk, struct clk *parent) + unsigned long flags; + int ret; + ++ if (!clk) ++ return 0; ++ + if (!clk->set_parent) + return -ENOSYS; + +@@ -174,7 +192,7 @@ EXPORT_SYMBOL(clk_set_parent); + + struct clk *clk_get_parent(struct clk *clk) + { +- return clk->parent; ++ return !clk ? NULL : clk->parent; + } + EXPORT_SYMBOL(clk_get_parent); + +diff --git a/arch/mips/include/asm/pgtable.h b/arch/mips/include/asm/pgtable.h +index bc3fc4fdc9ab..060fc2e50cd2 100644 +--- a/arch/mips/include/asm/pgtable.h ++++ b/arch/mips/include/asm/pgtable.h +@@ -187,8 +187,39 @@ static inline void set_pte(pte_t *ptep, pte_t pteval) + * Make sure the buddy is global too (if it's !none, + * it better already be global) + */ ++#ifdef CONFIG_SMP ++ /* ++ * For SMP, multiple CPUs can race, so we need to do ++ * this atomically. ++ */ ++#ifdef CONFIG_64BIT ++#define LL_INSN "lld" ++#define SC_INSN "scd" ++#else /* CONFIG_32BIT */ ++#define LL_INSN "ll" ++#define SC_INSN "sc" ++#endif ++ unsigned long page_global = _PAGE_GLOBAL; ++ unsigned long tmp; ++ ++ __asm__ __volatile__ ( ++ " .set push\n" ++ " .set noreorder\n" ++ "1: " LL_INSN " %[tmp], %[buddy]\n" ++ " bnez %[tmp], 2f\n" ++ " or %[tmp], %[tmp], %[global]\n" ++ " " SC_INSN " %[tmp], %[buddy]\n" ++ " beqz %[tmp], 1b\n" ++ " nop\n" ++ "2:\n" ++ " .set pop" ++ : [buddy] "+m" (buddy->pte), ++ [tmp] "=&r" (tmp) ++ : [global] "r" (page_global)); ++#else /* !CONFIG_SMP */ + if (pte_none(*buddy)) + pte_val(*buddy) = pte_val(*buddy) | _PAGE_GLOBAL; ++#endif /* CONFIG_SMP */ + } + #endif + } +diff --git a/arch/mips/include/asm/stackframe.h b/arch/mips/include/asm/stackframe.h +index b188c797565c..0562a24dc615 100644 +--- a/arch/mips/include/asm/stackframe.h ++++ b/arch/mips/include/asm/stackframe.h +@@ -152,6 +152,31 @@ + .set noreorder + bltz k0, 8f + move k1, sp ++#ifdef CONFIG_EVA ++ /* ++ * Flush interAptiv's Return Prediction Stack (RPS) by writing ++ * EntryHi. Toggling Config7.RPS is slower and less portable. ++ * ++ * The RPS isn't automatically flushed when exceptions are ++ * taken, which can result in kernel mode speculative accesses ++ * to user addresses if the RPS mispredicts. That's harmless ++ * when user and kernel share the same address space, but with ++ * EVA the same user segments may be unmapped to kernel mode, ++ * even containing sensitive MMIO regions or invalid memory. ++ * ++ * This can happen when the kernel sets the return address to ++ * ret_from_* and jr's to the exception handler, which looks ++ * more like a tail call than a function call. If nested calls ++ * don't evict the last user address in the RPS, it will ++ * mispredict the return and fetch from a user controlled ++ * address into the icache. ++ * ++ * More recent EVA-capable cores with MAAR to restrict ++ * speculative accesses aren't affected. ++ */ ++ MFC0 k0, CP0_ENTRYHI ++ MTC0 k0, CP0_ENTRYHI ++#endif + .set reorder + /* Called from user mode, new stack. */ + get_saved_sp +diff --git a/arch/mips/kernel/mips-mt-fpaff.c b/arch/mips/kernel/mips-mt-fpaff.c +index 362bb3707e62..116c67a5320a 100644 +--- a/arch/mips/kernel/mips-mt-fpaff.c ++++ b/arch/mips/kernel/mips-mt-fpaff.c +@@ -154,7 +154,7 @@ asmlinkage long mipsmt_sys_sched_getaffinity(pid_t pid, unsigned int len, + unsigned long __user *user_mask_ptr) + { + unsigned int real_len; +- cpumask_t mask; ++ cpumask_t allowed, mask; + int retval; + struct task_struct *p; + +@@ -173,7 +173,8 @@ asmlinkage long mipsmt_sys_sched_getaffinity(pid_t pid, unsigned int len, + if (retval) + goto out_unlock; + +- cpumask_and(&mask, &p->thread.user_cpus_allowed, cpu_possible_mask); ++ cpumask_or(&allowed, &p->thread.user_cpus_allowed, &p->cpus_allowed); ++ cpumask_and(&mask, &allowed, cpu_active_mask); + + out_unlock: + read_unlock(&tasklist_lock); +diff --git a/arch/mips/kernel/signal32.c b/arch/mips/kernel/signal32.c +index d69179c0d49d..f019f100a4bd 100644 +--- a/arch/mips/kernel/signal32.c ++++ b/arch/mips/kernel/signal32.c +@@ -409,8 +409,6 @@ int copy_siginfo_to_user32(compat_siginfo_t __user *to, const siginfo_t *from) + + int copy_siginfo_from_user32(siginfo_t *to, compat_siginfo_t __user *from) + { +- memset(to, 0, sizeof *to); +- + if (copy_from_user(to, from, 3*sizeof(int)) || + copy_from_user(to->_sifields._pad, + from->_sifields._pad, SI_PAD_SIZE32)) +diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c +index d255a2a1837a..f506c53cb4f5 100644 +--- a/arch/mips/kernel/traps.c ++++ b/arch/mips/kernel/traps.c +@@ -190,6 +190,7 @@ static void show_stacktrace(struct task_struct *task, + void show_stack(struct task_struct *task, unsigned long *sp) + { + struct pt_regs regs; ++ mm_segment_t old_fs = get_fs(); + if (sp) { + regs.regs[29] = (unsigned long)sp; + regs.regs[31] = 0; +@@ -208,7 +209,13 @@ void show_stack(struct task_struct *task, unsigned long *sp) + prepare_frametrace(®s); + } + } ++ /* ++ * show_stack() deals exclusively with kernel mode, so be sure to access ++ * the stack in the kernel (not user) address space. ++ */ ++ set_fs(KERNEL_DS); + show_stacktrace(task, ®s); ++ set_fs(old_fs); + } + + static void show_code(unsigned int __user *pc) +@@ -1376,6 +1383,7 @@ asmlinkage void do_mcheck(struct pt_regs *regs) + const int field = 2 * sizeof(unsigned long); + int multi_match = regs->cp0_status & ST0_TS; + enum ctx_state prev_state; ++ mm_segment_t old_fs = get_fs(); + + prev_state = exception_enter(); + show_regs(regs); +@@ -1390,8 +1398,13 @@ asmlinkage void do_mcheck(struct pt_regs *regs) + dump_tlb_all(); + } + ++ if (!user_mode(regs)) ++ set_fs(KERNEL_DS); ++ + show_code((unsigned int __user *) regs->cp0_epc); + ++ set_fs(old_fs); ++ + /* + * Some chips may have other causes of machine check (e.g. SB1 + * graduation timer) +diff --git a/arch/mips/mti-malta/malta-time.c b/arch/mips/mti-malta/malta-time.c +index 3778a359f3ad..38748da2a9d6 100644 +--- a/arch/mips/mti-malta/malta-time.c ++++ b/arch/mips/mti-malta/malta-time.c +@@ -158,14 +158,17 @@ unsigned int get_c0_compare_int(void) + + static void __init init_rtc(void) + { +- /* stop the clock whilst setting it up */ +- CMOS_WRITE(RTC_SET | RTC_24H, RTC_CONTROL); ++ unsigned char freq, ctrl; + +- /* 32KHz time base */ +- CMOS_WRITE(RTC_REF_CLCK_32KHZ, RTC_FREQ_SELECT); ++ /* Set 32KHz time base if not already set */ ++ freq = CMOS_READ(RTC_FREQ_SELECT); ++ if ((freq & RTC_DIV_CTL) != RTC_REF_CLCK_32KHZ) ++ CMOS_WRITE(RTC_REF_CLCK_32KHZ, RTC_FREQ_SELECT); + +- /* start the clock */ +- CMOS_WRITE(RTC_24H, RTC_CONTROL); ++ /* Ensure SET bit is clear so RTC can run */ ++ ctrl = CMOS_READ(RTC_CONTROL); ++ if (ctrl & RTC_SET) ++ CMOS_WRITE(ctrl & ~RTC_SET, RTC_CONTROL); + } + + void __init plat_time_init(void) +diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c +index b171001698ff..28f36b9c0e55 100644 +--- a/arch/powerpc/kernel/signal_32.c ++++ b/arch/powerpc/kernel/signal_32.c +@@ -966,8 +966,6 @@ int copy_siginfo_to_user32(struct compat_siginfo __user *d, const siginfo_t *s) + + int copy_siginfo_from_user32(siginfo_t *to, struct compat_siginfo __user *from) + { +- memset(to, 0, sizeof *to); +- + if (copy_from_user(to, from, 3*sizeof(int)) || + copy_from_user(to->_sifields._pad, + from->_sifields._pad, SI_PAD_SIZE32)) +diff --git a/arch/s390/include/asm/kexec.h b/arch/s390/include/asm/kexec.h +index 694bcd6bd927..2f924bc30e35 100644 +--- a/arch/s390/include/asm/kexec.h ++++ b/arch/s390/include/asm/kexec.h +@@ -26,6 +26,9 @@ + /* Not more than 2GB */ + #define KEXEC_CONTROL_MEMORY_LIMIT (1UL<<31) + ++/* Allocate control page with GFP_DMA */ ++#define KEXEC_CONTROL_MEMORY_GFP GFP_DMA ++ + /* Maximum address we can use for the crash control pages */ + #define KEXEC_CRASH_CONTROL_MEMORY_LIMIT (-1UL) + +diff --git a/arch/s390/kernel/sclp.S b/arch/s390/kernel/sclp.S +index a41f2c99dcc8..a0c4e7652647 100644 +--- a/arch/s390/kernel/sclp.S ++++ b/arch/s390/kernel/sclp.S +@@ -277,6 +277,8 @@ ENTRY(_sclp_print_early) + jno .Lesa2 + ahi %r15,-80 + stmh %r6,%r15,96(%r15) # store upper register halves ++ basr %r13,0 ++ lmh %r0,%r15,.Lzeroes-.(%r13) # clear upper register halves + .Lesa2: + #endif + lr %r10,%r2 # save string pointer +@@ -300,6 +302,8 @@ ENTRY(_sclp_print_early) + #endif + lm %r6,%r15,120(%r15) # restore registers + br %r14 ++.Lzeroes: ++ .fill 64,4,0 + + .LwritedataS4: + .long 0x00760005 # SCLP command for write data +diff --git a/arch/sparc/include/asm/visasm.h b/arch/sparc/include/asm/visasm.h +index 1f0aa2024e94..6424249d5f78 100644 +--- a/arch/sparc/include/asm/visasm.h ++++ b/arch/sparc/include/asm/visasm.h +@@ -28,16 +28,10 @@ + * Must preserve %o5 between VISEntryHalf and VISExitHalf */ + + #define VISEntryHalf \ +- rd %fprs, %o5; \ +- andcc %o5, FPRS_FEF, %g0; \ +- be,pt %icc, 297f; \ +- sethi %hi(298f), %g7; \ +- sethi %hi(VISenterhalf), %g1; \ +- jmpl %g1 + %lo(VISenterhalf), %g0; \ +- or %g7, %lo(298f), %g7; \ +- clr %o5; \ +-297: wr %o5, FPRS_FEF, %fprs; \ +-298: ++ VISEntry ++ ++#define VISExitHalf \ ++ VISExit + + #define VISEntryHalfFast(fail_label) \ + rd %fprs, %o5; \ +@@ -47,7 +41,7 @@ + ba,a,pt %xcc, fail_label; \ + 297: wr %o5, FPRS_FEF, %fprs; + +-#define VISExitHalf \ ++#define VISExitHalfFast \ + wr %o5, 0, %fprs; + + #ifndef __ASSEMBLY__ +diff --git a/arch/sparc/lib/NG4memcpy.S b/arch/sparc/lib/NG4memcpy.S +index 140527a20e7d..83aeeb1dffdb 100644 +--- a/arch/sparc/lib/NG4memcpy.S ++++ b/arch/sparc/lib/NG4memcpy.S +@@ -240,8 +240,11 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ + add %o0, 0x40, %o0 + bne,pt %icc, 1b + LOAD(prefetch, %g1 + 0x200, #n_reads_strong) ++#ifdef NON_USER_COPY ++ VISExitHalfFast ++#else + VISExitHalf +- ++#endif + brz,pn %o2, .Lexit + cmp %o2, 19 + ble,pn %icc, .Lsmall_unaligned +diff --git a/arch/sparc/lib/VISsave.S b/arch/sparc/lib/VISsave.S +index b320ae9e2e2e..a063d84336d6 100644 +--- a/arch/sparc/lib/VISsave.S ++++ b/arch/sparc/lib/VISsave.S +@@ -44,9 +44,8 @@ vis1: ldub [%g6 + TI_FPSAVED], %g3 + + stx %g3, [%g6 + TI_GSR] + 2: add %g6, %g1, %g3 +- cmp %o5, FPRS_DU +- be,pn %icc, 6f +- sll %g1, 3, %g1 ++ mov FPRS_DU | FPRS_DL | FPRS_FEF, %o5 ++ sll %g1, 3, %g1 + stb %o5, [%g3 + TI_FPSAVED] + rd %gsr, %g2 + add %g6, %g1, %g3 +@@ -80,65 +79,3 @@ vis1: ldub [%g6 + TI_FPSAVED], %g3 + .align 32 + 80: jmpl %g7 + %g0, %g0 + nop +- +-6: ldub [%g3 + TI_FPSAVED], %o5 +- or %o5, FPRS_DU, %o5 +- add %g6, TI_FPREGS+0x80, %g2 +- stb %o5, [%g3 + TI_FPSAVED] +- +- sll %g1, 5, %g1 +- add %g6, TI_FPREGS+0xc0, %g3 +- wr %g0, FPRS_FEF, %fprs +- membar #Sync +- stda %f32, [%g2 + %g1] ASI_BLK_P +- stda %f48, [%g3 + %g1] ASI_BLK_P +- membar #Sync +- ba,pt %xcc, 80f +- nop +- +- .align 32 +-80: jmpl %g7 + %g0, %g0 +- nop +- +- .align 32 +-VISenterhalf: +- ldub [%g6 + TI_FPDEPTH], %g1 +- brnz,a,pn %g1, 1f +- cmp %g1, 1 +- stb %g0, [%g6 + TI_FPSAVED] +- stx %fsr, [%g6 + TI_XFSR] +- clr %o5 +- jmpl %g7 + %g0, %g0 +- wr %g0, FPRS_FEF, %fprs +- +-1: bne,pn %icc, 2f +- srl %g1, 1, %g1 +- ba,pt %xcc, vis1 +- sub %g7, 8, %g7 +-2: addcc %g6, %g1, %g3 +- sll %g1, 3, %g1 +- andn %o5, FPRS_DU, %g2 +- stb %g2, [%g3 + TI_FPSAVED] +- +- rd %gsr, %g2 +- add %g6, %g1, %g3 +- stx %g2, [%g3 + TI_GSR] +- add %g6, %g1, %g2 +- stx %fsr, [%g2 + TI_XFSR] +- sll %g1, 5, %g1 +-3: andcc %o5, FPRS_DL, %g0 +- be,pn %icc, 4f +- add %g6, TI_FPREGS, %g2 +- +- add %g6, TI_FPREGS+0x40, %g3 +- membar #Sync +- stda %f0, [%g2 + %g1] ASI_BLK_P +- stda %f16, [%g3 + %g1] ASI_BLK_P +- membar #Sync +- ba,pt %xcc, 4f +- nop +- +- .align 32 +-4: and %o5, FPRS_DU, %o5 +- jmpl %g7 + %g0, %g0 +- wr %o5, FPRS_FEF, %fprs +diff --git a/arch/sparc/lib/ksyms.c b/arch/sparc/lib/ksyms.c +index 1d649a95660c..8069ce12f20b 100644 +--- a/arch/sparc/lib/ksyms.c ++++ b/arch/sparc/lib/ksyms.c +@@ -135,10 +135,6 @@ EXPORT_SYMBOL(copy_user_page); + void VISenter(void); + EXPORT_SYMBOL(VISenter); + +-/* CRYPTO code needs this */ +-void VISenterhalf(void); +-EXPORT_SYMBOL(VISenterhalf); +- + extern void xor_vis_2(unsigned long, unsigned long *, unsigned long *); + extern void xor_vis_3(unsigned long, unsigned long *, unsigned long *, + unsigned long *); +diff --git a/arch/tile/kernel/setup.c b/arch/tile/kernel/setup.c +index b9736ded06f2..656224502dfc 100644 +--- a/arch/tile/kernel/setup.c ++++ b/arch/tile/kernel/setup.c +@@ -1144,7 +1144,7 @@ static void __init load_hv_initrd(void) + + void __init free_initrd_mem(unsigned long begin, unsigned long end) + { +- free_bootmem(__pa(begin), end - begin); ++ free_bootmem_late(__pa(begin), end - begin); + } + + static int __init setup_initrd(char *str) +diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c +index 3790a66d6898..acdf06bc418b 100644 +--- a/arch/x86/boot/compressed/eboot.c ++++ b/arch/x86/boot/compressed/eboot.c +@@ -1194,6 +1194,10 @@ static efi_status_t setup_e820(struct boot_params *params, + unsigned int e820_type = 0; + unsigned long m = efi->efi_memmap; + ++#ifdef CONFIG_X86_64 ++ m |= (u64)efi->efi_memmap_hi << 32; ++#endif ++ + d = (efi_memory_desc_t *)(m + (i * efi->efi_memdesc_size)); + switch (d->type) { + case EFI_RESERVED_TYPE: +diff --git a/arch/x86/kvm/lapic.h b/arch/x86/kvm/lapic.h +index 6a11845fd8b9..72051730caf1 100644 +--- a/arch/x86/kvm/lapic.h ++++ b/arch/x86/kvm/lapic.h +@@ -165,7 +165,7 @@ static inline u16 apic_logical_id(struct kvm_apic_map *map, u32 ldr) + + static inline bool kvm_apic_has_events(struct kvm_vcpu *vcpu) + { +- return vcpu->arch.apic->pending_events; ++ return kvm_vcpu_has_lapic(vcpu) && vcpu->arch.apic->pending_events; + } + + bool kvm_apic_pending_eoi(struct kvm_vcpu *vcpu, int vector); +diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c +index 7d67146c3f87..e180e097a53a 100644 +--- a/arch/x86/xen/enlighten.c ++++ b/arch/x86/xen/enlighten.c +@@ -481,6 +481,7 @@ static void set_aliased_prot(void *v, pgprot_t prot) + pte_t pte; + unsigned long pfn; + struct page *page; ++ unsigned char dummy; + + ptep = lookup_address((unsigned long)v, &level); + BUG_ON(ptep == NULL); +@@ -490,6 +491,32 @@ static void set_aliased_prot(void *v, pgprot_t prot) + + pte = pfn_pte(pfn, prot); + ++ /* ++ * Careful: update_va_mapping() will fail if the virtual address ++ * we're poking isn't populated in the page tables. We don't ++ * need to worry about the direct map (that's always in the page ++ * tables), but we need to be careful about vmap space. In ++ * particular, the top level page table can lazily propagate ++ * entries between processes, so if we've switched mms since we ++ * vmapped the target in the first place, we might not have the ++ * top-level page table entry populated. ++ * ++ * We disable preemption because we want the same mm active when ++ * we probe the target and when we issue the hypercall. We'll ++ * have the same nominal mm, but if we're a kernel thread, lazy ++ * mm dropping could change our pgd. ++ * ++ * Out of an abundance of caution, this uses __get_user() to fault ++ * in the target address just in case there's some obscure case ++ * in which the target address isn't readable. ++ */ ++ ++ preempt_disable(); ++ ++ pagefault_disable(); /* Avoid warnings due to being atomic. */ ++ __get_user(dummy, (unsigned char __user __force *)v); ++ pagefault_enable(); ++ + if (HYPERVISOR_update_va_mapping((unsigned long)v, pte, 0)) + BUG(); + +@@ -501,6 +528,8 @@ static void set_aliased_prot(void *v, pgprot_t prot) + BUG(); + } else + kmap_flush_unused(); ++ ++ preempt_enable(); + } + + static void xen_alloc_ldt(struct desc_struct *ldt, unsigned entries) +@@ -508,6 +537,17 @@ static void xen_alloc_ldt(struct desc_struct *ldt, unsigned entries) + const unsigned entries_per_page = PAGE_SIZE / LDT_ENTRY_SIZE; + int i; + ++ /* ++ * We need to mark the all aliases of the LDT pages RO. We ++ * don't need to call vm_flush_aliases(), though, since that's ++ * only responsible for flushing aliases out the TLBs, not the ++ * page tables, and Xen will flush the TLB for us if needed. ++ * ++ * To avoid confusing future readers: none of this is necessary ++ * to load the LDT. The hypervisor only checks this when the ++ * LDT is faulted in due to subsequent descriptor access. ++ */ ++ + for(i = 0; i < entries; i += entries_per_page) + set_aliased_prot(ldt + i, PAGE_KERNEL_RO); + } +diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c +index 0ac817b750db..6817e28960b7 100644 +--- a/block/blk-cgroup.c ++++ b/block/blk-cgroup.c +@@ -716,8 +716,12 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol, + return -EINVAL; + + disk = get_gendisk(MKDEV(major, minor), &part); +- if (!disk || part) ++ if (!disk) + return -EINVAL; ++ if (part) { ++ put_disk(disk); ++ return -EINVAL; ++ } + + rcu_read_lock(); + spin_lock_irq(disk->queue->queue_lock); +diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c +index 8b67bd0f6bb5..cd4598b2038d 100644 +--- a/drivers/acpi/bus.c ++++ b/drivers/acpi/bus.c +@@ -467,6 +467,16 @@ static int __init acpi_bus_init_irq(void) + return 0; + } + ++/** ++ * acpi_early_init - Initialize ACPICA and populate the ACPI namespace. ++ * ++ * The ACPI tables are accessible after this, but the handling of events has not ++ * been initialized and the global lock is not available yet, so AML should not ++ * be executed at this point. ++ * ++ * Doing this before switching the EFI runtime services to virtual mode allows ++ * the EfiBootServices memory to be freed slightly earlier on boot. ++ */ + void __init acpi_early_init(void) + { + acpi_status status; +@@ -530,26 +540,42 @@ void __init acpi_early_init(void) + acpi_gbl_FADT.sci_interrupt = acpi_sci_override_gsi; + } + #endif ++ return; ++ ++ error0: ++ disable_acpi(); ++} ++ ++/** ++ * acpi_subsystem_init - Finalize the early initialization of ACPI. ++ * ++ * Switch over the platform to the ACPI mode (if possible), initialize the ++ * handling of ACPI events, install the interrupt and global lock handlers. ++ * ++ * Doing this too early is generally unsafe, but at the same time it needs to be ++ * done before all things that really depend on ACPI. The right spot appears to ++ * be before finalizing the EFI initialization. ++ */ ++void __init acpi_subsystem_init(void) ++{ ++ acpi_status status; ++ ++ if (acpi_disabled) ++ return; + + status = acpi_enable_subsystem(~ACPI_NO_ACPI_ENABLE); + if (ACPI_FAILURE(status)) { + printk(KERN_ERR PREFIX "Unable to enable ACPI\n"); +- goto error0; ++ disable_acpi(); ++ } else { ++ /* ++ * If the system is using ACPI then we can be reasonably ++ * confident that any regulators are managed by the firmware ++ * so tell the regulator core it has everything it needs to ++ * know. ++ */ ++ regulator_has_full_constraints(); + } +- +- /* +- * If the system is using ACPI then we can be reasonably +- * confident that any regulators are managed by the firmware +- * so tell the regulator core it has everything it needs to +- * know. +- */ +- regulator_has_full_constraints(); +- +- return; +- +- error0: +- disable_acpi(); +- return; + } + + static int __init acpi_bus_init(void) +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index 98dc0dc605bc..74e18e94bef2 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -4226,10 +4226,47 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { + { "PIONEER DVD-RW DVR-216D", NULL, ATA_HORKAGE_NOSETXFER }, + + /* devices that don't properly handle queued TRIM commands */ +- { "Micron_M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, }, +- { "Crucial_CT???M500SSD*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, }, +- { "Micron_M550*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, }, +- { "Crucial_CT*M550SSD*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, }, ++ { "Micron_M500_*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | ++ ATA_HORKAGE_ZERO_AFTER_TRIM, }, ++ { "Crucial_CT*M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | ++ ATA_HORKAGE_ZERO_AFTER_TRIM, }, ++ { "Micron_M5[15]0_*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM | ++ ATA_HORKAGE_ZERO_AFTER_TRIM, }, ++ { "Crucial_CT*M550*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM | ++ ATA_HORKAGE_ZERO_AFTER_TRIM, }, ++ { "Crucial_CT*MX100*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM | ++ ATA_HORKAGE_ZERO_AFTER_TRIM, }, ++ { "Samsung SSD 8*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | ++ ATA_HORKAGE_ZERO_AFTER_TRIM, }, ++ ++ /* devices that don't properly handle TRIM commands */ ++ { "SuperSSpeed S238*", NULL, ATA_HORKAGE_NOTRIM, }, ++ ++ /* ++ * As defined, the DRAT (Deterministic Read After Trim) and RZAT ++ * (Return Zero After Trim) flags in the ATA Command Set are ++ * unreliable in the sense that they only define what happens if ++ * the device successfully executed the DSM TRIM command. TRIM ++ * is only advisory, however, and the device is free to silently ++ * ignore all or parts of the request. ++ * ++ * Whitelist drives that are known to reliably return zeroes ++ * after TRIM. ++ */ ++ ++ /* ++ * The intel 510 drive has buggy DRAT/RZAT. Explicitly exclude ++ * that model before whitelisting all other intel SSDs. ++ */ ++ { "INTEL*SSDSC2MH*", NULL, 0, }, ++ ++ { "Micron*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, }, ++ { "Crucial*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, }, ++ { "INTEL*SSD*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, }, ++ { "SSD*INTEL*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, }, ++ { "Samsung*SSD*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, }, ++ { "SAMSUNG*SSD*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, }, ++ { "ST[1248][0248]0[FH]*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, }, + + /* devices that don't properly handle TRIM commands */ + { "SuperSSpeed S238*", NULL, ATA_HORKAGE_NOTRIM, }, +diff --git a/drivers/ata/libata-pmp.c b/drivers/ata/libata-pmp.c +index 7ccc084bf1df..85aa76116a30 100644 +--- a/drivers/ata/libata-pmp.c ++++ b/drivers/ata/libata-pmp.c +@@ -460,6 +460,13 @@ static void sata_pmp_quirks(struct ata_port *ap) + ATA_LFLAG_NO_SRST | + ATA_LFLAG_ASSUME_ATA; + } ++ } else if (vendor == 0x11ab && devid == 0x4140) { ++ /* Marvell 4140 quirks */ ++ ata_for_each_link(link, ap, EDGE) { ++ /* port 4 is for SEMB device and it doesn't like SRST */ ++ if (link->pmp == 4) ++ link->flags |= ATA_LFLAG_DISABLED; ++ } + } + } + +diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c +index d6ff64248c23..78d56c9390cc 100644 +--- a/drivers/ata/libata-scsi.c ++++ b/drivers/ata/libata-scsi.c +@@ -2516,13 +2516,15 @@ static unsigned int ata_scsiop_read_cap(struct ata_scsi_args *args, u8 *rbuf) + + if (ata_id_has_trim(args->id) && + !(dev->horkage & ATA_HORKAGE_NOTRIM)) { +- rbuf[14] |= 0x80; /* TPE */ ++ rbuf[14] |= 0x80; /* LBPME */ + +- if (ata_id_has_zero_after_trim(args->id)) +- rbuf[14] |= 0x40; /* TPRZ */ ++ if (ata_id_has_zero_after_trim(args->id) && ++ dev->horkage & ATA_HORKAGE_ZERO_AFTER_TRIM) { ++ ata_dev_info(dev, "Enabling discard_zeroes_data\n"); ++ rbuf[14] |= 0x40; /* LBPRZ */ ++ } + } + } +- + return 0; + } + +diff --git a/drivers/ata/libata-transport.c b/drivers/ata/libata-transport.c +index e37413228228..fd29b7224082 100644 +--- a/drivers/ata/libata-transport.c ++++ b/drivers/ata/libata-transport.c +@@ -559,6 +559,29 @@ show_ata_dev_gscr(struct device *dev, + + static DEVICE_ATTR(gscr, S_IRUGO, show_ata_dev_gscr, NULL); + ++static ssize_t ++show_ata_dev_trim(struct device *dev, ++ struct device_attribute *attr, char *buf) ++{ ++ struct ata_device *ata_dev = transport_class_to_dev(dev); ++ unsigned char *mode; ++ ++ if (!ata_id_has_trim(ata_dev->id)) ++ mode = "unsupported"; ++ else if (ata_dev->horkage & ATA_HORKAGE_NOTRIM) ++ mode = "forced_unsupported"; ++ else if (ata_dev->horkage & ATA_HORKAGE_NO_NCQ_TRIM) ++ mode = "forced_unqueued"; ++ else if (ata_fpdma_dsm_supported(ata_dev)) ++ mode = "queued"; ++ else ++ mode = "unqueued"; ++ ++ return snprintf(buf, 20, "%s\n", mode); ++} ++ ++static DEVICE_ATTR(trim, S_IRUGO, show_ata_dev_trim, NULL); ++ + static DECLARE_TRANSPORT_CLASS(ata_dev_class, + "ata_device", NULL, NULL, NULL); + +@@ -732,6 +755,7 @@ struct scsi_transport_template *ata_attach_transport(void) + SETUP_DEV_ATTRIBUTE(ering); + SETUP_DEV_ATTRIBUTE(id); + SETUP_DEV_ATTRIBUTE(gscr); ++ SETUP_DEV_ATTRIBUTE(trim); + BUG_ON(count > ATA_DEV_ATTRS); + i->dev_attrs[count] = NULL; + +diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c +index 501a8ca662f4..dc1ca84e90f1 100644 +--- a/drivers/block/rbd.c ++++ b/drivers/block/rbd.c +@@ -520,6 +520,7 @@ void rbd_warn(struct rbd_device *rbd_dev, const char *fmt, ...) + # define rbd_assert(expr) ((void) 0) + #endif /* !RBD_DEBUG */ + ++static void rbd_osd_copyup_callback(struct rbd_obj_request *obj_request); + static int rbd_img_obj_request_submit(struct rbd_obj_request *obj_request); + static void rbd_img_parent_read(struct rbd_obj_request *obj_request); + static void rbd_dev_remove_parent(struct rbd_device *rbd_dev); +@@ -1795,6 +1796,16 @@ static void rbd_osd_stat_callback(struct rbd_obj_request *obj_request) + obj_request_done_set(obj_request); + } + ++static void rbd_osd_call_callback(struct rbd_obj_request *obj_request) ++{ ++ dout("%s: obj %p\n", __func__, obj_request); ++ ++ if (obj_request_img_data_test(obj_request)) ++ rbd_osd_copyup_callback(obj_request); ++ else ++ obj_request_done_set(obj_request); ++} ++ + static void rbd_osd_req_callback(struct ceph_osd_request *osd_req, + struct ceph_msg *msg) + { +@@ -1842,6 +1853,8 @@ static void rbd_osd_req_callback(struct ceph_osd_request *osd_req, + rbd_osd_discard_callback(obj_request); + break; + case CEPH_OSD_OP_CALL: ++ rbd_osd_call_callback(obj_request); ++ break; + case CEPH_OSD_OP_NOTIFY_ACK: + case CEPH_OSD_OP_WATCH: + rbd_osd_trivial_callback(obj_request); +@@ -2499,13 +2512,15 @@ out_unwind: + } + + static void +-rbd_img_obj_copyup_callback(struct rbd_obj_request *obj_request) ++rbd_osd_copyup_callback(struct rbd_obj_request *obj_request) + { + struct rbd_img_request *img_request; + struct rbd_device *rbd_dev; + struct page **pages; + u32 page_count; + ++ dout("%s: obj %p\n", __func__, obj_request); ++ + rbd_assert(obj_request->type == OBJ_REQUEST_BIO || + obj_request->type == OBJ_REQUEST_NODATA); + rbd_assert(obj_request_img_data_test(obj_request)); +@@ -2532,9 +2547,7 @@ rbd_img_obj_copyup_callback(struct rbd_obj_request *obj_request) + if (!obj_request->result) + obj_request->xferred = obj_request->length; + +- /* Finish up with the normal image object callback */ +- +- rbd_img_obj_callback(obj_request); ++ obj_request_done_set(obj_request); + } + + static void +@@ -2619,7 +2632,6 @@ rbd_img_obj_parent_read_full_callback(struct rbd_img_request *img_request) + + /* All set, send it off. */ + +- orig_request->callback = rbd_img_obj_copyup_callback; + osdc = &rbd_dev->rbd_client->client->osdc; + img_result = rbd_obj_request_submit(osdc, orig_request); + if (!img_result) +diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c +index 8dc319dd3150..e527a3e13939 100644 +--- a/drivers/bluetooth/ath3k.c ++++ b/drivers/bluetooth/ath3k.c +@@ -107,6 +107,7 @@ static const struct usb_device_id ath3k_table[] = { + { USB_DEVICE(0x0cf3, 0xe003) }, + { USB_DEVICE(0x0CF3, 0xE004) }, + { USB_DEVICE(0x0CF3, 0xE005) }, ++ { USB_DEVICE(0x0CF3, 0xE006) }, + { USB_DEVICE(0x13d3, 0x3362) }, + { USB_DEVICE(0x13d3, 0x3375) }, + { USB_DEVICE(0x13d3, 0x3393) }, +@@ -165,6 +166,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = { + { USB_DEVICE(0x0CF3, 0x817a), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x0cf3, 0xe006), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 }, +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index c675e2bd9fd3..82360dd65a1f 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -195,6 +195,7 @@ static const struct usb_device_id blacklist_table[] = { + { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x0cf3, 0xe006), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 }, +diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c +index aa30a25c8d49..7d52c0aafa7f 100644 +--- a/drivers/char/hw_random/core.c ++++ b/drivers/char/hw_random/core.c +@@ -365,7 +365,7 @@ static int hwrng_fillfn(void *unused) + static void start_khwrngd(void) + { + hwrng_fill = kthread_run(hwrng_fillfn, NULL, "hwrng"); +- if (hwrng_fill == ERR_PTR(-ENOMEM)) { ++ if (IS_ERR(hwrng_fill)) { + pr_err("hwrng_fill thread creation failed"); + hwrng_fill = NULL; + } +diff --git a/drivers/char/i8k.c b/drivers/char/i8k.c +index 471f985e38d2..26397bb7d826 100644 +--- a/drivers/char/i8k.c ++++ b/drivers/char/i8k.c +@@ -796,6 +796,21 @@ static struct dmi_system_id i8k_dmi_table[] __initdata = { + { } + }; + ++static struct dmi_system_id i8k_blacklist_dmi_table[] __initdata = { ++ { ++ /* ++ * CPU fan speed going up and down on Dell Studio XPS 8100 ++ * for unknown reasons. ++ */ ++ .ident = "Dell Studio XPS 8100", ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Studio XPS 8100"), ++ }, ++ }, ++ { } ++}; ++ + /* + * Probe for the presence of a supported laptop. + */ +@@ -806,7 +821,8 @@ static int __init i8k_probe(void) + /* + * Get DMI information + */ +- if (!dmi_check_system(i8k_dmi_table)) { ++ if (!dmi_check_system(i8k_dmi_table) || ++ dmi_check_system(i8k_blacklist_dmi_table)) { + if (!ignore_dmi && !force) + return -ENODEV; + +diff --git a/drivers/clk/keystone/pll.c b/drivers/clk/keystone/pll.c +index 0dd8a4b12747..4a375ead70e9 100644 +--- a/drivers/clk/keystone/pll.c ++++ b/drivers/clk/keystone/pll.c +@@ -37,7 +37,8 @@ + * Main PLL or any other PLLs in the device such as ARM PLL, DDR PLL + * or PA PLL available on keystone2. These PLLs are controlled by + * this register. Main PLL is controlled by a PLL controller. +- * @pllm: PLL register map address ++ * @pllm: PLL register map address for multiplier bits ++ * @pllod: PLL register map address for post divider bits + * @pll_ctl0: PLL controller map address + * @pllm_lower_mask: multiplier lower mask + * @pllm_upper_mask: multiplier upper mask +@@ -53,6 +54,7 @@ struct clk_pll_data { + u32 phy_pllm; + u32 phy_pll_ctl0; + void __iomem *pllm; ++ void __iomem *pllod; + void __iomem *pll_ctl0; + u32 pllm_lower_mask; + u32 pllm_upper_mask; +@@ -102,7 +104,11 @@ static unsigned long clk_pllclk_recalc(struct clk_hw *hw, + /* read post divider from od bits*/ + postdiv = ((val & pll_data->clkod_mask) >> + pll_data->clkod_shift) + 1; +- else ++ else if (pll_data->pllod) { ++ postdiv = readl(pll_data->pllod); ++ postdiv = ((postdiv & pll_data->clkod_mask) >> ++ pll_data->clkod_shift) + 1; ++ } else + postdiv = pll_data->postdiv; + + rate /= (prediv + 1); +@@ -172,12 +178,21 @@ static void __init _of_pll_clk_init(struct device_node *node, bool pllctrl) + /* assume the PLL has output divider register bits */ + pll_data->clkod_mask = CLKOD_MASK; + pll_data->clkod_shift = CLKOD_SHIFT; ++ ++ /* ++ * Check if there is an post-divider register. If not ++ * assume od bits are part of control register. ++ */ ++ i = of_property_match_string(node, "reg-names", ++ "post-divider"); ++ pll_data->pllod = of_iomap(node, i); + } + + i = of_property_match_string(node, "reg-names", "control"); + pll_data->pll_ctl0 = of_iomap(node, i); + if (!pll_data->pll_ctl0) { + pr_err("%s: ioremap failed\n", __func__); ++ iounmap(pll_data->pllod); + goto out; + } + +@@ -193,6 +208,7 @@ static void __init _of_pll_clk_init(struct device_node *node, bool pllctrl) + pll_data->pllm = of_iomap(node, i); + if (!pll_data->pllm) { + iounmap(pll_data->pll_ctl0); ++ iounmap(pll_data->pllod); + goto out; + } + } +diff --git a/drivers/cpufreq/pcc-cpufreq.c b/drivers/cpufreq/pcc-cpufreq.c +index 4d2c8e861089..2a0d58959acf 100644 +--- a/drivers/cpufreq/pcc-cpufreq.c ++++ b/drivers/cpufreq/pcc-cpufreq.c +@@ -603,6 +603,13 @@ static void __exit pcc_cpufreq_exit(void) + free_percpu(pcc_cpu_info); + } + ++static const struct acpi_device_id processor_device_ids[] = { ++ {ACPI_PROCESSOR_OBJECT_HID, }, ++ {ACPI_PROCESSOR_DEVICE_HID, }, ++ {}, ++}; ++MODULE_DEVICE_TABLE(acpi, processor_device_ids); ++ + MODULE_AUTHOR("Matthew Garrett, Naga Chumbalkar"); + MODULE_VERSION(PCC_VERSION); + MODULE_DESCRIPTION("Processor Clocking Control interface driver"); +diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c +index f757a0f428bd..3beed38d306a 100644 +--- a/drivers/crypto/ixp4xx_crypto.c ++++ b/drivers/crypto/ixp4xx_crypto.c +@@ -904,7 +904,6 @@ static int ablk_perform(struct ablkcipher_request *req, int encrypt) + crypt->mode |= NPE_OP_NOT_IN_PLACE; + /* This was never tested by Intel + * for more than one dst buffer, I think. */ +- BUG_ON(req->dst->length < nbytes); + req_ctx->dst = NULL; + if (!chainup_buffers(dev, req->dst, nbytes, &dst_hook, + flags, DMA_FROM_DEVICE)) +diff --git a/drivers/crypto/qat/qat_common/qat_algs.c b/drivers/crypto/qat/qat_common/qat_algs.c +index 9e9619cd4a79..5b35e5d2231d 100644 +--- a/drivers/crypto/qat/qat_common/qat_algs.c ++++ b/drivers/crypto/qat/qat_common/qat_algs.c +@@ -73,7 +73,8 @@ + ICP_QAT_HW_CIPHER_KEY_CONVERT, \ + ICP_QAT_HW_CIPHER_DECRYPT) + +-static atomic_t active_dev; ++static DEFINE_MUTEX(algs_lock); ++static unsigned int active_devs; + + struct qat_alg_buf { + uint32_t len; +@@ -955,27 +956,34 @@ static struct crypto_alg qat_algs[] = { { + + int qat_algs_register(void) + { +- if (atomic_add_return(1, &active_dev) == 1) { ++ int ret = 0; ++ ++ mutex_lock(&algs_lock); ++ if (++active_devs == 1) { + int i; + + for (i = 0; i < ARRAY_SIZE(qat_algs); i++) + qat_algs[i].cra_flags = CRYPTO_ALG_TYPE_AEAD | + CRYPTO_ALG_ASYNC; +- return crypto_register_algs(qat_algs, ARRAY_SIZE(qat_algs)); ++ ret = crypto_register_algs(qat_algs, ARRAY_SIZE(qat_algs)); + } +- return 0; ++ mutex_unlock(&algs_lock); ++ return ret; + } + + int qat_algs_unregister(void) + { +- if (atomic_sub_return(1, &active_dev) == 0) +- return crypto_unregister_algs(qat_algs, ARRAY_SIZE(qat_algs)); +- return 0; ++ int ret = 0; ++ ++ mutex_lock(&algs_lock); ++ if (--active_devs == 0) ++ ret = crypto_unregister_algs(qat_algs, ARRAY_SIZE(qat_algs)); ++ mutex_unlock(&algs_lock); ++ return ret; + } + + int qat_algs_init(void) + { +- atomic_set(&active_dev, 0); + crypto_get_default_rng(); + return 0; + } +diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c +index 1f5e42a1f5b4..dea239c38134 100644 +--- a/drivers/gpu/drm/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/drm_dp_mst_topology.c +@@ -1275,7 +1275,6 @@ retry: + goto retry; + } + DRM_DEBUG_KMS("failed to dpcd write %d %d\n", tosend, ret); +- WARN(1, "fail\n"); + + return -EIO; + } +diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h +index a84971351eee..c68e9f2947a6 100644 +--- a/drivers/gpu/drm/i915/i915_drv.h ++++ b/drivers/gpu/drm/i915/i915_drv.h +@@ -2899,15 +2899,14 @@ int vlv_freq_opcode(struct drm_i915_private *dev_priv, int val); + #define I915_READ64(reg) dev_priv->uncore.funcs.mmio_readq(dev_priv, (reg), true) + + #define I915_READ64_2x32(lower_reg, upper_reg) ({ \ +- u32 upper = I915_READ(upper_reg); \ +- u32 lower = I915_READ(lower_reg); \ +- u32 tmp = I915_READ(upper_reg); \ +- if (upper != tmp) { \ +- upper = tmp; \ +- lower = I915_READ(lower_reg); \ +- WARN_ON(I915_READ(upper_reg) != upper); \ +- } \ +- (u64)upper << 32 | lower; }) ++ u32 upper, lower, tmp; \ ++ tmp = I915_READ(upper_reg); \ ++ do { \ ++ upper = tmp; \ ++ lower = I915_READ(lower_reg); \ ++ tmp = I915_READ(upper_reg); \ ++ } while (upper != tmp); \ ++ (u64)upper << 32 | lower; }) + + #define POSTING_READ(reg) (void)I915_READ_NOTRACE(reg) + #define POSTING_READ16(reg) (void)I915_READ16_NOTRACE(reg) +diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c +index 3e5f6b71f3ad..c097d3a82bda 100644 +--- a/drivers/gpu/drm/radeon/radeon_combios.c ++++ b/drivers/gpu/drm/radeon/radeon_combios.c +@@ -1255,10 +1255,15 @@ struct radeon_encoder_lvds *radeon_combios_get_lvds_info(struct radeon_encoder + + if ((RBIOS16(tmp) == lvds->native_mode.hdisplay) && + (RBIOS16(tmp + 2) == lvds->native_mode.vdisplay)) { ++ u32 hss = (RBIOS16(tmp + 21) - RBIOS16(tmp + 19) - 1) * 8; ++ ++ if (hss > lvds->native_mode.hdisplay) ++ hss = (10 - 1) * 8; ++ + lvds->native_mode.htotal = lvds->native_mode.hdisplay + + (RBIOS16(tmp + 17) - RBIOS16(tmp + 19)) * 8; + lvds->native_mode.hsync_start = lvds->native_mode.hdisplay + +- (RBIOS16(tmp + 21) - RBIOS16(tmp + 19) - 1) * 8; ++ hss; + lvds->native_mode.hsync_end = lvds->native_mode.hsync_start + + (RBIOS8(tmp + 23) * 8); + +diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c +index 7eda03c13805..737d18c924bc 100644 +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -1943,6 +1943,7 @@ static const struct hid_device_id hid_have_special_driver[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb65a) }, + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE_BT) }, + { HID_USB_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE_PRO) }, + { HID_USB_DEVICE(USB_VENDOR_ID_TOPSEED, USB_DEVICE_ID_TOPSEED_CYBERLINK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_TOPSEED2, USB_DEVICE_ID_TOPSEED2_RF_COMBO) }, + { HID_USB_DEVICE(USB_VENDOR_ID_TWINHAN, USB_DEVICE_ID_TWINHAN_IR_REMOTE) }, +@@ -2333,6 +2334,7 @@ static const struct hid_device_id hid_ignore_list[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_MCC, USB_DEVICE_ID_MCC_PMD1208LS) }, + { HID_USB_DEVICE(USB_VENDOR_ID_MICROCHIP, USB_DEVICE_ID_PICKIT1) }, + { HID_USB_DEVICE(USB_VENDOR_ID_MICROCHIP, USB_DEVICE_ID_PICKIT2) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_MICROCHIP, USB_DEVICE_ID_PICK16F1454) }, + { HID_USB_DEVICE(USB_VENDOR_ID_NATIONAL_SEMICONDUCTOR, USB_DEVICE_ID_N_S_HARMONY) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ONTRAK, USB_DEVICE_ID_ONTRAK_ADU100) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ONTRAK, USB_DEVICE_ID_ONTRAK_ADU100 + 20) }, +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 252a7ed40f86..3603d0cb25d9 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -250,6 +250,8 @@ + + #define USB_DEVICE_ID_CYGNAL_RADIO_SI4713 0x8244 + ++#define USB_DEVICE_ID_CYGNAL_RADIO_SI4713 0x8244 ++ + #define USB_VENDOR_ID_CYPRESS 0x04b4 + #define USB_DEVICE_ID_CYPRESS_MOUSE 0x0001 + #define USB_DEVICE_ID_CYPRESS_HIDCOM 0x5500 +@@ -648,6 +650,7 @@ + #define USB_DEVICE_ID_PICKIT2 0x0033 + #define USB_DEVICE_ID_PICOLCD 0xc002 + #define USB_DEVICE_ID_PICOLCD_BOOTLOADER 0xf002 ++#define USB_DEVICE_ID_PICK16F1454 0x0042 + + #define USB_VENDOR_ID_MICROSOFT 0x045e + #define USB_DEVICE_ID_SIDEWINDER_GV 0x003b +@@ -895,6 +898,7 @@ + #define USB_VENDOR_ID_TIVO 0x150a + #define USB_DEVICE_ID_TIVO_SLIDE_BT 0x1200 + #define USB_DEVICE_ID_TIVO_SLIDE 0x1201 ++#define USB_DEVICE_ID_TIVO_SLIDE_PRO 0x1203 + + #define USB_VENDOR_ID_TOPSEED 0x0766 + #define USB_DEVICE_ID_TOPSEED_CYBERLINK 0x0204 +diff --git a/drivers/hid/hid-tivo.c b/drivers/hid/hid-tivo.c +index d790d8d71f7f..d98696927453 100644 +--- a/drivers/hid/hid-tivo.c ++++ b/drivers/hid/hid-tivo.c +@@ -64,6 +64,7 @@ static const struct hid_device_id tivo_devices[] = { + /* TiVo Slide Bluetooth remote, pairs with a Broadcom dongle */ + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE_BT) }, + { HID_USB_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE_PRO) }, + { } + }; + MODULE_DEVICE_TABLE(hid, tivo_devices); +diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig +index 917c3585f45b..06e99eb64295 100644 +--- a/drivers/i2c/busses/Kconfig ++++ b/drivers/i2c/busses/Kconfig +@@ -123,6 +123,7 @@ config I2C_I801 + Wildcat Point-LP (PCH) + BayTrail (SOC) + Sunrise Point-H (PCH) ++ Sunrise Point-LP (PCH) + + This driver can also be built as a module. If so, the module + will be called i2c-i801. +diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c +index 6ab4f1cb21f3..04d7d70ae32b 100644 +--- a/drivers/i2c/busses/i2c-i801.c ++++ b/drivers/i2c/busses/i2c-i801.c +@@ -59,6 +59,7 @@ + * Wildcat Point-LP (PCH) 0x9ca2 32 hard yes yes yes + * BayTrail (SOC) 0x0f12 32 hard yes yes yes + * Sunrise Point-H (PCH) 0xa123 32 hard yes yes yes ++ * Sunrise Point-LP (PCH) 0x9d23 32 hard yes yes yes + * + * Features supported by this driver: + * Software PEC no +@@ -182,6 +183,7 @@ + #define PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_SMBUS 0x9c22 + #define PCI_DEVICE_ID_INTEL_WILDCATPOINT_LP_SMBUS 0x9ca2 + #define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_SMBUS 0xa123 ++#define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_SMBUS 0x9d23 + + struct i801_mux_config { + char *gpio_chip; +@@ -829,6 +831,7 @@ static const struct pci_device_id i801_ids[] = { + { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BAYTRAIL_SMBUS) }, + { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BRASWELL_SMBUS) }, + { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_SMBUS) }, ++ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_SMBUS) }, + { 0, } + }; + +diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c +index 9b7ee7e427df..4a8a1d922e0f 100644 +--- a/drivers/idle/intel_idle.c ++++ b/drivers/idle/intel_idle.c +@@ -727,6 +727,7 @@ static const struct x86_cpu_id intel_idle_ids[] = { + ICPU(0x46, idle_cpu_hsw), + ICPU(0x4d, idle_cpu_avn), + ICPU(0x3d, idle_cpu_bdw), ++ ICPU(0x47, idle_cpu_bdw), + ICPU(0x4f, idle_cpu_bdw), + ICPU(0x56, idle_cpu_bdw), + {} +diff --git a/drivers/iio/accel/hid-sensor-accel-3d.c b/drivers/iio/accel/hid-sensor-accel-3d.c +index d5d95317003a..8ed7c0a70ed2 100644 +--- a/drivers/iio/accel/hid-sensor-accel-3d.c ++++ b/drivers/iio/accel/hid-sensor-accel-3d.c +@@ -305,7 +305,6 @@ static int hid_accel_3d_probe(struct platform_device *pdev) + struct iio_dev *indio_dev; + struct accel_3d_state *accel_state; + struct hid_sensor_hub_device *hsdev = pdev->dev.platform_data; +- struct iio_chan_spec *channels; + + indio_dev = devm_iio_device_alloc(&pdev->dev, + sizeof(struct accel_3d_state)); +@@ -326,21 +325,21 @@ static int hid_accel_3d_probe(struct platform_device *pdev) + return ret; + } + +- channels = kmemdup(accel_3d_channels, sizeof(accel_3d_channels), +- GFP_KERNEL); +- if (!channels) { ++ indio_dev->channels = kmemdup(accel_3d_channels, ++ sizeof(accel_3d_channels), GFP_KERNEL); ++ if (!indio_dev->channels) { + dev_err(&pdev->dev, "failed to duplicate channels\n"); + return -ENOMEM; + } + +- ret = accel_3d_parse_report(pdev, hsdev, channels, +- HID_USAGE_SENSOR_ACCEL_3D, accel_state); ++ ret = accel_3d_parse_report(pdev, hsdev, ++ (struct iio_chan_spec *)indio_dev->channels, ++ HID_USAGE_SENSOR_ACCEL_3D, accel_state); + if (ret) { + dev_err(&pdev->dev, "failed to setup attributes\n"); + goto error_free_dev_mem; + } + +- indio_dev->channels = channels; + indio_dev->num_channels = ARRAY_SIZE(accel_3d_channels); + indio_dev->dev.parent = &pdev->dev; + indio_dev->info = &accel_3d_info; +diff --git a/drivers/iio/adc/twl6030-gpadc.c b/drivers/iio/adc/twl6030-gpadc.c +index 89d8aa1d2818..df12c57e6ce0 100644 +--- a/drivers/iio/adc/twl6030-gpadc.c ++++ b/drivers/iio/adc/twl6030-gpadc.c +@@ -1001,7 +1001,7 @@ static struct platform_driver twl6030_gpadc_driver = { + + module_platform_driver(twl6030_gpadc_driver); + +-MODULE_ALIAS("platform: " DRIVER_NAME); ++MODULE_ALIAS("platform:" DRIVER_NAME); + MODULE_AUTHOR("Balaji T K <[email protected]>"); + MODULE_AUTHOR("Graeme Gregory <[email protected]>"); + MODULE_AUTHOR("Oleksandr Kozaruk <[email protected]"); +diff --git a/drivers/iio/gyro/hid-sensor-gyro-3d.c b/drivers/iio/gyro/hid-sensor-gyro-3d.c +index a3ea1e8785d7..c23c36bf99b5 100644 +--- a/drivers/iio/gyro/hid-sensor-gyro-3d.c ++++ b/drivers/iio/gyro/hid-sensor-gyro-3d.c +@@ -304,7 +304,6 @@ static int hid_gyro_3d_probe(struct platform_device *pdev) + struct iio_dev *indio_dev; + struct gyro_3d_state *gyro_state; + struct hid_sensor_hub_device *hsdev = pdev->dev.platform_data; +- struct iio_chan_spec *channels; + + indio_dev = devm_iio_device_alloc(&pdev->dev, sizeof(*gyro_state)); + if (!indio_dev) +@@ -323,21 +322,21 @@ static int hid_gyro_3d_probe(struct platform_device *pdev) + return ret; + } + +- channels = kmemdup(gyro_3d_channels, sizeof(gyro_3d_channels), +- GFP_KERNEL); +- if (!channels) { ++ indio_dev->channels = kmemdup(gyro_3d_channels, ++ sizeof(gyro_3d_channels), GFP_KERNEL); ++ if (!indio_dev->channels) { + dev_err(&pdev->dev, "failed to duplicate channels\n"); + return -ENOMEM; + } + +- ret = gyro_3d_parse_report(pdev, hsdev, channels, +- HID_USAGE_SENSOR_GYRO_3D, gyro_state); ++ ret = gyro_3d_parse_report(pdev, hsdev, ++ (struct iio_chan_spec *)indio_dev->channels, ++ HID_USAGE_SENSOR_GYRO_3D, gyro_state); + if (ret) { + dev_err(&pdev->dev, "failed to setup attributes\n"); + goto error_free_dev_mem; + } + +- indio_dev->channels = channels; + indio_dev->num_channels = ARRAY_SIZE(gyro_3d_channels); + indio_dev->dev.parent = &pdev->dev; + indio_dev->info = &gyro_3d_info; +diff --git a/drivers/iio/light/hid-sensor-als.c b/drivers/iio/light/hid-sensor-als.c +index a5283d75c096..9c44fe02e62e 100644 +--- a/drivers/iio/light/hid-sensor-als.c ++++ b/drivers/iio/light/hid-sensor-als.c +@@ -270,7 +270,6 @@ static int hid_als_probe(struct platform_device *pdev) + struct iio_dev *indio_dev; + struct als_state *als_state; + struct hid_sensor_hub_device *hsdev = pdev->dev.platform_data; +- struct iio_chan_spec *channels; + + indio_dev = devm_iio_device_alloc(&pdev->dev, sizeof(struct als_state)); + if (!indio_dev) +@@ -288,20 +287,21 @@ static int hid_als_probe(struct platform_device *pdev) + return ret; + } + +- channels = kmemdup(als_channels, sizeof(als_channels), GFP_KERNEL); +- if (!channels) { ++ indio_dev->channels = kmemdup(als_channels, ++ sizeof(als_channels), GFP_KERNEL); ++ if (!indio_dev->channels) { + dev_err(&pdev->dev, "failed to duplicate channels\n"); + return -ENOMEM; + } + +- ret = als_parse_report(pdev, hsdev, channels, +- HID_USAGE_SENSOR_ALS, als_state); ++ ret = als_parse_report(pdev, hsdev, ++ (struct iio_chan_spec *)indio_dev->channels, ++ HID_USAGE_SENSOR_ALS, als_state); + if (ret) { + dev_err(&pdev->dev, "failed to setup attributes\n"); + goto error_free_dev_mem; + } + +- indio_dev->channels = channels; + indio_dev->num_channels = + ARRAY_SIZE(als_channels); + indio_dev->dev.parent = &pdev->dev; +diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c +index a0966331a89b..c6f7e918b2b1 100644 +--- a/drivers/input/touchscreen/usbtouchscreen.c ++++ b/drivers/input/touchscreen/usbtouchscreen.c +@@ -625,6 +625,9 @@ static int dmc_tsc10_init(struct usbtouch_usb *usbtouch) + goto err_out; + } + ++ /* TSC-25 data sheet specifies a delay after the RESET command */ ++ msleep(150); ++ + /* set coordinate output rate */ + buf[0] = buf[1] = 0xFF; + ret = usb_control_msg(dev, usb_rcvctrlpipe (dev, 0), +diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c +index da3604e73e8a..cced062cab4b 100644 +--- a/drivers/md/bitmap.c ++++ b/drivers/md/bitmap.c +@@ -564,6 +564,8 @@ static int bitmap_read_sb(struct bitmap *bitmap) + if (err) + return err; + ++ err = -EINVAL; ++ + sb = kmap_atomic(sb_page); + + chunksize = le32_to_cpu(sb->chunksize); +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 43390353d62f..dd7a3701b99c 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -5432,8 +5432,7 @@ static int get_bitmap_file(struct mddev *mddev, void __user * arg) + char *ptr, *buf = NULL; + int err = -ENOMEM; + +- file = kmalloc(sizeof(*file), GFP_NOIO); +- ++ file = kzalloc(sizeof(*file), GFP_NOIO); + if (!file) + goto out; + +diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c +index 2f2f38f4d83c..d24245c7b94a 100644 +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -336,7 +336,7 @@ static void raid1_end_read_request(struct bio *bio, int error) + spin_lock_irqsave(&conf->device_lock, flags); + if (r1_bio->mddev->degraded == conf->raid_disks || + (r1_bio->mddev->degraded == conf->raid_disks-1 && +- !test_bit(Faulty, &conf->mirrors[mirror].rdev->flags))) ++ test_bit(In_sync, &conf->mirrors[mirror].rdev->flags))) + uptodate = 1; + spin_unlock_irqrestore(&conf->device_lock, flags); + } +@@ -1474,6 +1474,7 @@ static void error(struct mddev *mddev, struct md_rdev *rdev) + { + char b[BDEVNAME_SIZE]; + struct r1conf *conf = mddev->private; ++ unsigned long flags; + + /* + * If it is not operational, then we have already marked it as dead +@@ -1493,14 +1494,13 @@ static void error(struct mddev *mddev, struct md_rdev *rdev) + return; + } + set_bit(Blocked, &rdev->flags); ++ spin_lock_irqsave(&conf->device_lock, flags); + if (test_and_clear_bit(In_sync, &rdev->flags)) { +- unsigned long flags; +- spin_lock_irqsave(&conf->device_lock, flags); + mddev->degraded++; + set_bit(Faulty, &rdev->flags); +- spin_unlock_irqrestore(&conf->device_lock, flags); + } else + set_bit(Faulty, &rdev->flags); ++ spin_unlock_irqrestore(&conf->device_lock, flags); + /* + * if recovery is running, make sure it aborts. + */ +@@ -1566,7 +1566,10 @@ static int raid1_spare_active(struct mddev *mddev) + * Find all failed disks within the RAID1 configuration + * and mark them readable. + * Called under mddev lock, so rcu protection not needed. ++ * device_lock used to avoid races with raid1_end_read_request ++ * which expects 'In_sync' flags and ->degraded to be consistent. + */ ++ spin_lock_irqsave(&conf->device_lock, flags); + for (i = 0; i < conf->raid_disks; i++) { + struct md_rdev *rdev = conf->mirrors[i].rdev; + struct md_rdev *repl = conf->mirrors[conf->raid_disks + i].rdev; +@@ -1596,7 +1599,6 @@ static int raid1_spare_active(struct mddev *mddev) + sysfs_notify_dirent_safe(rdev->sysfs_state); + } + } +- spin_lock_irqsave(&conf->device_lock, flags); + mddev->degraded -= count; + spin_unlock_irqrestore(&conf->device_lock, flags); + +diff --git a/drivers/mmc/host/sdhci-esdhc.h b/drivers/mmc/host/sdhci-esdhc.h +index 3497cfaf683c..a870c42731d7 100644 +--- a/drivers/mmc/host/sdhci-esdhc.h ++++ b/drivers/mmc/host/sdhci-esdhc.h +@@ -45,6 +45,6 @@ + #define ESDHC_DMA_SYSCTL 0x40c + #define ESDHC_DMA_SNOOP 0x00000040 + +-#define ESDHC_HOST_CONTROL_RES 0x05 ++#define ESDHC_HOST_CONTROL_RES 0x01 + + #endif /* _DRIVERS_MMC_SDHCI_ESDHC_H */ +diff --git a/drivers/phy/phy-twl4030-usb.c b/drivers/phy/phy-twl4030-usb.c +index 7b04befd5271..13dd070a69da 100644 +--- a/drivers/phy/phy-twl4030-usb.c ++++ b/drivers/phy/phy-twl4030-usb.c +@@ -144,6 +144,16 @@ + #define PMBR1 0x0D + #define GPIO_USB_4PIN_ULPI_2430C (3 << 0) + ++/* ++ * If VBUS is valid or ID is ground, then we know a ++ * cable is present and we need to be runtime-enabled ++ */ ++static inline bool cable_present(enum omap_musb_vbus_id_status stat) ++{ ++ return stat == OMAP_MUSB_VBUS_VALID || ++ stat == OMAP_MUSB_ID_GROUND; ++} ++ + struct twl4030_usb { + struct usb_phy phy; + struct device *dev; +@@ -536,8 +546,10 @@ static irqreturn_t twl4030_usb_irq(int irq, void *_twl) + + mutex_lock(&twl->lock); + if (status >= 0 && status != twl->linkstat) { ++ status_changed = ++ cable_present(twl->linkstat) != ++ cable_present(status); + twl->linkstat = status; +- status_changed = true; + } + mutex_unlock(&twl->lock); + +@@ -553,15 +565,11 @@ static irqreturn_t twl4030_usb_irq(int irq, void *_twl) + * USB_LINK_VBUS state. musb_hdrc won't care until it + * starts to handle softconnect right. + */ +- if ((status == OMAP_MUSB_VBUS_VALID) || +- (status == OMAP_MUSB_ID_GROUND)) { +- if (pm_runtime_suspended(twl->dev)) +- pm_runtime_get_sync(twl->dev); ++ if (cable_present(status)) { ++ pm_runtime_get_sync(twl->dev); + } else { +- if (pm_runtime_active(twl->dev)) { +- pm_runtime_mark_last_busy(twl->dev); +- pm_runtime_put_autosuspend(twl->dev); +- } ++ pm_runtime_mark_last_busy(twl->dev); ++ pm_runtime_put_autosuspend(twl->dev); + } + omap_musb_mailbox(status); + } +@@ -765,6 +773,9 @@ static int twl4030_usb_remove(struct platform_device *pdev) + + /* disable complete OTG block */ + twl4030_usb_clear_bits(twl, POWER_CTRL, POWER_CTRL_OTG_ENAB); ++ ++ if (cable_present(twl->linkstat)) ++ pm_runtime_put_noidle(twl->dev); + pm_runtime_mark_last_busy(twl->dev); + pm_runtime_put(twl->dev); + +diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c +index cef5d49b59cd..b8311af7dda4 100644 +--- a/drivers/scsi/hpsa.c ++++ b/drivers/scsi/hpsa.c +@@ -103,7 +103,6 @@ static const struct pci_device_id hpsa_pci_device_id[] = { + {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSH, 0x103C, 0x1922}, + {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSH, 0x103C, 0x1923}, + {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSH, 0x103C, 0x1924}, +- {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSH, 0x103C, 0x1925}, + {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSH, 0x103C, 0x1926}, + {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSH, 0x103C, 0x1928}, + {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSH, 0x103C, 0x1929}, +@@ -149,6 +148,7 @@ static struct board_type products[] = { + {0x3249103C, "Smart Array P812", &SA5_access}, + {0x324A103C, "Smart Array P712m", &SA5_access}, + {0x324B103C, "Smart Array P711m", &SA5_access}, ++ {0x3233103C, "HP StorageWorks 1210m", &SA5_access}, /* alias of 333f */ + {0x3350103C, "Smart Array P222", &SA5_access}, + {0x3351103C, "Smart Array P420", &SA5_access}, + {0x3352103C, "Smart Array P421", &SA5_access}, +diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c +index c3bdca7bf1e9..f2e1b92eb314 100644 +--- a/drivers/scsi/ipr.c ++++ b/drivers/scsi/ipr.c +@@ -592,9 +592,10 @@ static void ipr_trc_hook(struct ipr_cmnd *ipr_cmd, + { + struct ipr_trace_entry *trace_entry; + struct ipr_ioa_cfg *ioa_cfg = ipr_cmd->ioa_cfg; ++ unsigned int trace_index; + +- trace_entry = &ioa_cfg->trace[atomic_add_return +- (1, &ioa_cfg->trace_index)%IPR_NUM_TRACE_ENTRIES]; ++ trace_index = atomic_add_return(1, &ioa_cfg->trace_index) & IPR_TRACE_INDEX_MASK; ++ trace_entry = &ioa_cfg->trace[trace_index]; + trace_entry->time = jiffies; + trace_entry->op_code = ipr_cmd->ioarcb.cmd_pkt.cdb[0]; + trace_entry->type = type; +@@ -1044,10 +1045,15 @@ static void ipr_send_blocking_cmd(struct ipr_cmnd *ipr_cmd, + + static int ipr_get_hrrq_index(struct ipr_ioa_cfg *ioa_cfg) + { ++ unsigned int hrrq; ++ + if (ioa_cfg->hrrq_num == 1) +- return 0; +- else +- return (atomic_add_return(1, &ioa_cfg->hrrq_index) % (ioa_cfg->hrrq_num - 1)) + 1; ++ hrrq = 0; ++ else { ++ hrrq = atomic_add_return(1, &ioa_cfg->hrrq_index); ++ hrrq = (hrrq % (ioa_cfg->hrrq_num - 1)) + 1; ++ } ++ return hrrq; + } + + /** +@@ -6227,21 +6233,23 @@ static void ipr_scsi_done(struct ipr_cmnd *ipr_cmd) + struct ipr_ioa_cfg *ioa_cfg = ipr_cmd->ioa_cfg; + struct scsi_cmnd *scsi_cmd = ipr_cmd->scsi_cmd; + u32 ioasc = be32_to_cpu(ipr_cmd->s.ioasa.hdr.ioasc); +- unsigned long hrrq_flags; ++ unsigned long lock_flags; + + scsi_set_resid(scsi_cmd, be32_to_cpu(ipr_cmd->s.ioasa.hdr.residual_data_len)); + + if (likely(IPR_IOASC_SENSE_KEY(ioasc) == 0)) { + scsi_dma_unmap(scsi_cmd); + +- spin_lock_irqsave(ipr_cmd->hrrq->lock, hrrq_flags); ++ spin_lock_irqsave(ipr_cmd->hrrq->lock, lock_flags); + list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q); + scsi_cmd->scsi_done(scsi_cmd); +- spin_unlock_irqrestore(ipr_cmd->hrrq->lock, hrrq_flags); ++ spin_unlock_irqrestore(ipr_cmd->hrrq->lock, lock_flags); + } else { +- spin_lock_irqsave(ipr_cmd->hrrq->lock, hrrq_flags); ++ spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags); ++ spin_lock(&ipr_cmd->hrrq->_lock); + ipr_erp_start(ioa_cfg, ipr_cmd); +- spin_unlock_irqrestore(ipr_cmd->hrrq->lock, hrrq_flags); ++ spin_unlock(&ipr_cmd->hrrq->_lock); ++ spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags); + } + } + +diff --git a/drivers/scsi/ipr.h b/drivers/scsi/ipr.h +index ae4626f64208..489487bdf230 100644 +--- a/drivers/scsi/ipr.h ++++ b/drivers/scsi/ipr.h +@@ -1481,6 +1481,7 @@ struct ipr_ioa_cfg { + + #define IPR_NUM_TRACE_INDEX_BITS 8 + #define IPR_NUM_TRACE_ENTRIES (1 << IPR_NUM_TRACE_INDEX_BITS) ++#define IPR_TRACE_INDEX_MASK (IPR_NUM_TRACE_ENTRIES - 1) + #define IPR_TRACE_SIZE (sizeof(struct ipr_trace_entry) * IPR_NUM_TRACE_ENTRIES) + char trace_start[8]; + #define IPR_TRACE_START_LABEL "trace" +diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c +index 07b2ea1fbf0d..b3c8aabfd687 100644 +--- a/drivers/scsi/sg.c ++++ b/drivers/scsi/sg.c +@@ -1785,6 +1785,9 @@ sg_start_req(Sg_request *srp, unsigned char *cmd) + md->from_user = 0; + } + ++ if (unlikely(iov_count > UIO_MAXIOV)) ++ return -EINVAL; ++ + if (iov_count) { + int len, size = sizeof(struct sg_iovec) * iov_count; + struct iovec *iov; +diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c +index 4daa372ed381..2f3c5f5cfe14 100644 +--- a/drivers/scsi/st.c ++++ b/drivers/scsi/st.c +@@ -1266,9 +1266,9 @@ static int st_open(struct inode *inode, struct file *filp) + spin_lock(&st_use_lock); + STp->in_use = 0; + spin_unlock(&st_use_lock); +- scsi_tape_put(STp); + if (resumed) + scsi_autopm_put_device(STp->device); ++ scsi_tape_put(STp); + return retval; + + } +diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c +index 3c5dd9762476..06ea1a113e45 100644 +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -3961,7 +3961,13 @@ get_immediate: + } + + transport_err: +- iscsit_take_action_for_connection_exit(conn); ++ /* ++ * Avoid the normal connection failure code-path if this connection ++ * is still within LOGIN mode, and iscsi_np process context is ++ * responsible for cleaning up the early connection failure. ++ */ ++ if (conn->conn_state != TARG_CONN_STATE_IN_LOGIN) ++ iscsit_take_action_for_connection_exit(conn); + out: + return 0; + } +@@ -4047,7 +4053,7 @@ reject: + + int iscsi_target_rx_thread(void *arg) + { +- int ret; ++ int ret, rc; + u8 buffer[ISCSI_HDR_LEN], opcode; + u32 checksum = 0, digest = 0; + struct iscsi_conn *conn = arg; +@@ -4057,10 +4063,16 @@ int iscsi_target_rx_thread(void *arg) + * connection recovery / failure event can be triggered externally. + */ + allow_signal(SIGINT); ++ /* ++ * Wait for iscsi_post_login_handler() to complete before allowing ++ * incoming iscsi/tcp socket I/O, and/or failing the connection. ++ */ ++ rc = wait_for_completion_interruptible(&conn->rx_login_comp); ++ if (rc < 0) ++ return 0; + + if (conn->conn_transport->transport_type == ISCSI_INFINIBAND) { + struct completion comp; +- int rc; + + init_completion(&comp); + rc = wait_for_completion_interruptible(&comp); +@@ -4499,7 +4511,18 @@ static void iscsit_logout_post_handler_closesession( + struct iscsi_conn *conn) + { + struct iscsi_session *sess = conn->sess; +- int sleep = cmpxchg(&conn->tx_thread_active, true, false); ++ int sleep = 1; ++ /* ++ * Traditional iscsi/tcp will invoke this logic from TX thread ++ * context during session logout, so clear tx_thread_active and ++ * sleep if iscsit_close_connection() has not already occured. ++ * ++ * Since iser-target invokes this logic from it's own workqueue, ++ * always sleep waiting for RX/TX thread shutdown to complete ++ * within iscsit_close_connection(). ++ */ ++ if (conn->conn_transport->transport_type == ISCSI_TCP) ++ sleep = cmpxchg(&conn->tx_thread_active, true, false); + + atomic_set(&conn->conn_logout_remove, 0); + complete(&conn->conn_logout_comp); +@@ -4513,7 +4536,10 @@ static void iscsit_logout_post_handler_closesession( + static void iscsit_logout_post_handler_samecid( + struct iscsi_conn *conn) + { +- int sleep = cmpxchg(&conn->tx_thread_active, true, false); ++ int sleep = 1; ++ ++ if (conn->conn_transport->transport_type == ISCSI_TCP) ++ sleep = cmpxchg(&conn->tx_thread_active, true, false); + + atomic_set(&conn->conn_logout_remove, 0); + complete(&conn->conn_logout_comp); +@@ -4732,6 +4758,7 @@ int iscsit_release_sessions_for_tpg(struct iscsi_portal_group *tpg, int force) + struct iscsi_session *sess; + struct se_portal_group *se_tpg = &tpg->tpg_se_tpg; + struct se_session *se_sess, *se_sess_tmp; ++ LIST_HEAD(free_list); + int session_count = 0; + + spin_lock_bh(&se_tpg->session_lock); +@@ -4753,14 +4780,17 @@ int iscsit_release_sessions_for_tpg(struct iscsi_portal_group *tpg, int force) + } + atomic_set(&sess->session_reinstatement, 1); + spin_unlock(&sess->conn_lock); +- spin_unlock_bh(&se_tpg->session_lock); + +- iscsit_free_session(sess); +- spin_lock_bh(&se_tpg->session_lock); ++ list_move_tail(&se_sess->sess_list, &free_list); ++ } ++ spin_unlock_bh(&se_tpg->session_lock); ++ ++ list_for_each_entry_safe(se_sess, se_sess_tmp, &free_list, sess_list) { ++ sess = (struct iscsi_session *)se_sess->fabric_sess_ptr; + ++ iscsit_free_session(sess); + session_count++; + } +- spin_unlock_bh(&se_tpg->session_lock); + + pr_debug("Released %d iSCSI Session(s) from Target Portal" + " Group: %hu\n", session_count, tpg->tpgt); +diff --git a/drivers/target/iscsi/iscsi_target_core.h b/drivers/target/iscsi/iscsi_target_core.h +index 2423f27e4670..62eb11329c71 100644 +--- a/drivers/target/iscsi/iscsi_target_core.h ++++ b/drivers/target/iscsi/iscsi_target_core.h +@@ -605,6 +605,7 @@ struct iscsi_conn { + int bitmap_id; + int rx_thread_active; + struct task_struct *rx_thread; ++ struct completion rx_login_comp; + int tx_thread_active; + struct task_struct *tx_thread; + /* list_head for session connection list */ +diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c +index 2d87abc6b38c..719ec300cd24 100644 +--- a/drivers/target/iscsi/iscsi_target_login.c ++++ b/drivers/target/iscsi/iscsi_target_login.c +@@ -83,6 +83,7 @@ static struct iscsi_login *iscsi_login_init_conn(struct iscsi_conn *conn) + init_completion(&conn->conn_logout_comp); + init_completion(&conn->rx_half_close_comp); + init_completion(&conn->tx_half_close_comp); ++ init_completion(&conn->rx_login_comp); + spin_lock_init(&conn->cmd_lock); + spin_lock_init(&conn->conn_usage_lock); + spin_lock_init(&conn->immed_queue_lock); +@@ -734,6 +735,7 @@ int iscsit_start_kthreads(struct iscsi_conn *conn) + + return 0; + out_tx: ++ send_sig(SIGINT, conn->tx_thread, 1); + kthread_stop(conn->tx_thread); + conn->tx_thread_active = false; + out_bitmap: +@@ -744,7 +746,7 @@ out_bitmap: + return ret; + } + +-int iscsi_post_login_handler( ++void iscsi_post_login_handler( + struct iscsi_np *np, + struct iscsi_conn *conn, + u8 zero_tsih) +@@ -754,7 +756,6 @@ int iscsi_post_login_handler( + struct se_session *se_sess = sess->se_sess; + struct iscsi_portal_group *tpg = sess->tpg; + struct se_portal_group *se_tpg = &tpg->tpg_se_tpg; +- int rc; + + iscsit_inc_conn_usage_count(conn); + +@@ -795,10 +796,6 @@ int iscsi_post_login_handler( + sess->sess_ops->InitiatorName); + spin_unlock_bh(&sess->conn_lock); + +- rc = iscsit_start_kthreads(conn); +- if (rc) +- return rc; +- + iscsi_post_login_start_timers(conn); + /* + * Determine CPU mask to ensure connection's RX and TX kthreads +@@ -807,15 +804,20 @@ int iscsi_post_login_handler( + iscsit_thread_get_cpumask(conn); + conn->conn_rx_reset_cpumask = 1; + conn->conn_tx_reset_cpumask = 1; +- ++ /* ++ * Wakeup the sleeping iscsi_target_rx_thread() now that ++ * iscsi_conn is in TARG_CONN_STATE_LOGGED_IN state. ++ */ ++ complete(&conn->rx_login_comp); + iscsit_dec_conn_usage_count(conn); ++ + if (stop_timer) { + spin_lock_bh(&se_tpg->session_lock); + iscsit_stop_time2retain_timer(sess); + spin_unlock_bh(&se_tpg->session_lock); + } + iscsit_dec_session_usage_count(sess); +- return 0; ++ return; + } + + iscsi_set_session_parameters(sess->sess_ops, conn->param_list, 1); +@@ -856,10 +858,6 @@ int iscsi_post_login_handler( + " iSCSI Target Portal Group: %hu\n", tpg->nsessions, tpg->tpgt); + spin_unlock_bh(&se_tpg->session_lock); + +- rc = iscsit_start_kthreads(conn); +- if (rc) +- return rc; +- + iscsi_post_login_start_timers(conn); + /* + * Determine CPU mask to ensure connection's RX and TX kthreads +@@ -868,10 +866,12 @@ int iscsi_post_login_handler( + iscsit_thread_get_cpumask(conn); + conn->conn_rx_reset_cpumask = 1; + conn->conn_tx_reset_cpumask = 1; +- ++ /* ++ * Wakeup the sleeping iscsi_target_rx_thread() now that ++ * iscsi_conn is in TARG_CONN_STATE_LOGGED_IN state. ++ */ ++ complete(&conn->rx_login_comp); + iscsit_dec_conn_usage_count(conn); +- +- return 0; + } + + static void iscsi_handle_login_thread_timeout(unsigned long data) +@@ -1435,23 +1435,12 @@ static int __iscsi_target_login_thread(struct iscsi_np *np) + if (ret < 0) + goto new_sess_out; + +- if (!conn->sess) { +- pr_err("struct iscsi_conn session pointer is NULL!\n"); +- goto new_sess_out; +- } +- + iscsi_stop_login_thread_timer(np); + +- if (signal_pending(current)) +- goto new_sess_out; +- + if (ret == 1) { + tpg_np = conn->tpg_np; + +- ret = iscsi_post_login_handler(np, conn, zero_tsih); +- if (ret < 0) +- goto new_sess_out; +- ++ iscsi_post_login_handler(np, conn, zero_tsih); + iscsit_deaccess_np(np, tpg, tpg_np); + } + +diff --git a/drivers/target/iscsi/iscsi_target_login.h b/drivers/target/iscsi/iscsi_target_login.h +index 29d098324b7f..55cbf4533544 100644 +--- a/drivers/target/iscsi/iscsi_target_login.h ++++ b/drivers/target/iscsi/iscsi_target_login.h +@@ -12,7 +12,8 @@ extern int iscsit_accept_np(struct iscsi_np *, struct iscsi_conn *); + extern int iscsit_get_login_rx(struct iscsi_conn *, struct iscsi_login *); + extern int iscsit_put_login_tx(struct iscsi_conn *, struct iscsi_login *, u32); + extern void iscsit_free_conn(struct iscsi_np *, struct iscsi_conn *); +-extern int iscsi_post_login_handler(struct iscsi_np *, struct iscsi_conn *, u8); ++extern int iscsit_start_kthreads(struct iscsi_conn *); ++extern void iscsi_post_login_handler(struct iscsi_np *, struct iscsi_conn *, u8); + extern void iscsi_target_login_sess_out(struct iscsi_conn *, struct iscsi_np *, + bool, bool); + extern int iscsi_target_login_thread(void *); +diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c +index 62a095f36bf2..092112e5e1a6 100644 +--- a/drivers/target/iscsi/iscsi_target_nego.c ++++ b/drivers/target/iscsi/iscsi_target_nego.c +@@ -17,6 +17,7 @@ + ******************************************************************************/ + + #include <linux/ctype.h> ++#include <linux/kthread.h> + #include <scsi/iscsi_proto.h> + #include <target/target_core_base.h> + #include <target/target_core_fabric.h> +@@ -361,10 +362,24 @@ static int iscsi_target_do_tx_login_io(struct iscsi_conn *conn, struct iscsi_log + ntohl(login_rsp->statsn), login->rsp_length); + + padding = ((-login->rsp_length) & 3); ++ /* ++ * Before sending the last login response containing the transition ++ * bit for full-feature-phase, go ahead and start up TX/RX threads ++ * now to avoid potential resource allocation failures after the ++ * final login response has been sent. ++ */ ++ if (login->login_complete) { ++ int rc = iscsit_start_kthreads(conn); ++ if (rc) { ++ iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR, ++ ISCSI_LOGIN_STATUS_NO_RESOURCES); ++ return -1; ++ } ++ } + + if (conn->conn_transport->iscsit_put_login_tx(conn, login, + login->rsp_length + padding) < 0) +- return -1; ++ goto err; + + login->rsp_length = 0; + mutex_lock(&sess->cmdsn_mutex); +@@ -373,6 +388,23 @@ static int iscsi_target_do_tx_login_io(struct iscsi_conn *conn, struct iscsi_log + mutex_unlock(&sess->cmdsn_mutex); + + return 0; ++ ++err: ++ if (login->login_complete) { ++ if (conn->rx_thread && conn->rx_thread_active) { ++ send_sig(SIGINT, conn->rx_thread, 1); ++ kthread_stop(conn->rx_thread); ++ } ++ if (conn->tx_thread && conn->tx_thread_active) { ++ send_sig(SIGINT, conn->tx_thread, 1); ++ kthread_stop(conn->tx_thread); ++ } ++ spin_lock(&iscsit_global->ts_bitmap_lock); ++ bitmap_release_region(iscsit_global->ts_bitmap, conn->bitmap_id, ++ get_order(1)); ++ spin_unlock(&iscsit_global->ts_bitmap_lock); ++ } ++ return -1; + } + + static void iscsi_target_sk_data_ready(struct sock *sk) +diff --git a/drivers/thermal/rcar_thermal.c b/drivers/thermal/rcar_thermal.c +index 8803e693fe68..2f3b4ff5b9d1 100644 +--- a/drivers/thermal/rcar_thermal.c ++++ b/drivers/thermal/rcar_thermal.c +@@ -372,6 +372,7 @@ static int rcar_thermal_probe(struct platform_device *pdev) + int i; + int ret = -ENODEV; + int idle = IDLE_INTERVAL; ++ u32 enr_bits = 0; + + common = devm_kzalloc(dev, sizeof(*common), GFP_KERNEL); + if (!common) +@@ -408,9 +409,6 @@ static int rcar_thermal_probe(struct platform_device *pdev) + if (IS_ERR(common->base)) + return PTR_ERR(common->base); + +- /* enable temperature comparation */ +- rcar_thermal_common_write(common, ENR, 0x00030303); +- + idle = 0; /* polling delay is not needed */ + } + +@@ -452,8 +450,15 @@ static int rcar_thermal_probe(struct platform_device *pdev) + rcar_thermal_irq_enable(priv); + + list_move_tail(&priv->list, &common->head); ++ ++ /* update ENR bits */ ++ enr_bits |= 3 << (i * 8); + } + ++ /* enable temperature comparation */ ++ if (irq) ++ rcar_thermal_common_write(common, ENR, enr_bits); ++ + platform_set_drvdata(pdev, common); + + dev_info(dev, "%d sensor probed\n", i); +diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c +index 33e16658e5cf..df02947a77e3 100644 +--- a/drivers/usb/gadget/function/f_uac2.c ++++ b/drivers/usb/gadget/function/f_uac2.c +@@ -1162,14 +1162,14 @@ afunc_set_alt(struct usb_function *fn, unsigned intf, unsigned alt) + factor = 1000; + } else { + ep_desc = &hs_epin_desc; +- factor = 125; ++ factor = 8000; + } + + /* pre-compute some values for iso_complete() */ + uac2->p_framesize = opts->p_ssize * + num_channels(opts->p_chmask); + rate = opts->p_srate * uac2->p_framesize; +- uac2->p_interval = (1 << (ep_desc->bInterval - 1)) * factor; ++ uac2->p_interval = factor / (1 << (ep_desc->bInterval - 1)); + uac2->p_pktsize = min_t(unsigned int, rate / uac2->p_interval, + prm->max_psize); + +diff --git a/drivers/usb/gadget/udc/udc-core.c b/drivers/usb/gadget/udc/udc-core.c +index f2054659f25b..5442febcd7af 100644 +--- a/drivers/usb/gadget/udc/udc-core.c ++++ b/drivers/usb/gadget/udc/udc-core.c +@@ -301,6 +301,7 @@ err4: + + err3: + put_device(&udc->dev); ++ device_del(&gadget->dev); + + err2: + put_device(&gadget->dev); +diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c +index 7ff97c39c8b4..8bdfb38782f8 100644 +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -484,10 +484,13 @@ static void xhci_hub_report_usb3_link_state(struct xhci_hcd *xhci, + u32 pls = status_reg & PORT_PLS_MASK; + + /* resume state is a xHCI internal state. +- * Do not report it to usb core. ++ * Do not report it to usb core, instead, pretend to be U3, ++ * thus usb core knows it's not ready for transfer + */ +- if (pls == XDEV_RESUME) ++ if (pls == XDEV_RESUME) { ++ *status |= USB_SS_PORT_LS_U3; + return; ++ } + + /* When the CAS bit is set then warm reset + * should be performed on port +@@ -588,7 +591,14 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd, + status |= USB_PORT_STAT_C_RESET << 16; + /* USB3.0 only */ + if (hcd->speed == HCD_USB3) { +- if ((raw_port_status & PORT_PLC)) ++ /* Port link change with port in resume state should not be ++ * reported to usbcore, as this is an internal state to be ++ * handled by xhci driver. Reporting PLC to usbcore may ++ * cause usbcore clearing PLC first and port change event ++ * irq won't be generated. ++ */ ++ if ((raw_port_status & PORT_PLC) && ++ (raw_port_status & PORT_PLS_MASK) != XDEV_RESUME) + status |= USB_PORT_STAT_C_LINK_STATE << 16; + if ((raw_port_status & PORT_WRC)) + status |= USB_PORT_STAT_C_BH_RESET << 16; +diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c +index a67018eddf41..d44c904df055 100644 +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -1796,7 +1796,8 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci) + int size; + int i, j, num_ports; + +- del_timer_sync(&xhci->cmd_timer); ++ if (timer_pending(&xhci->cmd_timer)) ++ del_timer_sync(&xhci->cmd_timer); + + /* Free the Event Ring Segment Table and the actual Event Ring */ + size = sizeof(struct xhci_erst_entry)*(xhci->erst.num_entries); +diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c +index 9848a67ddbbe..c70291cffc27 100644 +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -82,7 +82,7 @@ dma_addr_t xhci_trb_virt_to_dma(struct xhci_segment *seg, + return 0; + /* offset in TRBs */ + segment_offset = trb - seg->trbs; +- if (segment_offset > TRBS_PER_SEGMENT) ++ if (segment_offset >= TRBS_PER_SEGMENT) + return 0; + return seg->dma + (segment_offset * sizeof(*trb)); + } +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 3bceabe109f7..8e5f46082316 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -3457,6 +3457,9 @@ int xhci_discover_or_reset_device(struct usb_hcd *hcd, struct usb_device *udev) + return -EINVAL; + } + ++ if (virt_dev->tt_info) ++ old_active_eps = virt_dev->tt_info->active_eps; ++ + if (virt_dev->udev != udev) { + /* If the virt_dev and the udev does not match, this virt_dev + * may belong to another udev. +diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c +index b0c97a3f1bfe..634c14d022ce 100644 +--- a/drivers/usb/renesas_usbhs/fifo.c ++++ b/drivers/usb/renesas_usbhs/fifo.c +@@ -621,6 +621,8 @@ struct usbhs_pkt_handle usbhs_fifo_pio_push_handler = { + static int usbhsf_prepare_pop(struct usbhs_pkt *pkt, int *is_done) + { + struct usbhs_pipe *pipe = pkt->pipe; ++ struct usbhs_priv *priv = usbhs_pipe_to_priv(pipe); ++ struct usbhs_fifo *fifo = usbhsf_get_cfifo(priv); + + if (usbhs_pipe_is_busy(pipe)) + return 0; +@@ -634,6 +636,9 @@ static int usbhsf_prepare_pop(struct usbhs_pkt *pkt, int *is_done) + usbhs_pipe_data_sequence(pipe, pkt->sequence); + pkt->sequence = -1; /* -1 sequence will be ignored */ + ++ if (usbhs_pipe_is_dcp(pipe)) ++ usbhsf_fifo_clear(pipe, fifo); ++ + usbhs_pipe_set_trans_count_if_bulk(pipe, pkt->length); + usbhs_pipe_enable(pipe); + usbhs_pipe_running(pipe, 1); +@@ -683,7 +688,14 @@ static int usbhsf_pio_try_pop(struct usbhs_pkt *pkt, int *is_done) + *is_done = 1; + usbhsf_rx_irq_ctrl(pipe, 0); + usbhs_pipe_running(pipe, 0); +- usbhs_pipe_disable(pipe); /* disable pipe first */ ++ /* ++ * If function mode, since this controller is possible to enter ++ * Control Write status stage at this timing, this driver ++ * should not disable the pipe. If such a case happens, this ++ * controller is not able to complete the status stage. ++ */ ++ if (!usbhs_mod_is_host(priv) && !usbhs_pipe_is_dcp(pipe)) ++ usbhs_pipe_disable(pipe); /* disable pipe first */ + } + + /* +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index c8c4e50ffee1..463feb836f20 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1107,6 +1107,8 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */ + { USB_DEVICE_INTERFACE_CLASS(SIERRA_VENDOR_ID, 0x68c0, 0xff), + .driver_info = (kernel_ulong_t)&sierra_mc73xx_blacklist }, /* MC73xx */ ++ { USB_DEVICE_INTERFACE_CLASS(SIERRA_VENDOR_ID, 0x9041, 0xff), ++ .driver_info = (kernel_ulong_t)&sierra_mc73xx_blacklist }, /* MC7305/MC7355 */ + { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) }, + { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) }, + { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6003), +diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c +index 9c63897b3a56..d156545728c2 100644 +--- a/drivers/usb/serial/qcserial.c ++++ b/drivers/usb/serial/qcserial.c +@@ -145,7 +145,6 @@ static const struct usb_device_id id_table[] = { + {DEVICE_SWI(0x1199, 0x901c)}, /* Sierra Wireless EM7700 */ + {DEVICE_SWI(0x1199, 0x901f)}, /* Sierra Wireless EM7355 */ + {DEVICE_SWI(0x1199, 0x9040)}, /* Sierra Wireless Modem */ +- {DEVICE_SWI(0x1199, 0x9041)}, /* Sierra Wireless MC7305/MC7355 */ + {DEVICE_SWI(0x1199, 0x9051)}, /* Netgear AirCard 340U */ + {DEVICE_SWI(0x1199, 0x9053)}, /* Sierra Wireless Modem */ + {DEVICE_SWI(0x1199, 0x9054)}, /* Sierra Wireless Modem */ +@@ -158,6 +157,7 @@ static const struct usb_device_id id_table[] = { + {DEVICE_SWI(0x413c, 0x81a4)}, /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */ + {DEVICE_SWI(0x413c, 0x81a8)}, /* Dell Wireless 5808 Gobi(TM) 4G LTE Mobile Broadband Card */ + {DEVICE_SWI(0x413c, 0x81a9)}, /* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card */ ++ {DEVICE_SWI(0x413c, 0x81b1)}, /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card */ + + /* Huawei devices */ + {DEVICE_HWI(0x03f0, 0x581d)}, /* HP lt4112 LTE/HSPA+ Gobi 4G Modem (Huawei me906e) */ +diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c +index 46179a0828eb..07d1ecd564f7 100644 +--- a/drivers/usb/serial/sierra.c ++++ b/drivers/usb/serial/sierra.c +@@ -289,6 +289,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x68AA, 0xFF, 0xFF, 0xFF), + .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist + }, ++ { USB_DEVICE(0x1199, 0x68AB) }, /* Sierra Wireless AR8550 */ + /* AT&T Direct IP LTE modems */ + { USB_DEVICE_AND_INTERFACE_INFO(0x0F3D, 0x68AA, 0xFF, 0xFF, 0xFF), + .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist +diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h +index 300ef9b817ed..36584e1f15c5 100644 +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -2065,6 +2065,18 @@ UNUSUAL_DEV( 0x1908, 0x3335, 0x0200, 0x0200, + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_NO_READ_DISC_INFO ), + ++/* Reported by Oliver Neukum <[email protected]> ++ * This device morphes spontaneously into another device if the access ++ * pattern of Windows isn't followed. Thus writable media would be dirty ++ * if the initial instance is used. So the device is limited to its ++ * virtual CD. ++ * And yes, the concept that BCD goes up to 9 is not heeded */ ++UNUSUAL_DEV( 0x19d2, 0x1225, 0x0000, 0xffff, ++ "ZTE,Incorporated", ++ "ZTE WCDMA Technologies MSM", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_SINGLE_LUN ), ++ + /* Reported by Sven Geggus <[email protected]> + * This encrypted pen drive returns bogus data for the initial READ(10). + */ +diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c +index c90f4374442a..1fe2c8115be0 100644 +--- a/drivers/vhost/vhost.c ++++ b/drivers/vhost/vhost.c +@@ -882,6 +882,7 @@ long vhost_dev_ioctl(struct vhost_dev *d, unsigned int ioctl, void __user *argp) + } + if (eventfp != d->log_file) { + filep = d->log_file; ++ d->log_file = eventfp; + ctx = d->log_ctx; + d->log_ctx = eventfp ? + eventfd_ctx_fileget(eventfp) : NULL; +diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c +index 073b4a19a8b0..91cc44611062 100644 +--- a/drivers/xen/gntdev.c ++++ b/drivers/xen/gntdev.c +@@ -67,7 +67,7 @@ struct gntdev_priv { + * Only populated if populate_freeable_maps == 1 */ + struct list_head freeable_maps; + /* lock protects maps and freeable_maps */ +- spinlock_t lock; ++ struct mutex lock; + struct mm_struct *mm; + struct mmu_notifier mn; + }; +@@ -216,9 +216,9 @@ static void gntdev_put_map(struct gntdev_priv *priv, struct grant_map *map) + } + + if (populate_freeable_maps && priv) { +- spin_lock(&priv->lock); ++ mutex_lock(&priv->lock); + list_del(&map->next); +- spin_unlock(&priv->lock); ++ mutex_unlock(&priv->lock); + } + + if (map->pages && !use_ptemod) +@@ -387,9 +387,9 @@ static void gntdev_vma_close(struct vm_area_struct *vma) + * not do any unmapping, since that has been done prior to + * closing the vma, but it may still iterate the unmap_ops list. + */ +- spin_lock(&priv->lock); ++ mutex_lock(&priv->lock); + map->vma = NULL; +- spin_unlock(&priv->lock); ++ mutex_unlock(&priv->lock); + } + vma->vm_private_data = NULL; + gntdev_put_map(priv, map); +@@ -433,14 +433,14 @@ static void mn_invl_range_start(struct mmu_notifier *mn, + struct gntdev_priv *priv = container_of(mn, struct gntdev_priv, mn); + struct grant_map *map; + +- spin_lock(&priv->lock); ++ mutex_lock(&priv->lock); + list_for_each_entry(map, &priv->maps, next) { + unmap_if_in_range(map, start, end); + } + list_for_each_entry(map, &priv->freeable_maps, next) { + unmap_if_in_range(map, start, end); + } +- spin_unlock(&priv->lock); ++ mutex_unlock(&priv->lock); + } + + static void mn_invl_page(struct mmu_notifier *mn, +@@ -457,7 +457,7 @@ static void mn_release(struct mmu_notifier *mn, + struct grant_map *map; + int err; + +- spin_lock(&priv->lock); ++ mutex_lock(&priv->lock); + list_for_each_entry(map, &priv->maps, next) { + if (!map->vma) + continue; +@@ -476,7 +476,7 @@ static void mn_release(struct mmu_notifier *mn, + err = unmap_grant_pages(map, /* offset */ 0, map->count); + WARN_ON(err); + } +- spin_unlock(&priv->lock); ++ mutex_unlock(&priv->lock); + } + + static struct mmu_notifier_ops gntdev_mmu_ops = { +@@ -498,7 +498,7 @@ static int gntdev_open(struct inode *inode, struct file *flip) + + INIT_LIST_HEAD(&priv->maps); + INIT_LIST_HEAD(&priv->freeable_maps); +- spin_lock_init(&priv->lock); ++ mutex_init(&priv->lock); + + if (use_ptemod) { + priv->mm = get_task_mm(current); +@@ -529,12 +529,14 @@ static int gntdev_release(struct inode *inode, struct file *flip) + + pr_debug("priv %p\n", priv); + ++ mutex_lock(&priv->lock); + while (!list_empty(&priv->maps)) { + map = list_entry(priv->maps.next, struct grant_map, next); + list_del(&map->next); + gntdev_put_map(NULL /* already removed */, map); + } + WARN_ON(!list_empty(&priv->freeable_maps)); ++ mutex_unlock(&priv->lock); + + if (use_ptemod) + mmu_notifier_unregister(&priv->mn, priv->mm); +@@ -572,10 +574,10 @@ static long gntdev_ioctl_map_grant_ref(struct gntdev_priv *priv, + return -EFAULT; + } + +- spin_lock(&priv->lock); ++ mutex_lock(&priv->lock); + gntdev_add_map(priv, map); + op.index = map->index << PAGE_SHIFT; +- spin_unlock(&priv->lock); ++ mutex_unlock(&priv->lock); + + if (copy_to_user(u, &op, sizeof(op)) != 0) + return -EFAULT; +@@ -594,7 +596,7 @@ static long gntdev_ioctl_unmap_grant_ref(struct gntdev_priv *priv, + return -EFAULT; + pr_debug("priv %p, del %d+%d\n", priv, (int)op.index, (int)op.count); + +- spin_lock(&priv->lock); ++ mutex_lock(&priv->lock); + map = gntdev_find_map_index(priv, op.index >> PAGE_SHIFT, op.count); + if (map) { + list_del(&map->next); +@@ -602,7 +604,7 @@ static long gntdev_ioctl_unmap_grant_ref(struct gntdev_priv *priv, + list_add_tail(&map->next, &priv->freeable_maps); + err = 0; + } +- spin_unlock(&priv->lock); ++ mutex_unlock(&priv->lock); + if (map) + gntdev_put_map(priv, map); + return err; +@@ -670,7 +672,7 @@ static long gntdev_ioctl_notify(struct gntdev_priv *priv, void __user *u) + out_flags = op.action; + out_event = op.event_channel_port; + +- spin_lock(&priv->lock); ++ mutex_lock(&priv->lock); + + list_for_each_entry(map, &priv->maps, next) { + uint64_t begin = map->index << PAGE_SHIFT; +@@ -698,7 +700,7 @@ static long gntdev_ioctl_notify(struct gntdev_priv *priv, void __user *u) + rc = 0; + + unlock_out: +- spin_unlock(&priv->lock); ++ mutex_unlock(&priv->lock); + + /* Drop the reference to the event channel we did not save in the map */ + if (out_flags & UNMAP_NOTIFY_SEND_EVENT) +@@ -748,7 +750,7 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma) + pr_debug("map %d+%d at %lx (pgoff %lx)\n", + index, count, vma->vm_start, vma->vm_pgoff); + +- spin_lock(&priv->lock); ++ mutex_lock(&priv->lock); + map = gntdev_find_map_index(priv, index, count); + if (!map) + goto unlock_out; +@@ -783,7 +785,7 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma) + map->flags |= GNTMAP_readonly; + } + +- spin_unlock(&priv->lock); ++ mutex_unlock(&priv->lock); + + if (use_ptemod) { + err = apply_to_page_range(vma->vm_mm, vma->vm_start, +@@ -811,11 +813,11 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma) + return 0; + + unlock_out: +- spin_unlock(&priv->lock); ++ mutex_unlock(&priv->lock); + return err; + + out_unlock_put: +- spin_unlock(&priv->lock); ++ mutex_unlock(&priv->lock); + out_put_map: + if (use_ptemod) + map->vma = NULL; +diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c +index bf3f424e0013..02391f3eb9b0 100644 +--- a/fs/btrfs/extent_io.c ++++ b/fs/btrfs/extent_io.c +@@ -4484,8 +4484,11 @@ int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, + } + ret = fiemap_fill_next_extent(fieinfo, em_start, disko, + em_len, flags); +- if (ret) ++ if (ret) { ++ if (ret == 1) ++ ret = 0; + goto out_free; ++ } + } + out_free: + free_extent_map(em); +diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c +index cde9c03e3913..2105555657fc 100644 +--- a/fs/btrfs/super.c ++++ b/fs/btrfs/super.c +@@ -901,6 +901,15 @@ find_root: + if (IS_ERR(new_root)) + return ERR_CAST(new_root); + ++ if (!(sb->s_flags & MS_RDONLY)) { ++ int ret; ++ down_read(&fs_info->cleanup_work_sem); ++ ret = btrfs_orphan_cleanup(new_root); ++ up_read(&fs_info->cleanup_work_sem); ++ if (ret) ++ return ERR_PTR(ret); ++ } ++ + dir_id = btrfs_root_dirid(&new_root->root_item); + setup_root: + location.objectid = dir_id; +diff --git a/fs/dcache.c b/fs/dcache.c +index d0539a4a1ab1..a66d6d80e2d9 100644 +--- a/fs/dcache.c ++++ b/fs/dcache.c +@@ -629,6 +629,9 @@ repeat: + if (unlikely(d_unhashed(dentry))) + goto kill_it; + ++ if (unlikely(dentry->d_flags & DCACHE_DISCONNECTED)) ++ goto kill_it; ++ + if (unlikely(dentry->d_flags & DCACHE_OP_DELETE)) { + if (dentry->d_op->d_delete(dentry)) + goto kill_it; +diff --git a/fs/hpfs/super.c b/fs/hpfs/super.c +index 7cd00d3a7c9b..f445d155dfae 100644 +--- a/fs/hpfs/super.c ++++ b/fs/hpfs/super.c +@@ -52,17 +52,20 @@ static void unmark_dirty(struct super_block *s) + } + + /* Filesystem error... */ +-static char err_buf[1024]; +- + void hpfs_error(struct super_block *s, const char *fmt, ...) + { ++ struct va_format vaf; + va_list args; + + va_start(args, fmt); +- vsnprintf(err_buf, sizeof(err_buf), fmt, args); ++ ++ vaf.fmt = fmt; ++ vaf.va = &args; ++ ++ pr_err("filesystem error: %pV", &vaf); ++ + va_end(args); + +- pr_err("filesystem error: %s", err_buf); + if (!hpfs_sb(s)->sb_was_error) { + if (hpfs_sb(s)->sb_err == 2) { + pr_cont("; crashing the system because you wanted it\n"); +diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c +index 58f98ad93828..eda99c8ec3ed 100644 +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -4285,9 +4285,9 @@ laundromat_main(struct work_struct *laundry) + queue_delayed_work(laundry_wq, &nn->laundromat_work, t*HZ); + } + +-static inline __be32 nfs4_check_fh(struct svc_fh *fhp, struct nfs4_ol_stateid *stp) ++static inline __be32 nfs4_check_fh(struct svc_fh *fhp, struct nfs4_stid *stp) + { +- if (!nfsd_fh_match(&fhp->fh_handle, &stp->st_stid.sc_file->fi_fhandle)) ++ if (!nfsd_fh_match(&fhp->fh_handle, &stp->sc_file->fi_fhandle)) + return nfserr_bad_stateid; + return nfs_ok; + } +@@ -4462,20 +4462,49 @@ nfsd4_lookup_stateid(struct nfsd4_compound_state *cstate, + return nfs_ok; + } + ++static struct file * ++nfs4_find_file(struct nfs4_stid *s, int flags) ++{ ++ switch (s->sc_type) { ++ case NFS4_DELEG_STID: ++ if (WARN_ON_ONCE(!s->sc_file->fi_deleg_file)) ++ return NULL; ++ return get_file(s->sc_file->fi_deleg_file); ++ case NFS4_OPEN_STID: ++ case NFS4_LOCK_STID: ++ if (flags & RD_STATE) ++ return find_readable_file(s->sc_file); ++ else ++ return find_writeable_file(s->sc_file); ++ break; ++ } ++ ++ return NULL; ++} ++ ++static __be32 ++nfs4_check_olstateid(struct svc_fh *fhp, struct nfs4_ol_stateid *ols, int flags) ++{ ++ __be32 status; ++ ++ status = nfsd4_check_openowner_confirmed(ols); ++ if (status) ++ return status; ++ return nfs4_check_openmode(ols, flags); ++} ++ + /* +-* Checks for stateid operations +-*/ ++ * Checks for stateid operations ++ */ + __be32 + nfs4_preprocess_stateid_op(struct net *net, struct nfsd4_compound_state *cstate, + stateid_t *stateid, int flags, struct file **filpp) + { +- struct nfs4_stid *s; +- struct nfs4_ol_stateid *stp = NULL; +- struct nfs4_delegation *dp = NULL; +- struct svc_fh *current_fh = &cstate->current_fh; +- struct inode *ino = current_fh->fh_dentry->d_inode; ++ struct svc_fh *fhp = &cstate->current_fh; ++ struct inode *ino = fhp->fh_dentry->d_inode; ++ + struct nfsd_net *nn = net_generic(net, nfsd_net_id); +- struct file *file = NULL; ++ struct nfs4_stid *s; + __be32 status; + + if (filpp) +@@ -4485,60 +4514,39 @@ nfs4_preprocess_stateid_op(struct net *net, struct nfsd4_compound_state *cstate, + return nfserr_grace; + + if (ZERO_STATEID(stateid) || ONE_STATEID(stateid)) +- return check_special_stateids(net, current_fh, stateid, flags); ++ return check_special_stateids(net, fhp, stateid, flags); + + status = nfsd4_lookup_stateid(cstate, stateid, + NFS4_DELEG_STID|NFS4_OPEN_STID|NFS4_LOCK_STID, + &s, nn); + if (status) + return status; +- status = check_stateid_generation(stateid, &s->sc_stateid, nfsd4_has_session(cstate)); ++ status = check_stateid_generation(stateid, &s->sc_stateid, ++ nfsd4_has_session(cstate)); + if (status) + goto out; ++ + switch (s->sc_type) { + case NFS4_DELEG_STID: +- dp = delegstateid(s); +- status = nfs4_check_delegmode(dp, flags); +- if (status) +- goto out; +- if (filpp) { +- file = dp->dl_stid.sc_file->fi_deleg_file; +- if (!file) { +- WARN_ON_ONCE(1); +- status = nfserr_serverfault; +- goto out; +- } +- get_file(file); +- } ++ status = nfs4_check_delegmode(delegstateid(s), flags); + break; + case NFS4_OPEN_STID: + case NFS4_LOCK_STID: +- stp = openlockstateid(s); +- status = nfs4_check_fh(current_fh, stp); +- if (status) +- goto out; +- status = nfsd4_check_openowner_confirmed(stp); +- if (status) +- goto out; +- status = nfs4_check_openmode(stp, flags); +- if (status) +- goto out; +- if (filpp) { +- struct nfs4_file *fp = stp->st_stid.sc_file; +- +- if (flags & RD_STATE) +- file = find_readable_file(fp); +- else +- file = find_writeable_file(fp); +- } ++ status = nfs4_check_olstateid(fhp, openlockstateid(s), flags); + break; + default: + status = nfserr_bad_stateid; ++ break; ++ } ++ if (status) + goto out; ++ status = nfs4_check_fh(fhp, s); ++ ++ if (!status && filpp) { ++ *filpp = nfs4_find_file(s, flags); ++ if (!*filpp) ++ status = nfserr_serverfault; + } +- status = nfs_ok; +- if (file) +- *filpp = file; + out: + nfs4_put_stid(s); + return status; +@@ -4642,7 +4650,7 @@ static __be32 nfs4_seqid_op_checks(struct nfsd4_compound_state *cstate, stateid_ + status = check_stateid_generation(stateid, &stp->st_stid.sc_stateid, nfsd4_has_session(cstate)); + if (status) + return status; +- return nfs4_check_fh(current_fh, stp); ++ return nfs4_check_fh(current_fh, &stp->st_stid); + } + + /* +diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c +index 6abe96593225..0fd2f1c76e60 100644 +--- a/fs/nfsd/nfs4xdr.c ++++ b/fs/nfsd/nfs4xdr.c +@@ -1974,6 +1974,7 @@ nfsd4_encode_aclname(struct xdr_stream *xdr, struct svc_rqst *rqstp, + #define WORD0_ABSENT_FS_ATTRS (FATTR4_WORD0_FS_LOCATIONS | FATTR4_WORD0_FSID | \ + FATTR4_WORD0_RDATTR_ERROR) + #define WORD1_ABSENT_FS_ATTRS FATTR4_WORD1_MOUNTED_ON_FILEID ++#define WORD2_ABSENT_FS_ATTRS 0 + + #ifdef CONFIG_NFSD_V4_SECURITY_LABEL + static inline __be32 +@@ -2002,7 +2003,7 @@ nfsd4_encode_security_label(struct xdr_stream *xdr, struct svc_rqst *rqstp, + { return 0; } + #endif + +-static __be32 fattr_handle_absent_fs(u32 *bmval0, u32 *bmval1, u32 *rdattr_err) ++static __be32 fattr_handle_absent_fs(u32 *bmval0, u32 *bmval1, u32 *bmval2, u32 *rdattr_err) + { + /* As per referral draft: */ + if (*bmval0 & ~WORD0_ABSENT_FS_ATTRS || +@@ -2015,6 +2016,7 @@ static __be32 fattr_handle_absent_fs(u32 *bmval0, u32 *bmval1, u32 *rdattr_err) + } + *bmval0 &= WORD0_ABSENT_FS_ATTRS; + *bmval1 &= WORD1_ABSENT_FS_ATTRS; ++ *bmval2 &= WORD2_ABSENT_FS_ATTRS; + return 0; + } + +@@ -2078,8 +2080,7 @@ nfsd4_encode_fattr(struct xdr_stream *xdr, struct svc_fh *fhp, + BUG_ON(bmval2 & ~nfsd_suppattrs2(minorversion)); + + if (exp->ex_fslocs.migrated) { +- BUG_ON(bmval[2]); +- status = fattr_handle_absent_fs(&bmval0, &bmval1, &rdattr_err); ++ status = fattr_handle_absent_fs(&bmval0, &bmval1, &bmval2, &rdattr_err); + if (status) + goto out; + } +@@ -2122,8 +2123,8 @@ nfsd4_encode_fattr(struct xdr_stream *xdr, struct svc_fh *fhp, + } + + #ifdef CONFIG_NFSD_V4_SECURITY_LABEL +- if ((bmval[2] & FATTR4_WORD2_SECURITY_LABEL) || +- bmval[0] & FATTR4_WORD0_SUPPORTED_ATTRS) { ++ if ((bmval2 & FATTR4_WORD2_SECURITY_LABEL) || ++ bmval0 & FATTR4_WORD0_SUPPORTED_ATTRS) { + err = security_inode_getsecctx(dentry->d_inode, + &context, &contextlen); + contextsupport = (err == 0); +diff --git a/fs/notify/mark.c b/fs/notify/mark.c +index 34c38fabf514..28c90a6fcd6c 100644 +--- a/fs/notify/mark.c ++++ b/fs/notify/mark.c +@@ -329,16 +329,36 @@ void fsnotify_clear_marks_by_group_flags(struct fsnotify_group *group, + unsigned int flags) + { + struct fsnotify_mark *lmark, *mark; ++ LIST_HEAD(to_free); + ++ /* ++ * We have to be really careful here. Anytime we drop mark_mutex, e.g. ++ * fsnotify_clear_marks_by_inode() can come and free marks. Even in our ++ * to_free list so we have to use mark_mutex even when accessing that ++ * list. And freeing mark requires us to drop mark_mutex. So we can ++ * reliably free only the first mark in the list. That's why we first ++ * move marks to free to to_free list in one go and then free marks in ++ * to_free list one by one. ++ */ + mutex_lock_nested(&group->mark_mutex, SINGLE_DEPTH_NESTING); + list_for_each_entry_safe(mark, lmark, &group->marks_list, g_list) { +- if (mark->flags & flags) { +- fsnotify_get_mark(mark); +- fsnotify_destroy_mark_locked(mark, group); +- fsnotify_put_mark(mark); +- } ++ if (mark->flags & flags) ++ list_move(&mark->g_list, &to_free); + } + mutex_unlock(&group->mark_mutex); ++ ++ while (1) { ++ mutex_lock_nested(&group->mark_mutex, SINGLE_DEPTH_NESTING); ++ if (list_empty(&to_free)) { ++ mutex_unlock(&group->mark_mutex); ++ break; ++ } ++ mark = list_first_entry(&to_free, struct fsnotify_mark, g_list); ++ fsnotify_get_mark(mark); ++ fsnotify_destroy_mark_locked(mark, group); ++ mutex_unlock(&group->mark_mutex); ++ fsnotify_put_mark(mark); ++ } + } + + /* +diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c +index 21262f2b1654..60d6fd9fb6ca 100644 +--- a/fs/ocfs2/dlmglue.c ++++ b/fs/ocfs2/dlmglue.c +@@ -3993,9 +3993,13 @@ static void ocfs2_downconvert_thread_do_work(struct ocfs2_super *osb) + osb->dc_work_sequence = osb->dc_wake_sequence; + + processed = osb->blocked_lock_count; +- while (processed) { +- BUG_ON(list_empty(&osb->blocked_lock_list)); +- ++ /* ++ * blocked lock processing in this loop might call iput which can ++ * remove items off osb->blocked_lock_list. Downconvert up to ++ * 'processed' number of locks, but stop short if we had some ++ * removed in ocfs2_mark_lockres_freeing when downconverting. ++ */ ++ while (processed && !list_empty(&osb->blocked_lock_list)) { + lockres = list_entry(osb->blocked_lock_list.next, + struct ocfs2_lock_res, l_blocked_list); + list_del_init(&lockres->l_blocked_list); +diff --git a/fs/signalfd.c b/fs/signalfd.c +index 424b7b65321f..148f8e7af882 100644 +--- a/fs/signalfd.c ++++ b/fs/signalfd.c +@@ -121,8 +121,9 @@ static int signalfd_copyinfo(struct signalfd_siginfo __user *uinfo, + * Other callers might not initialize the si_lsb field, + * so check explicitly for the right codes here. + */ +- if (kinfo->si_code == BUS_MCEERR_AR || +- kinfo->si_code == BUS_MCEERR_AO) ++ if (kinfo->si_signo == SIGBUS && ++ (kinfo->si_code == BUS_MCEERR_AR || ++ kinfo->si_code == BUS_MCEERR_AO)) + err |= __put_user((short) kinfo->si_addr_lsb, + &uinfo->ssi_addr_lsb); + #endif +diff --git a/include/linux/acpi.h b/include/linux/acpi.h +index 76d64d6a903a..1c7eaa718e65 100644 +--- a/include/linux/acpi.h ++++ b/include/linux/acpi.h +@@ -415,6 +415,7 @@ extern acpi_status acpi_pci_osc_control_set(acpi_handle handle, + #define ACPI_OST_SC_INSERT_NOT_SUPPORTED 0x82 + + extern void acpi_early_init(void); ++extern void acpi_subsystem_init(void); + + extern int acpi_nvs_register(__u64 start, __u64 size); + +@@ -450,6 +451,7 @@ static inline const char *acpi_dev_name(struct acpi_device *adev) + } + + static inline void acpi_early_init(void) { } ++static inline void acpi_subsystem_init(void) { } + + static inline int early_acpi_boot_init(void) + { +diff --git a/include/linux/kexec.h b/include/linux/kexec.h +index 9d957b7ae095..9739607a6dfb 100644 +--- a/include/linux/kexec.h ++++ b/include/linux/kexec.h +@@ -27,6 +27,10 @@ + #error KEXEC_CONTROL_MEMORY_LIMIT not defined + #endif + ++#ifndef KEXEC_CONTROL_MEMORY_GFP ++#define KEXEC_CONTROL_MEMORY_GFP GFP_KERNEL ++#endif ++ + #ifndef KEXEC_CONTROL_PAGE_SIZE + #error KEXEC_CONTROL_PAGE_SIZE not defined + #endif +diff --git a/include/linux/libata.h b/include/linux/libata.h +index 8f6a07441b85..a60e04bcda0f 100644 +--- a/include/linux/libata.h ++++ b/include/linux/libata.h +@@ -429,7 +429,9 @@ enum { + ATA_HORKAGE_NO_NCQ_TRIM = (1 << 19), /* don't use queued TRIM */ + ATA_HORKAGE_NOLPM = (1 << 20), /* don't use LPM */ + ATA_HORKAGE_WD_BROKEN_LPM = (1 << 21), /* some WDs have broken LPM */ +- ATA_HORKAGE_NOTRIM = (1 << 24), /* don't use TRIM */ ++ ATA_HORKAGE_ZERO_AFTER_TRIM = (1 << 22),/* guarantees zero after trim */ ++ ATA_HORKAGE_NOTRIM = (1 << 24), /* don't use TRIM */ ++ + + /* DMA mask for user DMA control: User visible values; DO NOT + renumber */ +diff --git a/include/linux/mtd/nand.h b/include/linux/mtd/nand.h +index e4d451e4600b..49141aa5de3f 100644 +--- a/include/linux/mtd/nand.h ++++ b/include/linux/mtd/nand.h +@@ -176,17 +176,17 @@ typedef enum { + /* Chip may not exist, so silence any errors in scan */ + #define NAND_SCAN_SILENT_NODEV 0x00040000 + /* +- * This option could be defined by controller drivers to protect against +- * kmap'ed, vmalloc'ed highmem buffers being passed from upper layers +- */ +-#define NAND_USE_BOUNCE_BUFFER 0x00080000 +-/* + * Autodetect nand buswidth with readid/onfi. + * This suppose the driver will configure the hardware in 8 bits mode + * when calling nand_scan_ident, and update its configuration + * before calling nand_scan_tail. + */ + #define NAND_BUSWIDTH_AUTO 0x00080000 ++/* ++ * This option could be defined by controller drivers to protect against ++ * kmap'ed, vmalloc'ed highmem buffers being passed from upper layers ++ */ ++#define NAND_USE_BOUNCE_BUFFER 0x00100000 + + /* Options set by nand scan */ + /* Nand scan has allocated controller struct */ +diff --git a/include/uapi/linux/pci_regs.h b/include/uapi/linux/pci_regs.h +index 4a1d0cc38ff2..7dd8d80edfb6 100644 +--- a/include/uapi/linux/pci_regs.h ++++ b/include/uapi/linux/pci_regs.h +@@ -319,6 +319,7 @@ + #define PCI_MSIX_PBA 8 /* Pending Bit Array offset */ + #define PCI_MSIX_PBA_BIR 0x00000007 /* BAR index */ + #define PCI_MSIX_PBA_OFFSET 0xfffffff8 /* Offset into specified BAR */ ++#define PCI_MSIX_FLAGS_BIRMASK PCI_MSIX_PBA_BIR /* deprecated */ + #define PCI_CAP_MSIX_SIZEOF 12 /* size of MSIX registers */ + + /* MSI-X Table entry format */ +diff --git a/init/main.c b/init/main.c +index 321d0ceb26d3..32940a68ea48 100644 +--- a/init/main.c ++++ b/init/main.c +@@ -667,6 +667,7 @@ asmlinkage __visible void __init start_kernel(void) + + check_bugs(); + ++ acpi_subsystem_init(); + sfi_init_late(); + + if (efi_enabled(EFI_RUNTIME_SERVICES)) { +diff --git a/ipc/mqueue.c b/ipc/mqueue.c +index 4fcf39af1776..f65a044d66c5 100644 +--- a/ipc/mqueue.c ++++ b/ipc/mqueue.c +@@ -143,7 +143,6 @@ static int msg_insert(struct msg_msg *msg, struct mqueue_inode_info *info) + if (!leaf) + return -ENOMEM; + INIT_LIST_HEAD(&leaf->msg_list); +- info->qsize += sizeof(*leaf); + } + leaf->priority = msg->m_type; + rb_link_node(&leaf->rb_node, parent, p); +@@ -188,7 +187,6 @@ try_again: + "lazy leaf delete!\n"); + rb_erase(&leaf->rb_node, &info->msg_tree); + if (info->node_cache) { +- info->qsize -= sizeof(*leaf); + kfree(leaf); + } else { + info->node_cache = leaf; +@@ -201,7 +199,6 @@ try_again: + if (list_empty(&leaf->msg_list)) { + rb_erase(&leaf->rb_node, &info->msg_tree); + if (info->node_cache) { +- info->qsize -= sizeof(*leaf); + kfree(leaf); + } else { + info->node_cache = leaf; +@@ -1026,7 +1023,6 @@ SYSCALL_DEFINE5(mq_timedsend, mqd_t, mqdes, const char __user *, u_msg_ptr, + /* Save our speculative allocation into the cache */ + INIT_LIST_HEAD(&new_leaf->msg_list); + info->node_cache = new_leaf; +- info->qsize += sizeof(*new_leaf); + new_leaf = NULL; + } else { + kfree(new_leaf); +@@ -1133,7 +1129,6 @@ SYSCALL_DEFINE5(mq_timedreceive, mqd_t, mqdes, char __user *, u_msg_ptr, + /* Save our speculative allocation into the cache */ + INIT_LIST_HEAD(&new_leaf->msg_list); + info->node_cache = new_leaf; +- info->qsize += sizeof(*new_leaf); + } else { + kfree(new_leaf); + } +diff --git a/kernel/irq/resend.c b/kernel/irq/resend.c +index 9065107f083e..7a5237a1bce5 100644 +--- a/kernel/irq/resend.c ++++ b/kernel/irq/resend.c +@@ -75,13 +75,21 @@ void check_irq_resend(struct irq_desc *desc, unsigned int irq) + !desc->irq_data.chip->irq_retrigger(&desc->irq_data)) { + #ifdef CONFIG_HARDIRQS_SW_RESEND + /* +- * If the interrupt has a parent irq and runs +- * in the thread context of the parent irq, +- * retrigger the parent. ++ * If the interrupt is running in the thread ++ * context of the parent irq we need to be ++ * careful, because we cannot trigger it ++ * directly. + */ +- if (desc->parent_irq && +- irq_settings_is_nested_thread(desc)) ++ if (irq_settings_is_nested_thread(desc)) { ++ /* ++ * If the parent_irq is valid, we ++ * retrigger the parent, otherwise we ++ * do nothing. ++ */ ++ if (!desc->parent_irq) ++ return; + irq = desc->parent_irq; ++ } + /* Set it pending and activate the softirq: */ + set_bit(irq, irqs_resend); + tasklet_schedule(&resend_tasklet); +diff --git a/kernel/kexec.c b/kernel/kexec.c +index 2abf9f6e9a61..04eae03efe1e 100644 +--- a/kernel/kexec.c ++++ b/kernel/kexec.c +@@ -707,7 +707,7 @@ static struct page *kimage_alloc_normal_control_pages(struct kimage *image, + do { + unsigned long pfn, epfn, addr, eaddr; + +- pages = kimage_alloc_pages(GFP_KERNEL, order); ++ pages = kimage_alloc_pages(KEXEC_CONTROL_MEMORY_GFP, order); + if (!pages) + break; + pfn = page_to_pfn(pages); +diff --git a/kernel/signal.c b/kernel/signal.c +index 8f0876f9f6dd..74083306403f 100644 +--- a/kernel/signal.c ++++ b/kernel/signal.c +@@ -2745,7 +2745,8 @@ int copy_siginfo_to_user(siginfo_t __user *to, const siginfo_t *from) + * Other callers might not initialize the si_lsb field, + * so check explicitly for the right codes here. + */ +- if (from->si_code == BUS_MCEERR_AR || from->si_code == BUS_MCEERR_AO) ++ if (from->si_signo == SIGBUS && ++ (from->si_code == BUS_MCEERR_AR || from->si_code == BUS_MCEERR_AO)) + err |= __put_user(from->si_addr_lsb, &to->si_addr_lsb); + #endif + break; +@@ -3012,7 +3013,7 @@ COMPAT_SYSCALL_DEFINE3(rt_sigqueueinfo, + int, sig, + struct compat_siginfo __user *, uinfo) + { +- siginfo_t info; ++ siginfo_t info = {}; + int ret = copy_siginfo_from_user32(&info, uinfo); + if (unlikely(ret)) + return ret; +@@ -3058,7 +3059,7 @@ COMPAT_SYSCALL_DEFINE4(rt_tgsigqueueinfo, + int, sig, + struct compat_siginfo __user *, uinfo) + { +- siginfo_t info; ++ siginfo_t info = {}; + + if (copy_siginfo_from_user32(&info, uinfo)) + return -EFAULT; +diff --git a/mm/vmscan.c b/mm/vmscan.c +index e3b0a54a44aa..e321fe20b979 100644 +--- a/mm/vmscan.c ++++ b/mm/vmscan.c +@@ -895,21 +895,17 @@ static unsigned long shrink_page_list(struct list_head *page_list, + * + * 2) Global reclaim encounters a page, memcg encounters a + * page that is not marked for immediate reclaim or +- * the caller does not have __GFP_IO. In this case mark ++ * the caller does not have __GFP_FS (or __GFP_IO if it's ++ * simply going to swap, not to fs). In this case mark + * the page for immediate reclaim and continue scanning. + * +- * __GFP_IO is checked because a loop driver thread might ++ * Require may_enter_fs because we would wait on fs, which ++ * may not have submitted IO yet. And the loop driver might + * enter reclaim, and deadlock if it waits on a page for + * which it is needed to do the write (loop masks off + * __GFP_IO|__GFP_FS for this reason); but more thought + * would probably show more reasons. + * +- * Don't require __GFP_FS, since we're not going into the +- * FS, just waiting on its writeback completion. Worryingly, +- * ext4 gfs2 and xfs allocate pages with +- * grab_cache_page_write_begin(,,AOP_FLAG_NOFS), so testing +- * may_enter_fs here is liable to OOM on them. +- * + * 3) memcg encounters a page that is not already marked + * PageReclaim. memcg does not have any dirty pages + * throttling so we could easily OOM just because too many +@@ -926,7 +922,7 @@ static unsigned long shrink_page_list(struct list_head *page_list, + + /* Case 2 above */ + } else if (global_reclaim(sc) || +- !PageReclaim(page) || !(sc->gfp_mask & __GFP_IO)) { ++ !PageReclaim(page) || !may_enter_fs) { + /* + * This is slightly racy - end_page_writeback() + * might have just cleared PageReclaim, then +diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c +index 1a7e979e80ba..15046aec8484 100644 +--- a/net/ipv4/ip_vti.c ++++ b/net/ipv4/ip_vti.c +@@ -65,7 +65,6 @@ static int vti_input(struct sk_buff *skb, int nexthdr, __be32 spi, + goto drop; + + XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = tunnel; +- skb->mark = be32_to_cpu(tunnel->parms.i_key); + + return xfrm_input(skb, nexthdr, spi, encap_type); + } +@@ -91,6 +90,8 @@ static int vti_rcv_cb(struct sk_buff *skb, int err) + struct pcpu_sw_netstats *tstats; + struct xfrm_state *x; + struct ip_tunnel *tunnel = XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4; ++ u32 orig_mark = skb->mark; ++ int ret; + + if (!tunnel) + return 1; +@@ -107,7 +108,11 @@ static int vti_rcv_cb(struct sk_buff *skb, int err) + x = xfrm_input_state(skb); + family = x->inner_mode->afinfo->family; + +- if (!xfrm_policy_check(NULL, XFRM_POLICY_IN, skb, family)) ++ skb->mark = be32_to_cpu(tunnel->parms.i_key); ++ ret = xfrm_policy_check(NULL, XFRM_POLICY_IN, skb, family); ++ skb->mark = orig_mark; ++ ++ if (!ret) + return -EPERM; + + skb_scrub_packet(skb, !net_eq(tunnel->net, dev_net(skb->dev))); +@@ -216,8 +221,6 @@ static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev) + + memset(&fl, 0, sizeof(fl)); + +- skb->mark = be32_to_cpu(tunnel->parms.o_key); +- + switch (skb->protocol) { + case htons(ETH_P_IP): + xfrm_decode_session(skb, &fl, AF_INET); +@@ -233,6 +236,9 @@ static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev) + return NETDEV_TX_OK; + } + ++ /* override mark with tunnel output key */ ++ fl.flowi_mark = be32_to_cpu(tunnel->parms.o_key); ++ + return vti_xmit(skb, dev, &fl); + } + +diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c +index 2459b7b0f705..1d67b37592d1 100644 +--- a/net/ipv6/ip6_vti.c ++++ b/net/ipv6/ip6_vti.c +@@ -305,7 +305,6 @@ static int vti6_rcv(struct sk_buff *skb) + } + + XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 = t; +- skb->mark = be32_to_cpu(t->parms.i_key); + + rcu_read_unlock(); + +@@ -325,6 +324,8 @@ static int vti6_rcv_cb(struct sk_buff *skb, int err) + struct pcpu_sw_netstats *tstats; + struct xfrm_state *x; + struct ip6_tnl *t = XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6; ++ u32 orig_mark = skb->mark; ++ int ret; + + if (!t) + return 1; +@@ -341,7 +342,11 @@ static int vti6_rcv_cb(struct sk_buff *skb, int err) + x = xfrm_input_state(skb); + family = x->inner_mode->afinfo->family; + +- if (!xfrm_policy_check(NULL, XFRM_POLICY_IN, skb, family)) ++ skb->mark = be32_to_cpu(t->parms.i_key); ++ ret = xfrm_policy_check(NULL, XFRM_POLICY_IN, skb, family); ++ skb->mark = orig_mark; ++ ++ if (!ret) + return -EPERM; + + skb_scrub_packet(skb, !net_eq(t->net, dev_net(skb->dev))); +@@ -472,7 +477,6 @@ vti6_tnl_xmit(struct sk_buff *skb, struct net_device *dev) + int ret; + + memset(&fl, 0, sizeof(fl)); +- skb->mark = be32_to_cpu(t->parms.o_key); + + switch (skb->protocol) { + case htons(ETH_P_IPV6): +@@ -493,6 +497,9 @@ vti6_tnl_xmit(struct sk_buff *skb, struct net_device *dev) + goto tx_err; + } + ++ /* override mark with tunnel output key */ ++ fl.flowi_mark = be32_to_cpu(t->parms.o_key); ++ + ret = vti6_xmit(skb, dev, &fl); + if (ret < 0) + goto tx_err; +diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c +index c68896adfa96..2d19963e6d97 100644 +--- a/net/mac80211/debugfs_netdev.c ++++ b/net/mac80211/debugfs_netdev.c +@@ -725,6 +725,7 @@ void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata) + + debugfs_remove_recursive(sdata->vif.debugfs_dir); + sdata->vif.debugfs_dir = NULL; ++ sdata->debugfs.subdir_stations = NULL; + } + + void ieee80211_debugfs_rename_netdev(struct ieee80211_sub_if_data *sdata) +diff --git a/net/rds/ib_rdma.c b/net/rds/ib_rdma.c +index 273b8bff6ba4..657ba9f5d308 100644 +--- a/net/rds/ib_rdma.c ++++ b/net/rds/ib_rdma.c +@@ -759,8 +759,10 @@ void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents, + } + + ibmr = rds_ib_alloc_fmr(rds_ibdev); +- if (IS_ERR(ibmr)) ++ if (IS_ERR(ibmr)) { ++ rds_ib_dev_put(rds_ibdev); + return ibmr; ++ } + + ret = rds_ib_map_fmr(rds_ibdev, ibmr, sg, nents); + if (ret == 0) +diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c +index 85d1d4764612..00977873300c 100644 +--- a/net/xfrm/xfrm_input.c ++++ b/net/xfrm/xfrm_input.c +@@ -13,6 +13,8 @@ + #include <net/dst.h> + #include <net/ip.h> + #include <net/xfrm.h> ++#include <net/ip_tunnels.h> ++#include <net/ip6_tunnel.h> + + static struct kmem_cache *secpath_cachep __read_mostly; + +@@ -186,6 +188,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) + struct xfrm_state *x = NULL; + xfrm_address_t *daddr; + struct xfrm_mode *inner_mode; ++ u32 mark = skb->mark; + unsigned int family; + int decaps = 0; + int async = 0; +@@ -203,6 +206,18 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) + XFRM_SPI_SKB_CB(skb)->daddroff); + family = XFRM_SPI_SKB_CB(skb)->family; + ++ /* if tunnel is present override skb->mark value with tunnel i_key */ ++ if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4) { ++ switch (family) { ++ case AF_INET: ++ mark = be32_to_cpu(XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4->parms.i_key); ++ break; ++ case AF_INET6: ++ mark = be32_to_cpu(XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6->parms.i_key); ++ break; ++ } ++ } ++ + /* Allocate new secpath or COW existing one. */ + if (!skb->sp || atomic_read(&skb->sp->refcnt) != 1) { + struct sec_path *sp; +@@ -229,7 +244,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) + goto drop; + } + +- x = xfrm_state_lookup(net, skb->mark, daddr, spi, nexthdr, family); ++ x = xfrm_state_lookup(net, mark, daddr, spi, nexthdr, family); + if (x == NULL) { + XFRM_INC_STATS(net, LINUX_MIB_XFRMINNOSTATES); + xfrm_audit_state_notfound(skb, family, spi, seq); +diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c +index cdc620b2152f..7e4ad2943918 100644 +--- a/security/integrity/ima/ima_policy.c ++++ b/security/integrity/ima/ima_policy.c +@@ -27,6 +27,8 @@ + #define IMA_UID 0x0008 + #define IMA_FOWNER 0x0010 + #define IMA_FSUUID 0x0020 ++#define IMA_INMASK 0x0040 ++#define IMA_EUID 0x0080 + + #define UNKNOWN 0 + #define MEASURE 0x0001 /* same as IMA_MEASURE */ +@@ -176,6 +178,9 @@ static bool ima_match_rules(struct ima_rule_entry *rule, + if ((rule->flags & IMA_MASK) && + (rule->mask != mask && func != POST_SETATTR)) + return false; ++ if ((rule->flags & IMA_INMASK) && ++ (!(rule->mask & mask) && func != POST_SETATTR)) ++ return false; + if ((rule->flags & IMA_FSMAGIC) + && rule->fsmagic != inode->i_sb->s_magic) + return false; +@@ -184,6 +189,16 @@ static bool ima_match_rules(struct ima_rule_entry *rule, + return false; + if ((rule->flags & IMA_UID) && !uid_eq(rule->uid, cred->uid)) + return false; ++ if (rule->flags & IMA_EUID) { ++ if (has_capability_noaudit(current, CAP_SETUID)) { ++ if (!uid_eq(rule->uid, cred->euid) ++ && !uid_eq(rule->uid, cred->suid) ++ && !uid_eq(rule->uid, cred->uid)) ++ return false; ++ } else if (!uid_eq(rule->uid, cred->euid)) ++ return false; ++ } ++ + if ((rule->flags & IMA_FOWNER) && !uid_eq(rule->fowner, inode->i_uid)) + return false; + for (i = 0; i < MAX_LSM_RULES; i++) { +@@ -378,7 +393,8 @@ enum { + Opt_audit, + Opt_obj_user, Opt_obj_role, Opt_obj_type, + Opt_subj_user, Opt_subj_role, Opt_subj_type, +- Opt_func, Opt_mask, Opt_fsmagic, Opt_uid, Opt_fowner, ++ Opt_func, Opt_mask, Opt_fsmagic, ++ Opt_uid, Opt_euid, Opt_fowner, + Opt_appraise_type, Opt_fsuuid, Opt_permit_directio + }; + +@@ -399,6 +415,7 @@ static match_table_t policy_tokens = { + {Opt_fsmagic, "fsmagic=%s"}, + {Opt_fsuuid, "fsuuid=%s"}, + {Opt_uid, "uid=%s"}, ++ {Opt_euid, "euid=%s"}, + {Opt_fowner, "fowner=%s"}, + {Opt_appraise_type, "appraise_type=%s"}, + {Opt_permit_directio, "permit_directio"}, +@@ -440,6 +457,7 @@ static void ima_log_string(struct audit_buffer *ab, char *key, char *value) + static int ima_parse_rule(char *rule, struct ima_rule_entry *entry) + { + struct audit_buffer *ab; ++ char *from; + char *p; + int result = 0; + +@@ -530,18 +548,23 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry) + if (entry->mask) + result = -EINVAL; + +- if ((strcmp(args[0].from, "MAY_EXEC")) == 0) ++ from = args[0].from; ++ if (*from == '^') ++ from++; ++ ++ if ((strcmp(from, "MAY_EXEC")) == 0) + entry->mask = MAY_EXEC; +- else if (strcmp(args[0].from, "MAY_WRITE") == 0) ++ else if (strcmp(from, "MAY_WRITE") == 0) + entry->mask = MAY_WRITE; +- else if (strcmp(args[0].from, "MAY_READ") == 0) ++ else if (strcmp(from, "MAY_READ") == 0) + entry->mask = MAY_READ; +- else if (strcmp(args[0].from, "MAY_APPEND") == 0) ++ else if (strcmp(from, "MAY_APPEND") == 0) + entry->mask = MAY_APPEND; + else + result = -EINVAL; + if (!result) +- entry->flags |= IMA_MASK; ++ entry->flags |= (*args[0].from == '^') ++ ? IMA_INMASK : IMA_MASK; + break; + case Opt_fsmagic: + ima_log_string(ab, "fsmagic", args[0].from); +@@ -571,6 +594,9 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry) + break; + case Opt_uid: + ima_log_string(ab, "uid", args[0].from); ++ case Opt_euid: ++ if (token == Opt_euid) ++ ima_log_string(ab, "euid", args[0].from); + + if (uid_valid(entry->uid)) { + result = -EINVAL; +@@ -579,11 +605,14 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry) + + result = kstrtoul(args[0].from, 10, &lnum); + if (!result) { +- entry->uid = make_kuid(current_user_ns(), (uid_t)lnum); +- if (!uid_valid(entry->uid) || (((uid_t)lnum) != lnum)) ++ entry->uid = make_kuid(current_user_ns(), ++ (uid_t) lnum); ++ if (!uid_valid(entry->uid) || ++ (uid_t)lnum != lnum) + result = -EINVAL; + else +- entry->flags |= IMA_UID; ++ entry->flags |= (token == Opt_uid) ++ ? IMA_UID : IMA_EUID; + } + break; + case Opt_fowner: +diff --git a/sound/firewire/amdtp.c b/sound/firewire/amdtp.c +index 95fc2eaf11dc..b960b7f26664 100644 +--- a/sound/firewire/amdtp.c ++++ b/sound/firewire/amdtp.c +@@ -678,8 +678,9 @@ static void handle_in_packet(struct amdtp_stream *s, + s->data_block_counter != UINT_MAX) + data_block_counter = s->data_block_counter; + +- if (((s->flags & CIP_SKIP_DBC_ZERO_CHECK) && data_block_counter == 0) || +- (s->data_block_counter == UINT_MAX)) { ++ if (((s->flags & CIP_SKIP_DBC_ZERO_CHECK) && ++ data_block_counter == s->tx_first_dbc) || ++ s->data_block_counter == UINT_MAX) { + lost = false; + } else if (!(s->flags & CIP_DBC_IS_END_EVENT)) { + lost = data_block_counter != s->data_block_counter; +diff --git a/sound/firewire/amdtp.h b/sound/firewire/amdtp.h +index 4823c08196ac..6ce95b05ba2e 100644 +--- a/sound/firewire/amdtp.h ++++ b/sound/firewire/amdtp.h +@@ -131,6 +131,8 @@ struct amdtp_stream { + + /* quirk: fixed interval of dbc between previos/current packets. */ + unsigned int tx_dbc_interval; ++ /* quirk: indicate the value of dbc field in a first packet. */ ++ unsigned int tx_first_dbc; + + /* quirk: the first count of data blocks in an rx packet for MIDI */ + unsigned int rx_blocks_for_midi; +diff --git a/sound/firewire/fireworks/fireworks.c b/sound/firewire/fireworks/fireworks.c +index 3e2ed8e82cbc..6813b0f6f185 100644 +--- a/sound/firewire/fireworks/fireworks.c ++++ b/sound/firewire/fireworks/fireworks.c +@@ -237,8 +237,16 @@ efw_probe(struct fw_unit *unit, + err = get_hardware_info(efw); + if (err < 0) + goto error; ++ /* AudioFire8 (since 2009) and AudioFirePre8 */ + if (entry->model_id == MODEL_ECHO_AUDIOFIRE_9) + efw->is_af9 = true; ++ /* These models uses the same firmware. */ ++ if (entry->model_id == MODEL_ECHO_AUDIOFIRE_2 || ++ entry->model_id == MODEL_ECHO_AUDIOFIRE_4 || ++ entry->model_id == MODEL_ECHO_AUDIOFIRE_9 || ++ entry->model_id == MODEL_GIBSON_RIP || ++ entry->model_id == MODEL_GIBSON_GOLDTOP) ++ efw->is_fireworks3 = true; + + snd_efw_proc_init(efw); + +diff --git a/sound/firewire/fireworks/fireworks.h b/sound/firewire/fireworks/fireworks.h +index 4f0201a95222..084d414b228c 100644 +--- a/sound/firewire/fireworks/fireworks.h ++++ b/sound/firewire/fireworks/fireworks.h +@@ -71,6 +71,7 @@ struct snd_efw { + + /* for quirks */ + bool is_af9; ++ bool is_fireworks3; + u32 firmware_version; + + unsigned int midi_in_ports; +diff --git a/sound/firewire/fireworks/fireworks_stream.c b/sound/firewire/fireworks/fireworks_stream.c +index b985fc5ebdc6..30c4042524d0 100644 +--- a/sound/firewire/fireworks/fireworks_stream.c ++++ b/sound/firewire/fireworks/fireworks_stream.c +@@ -167,6 +167,15 @@ int snd_efw_stream_init_duplex(struct snd_efw *efw) + efw->tx_stream.flags |= CIP_DBC_IS_END_EVENT; + /* Fireworks reset dbc at bus reset. */ + efw->tx_stream.flags |= CIP_SKIP_DBC_ZERO_CHECK; ++ /* ++ * But Recent firmwares starts packets with non-zero dbc. ++ * Driver version 5.7.6 installs firmware version 5.7.3. ++ */ ++ if (efw->is_fireworks3 && ++ (efw->firmware_version == 0x5070000 || ++ efw->firmware_version == 0x5070300 || ++ efw->firmware_version == 0x5080000)) ++ efw->tx_stream.tx_first_dbc = 0x02; + /* AudioFire9 always reports wrong dbs. */ + if (efw->is_af9) + efw->tx_stream.flags |= CIP_WRONG_DBS; +diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c +index dd2b3d92071f..e5dac8ea65e4 100644 +--- a/sound/pci/hda/patch_cirrus.c ++++ b/sound/pci/hda/patch_cirrus.c +@@ -1001,9 +1001,7 @@ static void cs4210_spdif_automute(struct hda_codec *codec, + + spec->spdif_present = spdif_present; + /* SPDIF TX on/off */ +- if (spdif_present) +- snd_hda_set_pin_ctl(codec, spdif_pin, +- spdif_present ? PIN_OUT : 0); ++ snd_hda_set_pin_ctl(codec, spdif_pin, spdif_present ? PIN_OUT : 0); + + cs_automute(codec); + } +diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c +index edb6e6124a23..b422e406a9cb 100644 +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -47,7 +47,9 @@ MODULE_PARM_DESC(static_hdmi_pcm, "Don't restrict PCM parameters per ELD info"); + + #define is_haswell(codec) ((codec)->vendor_id == 0x80862807) + #define is_broadwell(codec) ((codec)->vendor_id == 0x80862808) +-#define is_haswell_plus(codec) (is_haswell(codec) || is_broadwell(codec)) ++#define is_skylake(codec) ((codec)->vendor_id == 0x80862809) ++#define is_haswell_plus(codec) (is_haswell(codec) || is_broadwell(codec) \ ++ || is_skylake(codec)) + + #define is_valleyview(codec) ((codec)->vendor_id == 0x80862882) + #define is_cherryview(codec) ((codec)->vendor_id == 0x80862883) +@@ -3366,6 +3368,7 @@ static const struct hda_codec_preset snd_hda_preset_hdmi[] = { + { .id = 0x80862806, .name = "PantherPoint HDMI", .patch = patch_generic_hdmi }, + { .id = 0x80862807, .name = "Haswell HDMI", .patch = patch_generic_hdmi }, + { .id = 0x80862808, .name = "Broadwell HDMI", .patch = patch_generic_hdmi }, ++{ .id = 0x80862809, .name = "Skylake HDMI", .patch = patch_generic_hdmi }, + { .id = 0x80862880, .name = "CedarTrail HDMI", .patch = patch_generic_hdmi }, + { .id = 0x80862882, .name = "Valleyview2 HDMI", .patch = patch_generic_hdmi }, + { .id = 0x80862883, .name = "Braswell HDMI", .patch = patch_generic_hdmi }, +@@ -3427,6 +3430,7 @@ MODULE_ALIAS("snd-hda-codec-id:80862805"); + MODULE_ALIAS("snd-hda-codec-id:80862806"); + MODULE_ALIAS("snd-hda-codec-id:80862807"); + MODULE_ALIAS("snd-hda-codec-id:80862808"); ++MODULE_ALIAS("snd-hda-codec-id:80862809"); + MODULE_ALIAS("snd-hda-codec-id:80862880"); + MODULE_ALIAS("snd-hda-codec-id:80862882"); + MODULE_ALIAS("snd-hda-codec-id:80862883"); +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 24cec17db1a4..f979293b421a 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -2221,7 +2221,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = { + SND_PCI_QUIRK(0x106b, 0x4300, "iMac 9,1", ALC889_FIXUP_IMAC91_VREF), + SND_PCI_QUIRK(0x106b, 0x4600, "MacbookPro 5,2", ALC889_FIXUP_IMAC91_VREF), + SND_PCI_QUIRK(0x106b, 0x4900, "iMac 9,1 Aluminum", ALC889_FIXUP_IMAC91_VREF), +- SND_PCI_QUIRK(0x106b, 0x4a00, "Macbook 5,2", ALC889_FIXUP_IMAC91_VREF), ++ SND_PCI_QUIRK(0x106b, 0x4a00, "Macbook 5,2", ALC889_FIXUP_MBA11_VREF), + + SND_PCI_QUIRK(0x1071, 0x8258, "Evesham Voyaeger", ALC882_FIXUP_EAPD), + SND_PCI_QUIRK(0x1462, 0x7350, "MSI-7350", ALC889_FIXUP_CD), +diff --git a/sound/soc/codecs/pcm1681.c b/sound/soc/codecs/pcm1681.c +index 477e13d30971..e7ba557979cb 100644 +--- a/sound/soc/codecs/pcm1681.c ++++ b/sound/soc/codecs/pcm1681.c +@@ -102,7 +102,7 @@ static int pcm1681_set_deemph(struct snd_soc_codec *codec) + + if (val != -1) { + regmap_update_bits(priv->regmap, PCM1681_DEEMPH_CONTROL, +- PCM1681_DEEMPH_RATE_MASK, val); ++ PCM1681_DEEMPH_RATE_MASK, val << 3); + enable = 1; + } else + enable = 0; +diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c +index 943e6a9a6319..34e5d8253c24 100644 +--- a/sound/soc/soc-dapm.c ++++ b/sound/soc/soc-dapm.c +@@ -1854,6 +1854,7 @@ static ssize_t dapm_widget_power_read_file(struct file *file, + size_t count, loff_t *ppos) + { + struct snd_soc_dapm_widget *w = file->private_data; ++ struct snd_soc_card *card = w->dapm->card; + char *buf; + int in, out; + ssize_t ret; +@@ -1863,6 +1864,8 @@ static ssize_t dapm_widget_power_read_file(struct file *file, + if (!buf) + return -ENOMEM; + ++ mutex_lock(&card->dapm_mutex); ++ + in = is_connected_input_ep(w, NULL); + dapm_clear_walk_input(w->dapm, &w->sources); + out = is_connected_output_ep(w, NULL); +@@ -1905,6 +1908,8 @@ static ssize_t dapm_widget_power_read_file(struct file *file, + p->sink->name); + } + ++ mutex_unlock(&card->dapm_mutex); ++ + ret = simple_read_from_buffer(user_buf, count, ppos, buf, ret); + + kfree(buf); +@@ -2165,11 +2170,15 @@ static ssize_t dapm_widget_show(struct device *dev, + struct snd_soc_pcm_runtime *rtd = dev_get_drvdata(dev); + int i, count = 0; + ++ mutex_lock(&rtd->card->dapm_mutex); ++ + for (i = 0; i < rtd->num_codecs; i++) { + struct snd_soc_codec *codec = rtd->codec_dais[i]->codec; + count += dapm_widget_show_codec(codec, buf + count); + } + ++ mutex_unlock(&rtd->card->dapm_mutex); ++ + return count; + } + +diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c +index b16be3944213..9a3e1076a5b1 100644 +--- a/sound/usb/mixer_maps.c ++++ b/sound/usb/mixer_maps.c +@@ -336,6 +336,20 @@ static const struct usbmix_name_map scms_usb3318_map[] = { + { 0 } + }; + ++/* Bose companion 5, the dB conversion factor is 16 instead of 256 */ ++static struct usbmix_dB_map bose_companion5_dB = {-5006, -6}; ++static struct usbmix_name_map bose_companion5_map[] = { ++ { 3, NULL, .dB = &bose_companion5_dB }, ++ { 0 } /* terminator */ ++}; ++ ++/* Dragonfly DAC 1.2, the dB conversion factor is 1 instead of 256 */ ++static struct usbmix_dB_map dragonfly_1_2_dB = {0, 5000}; ++static struct usbmix_name_map dragonfly_1_2_map[] = { ++ { 7, NULL, .dB = &dragonfly_1_2_dB }, ++ { 0 } /* terminator */ ++}; ++ + /* + * Control map entries + */ +@@ -442,6 +456,16 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = { + .id = USB_ID(0x25c4, 0x0003), + .map = scms_usb3318_map, + }, ++ { ++ /* Bose Companion 5 */ ++ .id = USB_ID(0x05a7, 0x1020), ++ .map = bose_companion5_map, ++ }, ++ { ++ /* Dragonfly DAC 1.2 */ ++ .id = USB_ID(0x21b4, 0x0081), ++ .map = dragonfly_1_2_map, ++ }, + { 0 } /* terminator */ + }; + +diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h +index fde5b6e3c8e5..17e1fdabd456 100644 +--- a/sound/usb/quirks-table.h ++++ b/sound/usb/quirks-table.h +@@ -2516,6 +2516,74 @@ YAMAHA_DEVICE(0x7010, "UB99"), + } + }, + ++/* Steinberg devices */ ++{ ++ /* Steinberg MI2 */ ++ USB_DEVICE_VENDOR_SPEC(0x0a4e, 0x2040), ++ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { ++ .ifnum = QUIRK_ANY_INTERFACE, ++ .type = QUIRK_COMPOSITE, ++ .data = & (const struct snd_usb_audio_quirk[]) { ++ { ++ .ifnum = 0, ++ .type = QUIRK_AUDIO_STANDARD_INTERFACE ++ }, ++ { ++ .ifnum = 1, ++ .type = QUIRK_AUDIO_STANDARD_INTERFACE ++ }, ++ { ++ .ifnum = 2, ++ .type = QUIRK_AUDIO_STANDARD_INTERFACE ++ }, ++ { ++ .ifnum = 3, ++ .type = QUIRK_MIDI_FIXED_ENDPOINT, ++ .data = &(const struct snd_usb_midi_endpoint_info) { ++ .out_cables = 0x0001, ++ .in_cables = 0x0001 ++ } ++ }, ++ { ++ .ifnum = -1 ++ } ++ } ++ } ++}, ++{ ++ /* Steinberg MI4 */ ++ USB_DEVICE_VENDOR_SPEC(0x0a4e, 0x4040), ++ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { ++ .ifnum = QUIRK_ANY_INTERFACE, ++ .type = QUIRK_COMPOSITE, ++ .data = & (const struct snd_usb_audio_quirk[]) { ++ { ++ .ifnum = 0, ++ .type = QUIRK_AUDIO_STANDARD_INTERFACE ++ }, ++ { ++ .ifnum = 1, ++ .type = QUIRK_AUDIO_STANDARD_INTERFACE ++ }, ++ { ++ .ifnum = 2, ++ .type = QUIRK_AUDIO_STANDARD_INTERFACE ++ }, ++ { ++ .ifnum = 3, ++ .type = QUIRK_MIDI_FIXED_ENDPOINT, ++ .data = &(const struct snd_usb_midi_endpoint_info) { ++ .out_cables = 0x0001, ++ .in_cables = 0x0001 ++ } ++ }, ++ { ++ .ifnum = -1 ++ } ++ } ++ } ++}, ++ + /* TerraTec devices */ + { + USB_DEVICE_VENDOR_SPEC(0x0ccd, 0x0012),
