diff options
Diffstat (limited to '1042_linux-3.12.43.patch')
| -rw-r--r-- | 1042_linux-3.12.43.patch | 5626 |
1 files changed, 5626 insertions, 0 deletions
diff --git a/1042_linux-3.12.43.patch b/1042_linux-3.12.43.patch new file mode 100644 index 00000000..27e709a5 --- /dev/null +++ b/1042_linux-3.12.43.patch @@ -0,0 +1,5626 @@ +diff --git a/Documentation/devicetree/bindings/dma/fsl-mxs-dma.txt b/Documentation/devicetree/bindings/dma/fsl-mxs-dma.txt +index a4873e5e3e36..e30e184f50c7 100644 +--- a/Documentation/devicetree/bindings/dma/fsl-mxs-dma.txt ++++ b/Documentation/devicetree/bindings/dma/fsl-mxs-dma.txt +@@ -38,7 +38,7 @@ dma_apbx: dma-apbx@80024000 { + 80 81 68 69 + 70 71 72 73 + 74 75 76 77>; +- interrupt-names = "auart4-rx", "aurat4-tx", "spdif-tx", "empty", ++ interrupt-names = "auart4-rx", "auart4-tx", "spdif-tx", "empty", + "saif0", "saif1", "i2c0", "i2c1", + "auart0-rx", "auart0-tx", "auart1-rx", "auart1-tx", + "auart2-rx", "auart2-tx", "auart3-rx", "auart3-tx"; +diff --git a/Makefile b/Makefile +index f78c2f2579f9..baf73c808c04 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 12 +-SUBLEVEL = 42 ++SUBLEVEL = 43 + EXTRAVERSION = + NAME = One Giant Leap for Frogkind + +diff --git a/arch/arc/kernel/signal.c b/arch/arc/kernel/signal.c +index d68b410595c8..a0c63fc48457 100644 +--- a/arch/arc/kernel/signal.c ++++ b/arch/arc/kernel/signal.c +@@ -131,6 +131,15 @@ SYSCALL_DEFINE0(rt_sigreturn) + /* Don't restart from sigreturn */ + syscall_wont_restart(regs); + ++ /* ++ * Ensure that sigreturn always returns to user mode (in case the ++ * regs saved on user stack got fudged between save and sigreturn) ++ * Otherwise it is easy to panic the kernel with a custom ++ * signal handler and/or restorer which clobberes the status32/ret ++ * to return to a bogus location in kernel mode. ++ */ ++ regs->status32 |= STATUS_U_MASK; ++ + return regs->r0; + + badframe: +@@ -234,8 +243,11 @@ setup_rt_frame(int signo, struct k_sigaction *ka, siginfo_t *info, + + /* + * handler returns using sigreturn stub provided already by userpsace ++ * If not, nuke the process right away + */ +- BUG_ON(!(ka->sa.sa_flags & SA_RESTORER)); ++ if(!(ka->sa.sa_flags & SA_RESTORER)) ++ return 1; ++ + regs->blink = (unsigned long)ka->sa.sa_restorer; + + /* User Stack for signal handler will be above the frame just carved */ +@@ -302,12 +314,12 @@ handle_signal(unsigned long sig, struct k_sigaction *ka, siginfo_t *info, + struct pt_regs *regs) + { + sigset_t *oldset = sigmask_to_save(); +- int ret; ++ int failed; + + /* Set up the stack frame */ +- ret = setup_rt_frame(sig, ka, info, oldset, regs); ++ failed = setup_rt_frame(sig, ka, info, oldset, regs); + +- if (ret) ++ if (failed) + force_sigsegv(sig, current); + else + signal_delivered(sig, info, ka, regs, 0); +diff --git a/arch/arm/boot/dts/armada-xp-openblocks-ax3-4.dts b/arch/arm/boot/dts/armada-xp-openblocks-ax3-4.dts +index d6cce8aa8c68..3db86a6ec91b 100644 +--- a/arch/arm/boot/dts/armada-xp-openblocks-ax3-4.dts ++++ b/arch/arm/boot/dts/armada-xp-openblocks-ax3-4.dts +@@ -69,6 +69,10 @@ + }; + + internal-regs { ++ rtc@10300 { ++ /* No crystal connected to the internal RTC */ ++ status = "disabled"; ++ }; + serial@12000 { + clock-frequency = <250000000>; + status = "okay"; +diff --git a/arch/arm/boot/dts/dove.dtsi b/arch/arm/boot/dts/dove.dtsi +index cc279166646f..72bf0257ab78 100644 +--- a/arch/arm/boot/dts/dove.dtsi ++++ b/arch/arm/boot/dts/dove.dtsi +@@ -106,7 +106,7 @@ + + uart2: serial@12200 { + compatible = "ns16550a"; +- reg = <0x12000 0x100>; ++ reg = <0x12200 0x100>; + reg-shift = <2>; + interrupts = <9>; + clocks = <&core_clk 0>; +@@ -115,7 +115,7 @@ + + uart3: serial@12300 { + compatible = "ns16550a"; +- reg = <0x12100 0x100>; ++ reg = <0x12300 0x100>; + reg-shift = <2>; + interrupts = <10>; + clocks = <&core_clk 0>; +diff --git a/arch/arm/boot/dts/imx23-olinuxino.dts b/arch/arm/boot/dts/imx23-olinuxino.dts +index fc766ae12e24..a4b59727bff5 100644 +--- a/arch/arm/boot/dts/imx23-olinuxino.dts ++++ b/arch/arm/boot/dts/imx23-olinuxino.dts +@@ -12,6 +12,7 @@ + */ + + /dts-v1/; ++#include <dt-bindings/gpio/gpio.h> + /include/ "imx23.dtsi" + + / { +@@ -93,6 +94,7 @@ + + ahb@80080000 { + usb0: usb@80080000 { ++ dr_mode = "host"; + vbus-supply = <®_usb0_vbus>; + status = "okay"; + }; +@@ -119,7 +121,7 @@ + + user { + label = "green"; +- gpios = <&gpio2 1 1>; ++ gpios = <&gpio2 1 GPIO_ACTIVE_HIGH>; + }; + }; + }; +diff --git a/arch/arm/boot/dts/imx25.dtsi b/arch/arm/boot/dts/imx25.dtsi +index cf3300a3071d..bfc327ff70af 100644 +--- a/arch/arm/boot/dts/imx25.dtsi ++++ b/arch/arm/boot/dts/imx25.dtsi +@@ -411,6 +411,7 @@ + + pwm4: pwm@53fc8000 { + compatible = "fsl,imx25-pwm", "fsl,imx27-pwm"; ++ #pwm-cells = <2>; + reg = <0x53fc8000 0x4000>; + clocks = <&clks 108>, <&clks 52>; + clock-names = "ipg", "per"; +diff --git a/arch/arm/boot/dts/imx28.dtsi b/arch/arm/boot/dts/imx28.dtsi +index 7363fded95ee..18132bba4260 100644 +--- a/arch/arm/boot/dts/imx28.dtsi ++++ b/arch/arm/boot/dts/imx28.dtsi +@@ -761,7 +761,7 @@ + 80 81 68 69 + 70 71 72 73 + 74 75 76 77>; +- interrupt-names = "auart4-rx", "aurat4-tx", "spdif-tx", "empty", ++ interrupt-names = "auart4-rx", "auart4-tx", "spdif-tx", "empty", + "saif0", "saif1", "i2c0", "i2c1", + "auart0-rx", "auart0-tx", "auart1-rx", "auart1-tx", + "auart2-rx", "auart2-tx", "auart3-rx", "auart3-tx"; +diff --git a/arch/arm/boot/dts/ste-dbx5x0.dtsi b/arch/arm/boot/dts/ste-dbx5x0.dtsi +index 1c1091eedade..faa64cd3ab73 100644 +--- a/arch/arm/boot/dts/ste-dbx5x0.dtsi ++++ b/arch/arm/boot/dts/ste-dbx5x0.dtsi +@@ -774,23 +774,6 @@ + status = "disabled"; + }; + +- vmmci: regulator-gpio { +- compatible = "regulator-gpio"; +- +- regulator-min-microvolt = <1800000>; +- regulator-max-microvolt = <2900000>; +- regulator-name = "mmci-reg"; +- regulator-type = "voltage"; +- +- startup-delay-us = <100>; +- enable-active-high; +- +- states = <1800000 0x1 +- 2900000 0x0>; +- +- status = "disabled"; +- }; +- + cryp@a03cb000 { + compatible = "stericsson,ux500-cryp"; + reg = <0xa03cb000 0x1000>; +diff --git a/arch/arm/boot/dts/ste-href.dtsi b/arch/arm/boot/dts/ste-href.dtsi +index 370e03f5e7b2..592f5a400ca8 100644 +--- a/arch/arm/boot/dts/ste-href.dtsi ++++ b/arch/arm/boot/dts/ste-href.dtsi +@@ -106,6 +106,21 @@ + }; + }; + ++ vmmci: regulator-gpio { ++ compatible = "regulator-gpio"; ++ ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <2900000>; ++ regulator-name = "mmci-reg"; ++ regulator-type = "voltage"; ++ ++ startup-delay-us = <100>; ++ enable-active-high; ++ ++ states = <1800000 0x1 ++ 2900000 0x0>; ++ }; ++ + // External Micro SD slot + sdi0_per1@80126000 { + arm,primecell-periphid = <0x10480180>; +diff --git a/arch/arm/boot/dts/ste-snowball.dts b/arch/arm/boot/dts/ste-snowball.dts +index f1fc128e249d..51a6ad40f8a8 100644 +--- a/arch/arm/boot/dts/ste-snowball.dts ++++ b/arch/arm/boot/dts/ste-snowball.dts +@@ -121,10 +121,21 @@ + }; + + vmmci: regulator-gpio { ++ compatible = "regulator-gpio"; ++ + gpios = <&gpio6 25 0x4>; + enable-gpio = <&gpio7 4 0x4>; + +- status = "okay"; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <2900000>; ++ regulator-name = "mmci-reg"; ++ regulator-type = "voltage"; ++ ++ startup-delay-us = <100>; ++ enable-active-high; ++ ++ states = <1800000 0x1 ++ 2900000 0x0>; + }; + + // External Micro SD slot +diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h +index f4b46d39b9cf..051b7269e639 100644 +--- a/arch/arm/include/asm/elf.h ++++ b/arch/arm/include/asm/elf.h +@@ -114,7 +114,7 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs); + the loader. We need to make sure that it is out of the way of the program + that it will "exec", and that there is sufficient room for the brk. */ + +-#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3) ++#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2) + + /* When the program starts, a1 contains a pointer to a function to be + registered with atexit, as per the SVR4 ABI. A value of 0 means we +diff --git a/arch/arm/mach-s3c64xx/crag6410.h b/arch/arm/mach-s3c64xx/crag6410.h +index 4c3c9994fc2c..81dc722ced57 100644 +--- a/arch/arm/mach-s3c64xx/crag6410.h ++++ b/arch/arm/mach-s3c64xx/crag6410.h +@@ -14,6 +14,7 @@ + #include <linux/gpio.h> + + #define GLENFARCLAS_PMIC_IRQ_BASE IRQ_BOARD_START ++#define BANFF_PMIC_IRQ_BASE (IRQ_BOARD_START + 64) + + #define PCA935X_GPIO_BASE GPIO_BOARD_START + #define CODEC_GPIO_BASE (GPIO_BOARD_START + 8) +diff --git a/arch/arm/mach-s3c64xx/mach-crag6410.c b/arch/arm/mach-s3c64xx/mach-crag6410.c +index eb8e5a1aca42..27180bd93832 100644 +--- a/arch/arm/mach-s3c64xx/mach-crag6410.c ++++ b/arch/arm/mach-s3c64xx/mach-crag6410.c +@@ -558,6 +558,7 @@ static struct wm831x_touch_pdata touch_pdata = { + + static struct wm831x_pdata crag_pmic_pdata = { + .wm831x_num = 1, ++ .irq_base = BANFF_PMIC_IRQ_BASE, + .gpio_base = BANFF_PMIC_GPIO_BASE, + .soft_shutdown = true, + +diff --git a/arch/arm64/kernel/vdso/Makefile b/arch/arm64/kernel/vdso/Makefile +index 6d20b7d162d8..a268a9af0c2d 100644 +--- a/arch/arm64/kernel/vdso/Makefile ++++ b/arch/arm64/kernel/vdso/Makefile +@@ -43,7 +43,7 @@ $(obj)/vdso-offsets.h: $(obj)/vdso.so.dbg FORCE + $(call if_changed,vdsosym) + + # Assembly rules for the .S files +-$(obj-vdso): %.o: %.S ++$(obj-vdso): %.o: %.S FORCE + $(call if_changed_dep,vdsoas) + + # Actual build commands +diff --git a/arch/c6x/kernel/time.c b/arch/c6x/kernel/time.c +index 356ee84cad95..04845aaf5985 100644 +--- a/arch/c6x/kernel/time.c ++++ b/arch/c6x/kernel/time.c +@@ -49,7 +49,7 @@ u64 sched_clock(void) + return (tsc * sched_clock_multiplier) >> SCHED_CLOCK_SHIFT; + } + +-void time_init(void) ++void __init time_init(void) + { + u64 tmp = (u64)NSEC_PER_SEC << SCHED_CLOCK_SHIFT; + +diff --git a/arch/mips/include/asm/suspend.h b/arch/mips/include/asm/suspend.h +deleted file mode 100644 +index 3adac3b53d19..000000000000 +--- a/arch/mips/include/asm/suspend.h ++++ /dev/null +@@ -1,7 +0,0 @@ +-#ifndef __ASM_SUSPEND_H +-#define __ASM_SUSPEND_H +- +-/* References to section boundaries */ +-extern const void __nosave_begin, __nosave_end; +- +-#endif /* __ASM_SUSPEND_H */ +diff --git a/arch/mips/power/cpu.c b/arch/mips/power/cpu.c +index 521e5963df05..2129e67723ff 100644 +--- a/arch/mips/power/cpu.c ++++ b/arch/mips/power/cpu.c +@@ -7,7 +7,7 @@ + * Author: Hu Hongbing <huhb@lemote.com> + * Wu Zhangjin <wuzhangjin@gmail.com> + */ +-#include <asm/suspend.h> ++#include <asm/sections.h> + #include <asm/fpu.h> + #include <asm/dsp.h> + +diff --git a/arch/mips/power/hibernate.S b/arch/mips/power/hibernate.S +index 32a7c828f073..e7567c8a9e79 100644 +--- a/arch/mips/power/hibernate.S ++++ b/arch/mips/power/hibernate.S +@@ -30,6 +30,8 @@ LEAF(swsusp_arch_suspend) + END(swsusp_arch_suspend) + + LEAF(swsusp_arch_resume) ++ /* Avoid TLB mismatch during and after kernel resume */ ++ jal local_flush_tlb_all + PTR_L t0, restore_pblist + 0: + PTR_L t1, PBE_ADDRESS(t0) /* source */ +@@ -43,7 +45,6 @@ LEAF(swsusp_arch_resume) + bne t1, t3, 1b + PTR_L t0, PBE_NEXT(t0) + bnez t0, 0b +- jal local_flush_tlb_all /* Avoid TLB mismatch after kernel resume */ + PTR_LA t0, saved_regs + PTR_L ra, PT_R31(t0) + PTR_L sp, PT_R29(t0) +diff --git a/arch/powerpc/kernel/cacheinfo.c b/arch/powerpc/kernel/cacheinfo.c +index bfb82365bc7a..c26b9355156a 100644 +--- a/arch/powerpc/kernel/cacheinfo.c ++++ b/arch/powerpc/kernel/cacheinfo.c +@@ -62,12 +62,22 @@ struct cache_type_info { + }; + + /* These are used to index the cache_type_info array. */ +-#define CACHE_TYPE_UNIFIED 0 +-#define CACHE_TYPE_INSTRUCTION 1 +-#define CACHE_TYPE_DATA 2 ++#define CACHE_TYPE_UNIFIED 0 /* cache-size, cache-block-size, etc. */ ++#define CACHE_TYPE_UNIFIED_D 1 /* d-cache-size, d-cache-block-size, etc */ ++#define CACHE_TYPE_INSTRUCTION 2 ++#define CACHE_TYPE_DATA 3 + + static const struct cache_type_info cache_type_info[] = { + { ++ /* Embedded systems that use cache-size, cache-block-size, ++ * etc. for the Unified (typically L2) cache. */ ++ .name = "Unified", ++ .size_prop = "cache-size", ++ .line_size_props = { "cache-line-size", ++ "cache-block-size", }, ++ .nr_sets_prop = "cache-sets", ++ }, ++ { + /* PowerPC Processor binding says the [di]-cache-* + * must be equal on unified caches, so just use + * d-cache properties. */ +@@ -294,7 +304,8 @@ static struct cache *cache_find_first_sibling(struct cache *cache) + { + struct cache *iter; + +- if (cache->type == CACHE_TYPE_UNIFIED) ++ if (cache->type == CACHE_TYPE_UNIFIED || ++ cache->type == CACHE_TYPE_UNIFIED_D) + return cache; + + list_for_each_entry(iter, &cache_list, list) +@@ -325,16 +336,29 @@ static bool cache_node_is_unified(const struct device_node *np) + return of_get_property(np, "cache-unified", NULL); + } + +-static struct cache *cache_do_one_devnode_unified(struct device_node *node, +- int level) ++/* ++ * Unified caches can have two different sets of tags. Most embedded ++ * use cache-size, etc. for the unified cache size, but open firmware systems ++ * use d-cache-size, etc. Check on initialization for which type we have, and ++ * return the appropriate structure type. Assume it's embedded if it isn't ++ * open firmware. If it's yet a 3rd type, then there will be missing entries ++ * in /sys/devices/system/cpu/cpu0/cache/index2/, and this code will need ++ * to be extended further. ++ */ ++static int cache_is_unified_d(const struct device_node *np) + { +- struct cache *cache; ++ return of_get_property(np, ++ cache_type_info[CACHE_TYPE_UNIFIED_D].size_prop, NULL) ? ++ CACHE_TYPE_UNIFIED_D : CACHE_TYPE_UNIFIED; ++} + ++/* ++ */ ++static struct cache *cache_do_one_devnode_unified(struct device_node *node, int level) ++{ + pr_debug("creating L%d ucache for %s\n", level, node->full_name); + +- cache = new_cache(CACHE_TYPE_UNIFIED, level, node); +- +- return cache; ++ return new_cache(cache_is_unified_d(node), level, node); + } + + static struct cache *cache_do_one_devnode_split(struct device_node *node, +diff --git a/arch/powerpc/kernel/suspend.c b/arch/powerpc/kernel/suspend.c +index 0167d53da30c..a531154cc0f3 100644 +--- a/arch/powerpc/kernel/suspend.c ++++ b/arch/powerpc/kernel/suspend.c +@@ -9,9 +9,7 @@ + + #include <linux/mm.h> + #include <asm/page.h> +- +-/* References to section boundaries */ +-extern const void __nosave_begin, __nosave_end; ++#include <asm/sections.h> + + /* + * pfn_is_nosave - check if given pfn is in the 'nosave' section +diff --git a/arch/powerpc/perf/callchain.c b/arch/powerpc/perf/callchain.c +index 2396dda282cd..ead55351b254 100644 +--- a/arch/powerpc/perf/callchain.c ++++ b/arch/powerpc/perf/callchain.c +@@ -243,7 +243,7 @@ static void perf_callchain_user_64(struct perf_callchain_entry *entry, + sp = regs->gpr[1]; + perf_callchain_store(entry, next_ip); + +- for (;;) { ++ while (entry->nr < PERF_MAX_STACK_DEPTH) { + fp = (unsigned long __user *) sp; + if (!valid_user_sp(sp, 1) || read_user_stack_64(fp, &next_sp)) + return; +diff --git a/arch/s390/kernel/suspend.c b/arch/s390/kernel/suspend.c +index a7a7537ce1e7..d3236c9e226b 100644 +--- a/arch/s390/kernel/suspend.c ++++ b/arch/s390/kernel/suspend.c +@@ -13,14 +13,10 @@ + #include <asm/ipl.h> + #include <asm/cio.h> + #include <asm/pci.h> ++#include <asm/sections.h> + #include "entry.h" + + /* +- * References to section boundaries +- */ +-extern const void __nosave_begin, __nosave_end; +- +-/* + * The restore of the saved pages in an hibernation image will set + * the change and referenced bits in the storage key for each page. + * Overindication of the referenced bits after an hibernation cycle +@@ -142,6 +138,8 @@ int pfn_is_nosave(unsigned long pfn) + { + unsigned long nosave_begin_pfn = PFN_DOWN(__pa(&__nosave_begin)); + unsigned long nosave_end_pfn = PFN_DOWN(__pa(&__nosave_end)); ++ unsigned long eshared_pfn = PFN_DOWN(__pa(&_eshared)) - 1; ++ unsigned long stext_pfn = PFN_DOWN(__pa(&_stext)); + + /* Always save lowcore pages (LC protection might be enabled). */ + if (pfn <= LC_PAGES) +@@ -149,6 +147,8 @@ int pfn_is_nosave(unsigned long pfn) + if (pfn >= nosave_begin_pfn && pfn < nosave_end_pfn) + return 1; + /* Skip memory holes and read-only pages (NSS, DCSS, ...). */ ++ if (pfn >= stext_pfn && pfn <= eshared_pfn) ++ return ipl_info.type == IPL_TYPE_NSS ? 1 : 0; + if (tprot(PFN_PHYS(pfn))) + return 1; + return 0; +diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c +index 59200ee275e5..563d7d883ac4 100644 +--- a/arch/s390/kvm/priv.c ++++ b/arch/s390/kvm/priv.c +@@ -355,6 +355,7 @@ static void handle_stsi_3_2_2(struct kvm_vcpu *vcpu, struct sysinfo_3_2_2 *mem) + for (n = mem->count - 1; n > 0 ; n--) + memcpy(&mem->vm[n], &mem->vm[n - 1], sizeof(mem->vm[0])); + ++ memset(&mem->vm[0], 0, sizeof(mem->vm[0])); + mem->vm[0].cpus_total = cpus; + mem->vm[0].cpus_configured = cpus; + mem->vm[0].cpus_standby = 0; +diff --git a/arch/sh/include/asm/sections.h b/arch/sh/include/asm/sections.h +index 1b6199740e98..7a99e6af6372 100644 +--- a/arch/sh/include/asm/sections.h ++++ b/arch/sh/include/asm/sections.h +@@ -3,7 +3,6 @@ + + #include <asm-generic/sections.h> + +-extern long __nosave_begin, __nosave_end; + extern long __machvec_start, __machvec_end; + extern char __uncached_start, __uncached_end; + extern char __start_eh_frame[], __stop_eh_frame[]; +diff --git a/arch/sparc/power/hibernate.c b/arch/sparc/power/hibernate.c +index 42b0b8ce699a..17bd2e167e07 100644 +--- a/arch/sparc/power/hibernate.c ++++ b/arch/sparc/power/hibernate.c +@@ -9,11 +9,9 @@ + #include <asm/hibernate.h> + #include <asm/visasm.h> + #include <asm/page.h> ++#include <asm/sections.h> + #include <asm/tlb.h> + +-/* References to section boundaries */ +-extern const void __nosave_begin, __nosave_end; +- + struct saved_context saved_context; + + /* +diff --git a/arch/unicore32/include/mach/pm.h b/arch/unicore32/include/mach/pm.h +index 4dcd34ae194c..77b522694e74 100644 +--- a/arch/unicore32/include/mach/pm.h ++++ b/arch/unicore32/include/mach/pm.h +@@ -36,8 +36,5 @@ extern int puv3_pm_enter(suspend_state_t state); + /* Defined in hibernate_asm.S */ + extern int restore_image(pgd_t *resume_pg_dir, struct pbe *restore_pblist); + +-/* References to section boundaries */ +-extern const void __nosave_begin, __nosave_end; +- + extern struct pbe *restore_pblist; + #endif +diff --git a/arch/unicore32/kernel/hibernate.c b/arch/unicore32/kernel/hibernate.c +index d75ef8b6cb56..9969ec374abb 100644 +--- a/arch/unicore32/kernel/hibernate.c ++++ b/arch/unicore32/kernel/hibernate.c +@@ -18,6 +18,7 @@ + #include <asm/page.h> + #include <asm/pgtable.h> + #include <asm/pgalloc.h> ++#include <asm/sections.h> + #include <asm/suspend.h> + + #include "mach/pm.h" +diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c +index 3fb8d95ab8b5..c5db2a43e730 100644 +--- a/arch/x86/kernel/process.c ++++ b/arch/x86/kernel/process.c +@@ -398,6 +398,52 @@ static void amd_e400_idle(void) + default_idle(); + } + ++/* ++ * Intel Core2 and older machines prefer MWAIT over HALT for C1. ++ * We can't rely on cpuidle installing MWAIT, because it will not load ++ * on systems that support only C1 -- so the boot default must be MWAIT. ++ * ++ * Some AMD machines are the opposite, they depend on using HALT. ++ * ++ * So for default C1, which is used during boot until cpuidle loads, ++ * use MWAIT-C1 on Intel HW that has it, else use HALT. ++ */ ++static int prefer_mwait_c1_over_halt(const struct cpuinfo_x86 *c) ++{ ++ if (c->x86_vendor != X86_VENDOR_INTEL) ++ return 0; ++ ++ if (!cpu_has(c, X86_FEATURE_MWAIT)) ++ return 0; ++ ++ return 1; ++} ++ ++/* ++ * MONITOR/MWAIT with no hints, used for default default C1 state. ++ * This invokes MWAIT with interrutps enabled and no flags, ++ * which is backwards compatible with the original MWAIT implementation. ++ */ ++ ++static void mwait_idle(void) ++{ ++ if (!current_set_polling_and_test()) { ++ if (static_cpu_has(X86_FEATURE_CLFLUSH_MONITOR)) { ++ mb(); ++ clflush((void *)¤t_thread_info()->flags); ++ mb(); ++ } ++ ++ __monitor((void *)¤t_thread_info()->flags, 0, 0); ++ if (!need_resched()) ++ __sti_mwait(0, 0); ++ else ++ local_irq_enable(); ++ } else ++ local_irq_enable(); ++ __current_clr_polling(); ++} ++ + void select_idle_routine(const struct cpuinfo_x86 *c) + { + #ifdef CONFIG_SMP +@@ -411,6 +457,9 @@ void select_idle_routine(const struct cpuinfo_x86 *c) + /* E400: APIC timer interrupt does not wake up CPU from C1e */ + pr_info("using AMD E400 aware idle routine\n"); + x86_idle = amd_e400_idle; ++ } else if (prefer_mwait_c1_over_halt(c)) { ++ pr_info("using mwait in idle threads\n"); ++ x86_idle = mwait_idle; + } else + x86_idle = default_idle; + } +diff --git a/arch/x86/power/hibernate_32.c b/arch/x86/power/hibernate_32.c +index 7d28c885d238..291226b952a9 100644 +--- a/arch/x86/power/hibernate_32.c ++++ b/arch/x86/power/hibernate_32.c +@@ -13,13 +13,11 @@ + #include <asm/page.h> + #include <asm/pgtable.h> + #include <asm/mmzone.h> ++#include <asm/sections.h> + + /* Defined in hibernate_asm_32.S */ + extern int restore_image(void); + +-/* References to section boundaries */ +-extern const void __nosave_begin, __nosave_end; +- + /* Pointer to the temporary resume page tables */ + pgd_t *resume_pg_dir; + +diff --git a/arch/x86/power/hibernate_64.c b/arch/x86/power/hibernate_64.c +index 304fca20d96e..2276238fde6f 100644 +--- a/arch/x86/power/hibernate_64.c ++++ b/arch/x86/power/hibernate_64.c +@@ -17,11 +17,9 @@ + #include <asm/page.h> + #include <asm/pgtable.h> + #include <asm/mtrr.h> ++#include <asm/sections.h> + #include <asm/suspend.h> + +-/* References to section boundaries */ +-extern __visible const void __nosave_begin, __nosave_end; +- + /* Defined in hibernate_asm_64.S */ + extern asmlinkage int restore_image(void); + +diff --git a/arch/xtensa/Kconfig b/arch/xtensa/Kconfig +index 8d24dcb7cdac..3b8060e4f1d7 100644 +--- a/arch/xtensa/Kconfig ++++ b/arch/xtensa/Kconfig +@@ -289,6 +289,36 @@ menu "Executable file formats" + + source "fs/Kconfig.binfmt" + ++config XTFPGA_LCD ++ bool "Enable XTFPGA LCD driver" ++ depends on XTENSA_PLATFORM_XTFPGA ++ default n ++ help ++ There's a 2x16 LCD on most of XTFPGA boards, kernel may output ++ progress messages there during bootup/shutdown. It may be useful ++ during board bringup. ++ ++ If unsure, say N. ++ ++config XTFPGA_LCD_BASE_ADDR ++ hex "XTFPGA LCD base address" ++ depends on XTFPGA_LCD ++ default "0x0d0c0000" ++ help ++ Base address of the LCD controller inside KIO region. ++ Different boards from XTFPGA family have LCD controller at different ++ addresses. Please consult prototyping user guide for your board for ++ the correct address. Wrong address here may lead to hardware lockup. ++ ++config XTFPGA_LCD_8BIT_ACCESS ++ bool "Use 8-bit access to XTFPGA LCD" ++ depends on XTFPGA_LCD ++ default n ++ help ++ LCD may be connected with 4- or 8-bit interface, 8-bit access may ++ only be used with 8-bit interface. Please consult prototyping user ++ guide for your board for the correct interface width. ++ + endmenu + + source "net/Kconfig" +diff --git a/arch/xtensa/include/uapi/asm/unistd.h b/arch/xtensa/include/uapi/asm/unistd.h +index 513effd48060..d07c1886bc8f 100644 +--- a/arch/xtensa/include/uapi/asm/unistd.h ++++ b/arch/xtensa/include/uapi/asm/unistd.h +@@ -715,7 +715,7 @@ __SYSCALL(323, sys_process_vm_writev, 6) + __SYSCALL(324, sys_name_to_handle_at, 5) + #define __NR_open_by_handle_at 325 + __SYSCALL(325, sys_open_by_handle_at, 3) +-#define __NR_sync_file_range 326 ++#define __NR_sync_file_range2 326 + __SYSCALL(326, sys_sync_file_range2, 6) + #define __NR_perf_event_open 327 + __SYSCALL(327, sys_perf_event_open, 5) +diff --git a/arch/xtensa/platforms/iss/network.c b/arch/xtensa/platforms/iss/network.c +index e9e1aad8c271..37141c8cd1a4 100644 +--- a/arch/xtensa/platforms/iss/network.c ++++ b/arch/xtensa/platforms/iss/network.c +@@ -395,10 +395,10 @@ static void iss_net_timer(unsigned long priv) + { + struct iss_net_private* lp = (struct iss_net_private*) priv; + +- spin_lock(&lp->lock); +- + iss_net_poll(); + ++ spin_lock(&lp->lock); ++ + mod_timer(&lp->timer, jiffies + lp->timer_val); + + spin_unlock(&lp->lock); +@@ -411,7 +411,7 @@ static int iss_net_open(struct net_device *dev) + char addr[sizeof "255.255.255.255\0"]; + int err; + +- spin_lock(&lp->lock); ++ spin_lock_bh(&lp->lock); + + if ((err = lp->tp.open(lp)) < 0) + goto out; +@@ -430,9 +430,11 @@ static int iss_net_open(struct net_device *dev) + while ((err = iss_net_rx(dev)) > 0) + ; + +- spin_lock(&opened_lock); ++ spin_unlock_bh(&lp->lock); ++ spin_lock_bh(&opened_lock); + list_add(&lp->opened_list, &opened); +- spin_unlock(&opened_lock); ++ spin_unlock_bh(&opened_lock); ++ spin_lock_bh(&lp->lock); + + init_timer(&lp->timer); + lp->timer_val = ISS_NET_TIMER_VALUE; +@@ -441,7 +443,7 @@ static int iss_net_open(struct net_device *dev) + mod_timer(&lp->timer, jiffies + lp->timer_val); + + out: +- spin_unlock(&lp->lock); ++ spin_unlock_bh(&lp->lock); + return err; + } + +@@ -450,7 +452,7 @@ static int iss_net_close(struct net_device *dev) + struct iss_net_private *lp = netdev_priv(dev); + printk("iss_net_close!\n"); + netif_stop_queue(dev); +- spin_lock(&lp->lock); ++ spin_lock_bh(&lp->lock); + + spin_lock(&opened_lock); + list_del(&opened); +@@ -460,18 +462,17 @@ printk("iss_net_close!\n"); + + lp->tp.close(lp); + +- spin_unlock(&lp->lock); ++ spin_unlock_bh(&lp->lock); + return 0; + } + + static int iss_net_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct iss_net_private *lp = netdev_priv(dev); +- unsigned long flags; + int len; + + netif_stop_queue(dev); +- spin_lock_irqsave(&lp->lock, flags); ++ spin_lock_bh(&lp->lock); + + len = lp->tp.write(lp, &skb); + +@@ -493,7 +494,7 @@ static int iss_net_start_xmit(struct sk_buff *skb, struct net_device *dev) + printk(KERN_ERR "iss_net_start_xmit: failed(%d)\n", len); + } + +- spin_unlock_irqrestore(&lp->lock, flags); ++ spin_unlock_bh(&lp->lock); + + dev_kfree_skb(skb); + return NETDEV_TX_OK; +@@ -532,9 +533,9 @@ static int iss_net_set_mac(struct net_device *dev, void *addr) + struct iss_net_private *lp = netdev_priv(dev); + struct sockaddr *hwaddr = addr; + +- spin_lock(&lp->lock); ++ spin_lock_bh(&lp->lock); + memcpy(dev->dev_addr, hwaddr->sa_data, ETH_ALEN); +- spin_unlock(&lp->lock); ++ spin_unlock_bh(&lp->lock); + #endif + + return 0; +@@ -604,14 +605,14 @@ static int iss_net_configure(int index, char *init) + *lp = ((struct iss_net_private) { + .device_list = LIST_HEAD_INIT(lp->device_list), + .opened_list = LIST_HEAD_INIT(lp->opened_list), +- .lock = __SPIN_LOCK_UNLOCKED(lp.lock), + .dev = dev, + .index = index, + //.fd = -1, + .mac = { 0xfe, 0xfd, 0x0, 0x0, 0x0, 0x0 }, + .have_mac = 0, +- }); ++ }); + ++ spin_lock_init(&lp->lock); + /* + * Try all transport protocols. + * Note: more protocols can be added by adding '&& !X_init(lp, eth)'. +diff --git a/arch/xtensa/platforms/xtfpga/Makefile b/arch/xtensa/platforms/xtfpga/Makefile +index b9ae206340cd..7839d38b2337 100644 +--- a/arch/xtensa/platforms/xtfpga/Makefile ++++ b/arch/xtensa/platforms/xtfpga/Makefile +@@ -6,4 +6,5 @@ + # + # Note 2! The CFLAGS definitions are in the main makefile... + +-obj-y = setup.o lcd.o ++obj-y += setup.o ++obj-$(CONFIG_XTFPGA_LCD) += lcd.o +diff --git a/arch/xtensa/platforms/xtfpga/include/platform/hardware.h b/arch/xtensa/platforms/xtfpga/include/platform/hardware.h +index 4416773cbde5..b39fbcf5c611 100644 +--- a/arch/xtensa/platforms/xtfpga/include/platform/hardware.h ++++ b/arch/xtensa/platforms/xtfpga/include/platform/hardware.h +@@ -44,9 +44,6 @@ + + /* UART */ + #define DUART16552_PADDR (XCHAL_KIO_PADDR + 0x0D050020) +-/* LCD instruction and data addresses. */ +-#define LCD_INSTR_ADDR ((char *)IOADDR(0x0D040000)) +-#define LCD_DATA_ADDR ((char *)IOADDR(0x0D040004)) + + /* Misc. */ + #define XTFPGA_FPGAREGS_VADDR IOADDR(0x0D020000) +diff --git a/arch/xtensa/platforms/xtfpga/include/platform/lcd.h b/arch/xtensa/platforms/xtfpga/include/platform/lcd.h +index 0e435645af5a..4c8541ed1139 100644 +--- a/arch/xtensa/platforms/xtfpga/include/platform/lcd.h ++++ b/arch/xtensa/platforms/xtfpga/include/platform/lcd.h +@@ -11,10 +11,25 @@ + #ifndef __XTENSA_XTAVNET_LCD_H + #define __XTENSA_XTAVNET_LCD_H + ++#ifdef CONFIG_XTFPGA_LCD + /* Display string STR at position POS on the LCD. */ + void lcd_disp_at_pos(char *str, unsigned char pos); + + /* Shift the contents of the LCD display left or right. */ + void lcd_shiftleft(void); + void lcd_shiftright(void); ++#else ++static inline void lcd_disp_at_pos(char *str, unsigned char pos) ++{ ++} ++ ++static inline void lcd_shiftleft(void) ++{ ++} ++ ++static inline void lcd_shiftright(void) ++{ ++} ++#endif ++ + #endif +diff --git a/arch/xtensa/platforms/xtfpga/lcd.c b/arch/xtensa/platforms/xtfpga/lcd.c +index 2872301598df..4dc0c1b43f4b 100644 +--- a/arch/xtensa/platforms/xtfpga/lcd.c ++++ b/arch/xtensa/platforms/xtfpga/lcd.c +@@ -1,50 +1,63 @@ + /* +- * Driver for the LCD display on the Tensilica LX60 Board. ++ * Driver for the LCD display on the Tensilica XTFPGA board family. ++ * http://www.mytechcorp.com/cfdata/productFile/File1/MOC-16216B-B-A0A04.pdf + * + * This file is subject to the terms and conditions of the GNU General Public + * License. See the file "COPYING" in the main directory of this archive + * for more details. + * + * Copyright (C) 2001, 2006 Tensilica Inc. ++ * Copyright (C) 2015 Cadence Design Systems Inc. + */ + +-/* +- * +- * FIXME: this code is from the examples from the LX60 user guide. +- * +- * The lcd_pause function does busy waiting, which is probably not +- * great. Maybe the code could be changed to use kernel timers, or +- * change the hardware to not need to wait. +- */ +- ++#include <linux/delay.h> + #include <linux/init.h> + #include <linux/io.h> + + #include <platform/hardware.h> + #include <platform/lcd.h> +-#include <linux/delay.h> + +-#define LCD_PAUSE_ITERATIONS 4000 ++/* LCD instruction and data addresses. */ ++#define LCD_INSTR_ADDR ((char *)IOADDR(CONFIG_XTFPGA_LCD_BASE_ADDR)) ++#define LCD_DATA_ADDR (LCD_INSTR_ADDR + 4) ++ + #define LCD_CLEAR 0x1 + #define LCD_DISPLAY_ON 0xc + + /* 8bit and 2 lines display */ + #define LCD_DISPLAY_MODE8BIT 0x38 ++#define LCD_DISPLAY_MODE4BIT 0x28 + #define LCD_DISPLAY_POS 0x80 + #define LCD_SHIFT_LEFT 0x18 + #define LCD_SHIFT_RIGHT 0x1c + ++static void lcd_put_byte(u8 *addr, u8 data) ++{ ++#ifdef CONFIG_XTFPGA_LCD_8BIT_ACCESS ++ ACCESS_ONCE(*addr) = data; ++#else ++ ACCESS_ONCE(*addr) = data & 0xf0; ++ ACCESS_ONCE(*addr) = (data << 4) & 0xf0; ++#endif ++} ++ + static int __init lcd_init(void) + { +- *LCD_INSTR_ADDR = LCD_DISPLAY_MODE8BIT; ++ ACCESS_ONCE(*LCD_INSTR_ADDR) = LCD_DISPLAY_MODE8BIT; + mdelay(5); +- *LCD_INSTR_ADDR = LCD_DISPLAY_MODE8BIT; ++ ACCESS_ONCE(*LCD_INSTR_ADDR) = LCD_DISPLAY_MODE8BIT; + udelay(200); +- *LCD_INSTR_ADDR = LCD_DISPLAY_MODE8BIT; ++ ACCESS_ONCE(*LCD_INSTR_ADDR) = LCD_DISPLAY_MODE8BIT; ++ udelay(50); ++#ifndef CONFIG_XTFPGA_LCD_8BIT_ACCESS ++ ACCESS_ONCE(*LCD_INSTR_ADDR) = LCD_DISPLAY_MODE4BIT; ++ udelay(50); ++ lcd_put_byte(LCD_INSTR_ADDR, LCD_DISPLAY_MODE4BIT); + udelay(50); +- *LCD_INSTR_ADDR = LCD_DISPLAY_ON; ++#endif ++ lcd_put_byte(LCD_INSTR_ADDR, LCD_DISPLAY_ON); + udelay(50); +- *LCD_INSTR_ADDR = LCD_CLEAR; ++ lcd_put_byte(LCD_INSTR_ADDR, LCD_CLEAR); + mdelay(10); + lcd_disp_at_pos("XTENSA LINUX", 0); + return 0; +@@ -52,10 +65,10 @@ static int __init lcd_init(void) + + void lcd_disp_at_pos(char *str, unsigned char pos) + { +- *LCD_INSTR_ADDR = LCD_DISPLAY_POS | pos; ++ lcd_put_byte(LCD_INSTR_ADDR, LCD_DISPLAY_POS | pos); + udelay(100); + while (*str != 0) { +- *LCD_DATA_ADDR = *str; ++ lcd_put_byte(LCD_DATA_ADDR, *str); + udelay(200); + str++; + } +@@ -63,13 +76,13 @@ void lcd_disp_at_pos(char *str, unsigned char pos) + + void lcd_shiftleft(void) + { +- *LCD_INSTR_ADDR = LCD_SHIFT_LEFT; ++ lcd_put_byte(LCD_INSTR_ADDR, LCD_SHIFT_LEFT); + udelay(50); + } + + void lcd_shiftright(void) + { +- *LCD_INSTR_ADDR = LCD_SHIFT_RIGHT; ++ lcd_put_byte(LCD_INSTR_ADDR, LCD_SHIFT_RIGHT); + udelay(50); + } + +diff --git a/drivers/acpi/acpica/acmacros.h b/drivers/acpi/acpica/acmacros.h +index 530a2f8c1252..0a9ee9bbe7ea 100644 +--- a/drivers/acpi/acpica/acmacros.h ++++ b/drivers/acpi/acpica/acmacros.h +@@ -63,19 +63,15 @@ + #define ACPI_SET64(ptr, val) (*ACPI_CAST64 (ptr) = (u64) (val)) + + /* +- * printf() format helpers ++ * printf() format helper. This macros is a workaround for the difficulties ++ * with emitting 64-bit integers and 64-bit pointers with the same code ++ * for both 32-bit and 64-bit hosts. + */ + + /* Split 64-bit integer into two 32-bit values. Use with %8.8X%8.8X */ + + #define ACPI_FORMAT_UINT64(i) ACPI_HIDWORD(i), ACPI_LODWORD(i) + +-#if ACPI_MACHINE_WIDTH == 64 +-#define ACPI_FORMAT_NATIVE_UINT(i) ACPI_FORMAT_UINT64(i) +-#else +-#define ACPI_FORMAT_NATIVE_UINT(i) 0, (i) +-#endif +- + /* + * Macros for moving data around to/from buffers that are possibly unaligned. + * If the hardware supports the transfer of unaligned data, just do the store. +diff --git a/drivers/acpi/acpica/dsopcode.c b/drivers/acpi/acpica/dsopcode.c +index 1fc1ff114f26..fedb65d774ae 100644 +--- a/drivers/acpi/acpica/dsopcode.c ++++ b/drivers/acpi/acpica/dsopcode.c +@@ -446,7 +446,7 @@ acpi_ds_eval_region_operands(struct acpi_walk_state *walk_state, + + ACPI_DEBUG_PRINT((ACPI_DB_EXEC, "RgnObj %p Addr %8.8X%8.8X Len %X\n", + obj_desc, +- ACPI_FORMAT_NATIVE_UINT(obj_desc->region.address), ++ ACPI_FORMAT_UINT64(obj_desc->region.address), + obj_desc->region.length)); + + /* Now the address and length are valid for this opregion */ +@@ -539,13 +539,12 @@ acpi_ds_eval_table_region_operands(struct acpi_walk_state *walk_state, + return_ACPI_STATUS(AE_NOT_EXIST); + } + +- obj_desc->region.address = +- (acpi_physical_address) ACPI_TO_INTEGER(table); ++ obj_desc->region.address = ACPI_PTR_TO_PHYSADDR(table); + obj_desc->region.length = table->length; + + ACPI_DEBUG_PRINT((ACPI_DB_EXEC, "RgnObj %p Addr %8.8X%8.8X Len %X\n", + obj_desc, +- ACPI_FORMAT_NATIVE_UINT(obj_desc->region.address), ++ ACPI_FORMAT_UINT64(obj_desc->region.address), + obj_desc->region.length)); + + /* Now the address and length are valid for this opregion */ +diff --git a/drivers/acpi/acpica/evregion.c b/drivers/acpi/acpica/evregion.c +index 1788b3870713..63ef6d43f046 100644 +--- a/drivers/acpi/acpica/evregion.c ++++ b/drivers/acpi/acpica/evregion.c +@@ -277,7 +277,7 @@ acpi_ev_address_space_dispatch(union acpi_operand_object *region_obj, + ACPI_DEBUG_PRINT((ACPI_DB_OPREGION, + "Handler %p (@%p) Address %8.8X%8.8X [%s]\n", + ®ion_obj->region.handler->address_space, handler, +- ACPI_FORMAT_NATIVE_UINT(address), ++ ACPI_FORMAT_UINT64(address), + acpi_ut_get_region_name(region_obj->region. + space_id))); + +diff --git a/drivers/acpi/acpica/exdump.c b/drivers/acpi/acpica/exdump.c +index 4d046faac48c..b64fb68aa5d3 100644 +--- a/drivers/acpi/acpica/exdump.c ++++ b/drivers/acpi/acpica/exdump.c +@@ -622,8 +622,8 @@ void acpi_ex_dump_operand(union acpi_operand_object *obj_desc, u32 depth) + acpi_os_printf("\n"); + } else { + acpi_os_printf(" base %8.8X%8.8X Length %X\n", +- ACPI_FORMAT_NATIVE_UINT(obj_desc->region. +- address), ++ ACPI_FORMAT_UINT64(obj_desc->region. ++ address), + obj_desc->region.length); + } + break; +diff --git a/drivers/acpi/acpica/exfldio.c b/drivers/acpi/acpica/exfldio.c +index 7e0afe72487e..61d753dc338f 100644 +--- a/drivers/acpi/acpica/exfldio.c ++++ b/drivers/acpi/acpica/exfldio.c +@@ -269,17 +269,15 @@ acpi_ex_access_region(union acpi_operand_object *obj_desc, + } + + ACPI_DEBUG_PRINT_RAW((ACPI_DB_BFIELD, +- " Region [%s:%X], Width %X, ByteBase %X, Offset %X at %p\n", ++ " Region [%s:%X], Width %X, ByteBase %X, Offset %X at %8.8X%8.8X\n", + acpi_ut_get_region_name(rgn_desc->region. + space_id), + rgn_desc->region.space_id, + obj_desc->common_field.access_byte_width, + obj_desc->common_field.base_byte_offset, +- field_datum_byte_offset, ACPI_CAST_PTR(void, +- (rgn_desc-> +- region. +- address + +- region_offset)))); ++ field_datum_byte_offset, ++ ACPI_FORMAT_UINT64(rgn_desc->region.address + ++ region_offset))); + + /* Invoke the appropriate address_space/op_region handler */ + +diff --git a/drivers/acpi/acpica/exregion.c b/drivers/acpi/acpica/exregion.c +index 303429bb4d5d..c678c3714d01 100644 +--- a/drivers/acpi/acpica/exregion.c ++++ b/drivers/acpi/acpica/exregion.c +@@ -181,7 +181,7 @@ acpi_ex_system_memory_space_handler(u32 function, + if (!mem_info->mapped_logical_address) { + ACPI_ERROR((AE_INFO, + "Could not map memory at 0x%8.8X%8.8X, size %u", +- ACPI_FORMAT_NATIVE_UINT(address), ++ ACPI_FORMAT_UINT64(address), + (u32) map_length)); + mem_info->mapped_length = 0; + return_ACPI_STATUS(AE_NO_MEMORY); +@@ -202,8 +202,7 @@ acpi_ex_system_memory_space_handler(u32 function, + + ACPI_DEBUG_PRINT((ACPI_DB_INFO, + "System-Memory (width %u) R/W %u Address=%8.8X%8.8X\n", +- bit_width, function, +- ACPI_FORMAT_NATIVE_UINT(address))); ++ bit_width, function, ACPI_FORMAT_UINT64(address))); + + /* + * Perform the memory read or write +@@ -318,8 +317,7 @@ acpi_ex_system_io_space_handler(u32 function, + + ACPI_DEBUG_PRINT((ACPI_DB_INFO, + "System-IO (width %u) R/W %u Address=%8.8X%8.8X\n", +- bit_width, function, +- ACPI_FORMAT_NATIVE_UINT(address))); ++ bit_width, function, ACPI_FORMAT_UINT64(address))); + + /* Decode the function parameter */ + +diff --git a/drivers/acpi/acpica/hwvalid.c b/drivers/acpi/acpica/hwvalid.c +index eab70d58852a..fae57584a182 100644 +--- a/drivers/acpi/acpica/hwvalid.c ++++ b/drivers/acpi/acpica/hwvalid.c +@@ -142,17 +142,17 @@ acpi_hw_validate_io_request(acpi_io_address address, u32 bit_width) + byte_width = ACPI_DIV_8(bit_width); + last_address = address + byte_width - 1; + +- ACPI_DEBUG_PRINT((ACPI_DB_IO, "Address %p LastAddress %p Length %X", +- ACPI_CAST_PTR(void, address), ACPI_CAST_PTR(void, +- last_address), +- byte_width)); ++ ACPI_DEBUG_PRINT((ACPI_DB_IO, ++ "Address %8.8X%8.8X LastAddress %8.8X%8.8X Length %X", ++ ACPI_FORMAT_UINT64(address), ++ ACPI_FORMAT_UINT64(last_address), byte_width)); + + /* Maximum 16-bit address in I/O space */ + + if (last_address > ACPI_UINT16_MAX) { + ACPI_ERROR((AE_INFO, +- "Illegal I/O port address/length above 64K: %p/0x%X", +- ACPI_CAST_PTR(void, address), byte_width)); ++ "Illegal I/O port address/length above 64K: %8.8X%8.8X/0x%X", ++ ACPI_FORMAT_UINT64(address), byte_width)); + return_ACPI_STATUS(AE_LIMIT); + } + +@@ -181,8 +181,8 @@ acpi_hw_validate_io_request(acpi_io_address address, u32 bit_width) + + if (acpi_gbl_osi_data >= port_info->osi_dependency) { + ACPI_DEBUG_PRINT((ACPI_DB_IO, +- "Denied AML access to port 0x%p/%X (%s 0x%.4X-0x%.4X)", +- ACPI_CAST_PTR(void, address), ++ "Denied AML access to port 0x%8.8X%8.8X/%X (%s 0x%.4X-0x%.4X)", ++ ACPI_FORMAT_UINT64(address), + byte_width, port_info->name, + port_info->start, + port_info->end)); +diff --git a/drivers/acpi/acpica/nsdump.c b/drivers/acpi/acpica/nsdump.c +index 7418c77fde8c..7f449f0eabfe 100644 +--- a/drivers/acpi/acpica/nsdump.c ++++ b/drivers/acpi/acpica/nsdump.c +@@ -260,12 +260,11 @@ acpi_ns_dump_one_object(acpi_handle obj_handle, + switch (type) { + case ACPI_TYPE_PROCESSOR: + +- acpi_os_printf("ID %02X Len %02X Addr %p\n", ++ acpi_os_printf("ID %02X Len %02X Addr %8.8X%8.8X\n", + obj_desc->processor.proc_id, + obj_desc->processor.length, +- ACPI_CAST_PTR(void, +- obj_desc->processor. +- address)); ++ ACPI_FORMAT_UINT64(obj_desc->processor. ++ address)); + break; + + case ACPI_TYPE_DEVICE: +@@ -336,8 +335,9 @@ acpi_ns_dump_one_object(acpi_handle obj_handle, + space_id)); + if (obj_desc->region.flags & AOPOBJ_DATA_VALID) { + acpi_os_printf(" Addr %8.8X%8.8X Len %.4X\n", +- ACPI_FORMAT_NATIVE_UINT +- (obj_desc->region.address), ++ ACPI_FORMAT_UINT64(obj_desc-> ++ region. ++ address), + obj_desc->region.length); + } else { + acpi_os_printf +diff --git a/drivers/acpi/acpica/tbinstal.c b/drivers/acpi/acpica/tbinstal.c +index 42a13c0d7015..52a4b8ecf4de 100644 +--- a/drivers/acpi/acpica/tbinstal.c ++++ b/drivers/acpi/acpica/tbinstal.c +@@ -300,8 +300,7 @@ struct acpi_table_header *acpi_tb_table_override(struct acpi_table_header + ACPI_EXCEPTION((AE_INFO, AE_NO_MEMORY, + "%4.4s %p Attempted physical table override failed", + table_header->signature, +- ACPI_CAST_PTR(void, +- table_desc->address))); ++ ACPI_PHYSADDR_TO_PTR(table_desc->address))); + return (NULL); + } + +@@ -317,7 +316,7 @@ struct acpi_table_header *acpi_tb_table_override(struct acpi_table_header + ACPI_INFO((AE_INFO, + "%4.4s %p %s table override, new table: %p", + table_header->signature, +- ACPI_CAST_PTR(void, table_desc->address), ++ ACPI_PHYSADDR_TO_PTR(table_desc->address), + override_type, new_table)); + + /* We can now unmap/delete the original table (if fully mapped) */ +diff --git a/drivers/acpi/acpica/tbprint.c b/drivers/acpi/acpica/tbprint.c +index dc963f823d2c..0c529f23e48a 100644 +--- a/drivers/acpi/acpica/tbprint.c ++++ b/drivers/acpi/acpica/tbprint.c +@@ -127,16 +127,12 @@ acpi_tb_print_table_header(acpi_physical_address address, + { + struct acpi_table_header local_header; + +- /* +- * The reason that the Address is cast to a void pointer is so that we +- * can use %p which will work properly on both 32-bit and 64-bit hosts. +- */ + if (ACPI_COMPARE_NAME(header->signature, ACPI_SIG_FACS)) { + + /* FACS only has signature and length fields */ + +- ACPI_INFO((AE_INFO, "%4.4s %p %05X", +- header->signature, ACPI_CAST_PTR(void, address), ++ ACPI_INFO((AE_INFO, "%-4.4s 0x%8.8X%8.8X %05X", ++ header->signature, ACPI_FORMAT_UINT64(address), + header->length)); + } else if (ACPI_COMPARE_NAME(header->signature, ACPI_SIG_RSDP)) { + +@@ -147,8 +143,8 @@ acpi_tb_print_table_header(acpi_physical_address address, + header)->oem_id, ACPI_OEM_ID_SIZE); + acpi_tb_fix_string(local_header.oem_id, ACPI_OEM_ID_SIZE); + +- ACPI_INFO((AE_INFO, "RSDP %p %05X (v%.2d %6.6s)", +- ACPI_CAST_PTR(void, address), ++ ACPI_INFO((AE_INFO, "RSDP 0x%8.8X%8.8X %05X (v%.2d %-6.6s)", ++ ACPI_FORMAT_UINT64(address), + (ACPI_CAST_PTR(struct acpi_table_rsdp, header)-> + revision > + 0) ? ACPI_CAST_PTR(struct acpi_table_rsdp, +@@ -162,8 +158,9 @@ acpi_tb_print_table_header(acpi_physical_address address, + acpi_tb_cleanup_table_header(&local_header, header); + + ACPI_INFO((AE_INFO, +- "%4.4s %p %05X (v%.2d %6.6s %8.8s %08X %4.4s %08X)", +- local_header.signature, ACPI_CAST_PTR(void, address), ++ "%-4.4s 0x%8.8X%8.8X" ++ " %05X (v%.2d %-6.6s %-8.8s %08X %-4.4s %08X)", ++ local_header.signature, ACPI_FORMAT_UINT64(address), + local_header.length, local_header.revision, + local_header.oem_id, local_header.oem_table_id, + local_header.oem_revision, +diff --git a/drivers/acpi/acpica/tbutils.c b/drivers/acpi/acpica/tbutils.c +index bffdfc7b8322..4a4ca8b38656 100644 +--- a/drivers/acpi/acpica/tbutils.c ++++ b/drivers/acpi/acpica/tbutils.c +@@ -285,8 +285,8 @@ acpi_tb_install_table(acpi_physical_address address, + table = acpi_os_map_memory(address, sizeof(struct acpi_table_header)); + if (!table) { + ACPI_ERROR((AE_INFO, +- "Could not map memory for table [%s] at %p", +- signature, ACPI_CAST_PTR(void, address))); ++ "Could not map memory for table [%s] at %8.8X%8.8X", ++ signature, ACPI_FORMAT_UINT64(address))); + return; + } + +diff --git a/drivers/acpi/acpica/tbxfload.c b/drivers/acpi/acpica/tbxfload.c +index 0ba9e328d5d7..981631717e47 100644 +--- a/drivers/acpi/acpica/tbxfload.c ++++ b/drivers/acpi/acpica/tbxfload.c +@@ -183,11 +183,10 @@ static acpi_status acpi_tb_load_namespace(void) + * be useful for debugging ACPI problems on some machines. + */ + if (acpi_gbl_disable_ssdt_table_load) { +- ACPI_INFO((AE_INFO, "Ignoring %4.4s at %p", ++ ACPI_INFO((AE_INFO, "Ignoring %4.4s at %8.8X%8.8X", + acpi_gbl_root_table_list.tables[i].signature. +- ascii, ACPI_CAST_PTR(void, +- acpi_gbl_root_table_list. +- tables[i].address))); ++ ascii, ACPI_FORMAT_UINT64(acpi_gbl_root_table_list. ++ tables[i].address))); + continue; + } + +diff --git a/drivers/acpi/acpica/tbxfroot.c b/drivers/acpi/acpica/tbxfroot.c +index 948c95e80d44..cd5d08a177fe 100644 +--- a/drivers/acpi/acpica/tbxfroot.c ++++ b/drivers/acpi/acpica/tbxfroot.c +@@ -112,7 +112,7 @@ acpi_status acpi_tb_validate_rsdp(struct acpi_table_rsdp *rsdp) + * + ******************************************************************************/ + +-acpi_status acpi_find_root_pointer(acpi_size *table_address) ++acpi_status acpi_find_root_pointer(acpi_physical_address * table_address) + { + u8 *table_ptr; + u8 *mem_rover; +@@ -170,7 +170,8 @@ acpi_status acpi_find_root_pointer(acpi_size *table_address) + physical_address += + (u32) ACPI_PTR_DIFF(mem_rover, table_ptr); + +- *table_address = physical_address; ++ *table_address = ++ (acpi_physical_address) physical_address; + return_ACPI_STATUS(AE_OK); + } + } +@@ -203,7 +204,7 @@ acpi_status acpi_find_root_pointer(acpi_size *table_address) + (ACPI_HI_RSDP_WINDOW_BASE + + ACPI_PTR_DIFF(mem_rover, table_ptr)); + +- *table_address = physical_address; ++ *table_address = (acpi_physical_address) physical_address; + return_ACPI_STATUS(AE_OK); + } + +diff --git a/drivers/acpi/acpica/utaddress.c b/drivers/acpi/acpica/utaddress.c +index e0a2e2779c2e..3c7770d75773 100644 +--- a/drivers/acpi/acpica/utaddress.c ++++ b/drivers/acpi/acpica/utaddress.c +@@ -107,10 +107,10 @@ acpi_ut_add_address_range(acpi_adr_space_type space_id, + acpi_gbl_address_range_list[space_id] = range_info; + + ACPI_DEBUG_PRINT((ACPI_DB_NAMES, +- "\nAdded [%4.4s] address range: 0x%p-0x%p\n", ++ "\nAdded [%4.4s] address range: 0x%8.8X%8.8X-0x%8.8X%8.8X\n", + acpi_ut_get_node_name(range_info->region_node), +- ACPI_CAST_PTR(void, address), +- ACPI_CAST_PTR(void, range_info->end_address))); ++ ACPI_FORMAT_UINT64(address), ++ ACPI_FORMAT_UINT64(range_info->end_address))); + + (void)acpi_ut_release_mutex(ACPI_MTX_NAMESPACE); + return_ACPI_STATUS(AE_OK); +@@ -160,15 +160,13 @@ acpi_ut_remove_address_range(acpi_adr_space_type space_id, + } + + ACPI_DEBUG_PRINT((ACPI_DB_NAMES, +- "\nRemoved [%4.4s] address range: 0x%p-0x%p\n", ++ "\nRemoved [%4.4s] address range: 0x%8.8X%8.8X-0x%8.8X%8.8X\n", + acpi_ut_get_node_name(range_info-> + region_node), +- ACPI_CAST_PTR(void, +- range_info-> +- start_address), +- ACPI_CAST_PTR(void, +- range_info-> +- end_address))); ++ ACPI_FORMAT_UINT64(range_info-> ++ start_address), ++ ACPI_FORMAT_UINT64(range_info-> ++ end_address))); + + ACPI_FREE(range_info); + return_VOID; +@@ -244,9 +242,9 @@ acpi_ut_check_address_range(acpi_adr_space_type space_id, + region_node); + + ACPI_WARNING((AE_INFO, +- "0x%p-0x%p %s conflicts with Region %s %d", +- ACPI_CAST_PTR(void, address), +- ACPI_CAST_PTR(void, end_address), ++ "0x%8.8X%8.8X-0x%8.8X%8.8X %s conflicts with Region %s %d", ++ ACPI_FORMAT_UINT64(address), ++ ACPI_FORMAT_UINT64(end_address), + acpi_ut_get_region_name(space_id), + pathname, overlap_count)); + ACPI_FREE(pathname); +diff --git a/drivers/base/bus.c b/drivers/base/bus.c +index aed92e41f291..f95dead9a8c2 100644 +--- a/drivers/base/bus.c ++++ b/drivers/base/bus.c +@@ -504,11 +504,11 @@ int bus_add_device(struct device *dev) + goto out_put; + error = device_add_groups(dev, bus->dev_groups); + if (error) +- goto out_groups; ++ goto out_id; + error = sysfs_create_link(&bus->p->devices_kset->kobj, + &dev->kobj, dev_name(dev)); + if (error) +- goto out_id; ++ goto out_groups; + error = sysfs_create_link(&dev->kobj, + &dev->bus->p->subsys.kobj, "subsystem"); + if (error) +diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c +index 2eb4458f4ba8..78bfd5021827 100644 +--- a/drivers/block/rbd.c ++++ b/drivers/block/rbd.c +@@ -2103,6 +2103,11 @@ static bool rbd_img_obj_end_request(struct rbd_obj_request *obj_request) + result, xferred); + if (!img_request->result) + img_request->result = result; ++ /* ++ * Need to end I/O on the entire obj_request worth of ++ * bytes in case of error. ++ */ ++ xferred = obj_request->length; + } + + /* Image object requests don't own their page array */ +diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c +index e0894227c302..0e3978496339 100644 +--- a/drivers/bluetooth/ath3k.c ++++ b/drivers/bluetooth/ath3k.c +@@ -65,6 +65,7 @@ static struct usb_device_id ath3k_table[] = { + /* Atheros AR3011 with sflash firmware*/ + { USB_DEVICE(0x0489, 0xE027) }, + { USB_DEVICE(0x0489, 0xE03D) }, ++ { USB_DEVICE(0x04F2, 0xAFF1) }, + { USB_DEVICE(0x0930, 0x0215) }, + { USB_DEVICE(0x0CF3, 0x3002) }, + { USB_DEVICE(0x0CF3, 0xE019) }, +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 042f6dccc399..070913737f44 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -142,6 +142,7 @@ static struct usb_device_id blacklist_table[] = { + /* Atheros 3011 with sflash firmware */ + { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE }, + { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE }, ++ { USB_DEVICE(0x04f2, 0xaff1), .driver_info = BTUSB_IGNORE }, + { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE }, + { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE }, + { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE }, +diff --git a/drivers/crypto/omap-aes.c b/drivers/crypto/omap-aes.c +index ce791c2f81f7..56374ee92365 100644 +--- a/drivers/crypto/omap-aes.c ++++ b/drivers/crypto/omap-aes.c +@@ -554,15 +554,23 @@ static int omap_aes_crypt_dma_stop(struct omap_aes_dev *dd) + return err; + } + +-int omap_aes_check_aligned(struct scatterlist *sg) ++int omap_aes_check_aligned(struct scatterlist *sg, int total) + { ++ int len = 0; ++ + while (sg) { + if (!IS_ALIGNED(sg->offset, 4)) + return -1; + if (!IS_ALIGNED(sg->length, AES_BLOCK_SIZE)) + return -1; ++ ++ len += sg->length; + sg = sg_next(sg); + } ++ ++ if (len != total) ++ return -1; ++ + return 0; + } + +@@ -633,8 +641,8 @@ static int omap_aes_handle_queue(struct omap_aes_dev *dd, + dd->in_sg = req->src; + dd->out_sg = req->dst; + +- if (omap_aes_check_aligned(dd->in_sg) || +- omap_aes_check_aligned(dd->out_sg)) { ++ if (omap_aes_check_aligned(dd->in_sg, dd->total) || ++ omap_aes_check_aligned(dd->out_sg, dd->total)) { + if (omap_aes_copy_sgs(dd)) + pr_err("Failed to copy SGs for unaligned cases\n"); + dd->sgs_copied = 1; +diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c +index db3129043e63..5eaafc868218 100644 +--- a/drivers/gpio/gpio-mvebu.c ++++ b/drivers/gpio/gpio-mvebu.c +@@ -304,11 +304,13 @@ static void mvebu_gpio_edge_irq_mask(struct irq_data *d) + { + struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d); + struct mvebu_gpio_chip *mvchip = gc->private; ++ struct irq_chip_type *ct = irq_data_get_chip_type(d); + u32 mask = 1 << (d->irq - gc->irq_base); + + irq_gc_lock(gc); +- gc->mask_cache &= ~mask; +- writel_relaxed(gc->mask_cache, mvebu_gpioreg_edge_mask(mvchip)); ++ ct->mask_cache_priv &= ~mask; ++ ++ writel_relaxed(ct->mask_cache_priv, mvebu_gpioreg_edge_mask(mvchip)); + irq_gc_unlock(gc); + } + +@@ -316,11 +318,13 @@ static void mvebu_gpio_edge_irq_unmask(struct irq_data *d) + { + struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d); + struct mvebu_gpio_chip *mvchip = gc->private; ++ struct irq_chip_type *ct = irq_data_get_chip_type(d); ++ + u32 mask = 1 << (d->irq - gc->irq_base); + + irq_gc_lock(gc); +- gc->mask_cache |= mask; +- writel_relaxed(gc->mask_cache, mvebu_gpioreg_edge_mask(mvchip)); ++ ct->mask_cache_priv |= mask; ++ writel_relaxed(ct->mask_cache_priv, mvebu_gpioreg_edge_mask(mvchip)); + irq_gc_unlock(gc); + } + +@@ -328,11 +332,13 @@ static void mvebu_gpio_level_irq_mask(struct irq_data *d) + { + struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d); + struct mvebu_gpio_chip *mvchip = gc->private; ++ struct irq_chip_type *ct = irq_data_get_chip_type(d); ++ + u32 mask = 1 << (d->irq - gc->irq_base); + + irq_gc_lock(gc); +- gc->mask_cache &= ~mask; +- writel_relaxed(gc->mask_cache, mvebu_gpioreg_level_mask(mvchip)); ++ ct->mask_cache_priv &= ~mask; ++ writel_relaxed(ct->mask_cache_priv, mvebu_gpioreg_level_mask(mvchip)); + irq_gc_unlock(gc); + } + +@@ -340,11 +346,13 @@ static void mvebu_gpio_level_irq_unmask(struct irq_data *d) + { + struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d); + struct mvebu_gpio_chip *mvchip = gc->private; ++ struct irq_chip_type *ct = irq_data_get_chip_type(d); ++ + u32 mask = 1 << (d->irq - gc->irq_base); + + irq_gc_lock(gc); +- gc->mask_cache |= mask; +- writel_relaxed(gc->mask_cache, mvebu_gpioreg_level_mask(mvchip)); ++ ct->mask_cache_priv |= mask; ++ writel_relaxed(ct->mask_cache_priv, mvebu_gpioreg_level_mask(mvchip)); + irq_gc_unlock(gc); + } + +diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c +index 8a9b61adcd87..77e38b76f925 100644 +--- a/drivers/gpio/gpiolib.c ++++ b/drivers/gpio/gpiolib.c +@@ -747,6 +747,7 @@ static struct class gpio_class = { + */ + static int gpiod_export(struct gpio_desc *desc, bool direction_may_change) + { ++ struct gpio_chip *chip; + unsigned long flags; + int status; + const char *ioname = NULL; +@@ -764,8 +765,16 @@ static int gpiod_export(struct gpio_desc *desc, bool direction_may_change) + return -EINVAL; + } + ++ chip = desc->chip; ++ + mutex_lock(&sysfs_lock); + ++ /* check if chip is being removed */ ++ if (!chip || !chip->exported) { ++ status = -ENODEV; ++ goto fail_unlock; ++ } ++ + spin_lock_irqsave(&gpio_lock, flags); + if (!test_bit(FLAG_REQUESTED, &desc->flags) || + test_bit(FLAG_EXPORT, &desc->flags)) { +@@ -1029,12 +1038,15 @@ static void gpiochip_unexport(struct gpio_chip *chip) + { + int status; + struct device *dev; ++ struct gpio_desc *desc; ++ unsigned int i; + + mutex_lock(&sysfs_lock); + dev = class_find_device(&gpio_class, NULL, chip, match_export); + if (dev) { + put_device(dev); + device_unregister(dev); ++ /* prevent further gpiod exports */ + chip->exported = 0; + status = 0; + } else +@@ -1044,6 +1056,13 @@ static void gpiochip_unexport(struct gpio_chip *chip) + if (status) + pr_debug("%s: chip %s status %d\n", __func__, + chip->label, status); ++ ++ /* unregister gpiod class devices owned by sysfs */ ++ for (i = 0; i < chip->ngpio; i++) { ++ desc = &chip->desc[i]; ++ if (test_and_clear_bit(FLAG_SYSFS, &desc->flags)) ++ gpiod_free(desc); ++ } + } + + static int __init gpiolib_sysfs_init(void) +@@ -1257,6 +1276,8 @@ int gpiochip_remove(struct gpio_chip *chip) + int status = 0; + unsigned id; + ++ gpiochip_unexport(chip); ++ + spin_lock_irqsave(&gpio_lock, flags); + + gpiochip_remove_pin_ranges(chip); +@@ -1277,9 +1298,6 @@ int gpiochip_remove(struct gpio_chip *chip) + + spin_unlock_irqrestore(&gpio_lock, flags); + +- if (status == 0) +- gpiochip_unexport(chip); +- + return status; + } + EXPORT_SYMBOL_GPL(gpiochip_remove); +diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h +index 9d344da55056..4e0053e64f14 100644 +--- a/drivers/gpu/drm/i915/i915_reg.h ++++ b/drivers/gpu/drm/i915/i915_reg.h +@@ -1105,6 +1105,7 @@ + #define GMBUS_CYCLE_INDEX (2<<25) + #define GMBUS_CYCLE_STOP (4<<25) + #define GMBUS_BYTE_COUNT_SHIFT 16 ++#define GMBUS_BYTE_COUNT_MAX 256U + #define GMBUS_SLAVE_INDEX_SHIFT 8 + #define GMBUS_SLAVE_ADDR_SHIFT 1 + #define GMBUS_SLAVE_READ (1<<0) +diff --git a/drivers/gpu/drm/i915/intel_i2c.c b/drivers/gpu/drm/i915/intel_i2c.c +index d1c1e0f7f262..36b720475dc0 100644 +--- a/drivers/gpu/drm/i915/intel_i2c.c ++++ b/drivers/gpu/drm/i915/intel_i2c.c +@@ -276,18 +276,17 @@ gmbus_wait_idle(struct drm_i915_private *dev_priv) + } + + static int +-gmbus_xfer_read(struct drm_i915_private *dev_priv, struct i2c_msg *msg, +- u32 gmbus1_index) ++gmbus_xfer_read_chunk(struct drm_i915_private *dev_priv, ++ unsigned short addr, u8 *buf, unsigned int len, ++ u32 gmbus1_index) + { + int reg_offset = dev_priv->gpio_mmio_base; +- u16 len = msg->len; +- u8 *buf = msg->buf; + + I915_WRITE(GMBUS1 + reg_offset, + gmbus1_index | + GMBUS_CYCLE_WAIT | + (len << GMBUS_BYTE_COUNT_SHIFT) | +- (msg->addr << GMBUS_SLAVE_ADDR_SHIFT) | ++ (addr << GMBUS_SLAVE_ADDR_SHIFT) | + GMBUS_SLAVE_READ | GMBUS_SW_RDY); + while (len) { + int ret; +@@ -309,11 +308,35 @@ gmbus_xfer_read(struct drm_i915_private *dev_priv, struct i2c_msg *msg, + } + + static int +-gmbus_xfer_write(struct drm_i915_private *dev_priv, struct i2c_msg *msg) ++gmbus_xfer_read(struct drm_i915_private *dev_priv, struct i2c_msg *msg, ++ u32 gmbus1_index) + { +- int reg_offset = dev_priv->gpio_mmio_base; +- u16 len = msg->len; + u8 *buf = msg->buf; ++ unsigned int rx_size = msg->len; ++ unsigned int len; ++ int ret; ++ ++ do { ++ len = min(rx_size, GMBUS_BYTE_COUNT_MAX); ++ ++ ret = gmbus_xfer_read_chunk(dev_priv, msg->addr, ++ buf, len, gmbus1_index); ++ if (ret) ++ return ret; ++ ++ rx_size -= len; ++ buf += len; ++ } while (rx_size != 0); ++ ++ return 0; ++} ++ ++static int ++gmbus_xfer_write_chunk(struct drm_i915_private *dev_priv, ++ unsigned short addr, u8 *buf, unsigned int len) ++{ ++ int reg_offset = dev_priv->gpio_mmio_base; ++ unsigned int chunk_size = len; + u32 val, loop; + + val = loop = 0; +@@ -325,8 +348,8 @@ gmbus_xfer_write(struct drm_i915_private *dev_priv, struct i2c_msg *msg) + I915_WRITE(GMBUS3 + reg_offset, val); + I915_WRITE(GMBUS1 + reg_offset, + GMBUS_CYCLE_WAIT | +- (msg->len << GMBUS_BYTE_COUNT_SHIFT) | +- (msg->addr << GMBUS_SLAVE_ADDR_SHIFT) | ++ (chunk_size << GMBUS_BYTE_COUNT_SHIFT) | ++ (addr << GMBUS_SLAVE_ADDR_SHIFT) | + GMBUS_SLAVE_WRITE | GMBUS_SW_RDY); + while (len) { + int ret; +@@ -343,6 +366,29 @@ gmbus_xfer_write(struct drm_i915_private *dev_priv, struct i2c_msg *msg) + if (ret) + return ret; + } ++ ++ return 0; ++} ++ ++static int ++gmbus_xfer_write(struct drm_i915_private *dev_priv, struct i2c_msg *msg) ++{ ++ u8 *buf = msg->buf; ++ unsigned int tx_size = msg->len; ++ unsigned int len; ++ int ret; ++ ++ do { ++ len = min(tx_size, GMBUS_BYTE_COUNT_MAX); ++ ++ ret = gmbus_xfer_write_chunk(dev_priv, msg->addr, buf, len); ++ if (ret) ++ return ret; ++ ++ buf += len; ++ tx_size -= len; ++ } while (tx_size != 0); ++ + return 0; + } + +diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c +index e5473daab676..d5b601bcbf11 100644 +--- a/drivers/gpu/drm/i915/intel_lvds.c ++++ b/drivers/gpu/drm/i915/intel_lvds.c +@@ -844,12 +844,28 @@ static int intel_dual_link_lvds_callback(const struct dmi_system_id *id) + static const struct dmi_system_id intel_dual_link_lvds[] = { + { + .callback = intel_dual_link_lvds_callback, +- .ident = "Apple MacBook Pro (Core i5/i7 Series)", ++ .ident = "Apple MacBook Pro 15\" (2010)", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro6,2"), ++ }, ++ }, ++ { ++ .callback = intel_dual_link_lvds_callback, ++ .ident = "Apple MacBook Pro 15\" (2011)", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."), + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro8,2"), + }, + }, ++ { ++ .callback = intel_dual_link_lvds_callback, ++ .ident = "Apple MacBook Pro 15\" (2012)", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro9,1"), ++ }, ++ }, + { } /* terminating entry */ + }; + +diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c +index 65344d65ff91..ecd4a3dd51bb 100644 +--- a/drivers/gpu/drm/radeon/atombios_crtc.c ++++ b/drivers/gpu/drm/radeon/atombios_crtc.c +@@ -332,8 +332,10 @@ atombios_set_crtc_dtd_timing(struct drm_crtc *crtc, + misc |= ATOM_COMPOSITESYNC; + if (mode->flags & DRM_MODE_FLAG_INTERLACE) + misc |= ATOM_INTERLACE; +- if (mode->flags & DRM_MODE_FLAG_DBLSCAN) ++ if (mode->flags & DRM_MODE_FLAG_DBLCLK) + misc |= ATOM_DOUBLE_CLOCK_MODE; ++ if (mode->flags & DRM_MODE_FLAG_DBLSCAN) ++ misc |= ATOM_H_REPLICATIONBY2 | ATOM_V_REPLICATIONBY2; + + args.susModeMiscInfo.usAccess = cpu_to_le16(misc); + args.ucCRTC = radeon_crtc->crtc_id; +@@ -376,8 +378,10 @@ static void atombios_crtc_set_timing(struct drm_crtc *crtc, + misc |= ATOM_COMPOSITESYNC; + if (mode->flags & DRM_MODE_FLAG_INTERLACE) + misc |= ATOM_INTERLACE; +- if (mode->flags & DRM_MODE_FLAG_DBLSCAN) ++ if (mode->flags & DRM_MODE_FLAG_DBLCLK) + misc |= ATOM_DOUBLE_CLOCK_MODE; ++ if (mode->flags & DRM_MODE_FLAG_DBLSCAN) ++ misc |= ATOM_H_REPLICATIONBY2 | ATOM_V_REPLICATIONBY2; + + args.susModeMiscInfo.usAccess = cpu_to_le16(misc); + args.ucCRTC = radeon_crtc->crtc_id; +diff --git a/drivers/gpu/drm/radeon/radeon_asic.c b/drivers/gpu/drm/radeon/radeon_asic.c +index 5720e66da23c..9af20389c74e 100644 +--- a/drivers/gpu/drm/radeon/radeon_asic.c ++++ b/drivers/gpu/drm/radeon/radeon_asic.c +@@ -1157,7 +1157,7 @@ static struct radeon_asic rs780_asic = { + static struct radeon_asic_ring rv770_uvd_ring = { + .ib_execute = &uvd_v1_0_ib_execute, + .emit_fence = &uvd_v2_2_fence_emit, +- .emit_semaphore = &uvd_v1_0_semaphore_emit, ++ .emit_semaphore = &uvd_v2_2_semaphore_emit, + .cs_parse = &radeon_uvd_cs_parse, + .ring_test = &uvd_v1_0_ring_test, + .ib_test = &uvd_v1_0_ib_test, +diff --git a/drivers/gpu/drm/radeon/radeon_asic.h b/drivers/gpu/drm/radeon/radeon_asic.h +index 70c29d5e080d..983e34e245e6 100644 +--- a/drivers/gpu/drm/radeon/radeon_asic.h ++++ b/drivers/gpu/drm/radeon/radeon_asic.h +@@ -812,6 +812,10 @@ void uvd_v1_0_ib_execute(struct radeon_device *rdev, struct radeon_ib *ib); + int uvd_v2_2_resume(struct radeon_device *rdev); + void uvd_v2_2_fence_emit(struct radeon_device *rdev, + struct radeon_fence *fence); ++void uvd_v2_2_semaphore_emit(struct radeon_device *rdev, ++ struct radeon_ring *ring, ++ struct radeon_semaphore *semaphore, ++ bool emit_wait); + + /* uvd v3.1 */ + void uvd_v3_1_semaphore_emit(struct radeon_device *rdev, +diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c +index a656b1a7e10a..b84c561c6084 100644 +--- a/drivers/gpu/drm/radeon/radeon_uvd.c ++++ b/drivers/gpu/drm/radeon/radeon_uvd.c +@@ -349,6 +349,29 @@ static int radeon_uvd_cs_msg_decode(uint32_t *msg, unsigned buf_sizes[]) + return 0; + } + ++static int radeon_uvd_validate_codec(struct radeon_cs_parser *p, ++ unsigned stream_type) ++{ ++ switch (stream_type) { ++ case 0: /* H264 */ ++ case 1: /* VC1 */ ++ /* always supported */ ++ return 0; ++ ++ case 3: /* MPEG2 */ ++ case 4: /* MPEG4 */ ++ /* only since UVD 3 */ ++ if (p->rdev->family >= CHIP_PALM) ++ return 0; ++ ++ /* fall through */ ++ default: ++ DRM_ERROR("UVD codec not supported by hardware %d!\n", ++ stream_type); ++ return -EINVAL; ++ } ++} ++ + static int radeon_uvd_cs_msg(struct radeon_cs_parser *p, struct radeon_bo *bo, + unsigned offset, unsigned buf_sizes[]) + { +@@ -387,50 +410,70 @@ static int radeon_uvd_cs_msg(struct radeon_cs_parser *p, struct radeon_bo *bo, + return -EINVAL; + } + +- if (msg_type == 1) { +- /* it's a decode msg, calc buffer sizes */ +- r = radeon_uvd_cs_msg_decode(msg, buf_sizes); +- /* calc image size (width * height) */ +- img_size = msg[6] * msg[7]; ++ switch (msg_type) { ++ case 0: ++ /* it's a create msg, calc image size (width * height) */ ++ img_size = msg[7] * msg[8]; ++ ++ r = radeon_uvd_validate_codec(p, msg[4]); ++ radeon_bo_kunmap(bo); ++ if (r) ++ return r; ++ ++ /* try to alloc a new handle */ ++ for (i = 0; i < RADEON_MAX_UVD_HANDLES; ++i) { ++ if (atomic_read(&p->rdev->uvd.handles[i]) == handle) { ++ DRM_ERROR("Handle 0x%x already in use!\n", handle); ++ return -EINVAL; ++ } ++ ++ if (!atomic_cmpxchg(&p->rdev->uvd.handles[i], 0, handle)) { ++ p->rdev->uvd.filp[i] = p->filp; ++ p->rdev->uvd.img_size[i] = img_size; ++ return 0; ++ } ++ } ++ ++ DRM_ERROR("No more free UVD handles!\n"); ++ return -EINVAL; ++ ++ case 1: ++ /* it's a decode msg, validate codec and calc buffer sizes */ ++ r = radeon_uvd_validate_codec(p, msg[4]); ++ if (!r) ++ r = radeon_uvd_cs_msg_decode(msg, buf_sizes); + radeon_bo_kunmap(bo); + if (r) + return r; + +- } else if (msg_type == 2) { ++ /* validate the handle */ ++ for (i = 0; i < RADEON_MAX_UVD_HANDLES; ++i) { ++ if (atomic_read(&p->rdev->uvd.handles[i]) == handle) { ++ if (p->rdev->uvd.filp[i] != p->filp) { ++ DRM_ERROR("UVD handle collision detected!\n"); ++ return -EINVAL; ++ } ++ return 0; ++ } ++ } ++ ++ DRM_ERROR("Invalid UVD handle 0x%x!\n", handle); ++ return -ENOENT; ++ ++ case 2: + /* it's a destroy msg, free the handle */ + for (i = 0; i < RADEON_MAX_UVD_HANDLES; ++i) + atomic_cmpxchg(&p->rdev->uvd.handles[i], handle, 0); + radeon_bo_kunmap(bo); + return 0; +- } else { +- /* it's a create msg, calc image size (width * height) */ +- img_size = msg[7] * msg[8]; +- radeon_bo_kunmap(bo); + +- if (msg_type != 0) { +- DRM_ERROR("Illegal UVD message type (%d)!\n", msg_type); +- return -EINVAL; +- } +- +- /* it's a create msg, no special handling needed */ +- } +- +- /* create or decode, validate the handle */ +- for (i = 0; i < RADEON_MAX_UVD_HANDLES; ++i) { +- if (atomic_read(&p->rdev->uvd.handles[i]) == handle) +- return 0; +- } ++ default: + +- /* handle not found try to alloc a new one */ +- for (i = 0; i < RADEON_MAX_UVD_HANDLES; ++i) { +- if (!atomic_cmpxchg(&p->rdev->uvd.handles[i], 0, handle)) { +- p->rdev->uvd.filp[i] = p->filp; +- p->rdev->uvd.img_size[i] = img_size; +- return 0; +- } ++ DRM_ERROR("Illegal UVD message type (%d)!\n", msg_type); ++ return -EINVAL; + } + +- DRM_ERROR("No more free UVD handles!\n"); ++ BUG(); + return -EINVAL; + } + +diff --git a/drivers/gpu/drm/radeon/rv770d.h b/drivers/gpu/drm/radeon/rv770d.h +index 1ae277152cc7..68ae18940b7a 100644 +--- a/drivers/gpu/drm/radeon/rv770d.h ++++ b/drivers/gpu/drm/radeon/rv770d.h +@@ -982,6 +982,9 @@ + ((n) & 0x3FFF) << 16) + + /* UVD */ ++#define UVD_SEMA_ADDR_LOW 0xef00 ++#define UVD_SEMA_ADDR_HIGH 0xef04 ++#define UVD_SEMA_CMD 0xef08 + #define UVD_GPCOM_VCPU_CMD 0xef0c + #define UVD_GPCOM_VCPU_DATA0 0xef10 + #define UVD_GPCOM_VCPU_DATA1 0xef14 +diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c +index 51588d30d675..bf7e4e9f1669 100644 +--- a/drivers/gpu/drm/radeon/si_dpm.c ++++ b/drivers/gpu/drm/radeon/si_dpm.c +@@ -2914,6 +2914,7 @@ struct si_dpm_quirk { + static struct si_dpm_quirk si_dpm_quirk_list[] = { + /* PITCAIRN - https://bugs.freedesktop.org/show_bug.cgi?id=76490 */ + { PCI_VENDOR_ID_ATI, 0x6810, 0x1462, 0x3036, 0, 120000 }, ++ { PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0xe271, 0, 120000 }, + { 0, 0, 0, 0 }, + }; + +diff --git a/drivers/gpu/drm/radeon/uvd_v1_0.c b/drivers/gpu/drm/radeon/uvd_v1_0.c +index f680f5ffbdeb..4bfea2dbb8c5 100644 +--- a/drivers/gpu/drm/radeon/uvd_v1_0.c ++++ b/drivers/gpu/drm/radeon/uvd_v1_0.c +@@ -365,16 +365,7 @@ void uvd_v1_0_semaphore_emit(struct radeon_device *rdev, + struct radeon_semaphore *semaphore, + bool emit_wait) + { +- uint64_t addr = semaphore->gpu_addr; +- +- radeon_ring_write(ring, PACKET0(UVD_SEMA_ADDR_LOW, 0)); +- radeon_ring_write(ring, (addr >> 3) & 0x000FFFFF); +- +- radeon_ring_write(ring, PACKET0(UVD_SEMA_ADDR_HIGH, 0)); +- radeon_ring_write(ring, (addr >> 23) & 0x000FFFFF); +- +- radeon_ring_write(ring, PACKET0(UVD_SEMA_CMD, 0)); +- radeon_ring_write(ring, emit_wait ? 1 : 0); ++ /* disable semaphores for UVD V1 hardware */ + } + + /** +diff --git a/drivers/gpu/drm/radeon/uvd_v2_2.c b/drivers/gpu/drm/radeon/uvd_v2_2.c +index 824550db3fed..e42e136a6abe 100644 +--- a/drivers/gpu/drm/radeon/uvd_v2_2.c ++++ b/drivers/gpu/drm/radeon/uvd_v2_2.c +@@ -61,6 +61,33 @@ void uvd_v2_2_fence_emit(struct radeon_device *rdev, + } + + /** ++ * uvd_v2_2_semaphore_emit - emit semaphore command ++ * ++ * @rdev: radeon_device pointer ++ * @ring: radeon_ring pointer ++ * @semaphore: semaphore to emit commands for ++ * @emit_wait: true if we should emit a wait command ++ * ++ * Emit a semaphore command (either wait or signal) to the UVD ring. ++ */ ++void uvd_v2_2_semaphore_emit(struct radeon_device *rdev, ++ struct radeon_ring *ring, ++ struct radeon_semaphore *semaphore, ++ bool emit_wait) ++{ ++ uint64_t addr = semaphore->gpu_addr; ++ ++ radeon_ring_write(ring, PACKET0(UVD_SEMA_ADDR_LOW, 0)); ++ radeon_ring_write(ring, (addr >> 3) & 0x000FFFFF); ++ ++ radeon_ring_write(ring, PACKET0(UVD_SEMA_ADDR_HIGH, 0)); ++ radeon_ring_write(ring, (addr >> 23) & 0x000FFFFF); ++ ++ radeon_ring_write(ring, PACKET0(UVD_SEMA_CMD, 0)); ++ radeon_ring_write(ring, emit_wait ? 1 : 0); ++} ++ ++/** + * uvd_v2_2_resume - memory controller programming + * + * @rdev: radeon_device pointer +diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c +index dea661331351..120237a90a86 100644 +--- a/drivers/hv/channel.c ++++ b/drivers/hv/channel.c +@@ -178,7 +178,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size, + GFP_KERNEL); + if (!open_info) { + err = -ENOMEM; +- goto error0; ++ goto error_gpadl; + } + + init_completion(&open_info->waitevent); +@@ -194,7 +194,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size, + + if (userdatalen > MAX_USER_DEFINED_BYTES) { + err = -EINVAL; +- goto error0; ++ goto error_gpadl; + } + + if (userdatalen) +@@ -238,6 +238,9 @@ error1: + list_del(&open_info->msglistentry); + spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags); + ++error_gpadl: ++ vmbus_teardown_gpadl(newchannel, newchannel->ringbuffer_gpadlhandle); ++ + error0: + free_pages((unsigned long)out, + get_order(send_ringbuffer_size + recv_ringbuffer_size)); +diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c +index 505fe29c75b0..8c248818592e 100644 +--- a/drivers/hv/channel_mgmt.c ++++ b/drivers/hv/channel_mgmt.c +@@ -716,7 +716,7 @@ int vmbus_request_offers(void) + { + struct vmbus_channel_message_header *msg; + struct vmbus_channel_msginfo *msginfo; +- int ret, t; ++ int ret; + + msginfo = kmalloc(sizeof(*msginfo) + + sizeof(struct vmbus_channel_message_header), +@@ -724,8 +724,6 @@ int vmbus_request_offers(void) + if (!msginfo) + return -ENOMEM; + +- init_completion(&msginfo->waitevent); +- + msg = (struct vmbus_channel_message_header *)msginfo->msg; + + msg->msgtype = CHANNELMSG_REQUESTOFFERS; +@@ -739,14 +737,6 @@ int vmbus_request_offers(void) + goto cleanup; + } + +- t = wait_for_completion_timeout(&msginfo->waitevent, 5*HZ); +- if (t == 0) { +- ret = -ETIMEDOUT; +- goto cleanup; +- } +- +- +- + cleanup: + kfree(msginfo); + +diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c +index 3be58f89ac77..b5de139920e3 100644 +--- a/drivers/i2c/i2c-core.c ++++ b/drivers/i2c/i2c-core.c +@@ -212,6 +212,7 @@ int i2c_generic_scl_recovery(struct i2c_adapter *adap) + adap->bus_recovery_info->set_scl(adap, 1); + return i2c_generic_recovery(adap); + } ++EXPORT_SYMBOL_GPL(i2c_generic_scl_recovery); + + int i2c_generic_gpio_recovery(struct i2c_adapter *adap) + { +@@ -226,6 +227,7 @@ int i2c_generic_gpio_recovery(struct i2c_adapter *adap) + + return ret; + } ++EXPORT_SYMBOL_GPL(i2c_generic_gpio_recovery); + + int i2c_recover_bus(struct i2c_adapter *adap) + { +@@ -235,6 +237,7 @@ int i2c_recover_bus(struct i2c_adapter *adap) + dev_dbg(&adap->dev, "Trying i2c bus recovery\n"); + return adap->bus_recovery_info->recover_bus(adap); + } ++EXPORT_SYMBOL_GPL(i2c_recover_bus); + + static int i2c_device_probe(struct device *dev) + { +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index dab4b41f1715..1429143301a7 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -840,19 +840,27 @@ static void cma_save_ib_info(struct rdma_cm_id *id, struct rdma_cm_id *listen_id + memcpy(&ib->sib_addr, &path->dgid, 16); + } + ++static __be16 ss_get_port(const struct sockaddr_storage *ss) ++{ ++ if (ss->ss_family == AF_INET) ++ return ((struct sockaddr_in *)ss)->sin_port; ++ else if (ss->ss_family == AF_INET6) ++ return ((struct sockaddr_in6 *)ss)->sin6_port; ++ BUG(); ++} ++ + static void cma_save_ip4_info(struct rdma_cm_id *id, struct rdma_cm_id *listen_id, + struct cma_hdr *hdr) + { +- struct sockaddr_in *listen4, *ip4; ++ struct sockaddr_in *ip4; + +- listen4 = (struct sockaddr_in *) &listen_id->route.addr.src_addr; + ip4 = (struct sockaddr_in *) &id->route.addr.src_addr; +- ip4->sin_family = listen4->sin_family; ++ ip4->sin_family = AF_INET; + ip4->sin_addr.s_addr = hdr->dst_addr.ip4.addr; +- ip4->sin_port = listen4->sin_port; ++ ip4->sin_port = ss_get_port(&listen_id->route.addr.src_addr); + + ip4 = (struct sockaddr_in *) &id->route.addr.dst_addr; +- ip4->sin_family = listen4->sin_family; ++ ip4->sin_family = AF_INET; + ip4->sin_addr.s_addr = hdr->src_addr.ip4.addr; + ip4->sin_port = hdr->port; + } +@@ -860,16 +868,15 @@ static void cma_save_ip4_info(struct rdma_cm_id *id, struct rdma_cm_id *listen_i + static void cma_save_ip6_info(struct rdma_cm_id *id, struct rdma_cm_id *listen_id, + struct cma_hdr *hdr) + { +- struct sockaddr_in6 *listen6, *ip6; ++ struct sockaddr_in6 *ip6; + +- listen6 = (struct sockaddr_in6 *) &listen_id->route.addr.src_addr; + ip6 = (struct sockaddr_in6 *) &id->route.addr.src_addr; +- ip6->sin6_family = listen6->sin6_family; ++ ip6->sin6_family = AF_INET6; + ip6->sin6_addr = hdr->dst_addr.ip6; +- ip6->sin6_port = listen6->sin6_port; ++ ip6->sin6_port = ss_get_port(&listen_id->route.addr.src_addr); + + ip6 = (struct sockaddr_in6 *) &id->route.addr.dst_addr; +- ip6->sin6_family = listen6->sin6_family; ++ ip6->sin6_family = AF_INET6; + ip6->sin6_addr = hdr->src_addr.ip6; + ip6->sin6_port = hdr->port; + } +diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c +index 055ebebc07dd..c1fef27010d4 100644 +--- a/drivers/infiniband/core/umem.c ++++ b/drivers/infiniband/core/umem.c +@@ -94,12 +94,15 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr, + if (dmasync) + dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs); + ++ if (!size) ++ return ERR_PTR(-EINVAL); ++ + /* + * If the combination of the addr and size requested for this memory + * region causes an integer overflow, return error. + */ +- if ((PAGE_ALIGN(addr + size) <= size) || +- (PAGE_ALIGN(addr + size) <= addr)) ++ if (((addr + size) < addr) || ++ PAGE_ALIGN(addr + size) < (addr + size)) + return ERR_PTR(-EINVAL); + + if (!can_do_mlock()) +diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c +index 4f10af2905b5..262a18437ceb 100644 +--- a/drivers/infiniband/hw/mlx4/qp.c ++++ b/drivers/infiniband/hw/mlx4/qp.c +@@ -2174,8 +2174,7 @@ static int build_lso_seg(struct mlx4_wqe_lso_seg *wqe, struct ib_send_wr *wr, + + memcpy(wqe->header, wr->wr.ud.header, wr->wr.ud.hlen); + +- *lso_hdr_sz = cpu_to_be32((wr->wr.ud.mss - wr->wr.ud.hlen) << 16 | +- wr->wr.ud.hlen); ++ *lso_hdr_sz = cpu_to_be32(wr->wr.ud.mss << 16 | wr->wr.ud.hlen); + *lso_seg_len = halign; + return 0; + } +diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c +index 0ec8604aadcf..04a7d9f00928 100644 +--- a/drivers/input/mouse/elantech.c ++++ b/drivers/input/mouse/elantech.c +@@ -814,6 +814,21 @@ static psmouse_ret_t elantech_process_byte(struct psmouse *psmouse) + } + + /* ++ * This writes the reg_07 value again to the hardware at the end of every ++ * set_rate call because the register loses its value. reg_07 allows setting ++ * absolute mode on v4 hardware ++ */ ++static void elantech_set_rate_restore_reg_07(struct psmouse *psmouse, ++ unsigned int rate) ++{ ++ struct elantech_data *etd = psmouse->private; ++ ++ etd->original_set_rate(psmouse, rate); ++ if (elantech_write_reg(psmouse, 0x07, etd->reg_07)) ++ psmouse_err(psmouse, "restoring reg_07 failed\n"); ++} ++ ++/* + * Put the touchpad into absolute mode + */ + static int elantech_set_absolute_mode(struct psmouse *psmouse) +@@ -1015,6 +1030,8 @@ static int elantech_get_resolution_v4(struct psmouse *psmouse, + * Asus K53SV 0x450f01 78, 15, 0c 2 hw buttons + * Asus G46VW 0x460f02 00, 18, 0c 2 hw buttons + * Asus G750JX 0x360f00 00, 16, 0c 2 hw buttons ++ * Asus TP500LN 0x381f17 10, 14, 0e clickpad ++ * Asus X750JN 0x381f17 10, 14, 0e clickpad + * Asus UX31 0x361f00 20, 15, 0e clickpad + * Asus UX32VD 0x361f02 00, 15, 0e clickpad + * Avatar AVIU-145A2 0x361f00 ? clickpad +@@ -1523,6 +1540,11 @@ int elantech_init(struct psmouse *psmouse) + goto init_fail; + } + ++ if (etd->fw_version == 0x381f17) { ++ etd->original_set_rate = psmouse->set_rate; ++ psmouse->set_rate = elantech_set_rate_restore_reg_07; ++ } ++ + if (elantech_set_input_params(psmouse)) { + psmouse_err(psmouse, "failed to query touchpad range.\n"); + goto init_fail; +diff --git a/drivers/input/mouse/elantech.h b/drivers/input/mouse/elantech.h +index 9e0e2a1f340d..59263a3a8667 100644 +--- a/drivers/input/mouse/elantech.h ++++ b/drivers/input/mouse/elantech.h +@@ -139,6 +139,7 @@ struct elantech_data { + struct finger_pos mt[ETP_MAX_FINGERS]; + unsigned char parity[256]; + int (*send_cmd)(struct psmouse *psmouse, unsigned char c, unsigned char *param); ++ void (*original_set_rate)(struct psmouse *psmouse, unsigned int rate); + }; + + #ifdef CONFIG_MOUSE_PS2_ELANTECH +diff --git a/drivers/media/usb/stk1160/stk1160-v4l.c b/drivers/media/usb/stk1160/stk1160-v4l.c +index c45c9881bb5f..4572530346fb 100644 +--- a/drivers/media/usb/stk1160/stk1160-v4l.c ++++ b/drivers/media/usb/stk1160/stk1160-v4l.c +@@ -244,6 +244,11 @@ static int stk1160_stop_streaming(struct stk1160 *dev) + if (mutex_lock_interruptible(&dev->v4l_lock)) + return -ERESTARTSYS; + ++ /* ++ * Once URBs are cancelled, the URB complete handler ++ * won't be running. This is required to safely release the ++ * current buffer (dev->isoc_ctl.buf). ++ */ + stk1160_cancel_isoc(dev); + + /* +@@ -624,8 +629,16 @@ void stk1160_clear_queue(struct stk1160 *dev) + stk1160_info("buffer [%p/%d] aborted\n", + buf, buf->vb.v4l2_buf.index); + } +- /* It's important to clear current buffer */ +- dev->isoc_ctl.buf = NULL; ++ ++ /* It's important to release the current buffer */ ++ if (dev->isoc_ctl.buf) { ++ buf = dev->isoc_ctl.buf; ++ dev->isoc_ctl.buf = NULL; ++ ++ vb2_buffer_done(&buf->vb, VB2_BUF_STATE_ERROR); ++ stk1160_info("buffer [%p/%d] aborted\n", ++ buf, buf->vb.v4l2_buf.index); ++ } + spin_unlock_irqrestore(&dev->buf_lock, flags); + } + +diff --git a/drivers/memstick/core/mspro_block.c b/drivers/memstick/core/mspro_block.c +index f4176ca3a794..cdd61ab5c2b5 100644 +--- a/drivers/memstick/core/mspro_block.c ++++ b/drivers/memstick/core/mspro_block.c +@@ -758,7 +758,7 @@ static int mspro_block_complete_req(struct memstick_dev *card, int error) + + if (error || (card->current_mrq.tpc == MSPRO_CMD_STOP)) { + if (msb->data_dir == READ) { +- for (cnt = 0; cnt < msb->current_seg; cnt++) ++ for (cnt = 0; cnt < msb->current_seg; cnt++) { + t_len += msb->req_sg[cnt].length + / msb->page_size; + +@@ -766,6 +766,7 @@ static int mspro_block_complete_req(struct memstick_dev *card, int error) + t_len += msb->current_page - 1; + + t_len *= msb->page_size; ++ } + } + } else + t_len = blk_rq_bytes(msb->block_req); +diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c +index 2aea365e096e..fb5662709a8f 100644 +--- a/drivers/mmc/card/block.c ++++ b/drivers/mmc/card/block.c +@@ -951,6 +951,18 @@ static inline void mmc_blk_reset_success(struct mmc_blk_data *md, int type) + md->reset_done &= ~type; + } + ++int mmc_access_rpmb(struct mmc_queue *mq) ++{ ++ struct mmc_blk_data *md = mq->data; ++ /* ++ * If this is a RPMB partition access, return ture ++ */ ++ if (md && md->part_type == EXT_CSD_PART_CONFIG_ACC_RPMB) ++ return true; ++ ++ return false; ++} ++ + static int mmc_blk_issue_discard_rq(struct mmc_queue *mq, struct request *req) + { + struct mmc_blk_data *md = mq->data; +diff --git a/drivers/mmc/card/queue.c b/drivers/mmc/card/queue.c +index fa9632eb63f1..e7e98eb862d9 100644 +--- a/drivers/mmc/card/queue.c ++++ b/drivers/mmc/card/queue.c +@@ -37,7 +37,7 @@ static int mmc_prep_request(struct request_queue *q, struct request *req) + return BLKPREP_KILL; + } + +- if (mq && mmc_card_removed(mq->card)) ++ if (mq && (mmc_card_removed(mq->card) || mmc_access_rpmb(mq))) + return BLKPREP_KILL; + + req->cmd_flags |= REQ_DONTPREP; +diff --git a/drivers/mmc/card/queue.h b/drivers/mmc/card/queue.h +index 5752d50049a3..99e6521e6169 100644 +--- a/drivers/mmc/card/queue.h ++++ b/drivers/mmc/card/queue.h +@@ -73,4 +73,6 @@ extern void mmc_queue_bounce_post(struct mmc_queue_req *); + extern int mmc_packed_init(struct mmc_queue *, struct mmc_card *); + extern void mmc_packed_clean(struct mmc_queue *); + ++extern int mmc_access_rpmb(struct mmc_queue *); ++ + #endif +diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c +index bf18b6bfce48..e743d3984d29 100644 +--- a/drivers/mmc/core/core.c ++++ b/drivers/mmc/core/core.c +@@ -2694,6 +2694,7 @@ int mmc_pm_notify(struct notifier_block *notify_block, + switch (mode) { + case PM_HIBERNATION_PREPARE: + case PM_SUSPEND_PREPARE: ++ case PM_RESTORE_PREPARE: + spin_lock_irqsave(&host->lock, flags); + host->rescan_disable = 1; + spin_unlock_irqrestore(&host->lock, flags); +diff --git a/drivers/mmc/host/sh_mmcif.c b/drivers/mmc/host/sh_mmcif.c +index 36629a024aa1..5b4f1e163e00 100644 +--- a/drivers/mmc/host/sh_mmcif.c ++++ b/drivers/mmc/host/sh_mmcif.c +@@ -1399,7 +1399,7 @@ static int sh_mmcif_probe(struct platform_device *pdev) + host = mmc_priv(mmc); + host->mmc = mmc; + host->addr = reg; +- host->timeout = msecs_to_jiffies(1000); ++ host->timeout = msecs_to_jiffies(10000); + host->ccs_enable = !pd || !pd->ccs_unsupported; + host->clk_ctrl2_enable = pd && pd->clk_ctrl2_present; + +diff --git a/drivers/mtd/ubi/attach.c b/drivers/mtd/ubi/attach.c +index c071d410488f..79d69bd26dd2 100644 +--- a/drivers/mtd/ubi/attach.c ++++ b/drivers/mtd/ubi/attach.c +@@ -408,7 +408,7 @@ int ubi_compare_lebs(struct ubi_device *ubi, const struct ubi_ainf_peb *aeb, + second_is_newer = !second_is_newer; + } else { + dbg_bld("PEB %d CRC is OK", pnum); +- bitflips = !!err; ++ bitflips |= !!err; + } + mutex_unlock(&ubi->buf_mutex); + +diff --git a/drivers/mtd/ubi/cdev.c b/drivers/mtd/ubi/cdev.c +index 8ca49f2043e4..4cbbd5531133 100644 +--- a/drivers/mtd/ubi/cdev.c ++++ b/drivers/mtd/ubi/cdev.c +@@ -451,7 +451,7 @@ static long vol_cdev_ioctl(struct file *file, unsigned int cmd, + /* Validate the request */ + err = -EINVAL; + if (req.lnum < 0 || req.lnum >= vol->reserved_pebs || +- req.bytes < 0 || req.lnum >= vol->usable_leb_size) ++ req.bytes < 0 || req.bytes > vol->usable_leb_size) + break; + + err = get_exclusive(desc); +diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c +index 0e11671dadc4..930cf2c77abb 100644 +--- a/drivers/mtd/ubi/eba.c ++++ b/drivers/mtd/ubi/eba.c +@@ -1362,7 +1362,8 @@ int ubi_eba_init(struct ubi_device *ubi, struct ubi_attach_info *ai) + * during re-size. + */ + ubi_move_aeb_to_list(av, aeb, &ai->erase); +- vol->eba_tbl[aeb->lnum] = aeb->pnum; ++ else ++ vol->eba_tbl[aeb->lnum] = aeb->pnum; + } + } + +diff --git a/drivers/mtd/ubi/misc.c b/drivers/mtd/ubi/misc.c +index f913d701a5b3..c4b1af07a121 100644 +--- a/drivers/mtd/ubi/misc.c ++++ b/drivers/mtd/ubi/misc.c +@@ -74,6 +74,8 @@ int ubi_check_volume(struct ubi_device *ubi, int vol_id) + for (i = 0; i < vol->used_ebs; i++) { + int size; + ++ cond_resched(); ++ + if (i == vol->used_ebs - 1) + size = vol->last_eb_bytes; + else +diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c +index 49e570abe58b..c08254016fe8 100644 +--- a/drivers/mtd/ubi/wl.c ++++ b/drivers/mtd/ubi/wl.c +@@ -999,7 +999,7 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk, + int cancel) + { + int err, scrubbing = 0, torture = 0, protect = 0, erroneous = 0; +- int vol_id = -1, uninitialized_var(lnum); ++ int vol_id = -1, lnum = -1; + #ifdef CONFIG_MTD_UBI_FASTMAP + int anchor = wrk->anchor; + #endif +diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c +index 15c85d4f3774..b7f68883da64 100644 +--- a/drivers/net/ethernet/intel/e1000/e1000_main.c ++++ b/drivers/net/ethernet/intel/e1000/e1000_main.c +@@ -144,6 +144,11 @@ static bool e1000_clean_rx_irq(struct e1000_adapter *adapter, + static bool e1000_clean_jumbo_rx_irq(struct e1000_adapter *adapter, + struct e1000_rx_ring *rx_ring, + int *work_done, int work_to_do); ++static void e1000_alloc_dummy_rx_buffers(struct e1000_adapter *adapter, ++ struct e1000_rx_ring *rx_ring, ++ int cleaned_count) ++{ ++} + static void e1000_alloc_rx_buffers(struct e1000_adapter *adapter, + struct e1000_rx_ring *rx_ring, + int cleaned_count); +@@ -3566,8 +3571,11 @@ static int e1000_change_mtu(struct net_device *netdev, int new_mtu) + msleep(1); + /* e1000_down has a dependency on max_frame_size */ + hw->max_frame_size = max_frame; +- if (netif_running(netdev)) ++ if (netif_running(netdev)) { ++ /* prevent buffers from being reallocated */ ++ adapter->alloc_rx_buf = e1000_alloc_dummy_rx_buffers; + e1000_down(adapter); ++ } + + /* NOTE: netdev_alloc_skb reserves 16 bytes, and typically NET_IP_ALIGN + * means we reserve 2 more, this pushes us to allocate from the next +diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c +index e7a2af3ad05a..7555095e0b74 100644 +--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c +@@ -313,6 +313,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = { + {RTL_USB_DEVICE(0x07b8, 0x8188, rtl92cu_hal_cfg)}, /*Abocom - Abocom*/ + {RTL_USB_DEVICE(0x07b8, 0x8189, rtl92cu_hal_cfg)}, /*Funai - Abocom*/ + {RTL_USB_DEVICE(0x0846, 0x9041, rtl92cu_hal_cfg)}, /*NetGear WNA1000M*/ ++ {RTL_USB_DEVICE(0x0b05, 0x17ba, rtl92cu_hal_cfg)}, /*ASUS-Edimax*/ + {RTL_USB_DEVICE(0x0bda, 0x5088, rtl92cu_hal_cfg)}, /*Thinkware-CC&C*/ + {RTL_USB_DEVICE(0x0df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/ + {RTL_USB_DEVICE(0x0df6, 0x005c, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/ +@@ -369,6 +370,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = { + {RTL_USB_DEVICE(0x2001, 0x3307, rtl92cu_hal_cfg)}, /*D-Link-Cameo*/ + {RTL_USB_DEVICE(0x2001, 0x3309, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/ + {RTL_USB_DEVICE(0x2001, 0x330a, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/ ++ {RTL_USB_DEVICE(0x2001, 0x330d, rtl92cu_hal_cfg)}, /*D-Link DWA-131 */ + {RTL_USB_DEVICE(0x2019, 0xab2b, rtl92cu_hal_cfg)}, /*Planex -Abocom*/ + {RTL_USB_DEVICE(0x20f4, 0x624d, rtl92cu_hal_cfg)}, /*TRENDNet*/ + {RTL_USB_DEVICE(0x2357, 0x0100, rtl92cu_hal_cfg)}, /*TP-Link WN8200ND*/ +diff --git a/drivers/net/wireless/ti/wl18xx/debugfs.c b/drivers/net/wireless/ti/wl18xx/debugfs.c +index 7f1669cdea09..779dc2b2ca75 100644 +--- a/drivers/net/wireless/ti/wl18xx/debugfs.c ++++ b/drivers/net/wireless/ti/wl18xx/debugfs.c +@@ -136,7 +136,7 @@ WL18XX_DEBUGFS_FWSTATS_FILE(rx_filter, protection_filter, "%u"); + WL18XX_DEBUGFS_FWSTATS_FILE(rx_filter, accum_arp_pend_requests, "%u"); + WL18XX_DEBUGFS_FWSTATS_FILE(rx_filter, max_arp_queue_dep, "%u"); + +-WL18XX_DEBUGFS_FWSTATS_FILE(rx_rate, rx_frames_per_rates, "%u"); ++WL18XX_DEBUGFS_FWSTATS_FILE_ARRAY(rx_rate, rx_frames_per_rates, 50); + + WL18XX_DEBUGFS_FWSTATS_FILE_ARRAY(aggr_size, tx_agg_vs_rate, + AGGR_STATS_TX_AGG*AGGR_STATS_TX_RATE); +diff --git a/drivers/net/wireless/ti/wlcore/debugfs.h b/drivers/net/wireless/ti/wlcore/debugfs.h +index f7381dd69009..1bce4325e86b 100644 +--- a/drivers/net/wireless/ti/wlcore/debugfs.h ++++ b/drivers/net/wireless/ti/wlcore/debugfs.h +@@ -26,8 +26,8 @@ + + #include "wlcore.h" + +-int wl1271_format_buffer(char __user *userbuf, size_t count, +- loff_t *ppos, char *fmt, ...); ++__printf(4, 5) int wl1271_format_buffer(char __user *userbuf, size_t count, ++ loff_t *ppos, char *fmt, ...); + + int wl1271_debugfs_init(struct wl1271 *wl); + void wl1271_debugfs_exit(struct wl1271 *wl); +diff --git a/drivers/parport/Kconfig b/drivers/parport/Kconfig +index 70694ce38be2..46d2de24bf3e 100644 +--- a/drivers/parport/Kconfig ++++ b/drivers/parport/Kconfig +@@ -37,7 +37,7 @@ config PARPORT_PC + tristate "PC-style hardware" + depends on (!SPARC64 || PCI) && !SPARC32 && !M32R && !FRV && !S390 && \ + (!M68K || ISA) && !MN10300 && !AVR32 && !BLACKFIN && \ +- !XTENSA && !CRIS && !H8300 ++ !XTENSA && !CRIS && !H8300 && !ARM64 + + ---help--- + You should say Y here if you have a PC-style parallel port. All +diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c +index 260a2551d612..c4e0f1e17663 100644 +--- a/drivers/pinctrl/core.c ++++ b/drivers/pinctrl/core.c +@@ -1107,7 +1107,7 @@ void devm_pinctrl_put(struct pinctrl *p) + EXPORT_SYMBOL_GPL(devm_pinctrl_put); + + int pinctrl_register_map(struct pinctrl_map const *maps, unsigned num_maps, +- bool dup, bool locked) ++ bool dup) + { + int i, ret; + struct pinctrl_maps *maps_node; +@@ -1175,11 +1175,9 @@ int pinctrl_register_map(struct pinctrl_map const *maps, unsigned num_maps, + maps_node->maps = maps; + } + +- if (!locked) +- mutex_lock(&pinctrl_maps_mutex); ++ mutex_lock(&pinctrl_maps_mutex); + list_add_tail(&maps_node->node, &pinctrl_maps); +- if (!locked) +- mutex_unlock(&pinctrl_maps_mutex); ++ mutex_unlock(&pinctrl_maps_mutex); + + return 0; + } +@@ -1194,7 +1192,7 @@ int pinctrl_register_map(struct pinctrl_map const *maps, unsigned num_maps, + int pinctrl_register_mappings(struct pinctrl_map const *maps, + unsigned num_maps) + { +- return pinctrl_register_map(maps, num_maps, true, false); ++ return pinctrl_register_map(maps, num_maps, true); + } + + void pinctrl_unregister_map(struct pinctrl_map const *map) +diff --git a/drivers/pinctrl/core.h b/drivers/pinctrl/core.h +index 75476b3d87da..b24ea846c867 100644 +--- a/drivers/pinctrl/core.h ++++ b/drivers/pinctrl/core.h +@@ -183,7 +183,7 @@ static inline struct pin_desc *pin_desc_get(struct pinctrl_dev *pctldev, + } + + int pinctrl_register_map(struct pinctrl_map const *maps, unsigned num_maps, +- bool dup, bool locked); ++ bool dup); + void pinctrl_unregister_map(struct pinctrl_map const *map); + + extern int pinctrl_force_sleep(struct pinctrl_dev *pctldev); +diff --git a/drivers/pinctrl/devicetree.c b/drivers/pinctrl/devicetree.c +index 340fb4e6c600..fd91c4c31f6b 100644 +--- a/drivers/pinctrl/devicetree.c ++++ b/drivers/pinctrl/devicetree.c +@@ -92,7 +92,7 @@ static int dt_remember_or_free_map(struct pinctrl *p, const char *statename, + dt_map->num_maps = num_maps; + list_add_tail(&dt_map->node, &p->dt_maps); + +- return pinctrl_register_map(map, num_maps, false, true); ++ return pinctrl_register_map(map, num_maps, false); + } + + struct pinctrl_dev *of_pinctrl_get(struct device_node *np) +diff --git a/drivers/platform/x86/compal-laptop.c b/drivers/platform/x86/compal-laptop.c +index eaa78edb1f4e..b978cd3556a4 100644 +--- a/drivers/platform/x86/compal-laptop.c ++++ b/drivers/platform/x86/compal-laptop.c +@@ -1049,7 +1049,13 @@ static int compal_probe(struct platform_device *pdev) + + /* Power supply */ + initialize_power_supply_data(data); +- power_supply_register(&compal_device->dev, &data->psy); ++ err = power_supply_register(&compal_device->dev, &data->psy); ++ if (err < 0) { ++ hwmon_device_unregister(data->hwmon_dev); ++ sysfs_remove_group(&pdev->dev.kobj, &compal_attribute_group); ++ kfree(data); ++ return err; ++ } + + platform_set_drvdata(pdev, data); + +diff --git a/drivers/power/lp8788-charger.c b/drivers/power/lp8788-charger.c +index ed49b50b220b..72da2a6c22db 100644 +--- a/drivers/power/lp8788-charger.c ++++ b/drivers/power/lp8788-charger.c +@@ -417,8 +417,10 @@ static int lp8788_psy_register(struct platform_device *pdev, + pchg->battery.num_properties = ARRAY_SIZE(lp8788_battery_prop); + pchg->battery.get_property = lp8788_battery_get_property; + +- if (power_supply_register(&pdev->dev, &pchg->battery)) ++ if (power_supply_register(&pdev->dev, &pchg->battery)) { ++ power_supply_unregister(&pchg->charger); + return -EPERM; ++ } + + return 0; + } +diff --git a/drivers/power/twl4030_madc_battery.c b/drivers/power/twl4030_madc_battery.c +index 7ef445a6cfa6..cf907609ec49 100644 +--- a/drivers/power/twl4030_madc_battery.c ++++ b/drivers/power/twl4030_madc_battery.c +@@ -192,6 +192,7 @@ static int twl4030_madc_battery_probe(struct platform_device *pdev) + { + struct twl4030_madc_battery *twl4030_madc_bat; + struct twl4030_madc_bat_platform_data *pdata = pdev->dev.platform_data; ++ int ret = 0; + + twl4030_madc_bat = kzalloc(sizeof(*twl4030_madc_bat), GFP_KERNEL); + if (!twl4030_madc_bat) +@@ -216,9 +217,11 @@ static int twl4030_madc_battery_probe(struct platform_device *pdev) + + twl4030_madc_bat->pdata = pdata; + platform_set_drvdata(pdev, twl4030_madc_bat); +- power_supply_register(&pdev->dev, &twl4030_madc_bat->psy); ++ ret = power_supply_register(&pdev->dev, &twl4030_madc_bat->psy); ++ if (ret < 0) ++ kfree(twl4030_madc_bat); + +- return 0; ++ return ret; + } + + static int twl4030_madc_battery_remove(struct platform_device *pdev) +diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c +index 0a7325361d29..5f57e3d35e26 100644 +--- a/drivers/scsi/3w-9xxx.c ++++ b/drivers/scsi/3w-9xxx.c +@@ -149,7 +149,6 @@ static int twa_reset_sequence(TW_Device_Extension *tw_dev, int soft_reset); + static int twa_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, char *cdb, int use_sg, TW_SG_Entry *sglistarg); + static void twa_scsiop_execute_scsi_complete(TW_Device_Extension *tw_dev, int request_id); + static char *twa_string_lookup(twa_message_type *table, unsigned int aen_code); +-static void twa_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id); + + /* Functions */ + +@@ -1352,11 +1351,11 @@ static irqreturn_t twa_interrupt(int irq, void *dev_instance) + } + + /* Now complete the io */ ++ scsi_dma_unmap(cmd); ++ cmd->scsi_done(cmd); + tw_dev->state[request_id] = TW_S_COMPLETED; + twa_free_request_id(tw_dev, request_id); + tw_dev->posted_request_count--; +- tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]); +- twa_unmap_scsi_data(tw_dev, request_id); + } + + /* Check for valid status after each drain */ +@@ -1414,26 +1413,6 @@ static void twa_load_sgl(TW_Device_Extension *tw_dev, TW_Command_Full *full_comm + } + } /* End twa_load_sgl() */ + +-/* This function will perform a pci-dma mapping for a scatter gather list */ +-static int twa_map_scsi_sg_data(TW_Device_Extension *tw_dev, int request_id) +-{ +- int use_sg; +- struct scsi_cmnd *cmd = tw_dev->srb[request_id]; +- +- use_sg = scsi_dma_map(cmd); +- if (!use_sg) +- return 0; +- else if (use_sg < 0) { +- TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1c, "Failed to map scatter gather list"); +- return 0; +- } +- +- cmd->SCp.phase = TW_PHASE_SGLIST; +- cmd->SCp.have_data_in = use_sg; +- +- return use_sg; +-} /* End twa_map_scsi_sg_data() */ +- + /* This function will poll for a response interrupt of a request */ + static int twa_poll_response(TW_Device_Extension *tw_dev, int request_id, int seconds) + { +@@ -1612,9 +1591,11 @@ static int twa_reset_device_extension(TW_Device_Extension *tw_dev) + (tw_dev->state[i] != TW_S_INITIAL) && + (tw_dev->state[i] != TW_S_COMPLETED)) { + if (tw_dev->srb[i]) { +- tw_dev->srb[i]->result = (DID_RESET << 16); +- tw_dev->srb[i]->scsi_done(tw_dev->srb[i]); +- twa_unmap_scsi_data(tw_dev, i); ++ struct scsi_cmnd *cmd = tw_dev->srb[i]; ++ ++ cmd->result = (DID_RESET << 16); ++ scsi_dma_unmap(cmd); ++ cmd->scsi_done(cmd); + } + } + } +@@ -1793,21 +1774,18 @@ static int twa_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_ + /* Save the scsi command for use by the ISR */ + tw_dev->srb[request_id] = SCpnt; + +- /* Initialize phase to zero */ +- SCpnt->SCp.phase = TW_PHASE_INITIAL; +- + retval = twa_scsiop_execute_scsi(tw_dev, request_id, NULL, 0, NULL); + switch (retval) { + case SCSI_MLQUEUE_HOST_BUSY: ++ scsi_dma_unmap(SCpnt); + twa_free_request_id(tw_dev, request_id); +- twa_unmap_scsi_data(tw_dev, request_id); + break; + case 1: +- tw_dev->state[request_id] = TW_S_COMPLETED; +- twa_free_request_id(tw_dev, request_id); +- twa_unmap_scsi_data(tw_dev, request_id); + SCpnt->result = (DID_ERROR << 16); ++ scsi_dma_unmap(SCpnt); + done(SCpnt); ++ tw_dev->state[request_id] = TW_S_COMPLETED; ++ twa_free_request_id(tw_dev, request_id); + retval = 0; + } + out: +@@ -1875,8 +1853,8 @@ static int twa_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, + command_packet->sg_list[0].address = TW_CPU_TO_SGL(tw_dev->generic_buffer_phys[request_id]); + command_packet->sg_list[0].length = cpu_to_le32(TW_MIN_SGL_LENGTH); + } else { +- sg_count = twa_map_scsi_sg_data(tw_dev, request_id); +- if (sg_count == 0) ++ sg_count = scsi_dma_map(srb); ++ if (sg_count < 0) + goto out; + + scsi_for_each_sg(srb, sg, sg_count, i) { +@@ -1991,15 +1969,6 @@ static char *twa_string_lookup(twa_message_type *table, unsigned int code) + return(table[index].text); + } /* End twa_string_lookup() */ + +-/* This function will perform a pci-dma unmap */ +-static void twa_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id) +-{ +- struct scsi_cmnd *cmd = tw_dev->srb[request_id]; +- +- if (cmd->SCp.phase == TW_PHASE_SGLIST) +- scsi_dma_unmap(cmd); +-} /* End twa_unmap_scsi_data() */ +- + /* This function gets called when a disk is coming on-line */ + static int twa_slave_configure(struct scsi_device *sdev) + { +diff --git a/drivers/scsi/3w-9xxx.h b/drivers/scsi/3w-9xxx.h +index 040f7214e5b7..0fdc83cfa0e1 100644 +--- a/drivers/scsi/3w-9xxx.h ++++ b/drivers/scsi/3w-9xxx.h +@@ -324,11 +324,6 @@ static twa_message_type twa_error_table[] = { + #define TW_CURRENT_DRIVER_BUILD 0 + #define TW_CURRENT_DRIVER_BRANCH 0 + +-/* Phase defines */ +-#define TW_PHASE_INITIAL 0 +-#define TW_PHASE_SINGLE 1 +-#define TW_PHASE_SGLIST 2 +- + /* Misc defines */ + #define TW_9550SX_DRAIN_COMPLETED 0xFFFF + #define TW_SECTOR_SIZE 512 +diff --git a/drivers/scsi/3w-sas.c b/drivers/scsi/3w-sas.c +index 4de346017e9f..61702ac00d42 100644 +--- a/drivers/scsi/3w-sas.c ++++ b/drivers/scsi/3w-sas.c +@@ -303,26 +303,6 @@ static int twl_post_command_packet(TW_Device_Extension *tw_dev, int request_id) + return 0; + } /* End twl_post_command_packet() */ + +-/* This function will perform a pci-dma mapping for a scatter gather list */ +-static int twl_map_scsi_sg_data(TW_Device_Extension *tw_dev, int request_id) +-{ +- int use_sg; +- struct scsi_cmnd *cmd = tw_dev->srb[request_id]; +- +- use_sg = scsi_dma_map(cmd); +- if (!use_sg) +- return 0; +- else if (use_sg < 0) { +- TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1, "Failed to map scatter gather list"); +- return 0; +- } +- +- cmd->SCp.phase = TW_PHASE_SGLIST; +- cmd->SCp.have_data_in = use_sg; +- +- return use_sg; +-} /* End twl_map_scsi_sg_data() */ +- + /* This function hands scsi cdb's to the firmware */ + static int twl_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, char *cdb, int use_sg, TW_SG_Entry_ISO *sglistarg) + { +@@ -370,8 +350,8 @@ static int twl_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, + if (!sglistarg) { + /* Map sglist from scsi layer to cmd packet */ + if (scsi_sg_count(srb)) { +- sg_count = twl_map_scsi_sg_data(tw_dev, request_id); +- if (sg_count == 0) ++ sg_count = scsi_dma_map(srb); ++ if (sg_count <= 0) + goto out; + + scsi_for_each_sg(srb, sg, sg_count, i) { +@@ -1116,15 +1096,6 @@ out: + return retval; + } /* End twl_initialize_device_extension() */ + +-/* This function will perform a pci-dma unmap */ +-static void twl_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id) +-{ +- struct scsi_cmnd *cmd = tw_dev->srb[request_id]; +- +- if (cmd->SCp.phase == TW_PHASE_SGLIST) +- scsi_dma_unmap(cmd); +-} /* End twl_unmap_scsi_data() */ +- + /* This function will handle attention interrupts */ + static int twl_handle_attention_interrupt(TW_Device_Extension *tw_dev) + { +@@ -1265,11 +1236,11 @@ static irqreturn_t twl_interrupt(int irq, void *dev_instance) + } + + /* Now complete the io */ ++ scsi_dma_unmap(cmd); ++ cmd->scsi_done(cmd); + tw_dev->state[request_id] = TW_S_COMPLETED; + twl_free_request_id(tw_dev, request_id); + tw_dev->posted_request_count--; +- tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]); +- twl_unmap_scsi_data(tw_dev, request_id); + } + + /* Check for another response interrupt */ +@@ -1414,10 +1385,12 @@ static int twl_reset_device_extension(TW_Device_Extension *tw_dev, int ioctl_res + if ((tw_dev->state[i] != TW_S_FINISHED) && + (tw_dev->state[i] != TW_S_INITIAL) && + (tw_dev->state[i] != TW_S_COMPLETED)) { +- if (tw_dev->srb[i]) { +- tw_dev->srb[i]->result = (DID_RESET << 16); +- tw_dev->srb[i]->scsi_done(tw_dev->srb[i]); +- twl_unmap_scsi_data(tw_dev, i); ++ struct scsi_cmnd *cmd = tw_dev->srb[i]; ++ ++ if (cmd) { ++ cmd->result = (DID_RESET << 16); ++ scsi_dma_unmap(cmd); ++ cmd->scsi_done(cmd); + } + } + } +@@ -1521,9 +1494,6 @@ static int twl_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_ + /* Save the scsi command for use by the ISR */ + tw_dev->srb[request_id] = SCpnt; + +- /* Initialize phase to zero */ +- SCpnt->SCp.phase = TW_PHASE_INITIAL; +- + retval = twl_scsiop_execute_scsi(tw_dev, request_id, NULL, 0, NULL); + if (retval) { + tw_dev->state[request_id] = TW_S_COMPLETED; +diff --git a/drivers/scsi/3w-sas.h b/drivers/scsi/3w-sas.h +index d474892701d4..fec6449c7595 100644 +--- a/drivers/scsi/3w-sas.h ++++ b/drivers/scsi/3w-sas.h +@@ -103,10 +103,6 @@ static char *twl_aen_severity_table[] = + #define TW_CURRENT_DRIVER_BUILD 0 + #define TW_CURRENT_DRIVER_BRANCH 0 + +-/* Phase defines */ +-#define TW_PHASE_INITIAL 0 +-#define TW_PHASE_SGLIST 2 +- + /* Misc defines */ + #define TW_SECTOR_SIZE 512 + #define TW_MAX_UNITS 32 +diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c +index 752624e6bc00..b327742b95ef 100644 +--- a/drivers/scsi/3w-xxxx.c ++++ b/drivers/scsi/3w-xxxx.c +@@ -1284,32 +1284,6 @@ static int tw_initialize_device_extension(TW_Device_Extension *tw_dev) + return 0; + } /* End tw_initialize_device_extension() */ + +-static int tw_map_scsi_sg_data(struct pci_dev *pdev, struct scsi_cmnd *cmd) +-{ +- int use_sg; +- +- dprintk(KERN_WARNING "3w-xxxx: tw_map_scsi_sg_data()\n"); +- +- use_sg = scsi_dma_map(cmd); +- if (use_sg < 0) { +- printk(KERN_WARNING "3w-xxxx: tw_map_scsi_sg_data(): pci_map_sg() failed.\n"); +- return 0; +- } +- +- cmd->SCp.phase = TW_PHASE_SGLIST; +- cmd->SCp.have_data_in = use_sg; +- +- return use_sg; +-} /* End tw_map_scsi_sg_data() */ +- +-static void tw_unmap_scsi_data(struct pci_dev *pdev, struct scsi_cmnd *cmd) +-{ +- dprintk(KERN_WARNING "3w-xxxx: tw_unmap_scsi_data()\n"); +- +- if (cmd->SCp.phase == TW_PHASE_SGLIST) +- scsi_dma_unmap(cmd); +-} /* End tw_unmap_scsi_data() */ +- + /* This function will reset a device extension */ + static int tw_reset_device_extension(TW_Device_Extension *tw_dev) + { +@@ -1332,8 +1306,8 @@ static int tw_reset_device_extension(TW_Device_Extension *tw_dev) + srb = tw_dev->srb[i]; + if (srb != NULL) { + srb->result = (DID_RESET << 16); +- tw_dev->srb[i]->scsi_done(tw_dev->srb[i]); +- tw_unmap_scsi_data(tw_dev->tw_pci_dev, tw_dev->srb[i]); ++ scsi_dma_unmap(srb); ++ srb->scsi_done(srb); + } + } + } +@@ -1780,8 +1754,8 @@ static int tw_scsiop_read_write(TW_Device_Extension *tw_dev, int request_id) + command_packet->byte8.io.lba = lba; + command_packet->byte6.block_count = num_sectors; + +- use_sg = tw_map_scsi_sg_data(tw_dev->tw_pci_dev, tw_dev->srb[request_id]); +- if (!use_sg) ++ use_sg = scsi_dma_map(srb); ++ if (use_sg <= 0) + return 1; + + scsi_for_each_sg(tw_dev->srb[request_id], sg, use_sg, i) { +@@ -1968,9 +1942,6 @@ static int tw_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_c + /* Save the scsi command for use by the ISR */ + tw_dev->srb[request_id] = SCpnt; + +- /* Initialize phase to zero */ +- SCpnt->SCp.phase = TW_PHASE_INITIAL; +- + switch (*command) { + case READ_10: + case READ_6: +@@ -2198,12 +2169,11 @@ static irqreturn_t tw_interrupt(int irq, void *dev_instance) + + /* Now complete the io */ + if ((error != TW_ISR_DONT_COMPLETE)) { ++ scsi_dma_unmap(tw_dev->srb[request_id]); ++ tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]); + tw_dev->state[request_id] = TW_S_COMPLETED; + tw_state_request_finish(tw_dev, request_id); + tw_dev->posted_request_count--; +- tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]); +- +- tw_unmap_scsi_data(tw_dev->tw_pci_dev, tw_dev->srb[request_id]); + } + } + +diff --git a/drivers/scsi/3w-xxxx.h b/drivers/scsi/3w-xxxx.h +index 49dcf03c631a..1d31858766ce 100644 +--- a/drivers/scsi/3w-xxxx.h ++++ b/drivers/scsi/3w-xxxx.h +@@ -195,11 +195,6 @@ static unsigned char tw_sense_table[][4] = + #define TW_AEN_SMART_FAIL 0x000F + #define TW_AEN_SBUF_FAIL 0x0024 + +-/* Phase defines */ +-#define TW_PHASE_INITIAL 0 +-#define TW_PHASE_SINGLE 1 +-#define TW_PHASE_SGLIST 2 +- + /* Misc defines */ + #define TW_ALIGNMENT_6000 64 /* 64 bytes */ + #define TW_ALIGNMENT_7000 4 /* 4 bytes */ +diff --git a/drivers/scsi/mvsas/mv_sas.c b/drivers/scsi/mvsas/mv_sas.c +index 6b1b4e91e53f..1aa2a8cbb4df 100644 +--- a/drivers/scsi/mvsas/mv_sas.c ++++ b/drivers/scsi/mvsas/mv_sas.c +@@ -441,14 +441,11 @@ static u32 mvs_get_ncq_tag(struct sas_task *task, u32 *tag) + static int mvs_task_prep_ata(struct mvs_info *mvi, + struct mvs_task_exec_info *tei) + { +- struct sas_ha_struct *sha = mvi->sas; + struct sas_task *task = tei->task; + struct domain_device *dev = task->dev; + struct mvs_device *mvi_dev = dev->lldd_dev; + struct mvs_cmd_hdr *hdr = tei->hdr; + struct asd_sas_port *sas_port = dev->port; +- struct sas_phy *sphy = dev->phy; +- struct asd_sas_phy *sas_phy = sha->sas_phy[sphy->number]; + struct mvs_slot_info *slot; + void *buf_prd; + u32 tag = tei->tag, hdr_tag; +@@ -468,7 +465,7 @@ static int mvs_task_prep_ata(struct mvs_info *mvi, + slot->tx = mvi->tx_prod; + del_q = TXQ_MODE_I | tag | + (TXQ_CMD_STP << TXQ_CMD_SHIFT) | +- (MVS_PHY_ID << TXQ_PHY_SHIFT) | ++ ((sas_port->phy_mask & TXQ_PHY_MASK) << TXQ_PHY_SHIFT) | + (mvi_dev->taskfileset << TXQ_SRS_SHIFT); + mvi->tx[mvi->tx_prod] = cpu_to_le32(del_q); + +diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c +index 86b05151fdab..97892f258043 100644 +--- a/drivers/scsi/storvsc_drv.c ++++ b/drivers/scsi/storvsc_drv.c +@@ -739,21 +739,22 @@ static unsigned int copy_to_bounce_buffer(struct scatterlist *orig_sgl, + if (bounce_sgl[j].length == PAGE_SIZE) { + /* full..move to next entry */ + sg_kunmap_atomic(bounce_addr); ++ bounce_addr = 0; + j++; ++ } + +- /* if we need to use another bounce buffer */ +- if (srclen || i != orig_sgl_count - 1) +- bounce_addr = sg_kmap_atomic(bounce_sgl,j); ++ /* if we need to use another bounce buffer */ ++ if (srclen && bounce_addr == 0) ++ bounce_addr = sg_kmap_atomic(bounce_sgl, j); + +- } else if (srclen == 0 && i == orig_sgl_count - 1) { +- /* unmap the last bounce that is < PAGE_SIZE */ +- sg_kunmap_atomic(bounce_addr); +- } + } + + sg_kunmap_atomic(src_addr - orig_sgl[i].offset); + } + ++ if (bounce_addr) ++ sg_kunmap_atomic(bounce_addr); ++ + local_irq_restore(flags); + + return total_copied; +diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c +index ca5bcfe874d0..2466632c2c01 100644 +--- a/drivers/spi/spidev.c ++++ b/drivers/spi/spidev.c +@@ -243,7 +243,10 @@ static int spidev_message(struct spidev_data *spidev, + k_tmp->len = u_tmp->len; + + total += k_tmp->len; +- if (total > bufsiz) { ++ /* Check total length of transfers. Also check each ++ * transfer length to avoid arithmetic overflow. ++ */ ++ if (total > bufsiz || k_tmp->len > bufsiz) { + status = -EMSGSIZE; + goto done; + } +diff --git a/drivers/staging/dwc2/hcd.c b/drivers/staging/dwc2/hcd.c +index da0d35cc33ce..690e468e9a85 100644 +--- a/drivers/staging/dwc2/hcd.c ++++ b/drivers/staging/dwc2/hcd.c +@@ -1462,7 +1462,7 @@ static int dwc2_hcd_hub_control(struct dwc2_hsotg *hsotg, u16 typereq, + dev_dbg(hsotg->dev, + "ClearPortFeature USB_PORT_FEAT_SUSPEND\n"); + writel(0, hsotg->regs + PCGCTL); +- usleep_range(20000, 40000); ++ msleep(USB_RESUME_TIMEOUT); + + hprt0 = dwc2_read_hprt0(hsotg); + hprt0 |= HPRT0_RES; +diff --git a/drivers/staging/panel/panel.c b/drivers/staging/panel/panel.c +index cbc15c120981..04758f9328d3 100644 +--- a/drivers/staging/panel/panel.c ++++ b/drivers/staging/panel/panel.c +@@ -275,11 +275,11 @@ static unsigned char lcd_bits[LCD_PORTS][LCD_BITS][BIT_STATES]; + * LCD types + */ + #define LCD_TYPE_NONE 0 +-#define LCD_TYPE_OLD 1 +-#define LCD_TYPE_KS0074 2 +-#define LCD_TYPE_HANTRONIX 3 +-#define LCD_TYPE_NEXCOM 4 +-#define LCD_TYPE_CUSTOM 5 ++#define LCD_TYPE_CUSTOM 1 ++#define LCD_TYPE_OLD 2 ++#define LCD_TYPE_KS0074 3 ++#define LCD_TYPE_HANTRONIX 4 ++#define LCD_TYPE_NEXCOM 5 + + /* + * keypad types +@@ -457,8 +457,7 @@ MODULE_PARM_DESC(keypad_enabled, "Deprecated option, use keypad_type instead"); + static int lcd_type = -1; + module_param(lcd_type, int, 0000); + MODULE_PARM_DESC(lcd_type, +- "LCD type: 0=none, 1=old //, 2=serial ks0074, " +- "3=hantronix //, 4=nexcom //, 5=compiled-in"); ++ "LCD type: 0=none, 1=compiled-in, 2=old, 3=serial ks0074, 4=hantronix, 5=nexcom"); + + static int lcd_proto = -1; + module_param(lcd_proto, int, 0000); +diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c +index 63d56cda2b96..75f126538a72 100644 +--- a/drivers/target/target_core_sbc.c ++++ b/drivers/target/target_core_sbc.c +@@ -298,7 +298,7 @@ sbc_setup_write_same(struct se_cmd *cmd, unsigned char *flags, struct sbc_ops *o + return 0; + } + +-static sense_reason_t xdreadwrite_callback(struct se_cmd *cmd) ++static sense_reason_t xdreadwrite_callback(struct se_cmd *cmd, bool success) + { + unsigned char *buf, *addr; + struct scatterlist *sg; +@@ -362,7 +362,7 @@ sbc_execute_rw(struct se_cmd *cmd) + cmd->data_direction); + } + +-static sense_reason_t compare_and_write_post(struct se_cmd *cmd) ++static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success) + { + struct se_device *dev = cmd->se_dev; + +@@ -385,7 +385,7 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd) + return TCM_NO_SENSE; + } + +-static sense_reason_t compare_and_write_callback(struct se_cmd *cmd) ++static sense_reason_t compare_and_write_callback(struct se_cmd *cmd, bool success) + { + struct se_device *dev = cmd->se_dev; + struct scatterlist *write_sg = NULL, *sg; +@@ -400,11 +400,16 @@ static sense_reason_t compare_and_write_callback(struct se_cmd *cmd) + + /* + * Handle early failure in transport_generic_request_failure(), +- * which will not have taken ->caw_mutex yet.. ++ * which will not have taken ->caw_sem yet.. + */ +- if (!cmd->t_data_sg || !cmd->t_bidi_data_sg) ++ if (!success && (!cmd->t_data_sg || !cmd->t_bidi_data_sg)) + return TCM_NO_SENSE; + /* ++ * Handle special case for zero-length COMPARE_AND_WRITE ++ */ ++ if (!cmd->data_length) ++ goto out; ++ /* + * Immediately exit + release dev->caw_sem if command has already + * been failed with a non-zero SCSI status. + */ +diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c +index 65ecaa1c59a7..b52bf3cad494 100644 +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -1589,11 +1589,11 @@ void transport_generic_request_failure(struct se_cmd *cmd, + transport_complete_task_attr(cmd); + /* + * Handle special case for COMPARE_AND_WRITE failure, where the +- * callback is expected to drop the per device ->caw_mutex. ++ * callback is expected to drop the per device ->caw_sem. + */ + if ((cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE) && + cmd->transport_complete_callback) +- cmd->transport_complete_callback(cmd); ++ cmd->transport_complete_callback(cmd, false); + + switch (sense_reason) { + case TCM_NON_EXISTENT_LUN: +@@ -1942,8 +1942,12 @@ static void target_complete_ok_work(struct work_struct *work) + if (cmd->transport_complete_callback) { + sense_reason_t rc; + +- rc = cmd->transport_complete_callback(cmd); ++ rc = cmd->transport_complete_callback(cmd, true); + if (!rc && !(cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE_POST)) { ++ if ((cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE) && ++ !cmd->data_length) ++ goto queue_rsp; ++ + return; + } else if (rc) { + ret = transport_send_check_condition_and_sense(cmd, +@@ -1957,6 +1961,7 @@ static void target_complete_ok_work(struct work_struct *work) + } + } + ++queue_rsp: + switch (cmd->data_direction) { + case DMA_FROM_DEVICE: + spin_lock(&cmd->se_lun->lun_sep_lock); +@@ -2045,6 +2050,16 @@ static inline void transport_reset_sgl_orig(struct se_cmd *cmd) + static inline void transport_free_pages(struct se_cmd *cmd) + { + if (cmd->se_cmd_flags & SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC) { ++ /* ++ * Release special case READ buffer payload required for ++ * SG_TO_MEM_NOALLOC to function with COMPARE_AND_WRITE ++ */ ++ if (cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE) { ++ transport_free_sgl(cmd->t_bidi_data_sg, ++ cmd->t_bidi_data_nents); ++ cmd->t_bidi_data_sg = NULL; ++ cmd->t_bidi_data_nents = 0; ++ } + transport_reset_sgl_orig(cmd); + return; + } +@@ -2193,6 +2208,7 @@ sense_reason_t + transport_generic_new_cmd(struct se_cmd *cmd) + { + int ret = 0; ++ bool zero_flag = !(cmd->se_cmd_flags & SCF_SCSI_DATA_CDB); + + /* + * Determine is the TCM fabric module has already allocated physical +@@ -2201,7 +2217,6 @@ transport_generic_new_cmd(struct se_cmd *cmd) + */ + if (!(cmd->se_cmd_flags & SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC) && + cmd->data_length) { +- bool zero_flag = !(cmd->se_cmd_flags & SCF_SCSI_DATA_CDB); + + if ((cmd->se_cmd_flags & SCF_BIDI) || + (cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE)) { +@@ -2224,6 +2239,20 @@ transport_generic_new_cmd(struct se_cmd *cmd) + cmd->data_length, zero_flag); + if (ret < 0) + return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE; ++ } else if ((cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE) && ++ cmd->data_length) { ++ /* ++ * Special case for COMPARE_AND_WRITE with fabrics ++ * using SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC. ++ */ ++ u32 caw_length = cmd->t_task_nolb * ++ cmd->se_dev->dev_attrib.block_size; ++ ++ ret = target_alloc_sgl(&cmd->t_bidi_data_sg, ++ &cmd->t_bidi_data_nents, ++ caw_length, zero_flag); ++ if (ret < 0) ++ return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE; + } + /* + * If this command is not a write we can execute it right here, +diff --git a/drivers/tty/hvc/hvc_xen.c b/drivers/tty/hvc/hvc_xen.c +index c193af6a628f..b4805adc50af 100644 +--- a/drivers/tty/hvc/hvc_xen.c ++++ b/drivers/tty/hvc/hvc_xen.c +@@ -299,11 +299,27 @@ static int xen_initial_domain_console_init(void) + return 0; + } + ++static void xen_console_update_evtchn(struct xencons_info *info) ++{ ++ if (xen_hvm_domain()) { ++ uint64_t v; ++ int err; ++ ++ err = hvm_get_parameter(HVM_PARAM_CONSOLE_EVTCHN, &v); ++ if (!err && v) ++ info->evtchn = v; ++ } else ++ info->evtchn = xen_start_info->console.domU.evtchn; ++} ++ + void xen_console_resume(void) + { + struct xencons_info *info = vtermno_to_xencons(HVC_COOKIE); +- if (info != NULL && info->irq) ++ if (info != NULL && info->irq) { ++ if (!xen_initial_domain()) ++ xen_console_update_evtchn(info); + rebind_evtchn_irq(info->evtchn, info->irq); ++ } + } + + static void xencons_disconnect_backend(struct xencons_info *info) +diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c +index ebdc00f184a1..ab2e22bf54fd 100644 +--- a/drivers/tty/serial/atmel_serial.c ++++ b/drivers/tty/serial/atmel_serial.c +@@ -756,6 +756,7 @@ static int atmel_prepare_tx_dma(struct uart_port *port) + config.direction = DMA_MEM_TO_DEV; + config.dst_addr_width = DMA_SLAVE_BUSWIDTH_1_BYTE; + config.dst_addr = port->mapbase + ATMEL_US_THR; ++ config.dst_maxburst = 1; + + ret = dmaengine_device_control(atmel_port->chan_tx, + DMA_SLAVE_CONFIG, +@@ -920,6 +921,7 @@ static int atmel_prepare_rx_dma(struct uart_port *port) + config.direction = DMA_DEV_TO_MEM; + config.src_addr_width = DMA_SLAVE_BUSWIDTH_1_BYTE; + config.src_addr = port->mapbase + ATMEL_US_RHR; ++ config.src_maxburst = 1; + + ret = dmaengine_device_control(atmel_port->chan_rx, + DMA_SLAVE_CONFIG, +diff --git a/drivers/tty/serial/of_serial.c b/drivers/tty/serial/of_serial.c +index 2caf9c6f6149..d666517288aa 100644 +--- a/drivers/tty/serial/of_serial.c ++++ b/drivers/tty/serial/of_serial.c +@@ -262,7 +262,6 @@ static struct of_device_id of_platform_serial_table[] = { + { .compatible = "ibm,qpace-nwp-serial", + .data = (void *)PORT_NWPSERIAL, }, + #endif +- { .type = "serial", .data = (void *)PORT_UNKNOWN, }, + { /* end of list */ }, + }; + +diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c +index 6463ca3bcfba..07133d0c971b 100644 +--- a/drivers/usb/class/cdc-wdm.c ++++ b/drivers/usb/class/cdc-wdm.c +@@ -244,7 +244,7 @@ static void wdm_int_callback(struct urb *urb) + case USB_CDC_NOTIFY_RESPONSE_AVAILABLE: + dev_dbg(&desc->intf->dev, + "NOTIFY_RESPONSE_AVAILABLE received: index %d len %d", +- dr->wIndex, dr->wLength); ++ le16_to_cpu(dr->wIndex), le16_to_cpu(dr->wLength)); + break; + + case USB_CDC_NOTIFY_NETWORK_CONNECTION: +@@ -257,7 +257,9 @@ static void wdm_int_callback(struct urb *urb) + clear_bit(WDM_POLL_RUNNING, &desc->flags); + dev_err(&desc->intf->dev, + "unknown notification %d received: index %d len %d\n", +- dr->bNotificationType, dr->wIndex, dr->wLength); ++ dr->bNotificationType, ++ le16_to_cpu(dr->wIndex), ++ le16_to_cpu(dr->wLength)); + goto exit; + } + +@@ -403,7 +405,7 @@ static ssize_t wdm_write + USB_RECIP_INTERFACE); + req->bRequest = USB_CDC_SEND_ENCAPSULATED_COMMAND; + req->wValue = 0; +- req->wIndex = desc->inum; ++ req->wIndex = desc->inum; /* already converted */ + req->wLength = cpu_to_le16(count); + set_bit(WDM_IN_USE, &desc->flags); + desc->outbuf = buf; +@@ -417,7 +419,7 @@ static ssize_t wdm_write + rv = usb_translate_errors(rv); + } else { + dev_dbg(&desc->intf->dev, "Tx URB has been submitted index=%d", +- req->wIndex); ++ le16_to_cpu(req->wIndex)); + } + out: + usb_autopm_put_interface(desc->intf); +@@ -780,7 +782,7 @@ static int wdm_create(struct usb_interface *intf, struct usb_endpoint_descriptor + desc->irq->bRequestType = (USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE); + desc->irq->bRequest = USB_CDC_GET_ENCAPSULATED_RESPONSE; + desc->irq->wValue = 0; +- desc->irq->wIndex = desc->inum; ++ desc->irq->wIndex = desc->inum; /* already converted */ + desc->irq->wLength = cpu_to_le16(desc->wMaxCommand); + + usb_fill_control_urb( +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index 420bf9bb09e5..78141993dfd0 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -3284,10 +3284,10 @@ int usb_port_resume(struct usb_device *udev, pm_message_t msg) + dev_dbg(hub->intfdev, "can't resume port %d, status %d\n", + port1, status); + } else { +- /* drive resume for at least 20 msec */ ++ /* drive resume for USB_RESUME_TIMEOUT msec */ + dev_dbg(&udev->dev, "usb %sresume\n", + (PMSG_IS_AUTO(msg) ? "auto-" : "")); +- msleep(25); ++ msleep(USB_RESUME_TIMEOUT); + + /* Virtual root hubs can trigger on GET_PORT_STATUS to + * stop resume signaling. Then finish the resume +diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c +index 7c0adb9812aa..a0b5a13b52b0 100644 +--- a/drivers/usb/gadget/composite.c ++++ b/drivers/usb/gadget/composite.c +@@ -528,7 +528,7 @@ static int bos_desc(struct usb_composite_dev *cdev) + usb_ext->bLength = USB_DT_USB_EXT_CAP_SIZE; + usb_ext->bDescriptorType = USB_DT_DEVICE_CAPABILITY; + usb_ext->bDevCapabilityType = USB_CAP_TYPE_EXT; +- usb_ext->bmAttributes = cpu_to_le32(USB_LPM_SUPPORT); ++ usb_ext->bmAttributes = cpu_to_le32(USB_LPM_SUPPORT | USB_BESL_SUPPORT); + + /* + * The Superspeed USB Capability descriptor shall be implemented by all +diff --git a/drivers/usb/gadget/printer.c b/drivers/usb/gadget/printer.c +index bf7a56b6d48a..a0dfdbddbf08 100644 +--- a/drivers/usb/gadget/printer.c ++++ b/drivers/usb/gadget/printer.c +@@ -975,6 +975,15 @@ unknown: + break; + } + /* host either stalls (value < 0) or reports success */ ++ if (value >= 0) { ++ req->length = value; ++ req->zero = value < wLength; ++ value = usb_ep_queue(cdev->gadget->ep0, req, GFP_ATOMIC); ++ if (value < 0) { ++ ERROR(dev, "%s:%d Error!\n", __func__, __LINE__); ++ req->status = 0; ++ } ++ } + return value; + } + +diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c +index 51b1f4e18c0d..9b27c65c7bb6 100644 +--- a/drivers/usb/host/ehci-hcd.c ++++ b/drivers/usb/host/ehci-hcd.c +@@ -791,12 +791,12 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd) + ehci->reset_done[i] == 0)) + continue; + +- /* start 20 msec resume signaling from this port, +- * and make khubd collect PORT_STAT_C_SUSPEND to +- * stop that signaling. Use 5 ms extra for safety, +- * like usb_port_resume() does. ++ /* start USB_RESUME_TIMEOUT msec resume signaling from ++ * this port, and make hub_wq collect ++ * PORT_STAT_C_SUSPEND to stop that signaling. + */ +- ehci->reset_done[i] = jiffies + msecs_to_jiffies(25); ++ ehci->reset_done[i] = jiffies + ++ msecs_to_jiffies(USB_RESUME_TIMEOUT); + set_bit(i, &ehci->resuming_ports); + ehci_dbg (ehci, "port %d remote wakeup\n", i + 1); + usb_hcd_start_port_resume(&hcd->self, i); +diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c +index 7ba861543d03..68a06b2f505a 100644 +--- a/drivers/usb/host/ehci-hub.c ++++ b/drivers/usb/host/ehci-hub.c +@@ -482,10 +482,13 @@ static int ehci_bus_resume (struct usb_hcd *hcd) + ehci_writel(ehci, temp, &ehci->regs->port_status [i]); + } + +- /* msleep for 20ms only if code is trying to resume port */ ++ /* ++ * msleep for USB_RESUME_TIMEOUT ms only if code is trying to resume ++ * port ++ */ + if (resume_needed) { + spin_unlock_irq(&ehci->lock); +- msleep(20); ++ msleep(USB_RESUME_TIMEOUT); + spin_lock_irq(&ehci->lock); + if (ehci->shutdown) + goto shutdown; +@@ -953,7 +956,7 @@ static int ehci_hub_control ( + temp &= ~PORT_WAKE_BITS; + ehci_writel(ehci, temp | PORT_RESUME, status_reg); + ehci->reset_done[wIndex] = jiffies +- + msecs_to_jiffies(20); ++ + msecs_to_jiffies(USB_RESUME_TIMEOUT); + set_bit(wIndex, &ehci->resuming_ports); + usb_hcd_start_port_resume(&hcd->self, wIndex); + break; +diff --git a/drivers/usb/host/fotg210-hcd.c b/drivers/usb/host/fotg210-hcd.c +index fce13bcc4a3e..be85c69ad49e 100644 +--- a/drivers/usb/host/fotg210-hcd.c ++++ b/drivers/usb/host/fotg210-hcd.c +@@ -1651,7 +1651,7 @@ static int fotg210_hub_control( + /* resume signaling for 20 msec */ + fotg210_writel(fotg210, temp | PORT_RESUME, status_reg); + fotg210->reset_done[wIndex] = jiffies +- + msecs_to_jiffies(20); ++ + msecs_to_jiffies(USB_RESUME_TIMEOUT); + break; + case USB_PORT_FEAT_C_SUSPEND: + clear_bit(wIndex, &fotg210->port_c_suspend); +diff --git a/drivers/usb/host/fusbh200-hcd.c b/drivers/usb/host/fusbh200-hcd.c +index 299253c826c7..0def3ed72013 100644 +--- a/drivers/usb/host/fusbh200-hcd.c ++++ b/drivers/usb/host/fusbh200-hcd.c +@@ -1610,10 +1610,9 @@ static int fusbh200_hub_control ( + if ((temp & PORT_PE) == 0) + goto error; + +- /* resume signaling for 20 msec */ + fusbh200_writel(fusbh200, temp | PORT_RESUME, status_reg); + fusbh200->reset_done[wIndex] = jiffies +- + msecs_to_jiffies(20); ++ + msecs_to_jiffies(USB_RESUME_TIMEOUT); + break; + case USB_PORT_FEAT_C_SUSPEND: + clear_bit(wIndex, &fusbh200->port_c_suspend); +diff --git a/drivers/usb/host/isp116x-hcd.c b/drivers/usb/host/isp116x-hcd.c +index c7d0f8f231be..200d33fc4a46 100644 +--- a/drivers/usb/host/isp116x-hcd.c ++++ b/drivers/usb/host/isp116x-hcd.c +@@ -1488,7 +1488,7 @@ static int isp116x_bus_resume(struct usb_hcd *hcd) + spin_unlock_irq(&isp116x->lock); + + hcd->state = HC_STATE_RESUMING; +- msleep(20); ++ msleep(USB_RESUME_TIMEOUT); + + /* Go operational */ + spin_lock_irq(&isp116x->lock); +diff --git a/drivers/usb/host/oxu210hp-hcd.c b/drivers/usb/host/oxu210hp-hcd.c +index 4a6df2d8f902..8fb603f33729 100644 +--- a/drivers/usb/host/oxu210hp-hcd.c ++++ b/drivers/usb/host/oxu210hp-hcd.c +@@ -2497,11 +2497,12 @@ static irqreturn_t oxu210_hcd_irq(struct usb_hcd *hcd) + || oxu->reset_done[i] != 0) + continue; + +- /* start 20 msec resume signaling from this port, +- * and make khubd collect PORT_STAT_C_SUSPEND to ++ /* start USB_RESUME_TIMEOUT resume signaling from this ++ * port, and make hub_wq collect PORT_STAT_C_SUSPEND to + * stop that signaling. + */ +- oxu->reset_done[i] = jiffies + msecs_to_jiffies(20); ++ oxu->reset_done[i] = jiffies + ++ msecs_to_jiffies(USB_RESUME_TIMEOUT); + oxu_dbg(oxu, "port %d remote wakeup\n", i + 1); + mod_timer(&hcd->rh_timer, oxu->reset_done[i]); + } +diff --git a/drivers/usb/host/r8a66597-hcd.c b/drivers/usb/host/r8a66597-hcd.c +index 2ad004ae747c..736f4370abf8 100644 +--- a/drivers/usb/host/r8a66597-hcd.c ++++ b/drivers/usb/host/r8a66597-hcd.c +@@ -2301,7 +2301,7 @@ static int r8a66597_bus_resume(struct usb_hcd *hcd) + rh->port &= ~USB_PORT_STAT_SUSPEND; + rh->port |= USB_PORT_STAT_C_SUSPEND << 16; + r8a66597_mdfy(r8a66597, RESUME, RESUME | UACT, dvstctr_reg); +- msleep(50); ++ msleep(USB_RESUME_TIMEOUT); + r8a66597_mdfy(r8a66597, UACT, RESUME | UACT, dvstctr_reg); + } + +diff --git a/drivers/usb/host/sl811-hcd.c b/drivers/usb/host/sl811-hcd.c +index 5477bf5df218..6b488be61508 100644 +--- a/drivers/usb/host/sl811-hcd.c ++++ b/drivers/usb/host/sl811-hcd.c +@@ -1260,7 +1260,7 @@ sl811h_hub_control( + sl811_write(sl811, SL11H_CTLREG1, sl811->ctrl1); + + mod_timer(&sl811->timer, jiffies +- + msecs_to_jiffies(20)); ++ + msecs_to_jiffies(USB_RESUME_TIMEOUT)); + break; + case USB_PORT_FEAT_POWER: + port_power(sl811, 0); +diff --git a/drivers/usb/host/uhci-hub.c b/drivers/usb/host/uhci-hub.c +index 9189bc984c98..a3e9f986af6c 100644 +--- a/drivers/usb/host/uhci-hub.c ++++ b/drivers/usb/host/uhci-hub.c +@@ -167,7 +167,7 @@ static void uhci_check_ports(struct uhci_hcd *uhci) + /* Port received a wakeup request */ + set_bit(port, &uhci->resuming_ports); + uhci->ports_timeout = jiffies + +- msecs_to_jiffies(25); ++ msecs_to_jiffies(USB_RESUME_TIMEOUT); + usb_hcd_start_port_resume( + &uhci_to_hcd(uhci)->self, port); + +@@ -337,7 +337,8 @@ static int uhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, + uhci_finish_suspend(uhci, port, port_addr); + + /* USB v2.0 7.1.7.5 */ +- uhci->ports_timeout = jiffies + msecs_to_jiffies(50); ++ uhci->ports_timeout = jiffies + ++ msecs_to_jiffies(USB_RESUME_TIMEOUT); + OK(0); + case USB_PORT_FEAT_POWER: + /* UHCI has no power switching */ +diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c +index 6bf308798a2d..75dc6647ba22 100644 +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -1735,7 +1735,7 @@ static void handle_port_status(struct xhci_hcd *xhci, + } else { + xhci_dbg(xhci, "resume HS port %d\n", port_id); + bus_state->resume_done[faked_port_index] = jiffies + +- msecs_to_jiffies(20); ++ msecs_to_jiffies(USB_RESUME_TIMEOUT); + set_bit(faked_port_index, &bus_state->resuming_ports); + mod_timer(&hcd->rh_timer, + bus_state->resume_done[faked_port_index]); +diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c +index 7c0c9335a0d9..3a63ec105045 100644 +--- a/drivers/usb/musb/musb_core.c ++++ b/drivers/usb/musb/musb_core.c +@@ -100,6 +100,7 @@ + #include <linux/platform_device.h> + #include <linux/io.h> + #include <linux/dma-mapping.h> ++#include <linux/usb.h> + + #include "musb_core.h" + +@@ -478,7 +479,7 @@ static irqreturn_t musb_stage0_irq(struct musb *musb, u8 int_usb, + (USB_PORT_STAT_C_SUSPEND << 16) + | MUSB_PORT_STAT_RESUME; + musb->rh_timer = jiffies +- + msecs_to_jiffies(20); ++ + msecs_to_jiffies(USB_RESUME_TIMEOUT); + + musb->xceiv->state = OTG_STATE_A_HOST; + musb->is_active = 1; +diff --git a/drivers/usb/musb/musb_virthub.c b/drivers/usb/musb/musb_virthub.c +index 9af6bba5eac9..5448125eda5a 100644 +--- a/drivers/usb/musb/musb_virthub.c ++++ b/drivers/usb/musb/musb_virthub.c +@@ -105,7 +105,7 @@ static void musb_port_suspend(struct musb *musb, bool do_suspend) + + /* later, GetPortStatus will stop RESUME signaling */ + musb->port1_status |= MUSB_PORT_STAT_RESUME; +- musb->rh_timer = jiffies + msecs_to_jiffies(20); ++ musb->rh_timer = jiffies + msecs_to_jiffies(USB_RESUME_TIMEOUT); + } + } + +diff --git a/drivers/usb/phy/phy.c b/drivers/usb/phy/phy.c +index 5d7966b8fe98..4fee0cce3dce 100644 +--- a/drivers/usb/phy/phy.c ++++ b/drivers/usb/phy/phy.c +@@ -78,7 +78,9 @@ static void devm_usb_phy_release(struct device *dev, void *res) + + static int devm_usb_phy_match(struct device *dev, void *res, void *match_data) + { +- return res == match_data; ++ struct usb_phy **phy = res; ++ ++ return *phy == match_data; + } + + /** +diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c +index c757a131bb4a..ec6d0de19694 100644 +--- a/fs/binfmt_elf.c ++++ b/fs/binfmt_elf.c +@@ -754,6 +754,7 @@ static int load_elf_binary(struct linux_binprm *bprm) + i < loc->elf_ex.e_phnum; i++, elf_ppnt++) { + int elf_prot = 0, elf_flags; + unsigned long k, vaddr; ++ unsigned long total_size = 0; + + if (elf_ppnt->p_type != PT_LOAD) + continue; +@@ -818,10 +819,16 @@ static int load_elf_binary(struct linux_binprm *bprm) + #else + load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr); + #endif ++ total_size = total_mapping_size(elf_phdata, ++ loc->elf_ex.e_phnum); ++ if (!total_size) { ++ error = -EINVAL; ++ goto out_free_dentry; ++ } + } + + error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt, +- elf_prot, elf_flags, 0); ++ elf_prot, elf_flags, total_size); + if (BAD_ADDR(error)) { + send_sig(SIGKILL, current, 0); + retval = IS_ERR((void *)error) ? +diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c +index b1c6e490379c..b3afdde7108c 100644 +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -6613,12 +6613,11 @@ static int __btrfs_free_reserved_extent(struct btrfs_root *root, + return -ENOSPC; + } + +- if (btrfs_test_opt(root, DISCARD)) +- ret = btrfs_discard_extent(root, start, len, NULL); +- + if (pin) + pin_down_extent(root, cache, start, len, 1); + else { ++ if (btrfs_test_opt(root, DISCARD)) ++ ret = btrfs_discard_extent(root, start, len, NULL); + btrfs_add_free_space(cache, start, len); + btrfs_update_reserved_bytes(cache, len, RESERVE_FREE); + } +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index 50a06debb1bd..d43cd15c3097 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -2671,6 +2671,9 @@ static int btrfs_extent_same(struct inode *src, u64 loff, u64 len, + if (src == dst) + return -EINVAL; + ++ if (len == 0) ++ return 0; ++ + btrfs_double_lock(src, loff, dst, dst_loff, len); + + ret = extent_same_check_offsets(src, loff, len); +@@ -3211,6 +3214,11 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd, + if (off + len == src->i_size) + len = ALIGN(src->i_size, bs) - off; + ++ if (len == 0) { ++ ret = 0; ++ goto out_unlock; ++ } ++ + /* verify the end result is block aligned */ + if (!IS_ALIGNED(off, bs) || !IS_ALIGNED(off + len, bs) || + !IS_ALIGNED(destoff, bs)) +diff --git a/fs/btrfs/xattr.c b/fs/btrfs/xattr.c +index 05740b9789e4..7e21b2b3fcf2 100644 +--- a/fs/btrfs/xattr.c ++++ b/fs/btrfs/xattr.c +@@ -322,21 +322,40 @@ const struct xattr_handler *btrfs_xattr_handlers[] = { + /* + * Check if the attribute is in a supported namespace. + * +- * This applied after the check for the synthetic attributes in the system ++ * This is applied after the check for the synthetic attributes in the system + * namespace. + */ +-static bool btrfs_is_valid_xattr(const char *name) ++static int btrfs_is_valid_xattr(const char *name) + { +- return !strncmp(name, XATTR_SECURITY_PREFIX, +- XATTR_SECURITY_PREFIX_LEN) || +- !strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN) || +- !strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN) || +- !strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN); ++ int len = strlen(name); ++ int prefixlen = 0; ++ ++ if (!strncmp(name, XATTR_SECURITY_PREFIX, ++ XATTR_SECURITY_PREFIX_LEN)) ++ prefixlen = XATTR_SECURITY_PREFIX_LEN; ++ else if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN)) ++ prefixlen = XATTR_SYSTEM_PREFIX_LEN; ++ else if (!strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN)) ++ prefixlen = XATTR_TRUSTED_PREFIX_LEN; ++ else if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN)) ++ prefixlen = XATTR_USER_PREFIX_LEN; ++ else ++ return -EOPNOTSUPP; ++ ++ /* ++ * The name cannot consist of just prefix ++ */ ++ if (len <= prefixlen) ++ return -EINVAL; ++ ++ return 0; + } + + ssize_t btrfs_getxattr(struct dentry *dentry, const char *name, + void *buffer, size_t size) + { ++ int ret; ++ + /* + * If this is a request for a synthetic attribute in the system.* + * namespace use the generic infrastructure to resolve a handler +@@ -345,8 +364,9 @@ ssize_t btrfs_getxattr(struct dentry *dentry, const char *name, + if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN)) + return generic_getxattr(dentry, name, buffer, size); + +- if (!btrfs_is_valid_xattr(name)) +- return -EOPNOTSUPP; ++ ret = btrfs_is_valid_xattr(name); ++ if (ret) ++ return ret; + return __btrfs_getxattr(dentry->d_inode, name, buffer, size); + } + +@@ -354,6 +374,7 @@ int btrfs_setxattr(struct dentry *dentry, const char *name, const void *value, + size_t size, int flags) + { + struct btrfs_root *root = BTRFS_I(dentry->d_inode)->root; ++ int ret; + + /* + * The permission on security.* and system.* is not checked +@@ -370,8 +391,9 @@ int btrfs_setxattr(struct dentry *dentry, const char *name, const void *value, + if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN)) + return generic_setxattr(dentry, name, value, size, flags); + +- if (!btrfs_is_valid_xattr(name)) +- return -EOPNOTSUPP; ++ ret = btrfs_is_valid_xattr(name); ++ if (ret) ++ return ret; + + if (size == 0) + value = ""; /* empty EA, do not remove */ +@@ -383,6 +405,7 @@ int btrfs_setxattr(struct dentry *dentry, const char *name, const void *value, + int btrfs_removexattr(struct dentry *dentry, const char *name) + { + struct btrfs_root *root = BTRFS_I(dentry->d_inode)->root; ++ int ret; + + /* + * The permission on security.* and system.* is not checked +@@ -399,8 +422,9 @@ int btrfs_removexattr(struct dentry *dentry, const char *name) + if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN)) + return generic_removexattr(dentry, name); + +- if (!btrfs_is_valid_xattr(name)) +- return -EOPNOTSUPP; ++ ret = btrfs_is_valid_xattr(name); ++ if (ret) ++ return ret; + + return __btrfs_setxattr(NULL, dentry->d_inode, name, NULL, 0, + XATTR_REPLACE); +diff --git a/fs/exec.c b/fs/exec.c +index 26bb91bf203b..d8b46a197172 100644 +--- a/fs/exec.c ++++ b/fs/exec.c +@@ -1272,6 +1272,53 @@ static int check_unsafe_exec(struct linux_binprm *bprm) + return res; + } + ++static void bprm_fill_uid(struct linux_binprm *bprm) ++{ ++ struct inode *inode; ++ unsigned int mode; ++ kuid_t uid; ++ kgid_t gid; ++ ++ /* clear any previous set[ug]id data from a previous binary */ ++ bprm->cred->euid = current_euid(); ++ bprm->cred->egid = current_egid(); ++ ++ if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) ++ return; ++ ++ if (current->no_new_privs) ++ return; ++ ++ inode = file_inode(bprm->file); ++ mode = ACCESS_ONCE(inode->i_mode); ++ if (!(mode & (S_ISUID|S_ISGID))) ++ return; ++ ++ /* Be careful if suid/sgid is set */ ++ mutex_lock(&inode->i_mutex); ++ ++ /* reload atomically mode/uid/gid now that lock held */ ++ mode = inode->i_mode; ++ uid = inode->i_uid; ++ gid = inode->i_gid; ++ mutex_unlock(&inode->i_mutex); ++ ++ /* We ignore suid/sgid if there are no mappings for them in the ns */ ++ if (!kuid_has_mapping(bprm->cred->user_ns, uid) || ++ !kgid_has_mapping(bprm->cred->user_ns, gid)) ++ return; ++ ++ if (mode & S_ISUID) { ++ bprm->per_clear |= PER_CLEAR_ON_SETID; ++ bprm->cred->euid = uid; ++ } ++ ++ if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) { ++ bprm->per_clear |= PER_CLEAR_ON_SETID; ++ bprm->cred->egid = gid; ++ } ++} ++ + /* + * Fill the binprm structure from the inode. + * Check permissions, then read the first 128 (BINPRM_BUF_SIZE) bytes +@@ -1280,39 +1327,12 @@ static int check_unsafe_exec(struct linux_binprm *bprm) + */ + int prepare_binprm(struct linux_binprm *bprm) + { +- umode_t mode; +- struct inode * inode = file_inode(bprm->file); + int retval; + +- mode = inode->i_mode; + if (bprm->file->f_op == NULL) + return -EACCES; + +- /* clear any previous set[ug]id data from a previous binary */ +- bprm->cred->euid = current_euid(); +- bprm->cred->egid = current_egid(); +- +- if (!(bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) && +- !current->no_new_privs && +- kuid_has_mapping(bprm->cred->user_ns, inode->i_uid) && +- kgid_has_mapping(bprm->cred->user_ns, inode->i_gid)) { +- /* Set-uid? */ +- if (mode & S_ISUID) { +- bprm->per_clear |= PER_CLEAR_ON_SETID; +- bprm->cred->euid = inode->i_uid; +- } +- +- /* Set-gid? */ +- /* +- * If setgid is set but no group execute bit then this +- * is a candidate for mandatory locking, not a setgid +- * executable. +- */ +- if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) { +- bprm->per_clear |= PER_CLEAR_ON_SETID; +- bprm->cred->egid = inode->i_gid; +- } +- } ++ bprm_fill_uid(bprm); + + /* fill in binprm security blob */ + retval = security_bprm_set_creds(bprm); +diff --git a/fs/ext4/extents_status.c b/fs/ext4/extents_status.c +index 171b9fa0f27a..4e8b79def9c7 100644 +--- a/fs/ext4/extents_status.c ++++ b/fs/ext4/extents_status.c +@@ -656,6 +656,14 @@ int ext4_es_insert_extent(struct inode *inode, ext4_lblk_t lblk, + + BUG_ON(end < lblk); + ++ if ((status & EXTENT_STATUS_DELAYED) && ++ (status & EXTENT_STATUS_WRITTEN)) { ++ ext4_warning(inode->i_sb, "Inserting extent [%u/%u] as " ++ " delayed and written which can potentially " ++ " cause data loss.\n", lblk, len); ++ WARN_ON(1); ++ } ++ + newes.es_lblk = lblk; + newes.es_len = len; + ext4_es_store_pblock(&newes, pblk); +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index ba68d211d748..70a390bb4733 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -569,6 +569,7 @@ int ext4_map_blocks(handle_t *handle, struct inode *inode, + status = map->m_flags & EXT4_MAP_UNWRITTEN ? + EXTENT_STATUS_UNWRITTEN : EXTENT_STATUS_WRITTEN; + if (!(flags & EXT4_GET_BLOCKS_DELALLOC_RESERVE) && ++ !(status & EXTENT_STATUS_WRITTEN) && + ext4_find_delalloc_range(inode, map->m_lblk, + map->m_lblk + map->m_len - 1)) + status |= EXTENT_STATUS_DELAYED; +@@ -678,6 +679,7 @@ found: + status = map->m_flags & EXT4_MAP_UNWRITTEN ? + EXTENT_STATUS_UNWRITTEN : EXTENT_STATUS_WRITTEN; + if (!(flags & EXT4_GET_BLOCKS_DELALLOC_RESERVE) && ++ !(status & EXTENT_STATUS_WRITTEN) && + ext4_find_delalloc_range(inode, map->m_lblk, + map->m_lblk + map->m_len - 1)) + status |= EXTENT_STATUS_DELAYED; +diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c +index 7e6954cbcef7..4587a1b31c93 100644 +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -1870,7 +1870,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry, + struct inode *inode) + { + struct inode *dir = dentry->d_parent->d_inode; +- struct buffer_head *bh; ++ struct buffer_head *bh = NULL; + struct ext4_dir_entry_2 *de; + struct ext4_dir_entry_tail *t; + struct super_block *sb; +@@ -1894,14 +1894,14 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry, + return retval; + if (retval == 1) { + retval = 0; +- return retval; ++ goto out; + } + } + + if (is_dx(dir)) { + retval = ext4_dx_add_entry(handle, dentry, inode); + if (!retval || (retval != ERR_BAD_DX_DIR)) +- return retval; ++ goto out; + ext4_clear_inode_flag(dir, EXT4_INODE_INDEX); + dx_fallback++; + ext4_mark_inode_dirty(handle, dir); +@@ -1913,14 +1913,15 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry, + return PTR_ERR(bh); + + retval = add_dirent_to_buf(handle, dentry, inode, NULL, bh); +- if (retval != -ENOSPC) { +- brelse(bh); +- return retval; +- } ++ if (retval != -ENOSPC) ++ goto out; + + if (blocks == 1 && !dx_fallback && +- EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX)) +- return make_indexed_dir(handle, dentry, inode, bh); ++ EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX)) { ++ retval = make_indexed_dir(handle, dentry, inode, bh); ++ bh = NULL; /* make_indexed_dir releases bh */ ++ goto out; ++ } + brelse(bh); + } + bh = ext4_append(handle, dir, &block); +@@ -1936,6 +1937,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry, + } + + retval = add_dirent_to_buf(handle, dentry, inode, de, bh); ++out: + brelse(bh); + if (retval == 0) + ext4_set_inode_state(inode, EXT4_STATE_NEWENTRY); +diff --git a/fs/namei.c b/fs/namei.c +index 1004966437f9..c0c78e193e2a 100644 +--- a/fs/namei.c ++++ b/fs/namei.c +@@ -1557,7 +1557,8 @@ static inline int walk_component(struct nameidata *nd, struct path *path, + + if (should_follow_link(inode, follow)) { + if (nd->flags & LOOKUP_RCU) { +- if (unlikely(unlazy_walk(nd, path->dentry))) { ++ if (unlikely(nd->path.mnt != path->mnt || ++ unlazy_walk(nd, path->dentry))) { + err = -ECHILD; + goto out_err; + } +@@ -3023,7 +3024,8 @@ finish_lookup: + + if (should_follow_link(inode, !symlink_ok)) { + if (nd->flags & LOOKUP_RCU) { +- if (unlikely(unlazy_walk(nd, path->dentry))) { ++ if (unlikely(nd->path.mnt != path->mnt || ++ unlazy_walk(nd, path->dentry))) { + error = -ECHILD; + goto out; + } +diff --git a/fs/namespace.c b/fs/namespace.c +index 7c3c0f6d2744..247f34d43dda 100644 +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -2940,6 +2940,12 @@ bool fs_fully_visible(struct file_system_type *type) + if (mnt->mnt.mnt_sb->s_type != type) + continue; + ++ /* This mount is not fully visible if it's root directory ++ * is not the root directory of the filesystem. ++ */ ++ if (mnt->mnt.mnt_root != mnt->mnt.mnt_sb->s_root) ++ continue; ++ + /* This mount is not fully visible if there are any child mounts + * that cover anything except for empty directories. + */ +diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c +index ecdbae19a766..090d8ce25bd1 100644 +--- a/fs/nilfs2/btree.c ++++ b/fs/nilfs2/btree.c +@@ -388,7 +388,7 @@ static int nilfs_btree_root_broken(const struct nilfs_btree_node *node, + nchildren = nilfs_btree_node_get_nchildren(node); + + if (unlikely(level < NILFS_BTREE_LEVEL_NODE_MIN || +- level > NILFS_BTREE_LEVEL_MAX || ++ level >= NILFS_BTREE_LEVEL_MAX || + nchildren < 0 || + nchildren > NILFS_BTREE_ROOT_NCHILDREN_MAX)) { + pr_crit("NILFS: bad btree root (inode number=%lu): level = %d, flags = 0x%x, nchildren = %d\n", +diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c +index 673c9bf5debc..4fe55b776a74 100644 +--- a/fs/ocfs2/dlm/dlmmaster.c ++++ b/fs/ocfs2/dlm/dlmmaster.c +@@ -726,6 +726,19 @@ lookup: + if (tmpres) { + spin_unlock(&dlm->spinlock); + spin_lock(&tmpres->spinlock); ++ ++ /* ++ * Right after dlm spinlock was released, dlm_thread could have ++ * purged the lockres. Check if lockres got unhashed. If so ++ * start over. ++ */ ++ if (hlist_unhashed(&tmpres->hash_node)) { ++ spin_unlock(&tmpres->spinlock); ++ dlm_lockres_put(tmpres); ++ tmpres = NULL; ++ goto lookup; ++ } ++ + /* Wait on the thread that is mastering the resource */ + if (tmpres->owner == DLM_LOCK_RES_OWNER_UNKNOWN) { + __dlm_wait_on_lockres(tmpres); +diff --git a/fs/proc/stat.c b/fs/proc/stat.c +index b5c72a3be359..339bdf8e488c 100644 +--- a/fs/proc/stat.c ++++ b/fs/proc/stat.c +@@ -184,29 +184,11 @@ static int show_stat(struct seq_file *p, void *v) + + static int stat_open(struct inode *inode, struct file *file) + { +- size_t size = 1024 + 128 * num_possible_cpus(); +- char *buf; +- struct seq_file *m; +- int res; ++ size_t size = 1024 + 128 * num_online_cpus(); + + /* minimum size to display an interrupt count : 2 bytes */ + size += 2 * nr_irqs; +- +- /* don't ask for more than the kmalloc() max size */ +- if (size > KMALLOC_MAX_SIZE) +- size = KMALLOC_MAX_SIZE; +- buf = kmalloc(size, GFP_KERNEL); +- if (!buf) +- return -ENOMEM; +- +- res = single_open(file, show_stat, NULL); +- if (!res) { +- m = file->private_data; +- m->buf = buf; +- m->size = ksize(buf); +- } else +- kfree(buf); +- return res; ++ return single_open_size(file, show_stat, NULL, size); + } + + static const struct file_operations proc_stat_operations = { +diff --git a/fs/seq_file.c b/fs/seq_file.c +index a290157265ef..6e050e26af43 100644 +--- a/fs/seq_file.c ++++ b/fs/seq_file.c +@@ -8,8 +8,10 @@ + #include <linux/fs.h> + #include <linux/export.h> + #include <linux/seq_file.h> ++#include <linux/vmalloc.h> + #include <linux/slab.h> + #include <linux/cred.h> ++#include <linux/mm.h> + + #include <asm/uaccess.h> + #include <asm/page.h> +@@ -30,6 +32,16 @@ static void seq_set_overflow(struct seq_file *m) + m->count = m->size; + } + ++static void *seq_buf_alloc(unsigned long size) ++{ ++ void *buf; ++ ++ buf = kmalloc(size, GFP_KERNEL | __GFP_NOWARN); ++ if (!buf && size > PAGE_SIZE) ++ buf = vmalloc(size); ++ return buf; ++} ++ + /** + * seq_open - initialize sequential file + * @file: file we initialize +@@ -96,7 +108,7 @@ static int traverse(struct seq_file *m, loff_t offset) + return 0; + } + if (!m->buf) { +- m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL); ++ m->buf = seq_buf_alloc(m->size = PAGE_SIZE); + if (!m->buf) + return -ENOMEM; + } +@@ -135,8 +147,9 @@ static int traverse(struct seq_file *m, loff_t offset) + + Eoverflow: + m->op->stop(m, p); +- kfree(m->buf); +- m->buf = kmalloc(m->size <<= 1, GFP_KERNEL); ++ kvfree(m->buf); ++ m->count = 0; ++ m->buf = seq_buf_alloc(m->size <<= 1); + return !m->buf ? -ENOMEM : -EAGAIN; + } + +@@ -191,7 +204,7 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos) + + /* grab buffer if we didn't have one */ + if (!m->buf) { +- m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL); ++ m->buf = seq_buf_alloc(m->size = PAGE_SIZE); + if (!m->buf) + goto Enomem; + } +@@ -231,11 +244,11 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos) + if (m->count < m->size) + goto Fill; + m->op->stop(m, p); +- kfree(m->buf); +- m->buf = kmalloc(m->size <<= 1, GFP_KERNEL); ++ kvfree(m->buf); ++ m->count = 0; ++ m->buf = seq_buf_alloc(m->size <<= 1); + if (!m->buf) + goto Enomem; +- m->count = 0; + m->version = 0; + pos = m->index; + p = m->op->start(m, &pos); +@@ -349,7 +362,7 @@ EXPORT_SYMBOL(seq_lseek); + int seq_release(struct inode *inode, struct file *file) + { + struct seq_file *m = file->private_data; +- kfree(m->buf); ++ kvfree(m->buf); + kfree(m); + return 0; + } +@@ -604,13 +617,13 @@ EXPORT_SYMBOL(single_open); + int single_open_size(struct file *file, int (*show)(struct seq_file *, void *), + void *data, size_t size) + { +- char *buf = kmalloc(size, GFP_KERNEL); ++ char *buf = seq_buf_alloc(size); + int ret; + if (!buf) + return -ENOMEM; + ret = single_open(file, show, data); + if (ret) { +- kfree(buf); ++ kvfree(buf); + return ret; + } + ((struct seq_file *)file->private_data)->buf = buf; +diff --git a/include/acpi/acpixf.h b/include/acpi/acpixf.h +index 85bfdbe17805..d62dfc745d8a 100644 +--- a/include/acpi/acpixf.h ++++ b/include/acpi/acpixf.h +@@ -181,7 +181,7 @@ acpi_status acpi_load_tables(void); + */ + acpi_status acpi_reallocate_root_table(void); + +-acpi_status acpi_find_root_pointer(acpi_size *rsdp_address); ++acpi_status acpi_find_root_pointer(acpi_physical_address * rsdp_address); + + acpi_status acpi_unload_table_id(acpi_owner_id id); + +diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h +index b748aefce929..3c36b091a2c4 100644 +--- a/include/acpi/actypes.h ++++ b/include/acpi/actypes.h +@@ -198,9 +198,29 @@ typedef int INT32; + typedef s32 acpi_native_int; + + typedef u32 acpi_size; ++ ++#ifdef ACPI_32BIT_PHYSICAL_ADDRESS ++ ++/* ++ * OSPMs can define this to shrink the size of the structures for 32-bit ++ * none PAE environment. ASL compiler may always define this to generate ++ * 32-bit OSPM compliant tables. ++ */ + typedef u32 acpi_io_address; + typedef u32 acpi_physical_address; + ++#else /* ACPI_32BIT_PHYSICAL_ADDRESS */ ++ ++/* ++ * It is reported that, after some calculations, the physical addresses can ++ * wrap over the 32-bit boundary on 32-bit PAE environment. ++ * https://bugzilla.kernel.org/show_bug.cgi?id=87971 ++ */ ++typedef u64 acpi_io_address; ++typedef u64 acpi_physical_address; ++ ++#endif /* ACPI_32BIT_PHYSICAL_ADDRESS */ ++ + #define ACPI_MAX_PTR ACPI_UINT32_MAX + #define ACPI_SIZE_MAX ACPI_UINT32_MAX + +diff --git a/include/acpi/platform/acenv.h b/include/acpi/platform/acenv.h +index ef04b36ca6ed..f7db107abb04 100644 +--- a/include/acpi/platform/acenv.h ++++ b/include/acpi/platform/acenv.h +@@ -76,6 +76,7 @@ + #define ACPI_LARGE_NAMESPACE_NODE + #define ACPI_DATA_TABLE_DISASSEMBLY + #define ACPI_SINGLE_THREADED ++#define ACPI_32BIT_PHYSICAL_ADDRESS + #endif + + /* acpi_exec configuration. Multithreaded with full AML debugger */ +diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h +index a52136ce13ad..bc1f54cc2c02 100644 +--- a/include/asm-generic/pgtable.h ++++ b/include/asm-generic/pgtable.h +@@ -599,11 +599,10 @@ static inline int pmd_none_or_trans_huge_or_clear_bad(pmd_t *pmd) + #ifdef CONFIG_TRANSPARENT_HUGEPAGE + barrier(); + #endif +- if (pmd_none(pmdval)) ++ if (pmd_none(pmdval) || pmd_trans_huge(pmdval)) + return 1; + if (unlikely(pmd_bad(pmdval))) { +- if (!pmd_trans_huge(pmdval)) +- pmd_clear_bad(pmd); ++ pmd_clear_bad(pmd); + return 1; + } + return 0; +diff --git a/include/asm-generic/sections.h b/include/asm-generic/sections.h +index f1a24b5c3b90..b58fd667f87b 100644 +--- a/include/asm-generic/sections.h ++++ b/include/asm-generic/sections.h +@@ -3,6 +3,8 @@ + + /* References to section boundaries */ + ++#include <linux/compiler.h> ++ + /* + * Usage guidelines: + * _text, _data: architecture specific, don't use them in arch-independent code +@@ -37,6 +39,8 @@ extern char __start_rodata[], __end_rodata[]; + /* Start and end of .ctors section - used for constructor calls. */ + extern char __ctors_start[], __ctors_end[]; + ++extern __visible const void __nosave_begin, __nosave_end; ++ + /* function descriptor handling (if any). Override + * in asm/sections.h */ + #ifndef dereference_function_descriptor +diff --git a/include/linux/nilfs2_fs.h b/include/linux/nilfs2_fs.h +index 98755767c7b0..1108acaacfc6 100644 +--- a/include/linux/nilfs2_fs.h ++++ b/include/linux/nilfs2_fs.h +@@ -458,7 +458,7 @@ struct nilfs_btree_node { + /* level */ + #define NILFS_BTREE_LEVEL_DATA 0 + #define NILFS_BTREE_LEVEL_NODE_MIN (NILFS_BTREE_LEVEL_DATA + 1) +-#define NILFS_BTREE_LEVEL_MAX 14 ++#define NILFS_BTREE_LEVEL_MAX 14 /* Max level (exclusive) */ + + /** + * struct nilfs_palloc_group_desc - block group descriptor +diff --git a/include/linux/rmap.h b/include/linux/rmap.h +index 6dacb93a6d94..fc7c6cb295e4 100644 +--- a/include/linux/rmap.h ++++ b/include/linux/rmap.h +@@ -37,6 +37,16 @@ struct anon_vma { + atomic_t refcount; + + /* ++ * Count of child anon_vmas and VMAs which points to this anon_vma. ++ * ++ * This counter is used for making decision about reusing anon_vma ++ * instead of forking new one. See comments in function anon_vma_clone. ++ */ ++ unsigned degree; ++ ++ struct anon_vma *parent; /* Parent of this anon_vma */ ++ ++ /* + * NOTE: the LSB of the rb_root.rb_node is set by + * mm_take_all_locks() _after_ taking the above lock. So the + * rb_root must only be read/written after taking the above lock +diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h +index 2960dab8b6fc..79147dc9630d 100644 +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -638,6 +638,7 @@ extern bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from, + + extern struct sk_buff *__alloc_skb(unsigned int size, + gfp_t priority, int flags, int node); ++struct sk_buff *__build_skb(void *data, unsigned int frag_size); + extern struct sk_buff *build_skb(void *data, unsigned int frag_size); + static inline struct sk_buff *alloc_skb(unsigned int size, + gfp_t priority) +diff --git a/include/linux/usb.h b/include/linux/usb.h +index 39cfa0aca91f..6b37946481e8 100644 +--- a/include/linux/usb.h ++++ b/include/linux/usb.h +@@ -206,6 +206,32 @@ void usb_put_intf(struct usb_interface *intf); + #define USB_MAXINTERFACES 32 + #define USB_MAXIADS (USB_MAXINTERFACES/2) + ++/* ++ * USB Resume Timer: Every Host controller driver should drive the resume ++ * signalling on the bus for the amount of time defined by this macro. ++ * ++ * That way we will have a 'stable' behavior among all HCDs supported by Linux. ++ * ++ * Note that the USB Specification states we should drive resume for *at least* ++ * 20 ms, but it doesn't give an upper bound. This creates two possible ++ * situations which we want to avoid: ++ * ++ * (a) sometimes an msleep(20) might expire slightly before 20 ms, which causes ++ * us to fail USB Electrical Tests, thus failing Certification ++ * ++ * (b) Some (many) devices actually need more than 20 ms of resume signalling, ++ * and while we can argue that's against the USB Specification, we don't have ++ * control over which devices a certification laboratory will be using for ++ * certification. If CertLab uses a device which was tested against Windows and ++ * that happens to have relaxed resume signalling rules, we might fall into ++ * situations where we fail interoperability and electrical tests. ++ * ++ * In order to avoid both conditions, we're using a 40 ms resume timeout, which ++ * should cope with both LPJ calibration errors and devices not following every ++ * detail of the USB Specification. ++ */ ++#define USB_RESUME_TIMEOUT 40 /* ms */ ++ + /** + * struct usb_interface_cache - long-term representation of a device interface + * @num_altsetting: number of altsettings defined. +diff --git a/include/sound/emu10k1.h b/include/sound/emu10k1.h +index dfb42ca6d043..8898cdeb42a4 100644 +--- a/include/sound/emu10k1.h ++++ b/include/sound/emu10k1.h +@@ -41,7 +41,8 @@ + + #define EMUPAGESIZE 4096 + #define MAXREQVOICES 8 +-#define MAXPAGES 8192 ++#define MAXPAGES0 4096 /* 32 bit mode */ ++#define MAXPAGES1 8192 /* 31 bit mode */ + #define RESERVED 0 + #define NUM_MIDI 16 + #define NUM_G 64 /* use all channels */ +@@ -50,8 +51,7 @@ + + /* FIXME? - according to the OSS driver the EMU10K1 needs a 29 bit DMA mask */ + #define EMU10K1_DMA_MASK 0x7fffffffUL /* 31bit */ +-#define AUDIGY_DMA_MASK 0x7fffffffUL /* 31bit FIXME - 32 should work? */ +- /* See ALSA bug #1276 - rlrevell */ ++#define AUDIGY_DMA_MASK 0xffffffffUL /* 32bit mode */ + + #define TMEMSIZE 256*1024 + #define TMEMSIZEREG 4 +@@ -468,8 +468,11 @@ + + #define MAPB 0x0d /* Cache map B */ + +-#define MAP_PTE_MASK 0xffffe000 /* The 19 MSBs of the PTE indexed by the PTI */ +-#define MAP_PTI_MASK 0x00001fff /* The 13 bit index to one of the 8192 PTE dwords */ ++#define MAP_PTE_MASK0 0xfffff000 /* The 20 MSBs of the PTE indexed by the PTI */ ++#define MAP_PTI_MASK0 0x00000fff /* The 12 bit index to one of the 4096 PTE dwords */ ++ ++#define MAP_PTE_MASK1 0xffffe000 /* The 19 MSBs of the PTE indexed by the PTI */ ++#define MAP_PTI_MASK1 0x00001fff /* The 13 bit index to one of the 8192 PTE dwords */ + + /* 0x0e, 0x0f: Not used */ + +@@ -1706,6 +1709,7 @@ struct snd_emu10k1 { + unsigned short model; /* subsystem id */ + unsigned int card_type; /* EMU10K1_CARD_* */ + unsigned int ecard_ctrl; /* ecard control bits */ ++ unsigned int address_mode; /* address mode */ + unsigned long dma_mask; /* PCI DMA mask */ + unsigned int delay_pcm_irq; /* in samples */ + int max_cache_pages; /* max memory size / PAGE_SIZE */ +diff --git a/include/sound/soc-dapm.h b/include/sound/soc-dapm.h +index 9e600b418467..11a6d2d68914 100644 +--- a/include/sound/soc-dapm.h ++++ b/include/sound/soc-dapm.h +@@ -300,7 +300,7 @@ struct device; + .access = SNDRV_CTL_ELEM_ACCESS_TLV_READ | SNDRV_CTL_ELEM_ACCESS_READWRITE,\ + .tlv.p = (tlv_array), \ + .get = snd_soc_dapm_get_volsw, .put = snd_soc_dapm_put_volsw, \ +- .private_value = SOC_SINGLE_VALUE(reg, shift, max, invert, 0) } ++ .private_value = SOC_SINGLE_VALUE(reg, shift, max, invert, 1) } + #define SOC_DAPM_ENUM(xname, xenum) \ + { .iface = SNDRV_CTL_ELEM_IFACE_MIXER, .name = xname, \ + .info = snd_soc_info_enum_double, \ +diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h +index 38647a3441c9..085e6bedf393 100644 +--- a/include/target/target_core_base.h ++++ b/include/target/target_core_base.h +@@ -457,7 +457,7 @@ struct se_cmd { + sense_reason_t (*execute_cmd)(struct se_cmd *); + sense_reason_t (*execute_rw)(struct se_cmd *, struct scatterlist *, + u32, enum dma_data_direction); +- sense_reason_t (*transport_complete_callback)(struct se_cmd *); ++ sense_reason_t (*transport_complete_callback)(struct se_cmd *, bool); + + unsigned char *t_task_cdb; + unsigned char __t_task_cdb[TCM_MAX_COMMAND_SIZE]; +diff --git a/kernel/ptrace.c b/kernel/ptrace.c +index 1f4bcb3cc21c..be9760f8284a 100644 +--- a/kernel/ptrace.c ++++ b/kernel/ptrace.c +@@ -720,6 +720,8 @@ static int ptrace_peek_siginfo(struct task_struct *child, + static int ptrace_resume(struct task_struct *child, long request, + unsigned long data) + { ++ bool need_siglock; ++ + if (!valid_signal(data)) + return -EIO; + +@@ -747,8 +749,26 @@ static int ptrace_resume(struct task_struct *child, long request, + user_disable_single_step(child); + } + ++ /* ++ * Change ->exit_code and ->state under siglock to avoid the race ++ * with wait_task_stopped() in between; a non-zero ->exit_code will ++ * wrongly look like another report from tracee. ++ * ++ * Note that we need siglock even if ->exit_code == data and/or this ++ * status was not reported yet, the new status must not be cleared by ++ * wait_task_stopped() after resume. ++ * ++ * If data == 0 we do not care if wait_task_stopped() reports the old ++ * status and clears the code too; this can't race with the tracee, it ++ * takes siglock after resume. ++ */ ++ need_siglock = data && !thread_group_empty(current); ++ if (need_siglock) ++ spin_lock_irq(&child->sighand->siglock); + child->exit_code = data; + wake_up_state(child, __TASK_TRACED); ++ if (need_siglock) ++ spin_unlock_irq(&child->sighand->siglock); + + return 0; + } +diff --git a/kernel/softirq.c b/kernel/softirq.c +index d7d498d8cc4f..b331c8756543 100644 +--- a/kernel/softirq.c ++++ b/kernel/softirq.c +@@ -772,9 +772,13 @@ static void run_ksoftirqd(unsigned int cpu) + local_irq_disable(); + if (local_softirq_pending()) { + __do_softirq(); +- rcu_note_context_switch(cpu); + local_irq_enable(); + cond_resched(); ++ ++ preempt_disable(); ++ rcu_note_context_switch(cpu); ++ preempt_enable(); ++ + return; + } + local_irq_enable(); +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index 21ee379e3e4b..469af802d14e 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -2651,7 +2651,7 @@ static DEFINE_PER_CPU(unsigned int, current_context); + + static __always_inline int trace_recursive_lock(void) + { +- unsigned int val = this_cpu_read(current_context); ++ unsigned int val = __this_cpu_read(current_context); + int bit; + + if (in_interrupt()) { +@@ -2668,18 +2668,17 @@ static __always_inline int trace_recursive_lock(void) + return 1; + + val |= (1 << bit); +- this_cpu_write(current_context, val); ++ __this_cpu_write(current_context, val); + + return 0; + } + + static __always_inline void trace_recursive_unlock(void) + { +- unsigned int val = this_cpu_read(current_context); ++ unsigned int val = __this_cpu_read(current_context); + +- val--; +- val &= this_cpu_read(current_context); +- this_cpu_write(current_context, val); ++ val &= val & (val - 1); ++ __this_cpu_write(current_context, val); + } + + #else +diff --git a/lib/string.c b/lib/string.c +index 43d0781daf47..cb9ea2181557 100644 +--- a/lib/string.c ++++ b/lib/string.c +@@ -598,7 +598,7 @@ EXPORT_SYMBOL(memset); + void memzero_explicit(void *s, size_t count) + { + memset(s, 0, count); +- OPTIMIZER_HIDE_VAR(s); ++ barrier(); + } + EXPORT_SYMBOL(memzero_explicit); + +diff --git a/mm/hugetlb.c b/mm/hugetlb.c +index 424ee30fcd0d..c91c347bb3ea 100644 +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -3494,8 +3494,7 @@ retry: + if (!pmd_huge(*pmd)) + goto out; + if (pmd_present(*pmd)) { +- page = pte_page(*(pte_t *)pmd) + +- ((address & ~PMD_MASK) >> PAGE_SHIFT); ++ page = pmd_page(*pmd) + ((address & ~PMD_MASK) >> PAGE_SHIFT); + if (flags & FOLL_GET) + get_page(page); + } else { +diff --git a/mm/memory-failure.c b/mm/memory-failure.c +index 532b4661985c..5785b59620ef 100644 +--- a/mm/memory-failure.c ++++ b/mm/memory-failure.c +@@ -1149,10 +1149,10 @@ int memory_failure(unsigned long pfn, int trapno, int flags) + * The check (unnecessarily) ignores LRU pages being isolated and + * walked by the page reclaim code, however that's not a big loss. + */ +- if (!PageHuge(p) && !PageTransTail(p)) { +- if (!PageLRU(p)) +- shake_page(p, 0); +- if (!PageLRU(p)) { ++ if (!PageHuge(p)) { ++ if (!PageLRU(hpage)) ++ shake_page(hpage, 0); ++ if (!PageLRU(hpage)) { + /* + * shake_page could have turned it free. + */ +@@ -1718,12 +1718,12 @@ int soft_offline_page(struct page *page, int flags) + } else { /* for free pages */ + if (PageHuge(page)) { + set_page_hwpoison_huge_page(hpage); +- dequeue_hwpoisoned_huge_page(hpage); +- atomic_long_add(1 << compound_order(hpage), ++ if (!dequeue_hwpoisoned_huge_page(hpage)) ++ atomic_long_add(1 << compound_order(hpage), + &num_poisoned_pages); + } else { +- SetPageHWPoison(page); +- atomic_long_inc(&num_poisoned_pages); ++ if (!TestSetPageHWPoison(page)) ++ atomic_long_inc(&num_poisoned_pages); + } + } + unset: +diff --git a/mm/mmap.c b/mm/mmap.c +index c3ed083cfb59..5070dabd5be4 100644 +--- a/mm/mmap.c ++++ b/mm/mmap.c +@@ -748,10 +748,10 @@ again: remove_next = 1 + (end > next->vm_end); + if (exporter && exporter->anon_vma && !importer->anon_vma) { + int error; + ++ importer->anon_vma = exporter->anon_vma; + error = anon_vma_clone(importer, exporter); + if (error) + return error; +- importer->anon_vma = exporter->anon_vma; + } + } + +diff --git a/mm/page-writeback.c b/mm/page-writeback.c +index 51d8d15f48d7..656a5490f693 100644 +--- a/mm/page-writeback.c ++++ b/mm/page-writeback.c +@@ -601,7 +601,7 @@ static long long pos_ratio_polynom(unsigned long setpoint, + long x; + + x = div64_s64(((s64)setpoint - (s64)dirty) << RATELIMIT_CALC_SHIFT, +- limit - setpoint + 1); ++ (limit - setpoint) | 1); + pos_ratio = x; + pos_ratio = pos_ratio * x >> RATELIMIT_CALC_SHIFT; + pos_ratio = pos_ratio * x >> RATELIMIT_CALC_SHIFT; +@@ -828,7 +828,7 @@ static unsigned long bdi_position_ratio(struct backing_dev_info *bdi, + * scale global setpoint to bdi's: + * bdi_setpoint = setpoint * bdi_thresh / thresh + */ +- x = div_u64((u64)bdi_thresh << 16, thresh + 1); ++ x = div_u64((u64)bdi_thresh << 16, thresh | 1); + bdi_setpoint = setpoint * (u64)x >> 16; + /* + * Use span=(8*write_bw) in single bdi case as indicated by +@@ -843,7 +843,7 @@ static unsigned long bdi_position_ratio(struct backing_dev_info *bdi, + + if (bdi_dirty < x_intercept - span / 4) { + pos_ratio = div64_u64(pos_ratio * (x_intercept - bdi_dirty), +- x_intercept - bdi_setpoint + 1); ++ (x_intercept - bdi_setpoint) | 1); + } else + pos_ratio /= 4; + +diff --git a/mm/rmap.c b/mm/rmap.c +index 440c71c43b8d..ecb6136559b6 100644 +--- a/mm/rmap.c ++++ b/mm/rmap.c +@@ -72,6 +72,8 @@ static inline struct anon_vma *anon_vma_alloc(void) + anon_vma = kmem_cache_alloc(anon_vma_cachep, GFP_KERNEL); + if (anon_vma) { + atomic_set(&anon_vma->refcount, 1); ++ anon_vma->degree = 1; /* Reference for first vma */ ++ anon_vma->parent = anon_vma; + /* + * Initialise the anon_vma root to point to itself. If called + * from fork, the root will be reset to the parents anon_vma. +@@ -188,6 +190,8 @@ int anon_vma_prepare(struct vm_area_struct *vma) + if (likely(!vma->anon_vma)) { + vma->anon_vma = anon_vma; + anon_vma_chain_link(vma, avc, anon_vma); ++ /* vma reference or self-parent link for new root */ ++ anon_vma->degree++; + allocated = NULL; + avc = NULL; + } +@@ -236,6 +240,14 @@ static inline void unlock_anon_vma_root(struct anon_vma *root) + /* + * Attach the anon_vmas from src to dst. + * Returns 0 on success, -ENOMEM on failure. ++ * ++ * If dst->anon_vma is NULL this function tries to find and reuse existing ++ * anon_vma which has no vmas and only one child anon_vma. This prevents ++ * degradation of anon_vma hierarchy to endless linear chain in case of ++ * constantly forking task. On the other hand, an anon_vma with more than one ++ * child isn't reused even if there was no alive vma, thus rmap walker has a ++ * good chance of avoiding scanning the whole hierarchy when it searches where ++ * page is mapped. + */ + int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src) + { +@@ -256,11 +268,32 @@ int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src) + anon_vma = pavc->anon_vma; + root = lock_anon_vma_root(root, anon_vma); + anon_vma_chain_link(dst, avc, anon_vma); ++ ++ /* ++ * Reuse existing anon_vma if its degree lower than two, ++ * that means it has no vma and only one anon_vma child. ++ * ++ * Do not chose parent anon_vma, otherwise first child ++ * will always reuse it. Root anon_vma is never reused: ++ * it has self-parent reference and at least one child. ++ */ ++ if (!dst->anon_vma && anon_vma != src->anon_vma && ++ anon_vma->degree < 2) ++ dst->anon_vma = anon_vma; + } ++ if (dst->anon_vma) ++ dst->anon_vma->degree++; + unlock_anon_vma_root(root); + return 0; + + enomem_failure: ++ /* ++ * dst->anon_vma is dropped here otherwise its degree can be incorrectly ++ * decremented in unlink_anon_vmas(). ++ * We can safely do this because callers of anon_vma_clone() don't care ++ * about dst->anon_vma if anon_vma_clone() failed. ++ */ ++ dst->anon_vma = NULL; + unlink_anon_vmas(dst); + return -ENOMEM; + } +@@ -280,6 +313,9 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma) + if (!pvma->anon_vma) + return 0; + ++ /* Drop inherited anon_vma, we'll reuse existing or allocate new. */ ++ vma->anon_vma = NULL; ++ + /* + * First, attach the new VMA to the parent VMA's anon_vmas, + * so rmap can find non-COWed pages in child processes. +@@ -288,6 +324,10 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma) + if (error) + return error; + ++ /* An existing anon_vma has been reused, all done then. */ ++ if (vma->anon_vma) ++ return 0; ++ + /* Then add our own anon_vma. */ + anon_vma = anon_vma_alloc(); + if (!anon_vma) +@@ -301,6 +341,7 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma) + * lock any of the anon_vmas in this anon_vma tree. + */ + anon_vma->root = pvma->anon_vma->root; ++ anon_vma->parent = pvma->anon_vma; + /* + * With refcounts, an anon_vma can stay around longer than the + * process it belongs to. The root anon_vma needs to be pinned until +@@ -311,6 +352,7 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma) + vma->anon_vma = anon_vma; + anon_vma_lock_write(anon_vma); + anon_vma_chain_link(vma, avc, anon_vma); ++ anon_vma->parent->degree++; + anon_vma_unlock_write(anon_vma); + + return 0; +@@ -341,12 +383,16 @@ void unlink_anon_vmas(struct vm_area_struct *vma) + * Leave empty anon_vmas on the list - we'll need + * to free them outside the lock. + */ +- if (RB_EMPTY_ROOT(&anon_vma->rb_root)) ++ if (RB_EMPTY_ROOT(&anon_vma->rb_root)) { ++ anon_vma->parent->degree--; + continue; ++ } + + list_del(&avc->same_vma); + anon_vma_chain_free(avc); + } ++ if (vma->anon_vma) ++ vma->anon_vma->degree--; + unlock_anon_vma_root(root); + + /* +@@ -357,6 +403,7 @@ void unlink_anon_vmas(struct vm_area_struct *vma) + list_for_each_entry_safe(avc, next, &vma->anon_vma_chain, same_vma) { + struct anon_vma *anon_vma = avc->anon_vma; + ++ BUG_ON(anon_vma->degree); + put_anon_vma(anon_vma); + + list_del(&avc->same_vma); +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index 17313d17a923..fa8448a730a9 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -277,13 +277,14 @@ nodata: + EXPORT_SYMBOL(__alloc_skb); + + /** +- * build_skb - build a network buffer ++ * __build_skb - build a network buffer + * @data: data buffer provided by caller +- * @frag_size: size of fragment, or 0 if head was kmalloced ++ * @frag_size: size of data, or 0 if head was kmalloced + * + * Allocate a new &sk_buff. Caller provides space holding head and + * skb_shared_info. @data must have been allocated by kmalloc() only if +- * @frag_size is 0, otherwise data should come from the page allocator. ++ * @frag_size is 0, otherwise data should come from the page allocator ++ * or vmalloc() + * The return is the new skb buffer. + * On a failure the return is %NULL, and @data is not freed. + * Notes : +@@ -294,7 +295,7 @@ EXPORT_SYMBOL(__alloc_skb); + * before giving packet to stack. + * RX rings only contains data buffers, not full skbs. + */ +-struct sk_buff *build_skb(void *data, unsigned int frag_size) ++struct sk_buff *__build_skb(void *data, unsigned int frag_size) + { + struct skb_shared_info *shinfo; + struct sk_buff *skb; +@@ -308,7 +309,6 @@ struct sk_buff *build_skb(void *data, unsigned int frag_size) + + memset(skb, 0, offsetof(struct sk_buff, tail)); + skb->truesize = SKB_TRUESIZE(size); +- skb->head_frag = frag_size != 0; + atomic_set(&skb->users, 1); + skb->head = data; + skb->data = data; +@@ -325,6 +325,23 @@ struct sk_buff *build_skb(void *data, unsigned int frag_size) + + return skb; + } ++ ++/* build_skb() is wrapper over __build_skb(), that specifically ++ * takes care of skb->head and skb->pfmemalloc ++ * This means that if @frag_size is not zero, then @data must be backed ++ * by a page fragment, not kmalloc() or vmalloc() ++ */ ++struct sk_buff *build_skb(void *data, unsigned int frag_size) ++{ ++ struct sk_buff *skb = __build_skb(data, frag_size); ++ ++ if (skb && frag_size) { ++ skb->head_frag = 1; ++ if (virt_to_head_page(data)->pfmemalloc) ++ skb->pfmemalloc = 1; ++ } ++ return skb; ++} + EXPORT_SYMBOL(build_skb); + + struct netdev_alloc_cache { +@@ -351,7 +368,8 @@ refill: + gfp_t gfp = gfp_mask; + + if (order) +- gfp |= __GFP_COMP | __GFP_NOWARN; ++ gfp |= __GFP_COMP | __GFP_NOWARN | ++ __GFP_NOMEMALLOC; + nc->frag.page = alloc_pages(gfp, order); + if (likely(nc->frag.page)) + break; +diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c +index 31ee5c6033df..479e8a63125a 100644 +--- a/net/ipv4/ip_forward.c ++++ b/net/ipv4/ip_forward.c +@@ -126,6 +126,9 @@ int ip_forward(struct sk_buff *skb) + struct rtable *rt; /* Route we use */ + struct ip_options *opt = &(IPCB(skb)->opt); + ++ if (unlikely(skb->sk)) ++ goto drop; ++ + if (skb_warn_if_lro(skb)) + goto drop; + +diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c +index a9f8e66f6dad..54012b8c0ef9 100644 +--- a/net/ipv4/ping.c ++++ b/net/ipv4/ping.c +@@ -154,6 +154,7 @@ void ping_unhash(struct sock *sk) + if (sk_hashed(sk)) { + write_lock_bh(&ping_table.lock); + hlist_nulls_del(&sk->sk_nulls_node); ++ sk_nulls_node_init(&sk->sk_nulls_node); + sock_put(sk); + isk->inet_num = 0; + isk->inet_sport = 0; +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 72d11b4593c8..47b27e9dd8cc 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -2581,39 +2581,65 @@ begin_fwd: + } + } + +-/* Send a fin. The caller locks the socket for us. This cannot be +- * allowed to fail queueing a FIN frame under any circumstances. ++/* We allow to exceed memory limits for FIN packets to expedite ++ * connection tear down and (memory) recovery. ++ * Otherwise tcp_send_fin() could be tempted to either delay FIN ++ * or even be forced to close flow without any FIN. ++ */ ++static void sk_forced_wmem_schedule(struct sock *sk, int size) ++{ ++ int amt, status; ++ ++ if (size <= sk->sk_forward_alloc) ++ return; ++ amt = sk_mem_pages(size); ++ sk->sk_forward_alloc += amt * SK_MEM_QUANTUM; ++ sk_memory_allocated_add(sk, amt, &status); ++} ++ ++/* Send a FIN. The caller locks the socket for us. ++ * We should try to send a FIN packet really hard, but eventually give up. + */ + void tcp_send_fin(struct sock *sk) + { ++ struct sk_buff *skb, *tskb = tcp_write_queue_tail(sk); + struct tcp_sock *tp = tcp_sk(sk); +- struct sk_buff *skb = tcp_write_queue_tail(sk); +- int mss_now; + +- /* Optimization, tack on the FIN if we have a queue of +- * unsent frames. But be careful about outgoing SACKS +- * and IP options. ++ /* Optimization, tack on the FIN if we have one skb in write queue and ++ * this skb was not yet sent, or we are under memory pressure. ++ * Note: in the latter case, FIN packet will be sent after a timeout, ++ * as TCP stack thinks it has already been transmitted. + */ +- mss_now = tcp_current_mss(sk); +- +- if (tcp_send_head(sk) != NULL) { +- TCP_SKB_CB(skb)->tcp_flags |= TCPHDR_FIN; +- TCP_SKB_CB(skb)->end_seq++; ++ if (tskb && (tcp_send_head(sk) || sk_under_memory_pressure(sk))) { ++coalesce: ++ TCP_SKB_CB(tskb)->tcp_flags |= TCPHDR_FIN; ++ TCP_SKB_CB(tskb)->end_seq++; + tp->write_seq++; ++ if (!tcp_send_head(sk)) { ++ /* This means tskb was already sent. ++ * Pretend we included the FIN on previous transmit. ++ * We need to set tp->snd_nxt to the value it would have ++ * if FIN had been sent. This is because retransmit path ++ * does not change tp->snd_nxt. ++ */ ++ tp->snd_nxt++; ++ return; ++ } + } else { +- /* Socket is locked, keep trying until memory is available. */ +- for (;;) { +- skb = sk_stream_alloc_skb(sk, 0, sk->sk_allocation); +- if (skb) +- break; +- yield(); ++ skb = alloc_skb_fclone(MAX_TCP_HEADER, sk->sk_allocation); ++ if (unlikely(!skb)) { ++ if (tskb) ++ goto coalesce; ++ return; + } ++ skb_reserve(skb, MAX_TCP_HEADER); ++ sk_forced_wmem_schedule(sk, skb->truesize); + /* FIN eats a sequence byte, write_seq advanced by tcp_queue_skb(). */ + tcp_init_nondata_skb(skb, tp->write_seq, + TCPHDR_ACK | TCPHDR_FIN); + tcp_queue_skb(sk, skb); + } +- __tcp_push_pending_frames(sk, mss_now, TCP_NAGLE_OFF); ++ __tcp_push_pending_frames(sk, tcp_current_mss(sk), TCP_NAGLE_OFF); + } + + /* We get here when a process closes a file descriptor (either due to +diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c +index 00590135dc30..5a75a1eb3ae7 100644 +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -1616,13 +1616,11 @@ static struct sk_buff *netlink_alloc_large_skb(unsigned int size, + if (data == NULL) + return NULL; + +- skb = build_skb(data, size); ++ skb = __build_skb(data, size); + if (skb == NULL) + vfree(data); +- else { +- skb->head_frag = 0; ++ else + skb->destructor = netlink_skb_destructor; +- } + + return skb; + } +diff --git a/sound/oss/sequencer.c b/sound/oss/sequencer.c +index 4ff60a6427d9..2e67dd590be5 100644 +--- a/sound/oss/sequencer.c ++++ b/sound/oss/sequencer.c +@@ -683,13 +683,8 @@ static int seq_timing_event(unsigned char *event_rec) + break; + + case TMR_ECHO: +- if (seq_mode == SEQ_2) +- seq_copy_to_input(event_rec, 8); +- else +- { +- parm = (parm << 8 | SEQ_ECHO); +- seq_copy_to_input((unsigned char *) &parm, 4); +- } ++ parm = (parm << 8 | SEQ_ECHO); ++ seq_copy_to_input((unsigned char *) &parm, 4); + break; + + default:; +@@ -1332,7 +1327,6 @@ int sequencer_ioctl(int dev, struct file *file, unsigned int cmd, void __user *a + int mode = translate_mode(file); + struct synth_info inf; + struct seq_event_rec event_rec; +- unsigned long flags; + int __user *p = arg; + + orig_dev = dev = dev >> 4; +@@ -1487,9 +1481,7 @@ int sequencer_ioctl(int dev, struct file *file, unsigned int cmd, void __user *a + case SNDCTL_SEQ_OUTOFBAND: + if (copy_from_user(&event_rec, arg, sizeof(event_rec))) + return -EFAULT; +- spin_lock_irqsave(&lock,flags); + play_event(event_rec.arr); +- spin_unlock_irqrestore(&lock,flags); + return 0; + + case SNDCTL_MIDI_INFO: +diff --git a/sound/pci/emu10k1/emu10k1.c b/sound/pci/emu10k1/emu10k1.c +index 9e1bd0c39a8c..6757458e8db6 100644 +--- a/sound/pci/emu10k1/emu10k1.c ++++ b/sound/pci/emu10k1/emu10k1.c +@@ -181,8 +181,10 @@ static int snd_card_emu10k1_probe(struct pci_dev *pci, + } + #endif + +- strcpy(card->driver, emu->card_capabilities->driver); +- strcpy(card->shortname, emu->card_capabilities->name); ++ strlcpy(card->driver, emu->card_capabilities->driver, ++ sizeof(card->driver)); ++ strlcpy(card->shortname, emu->card_capabilities->name, ++ sizeof(card->shortname)); + snprintf(card->longname, sizeof(card->longname), + "%s (rev.%d, serial:0x%x) at 0x%lx, irq %i", + card->shortname, emu->revision, emu->serial, emu->port, emu->irq); +diff --git a/sound/pci/emu10k1/emu10k1_callback.c b/sound/pci/emu10k1/emu10k1_callback.c +index 0a34b5f1c475..f8a6549f00e5 100644 +--- a/sound/pci/emu10k1/emu10k1_callback.c ++++ b/sound/pci/emu10k1/emu10k1_callback.c +@@ -415,7 +415,7 @@ start_voice(struct snd_emux_voice *vp) + snd_emu10k1_ptr_write(hw, Z2, ch, 0); + + /* invalidate maps */ +- temp = (hw->silent_page.addr << 1) | MAP_PTI_MASK; ++ temp = (hw->silent_page.addr << hw->address_mode) | (hw->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0); + snd_emu10k1_ptr_write(hw, MAPA, ch, temp); + snd_emu10k1_ptr_write(hw, MAPB, ch, temp); + #if 0 +@@ -436,7 +436,7 @@ start_voice(struct snd_emux_voice *vp) + snd_emu10k1_ptr_write(hw, CDF, ch, sample); + + /* invalidate maps */ +- temp = ((unsigned int)hw->silent_page.addr << 1) | MAP_PTI_MASK; ++ temp = ((unsigned int)hw->silent_page.addr << hw_address_mode) | (hw->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0); + snd_emu10k1_ptr_write(hw, MAPA, ch, temp); + snd_emu10k1_ptr_write(hw, MAPB, ch, temp); + +diff --git a/sound/pci/emu10k1/emu10k1_main.c b/sound/pci/emu10k1/emu10k1_main.c +index bdd888ec9a84..a131092572e6 100644 +--- a/sound/pci/emu10k1/emu10k1_main.c ++++ b/sound/pci/emu10k1/emu10k1_main.c +@@ -282,7 +282,7 @@ static int snd_emu10k1_init(struct snd_emu10k1 *emu, int enable_ir, int resume) + snd_emu10k1_ptr_write(emu, TCB, 0, 0); /* taken from original driver */ + snd_emu10k1_ptr_write(emu, TCBS, 0, 4); /* taken from original driver */ + +- silent_page = (emu->silent_page.addr << 1) | MAP_PTI_MASK; ++ silent_page = (emu->silent_page.addr << emu->address_mode) | (emu->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0); + for (ch = 0; ch < NUM_G; ch++) { + snd_emu10k1_ptr_write(emu, MAPA, ch, silent_page); + snd_emu10k1_ptr_write(emu, MAPB, ch, silent_page); +@@ -348,6 +348,11 @@ static int snd_emu10k1_init(struct snd_emu10k1 *emu, int enable_ir, int resume) + outl(reg | A_IOCFG_GPOUT0, emu->port + A_IOCFG); + } + ++ if (emu->address_mode == 0) { ++ /* use 16M in 4G */ ++ outl(inl(emu->port + HCFG) | HCFG_EXPANDED_MEM, emu->port + HCFG); ++ } ++ + return 0; + } + +@@ -1411,7 +1416,7 @@ static struct snd_emu_chip_details emu_chip_details[] = { + * + */ + {.vendor = 0x1102, .device = 0x0008, .subsystem = 0x20011102, +- .driver = "Audigy2", .name = "SB Audigy 2 ZS Notebook [SB0530]", ++ .driver = "Audigy2", .name = "Audigy 2 ZS Notebook [SB0530]", + .id = "Audigy2", + .emu10k2_chip = 1, + .ca0108_chip = 1, +@@ -1561,7 +1566,7 @@ static struct snd_emu_chip_details emu_chip_details[] = { + .adc_1361t = 1, /* 24 bit capture instead of 16bit */ + .ac97_chip = 1} , + {.vendor = 0x1102, .device = 0x0004, .subsystem = 0x10051102, +- .driver = "Audigy2", .name = "SB Audigy 2 Platinum EX [SB0280]", ++ .driver = "Audigy2", .name = "Audigy 2 Platinum EX [SB0280]", + .id = "Audigy2", + .emu10k2_chip = 1, + .ca0102_chip = 1, +@@ -1865,8 +1870,10 @@ int snd_emu10k1_create(struct snd_card *card, + + is_audigy = emu->audigy = c->emu10k2_chip; + ++ /* set addressing mode */ ++ emu->address_mode = is_audigy ? 0 : 1; + /* set the DMA transfer mask */ +- emu->dma_mask = is_audigy ? AUDIGY_DMA_MASK : EMU10K1_DMA_MASK; ++ emu->dma_mask = emu->address_mode ? EMU10K1_DMA_MASK : AUDIGY_DMA_MASK; + if (pci_set_dma_mask(pci, emu->dma_mask) < 0 || + pci_set_consistent_dma_mask(pci, emu->dma_mask) < 0) { + snd_printk(KERN_ERR "architecture does not support PCI busmaster DMA with mask 0x%lx\n", emu->dma_mask); +@@ -1889,7 +1896,7 @@ int snd_emu10k1_create(struct snd_card *card, + + emu->max_cache_pages = max_cache_bytes >> PAGE_SHIFT; + if (snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV, snd_dma_pci_data(pci), +- 32 * 1024, &emu->ptb_pages) < 0) { ++ (emu->address_mode ? 32 : 16) * 1024, &emu->ptb_pages) < 0) { + err = -ENOMEM; + goto error; + } +@@ -1988,8 +1995,8 @@ int snd_emu10k1_create(struct snd_card *card, + + /* Clear silent pages and set up pointers */ + memset(emu->silent_page.area, 0, PAGE_SIZE); +- silent_page = emu->silent_page.addr << 1; +- for (idx = 0; idx < MAXPAGES; idx++) ++ silent_page = emu->silent_page.addr << emu->address_mode; ++ for (idx = 0; idx < (emu->address_mode ? MAXPAGES1 : MAXPAGES0); idx++) + ((u32 *)emu->ptb_pages.area)[idx] = cpu_to_le32(silent_page | idx); + + /* set up voice indices */ +diff --git a/sound/pci/emu10k1/emupcm.c b/sound/pci/emu10k1/emupcm.c +index 5ae1d045bdcb..7581019d7c84 100644 +--- a/sound/pci/emu10k1/emupcm.c ++++ b/sound/pci/emu10k1/emupcm.c +@@ -379,7 +379,7 @@ static void snd_emu10k1_pcm_init_voice(struct snd_emu10k1 *emu, + snd_emu10k1_ptr_write(emu, Z1, voice, 0); + snd_emu10k1_ptr_write(emu, Z2, voice, 0); + /* invalidate maps */ +- silent_page = ((unsigned int)emu->silent_page.addr << 1) | MAP_PTI_MASK; ++ silent_page = ((unsigned int)emu->silent_page.addr << emu->address_mode) | (emu->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0); + snd_emu10k1_ptr_write(emu, MAPA, voice, silent_page); + snd_emu10k1_ptr_write(emu, MAPB, voice, silent_page); + /* modulation envelope */ +diff --git a/sound/pci/emu10k1/emuproc.c b/sound/pci/emu10k1/emuproc.c +index 2ca9f2e93139..53745f4c2bf5 100644 +--- a/sound/pci/emu10k1/emuproc.c ++++ b/sound/pci/emu10k1/emuproc.c +@@ -241,31 +241,22 @@ static void snd_emu10k1_proc_spdif_read(struct snd_info_entry *entry, + struct snd_emu10k1 *emu = entry->private_data; + u32 value; + u32 value2; +- unsigned long flags; + u32 rate; + + if (emu->card_capabilities->emu_model) { +- spin_lock_irqsave(&emu->emu_lock, flags); + snd_emu1010_fpga_read(emu, 0x38, &value); +- spin_unlock_irqrestore(&emu->emu_lock, flags); + if ((value & 0x1) == 0) { +- spin_lock_irqsave(&emu->emu_lock, flags); + snd_emu1010_fpga_read(emu, 0x2a, &value); + snd_emu1010_fpga_read(emu, 0x2b, &value2); +- spin_unlock_irqrestore(&emu->emu_lock, flags); + rate = 0x1770000 / (((value << 5) | value2)+1); + snd_iprintf(buffer, "ADAT Locked : %u\n", rate); + } else { + snd_iprintf(buffer, "ADAT Unlocked\n"); + } +- spin_lock_irqsave(&emu->emu_lock, flags); + snd_emu1010_fpga_read(emu, 0x20, &value); +- spin_unlock_irqrestore(&emu->emu_lock, flags); + if ((value & 0x4) == 0) { +- spin_lock_irqsave(&emu->emu_lock, flags); + snd_emu1010_fpga_read(emu, 0x28, &value); + snd_emu1010_fpga_read(emu, 0x29, &value2); +- spin_unlock_irqrestore(&emu->emu_lock, flags); + rate = 0x1770000 / (((value << 5) | value2)+1); + snd_iprintf(buffer, "SPDIF Locked : %d\n", rate); + } else { +@@ -410,14 +401,11 @@ static void snd_emu_proc_emu1010_reg_read(struct snd_info_entry *entry, + { + struct snd_emu10k1 *emu = entry->private_data; + u32 value; +- unsigned long flags; + int i; + snd_iprintf(buffer, "EMU1010 Registers:\n\n"); + + for(i = 0; i < 0x40; i+=1) { +- spin_lock_irqsave(&emu->emu_lock, flags); + snd_emu1010_fpga_read(emu, i, &value); +- spin_unlock_irqrestore(&emu->emu_lock, flags); + snd_iprintf(buffer, "%02X: %08X, %02X\n", i, value, (value >> 8) & 0x7f); + } + } +diff --git a/sound/pci/emu10k1/memory.c b/sound/pci/emu10k1/memory.c +index ae709c1ab3a8..d514458efe3d 100644 +--- a/sound/pci/emu10k1/memory.c ++++ b/sound/pci/emu10k1/memory.c +@@ -34,10 +34,11 @@ + * aligned pages in others + */ + #define __set_ptb_entry(emu,page,addr) \ +- (((u32 *)(emu)->ptb_pages.area)[page] = cpu_to_le32(((addr) << 1) | (page))) ++ (((u32 *)(emu)->ptb_pages.area)[page] = cpu_to_le32(((addr) << (emu->address_mode)) | (page))) + + #define UNIT_PAGES (PAGE_SIZE / EMUPAGESIZE) +-#define MAX_ALIGN_PAGES (MAXPAGES / UNIT_PAGES) ++#define MAX_ALIGN_PAGES0 (MAXPAGES0 / UNIT_PAGES) ++#define MAX_ALIGN_PAGES1 (MAXPAGES1 / UNIT_PAGES) + /* get aligned page from offset address */ + #define get_aligned_page(offset) ((offset) >> PAGE_SHIFT) + /* get offset address from aligned page */ +@@ -124,7 +125,7 @@ static int search_empty_map_area(struct snd_emu10k1 *emu, int npages, struct lis + } + page = blk->mapped_page + blk->pages; + } +- size = MAX_ALIGN_PAGES - page; ++ size = (emu->address_mode ? MAX_ALIGN_PAGES1 : MAX_ALIGN_PAGES0) - page; + if (size >= max_size) { + *nextp = pos; + return page; +@@ -181,7 +182,7 @@ static int unmap_memblk(struct snd_emu10k1 *emu, struct snd_emu10k1_memblk *blk) + q = get_emu10k1_memblk(p, mapped_link); + end_page = q->mapped_page; + } else +- end_page = MAX_ALIGN_PAGES; ++ end_page = (emu->address_mode ? MAX_ALIGN_PAGES1 : MAX_ALIGN_PAGES0); + + /* remove links */ + list_del(&blk->mapped_link); +@@ -305,7 +306,7 @@ snd_emu10k1_alloc_pages(struct snd_emu10k1 *emu, struct snd_pcm_substream *subst + if (snd_BUG_ON(!emu)) + return NULL; + if (snd_BUG_ON(runtime->dma_bytes <= 0 || +- runtime->dma_bytes >= MAXPAGES * EMUPAGESIZE)) ++ runtime->dma_bytes >= (emu->address_mode ? MAXPAGES1 : MAXPAGES0) * EMUPAGESIZE)) + return NULL; + hdr = emu->memhdr; + if (snd_BUG_ON(!hdr)) +diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c +index fed93cb2ee2f..931bd7386326 100644 +--- a/sound/pci/hda/hda_codec.c ++++ b/sound/pci/hda/hda_codec.c +@@ -2012,6 +2012,16 @@ static void put_vol_mute(struct hda_codec *codec, unsigned int amp_caps, + snd_hda_codec_write(codec, nid, 0, AC_VERB_SET_AMP_GAIN_MUTE, parm); + } + ++/* meta hook to call each driver's vmaster hook */ ++static void vmaster_hook(void *private_data, int enabled) ++{ ++ struct hda_vmaster_mute_hook *hook = private_data; ++ ++ if (hook->mute_mode != HDA_VMUTE_FOLLOW_MASTER) ++ enabled = hook->mute_mode; ++ hook->hook(hook->codec, enabled); ++} ++ + /** + * snd_hda_codec_amp_read - Read AMP value + * @codec: HD-audio codec +@@ -2834,9 +2844,9 @@ int snd_hda_add_vmaster_hook(struct hda_codec *codec, + + if (!hook->hook || !hook->sw_kctl) + return 0; +- snd_ctl_add_vmaster_hook(hook->sw_kctl, hook->hook, codec); + hook->codec = codec; + hook->mute_mode = HDA_VMUTE_FOLLOW_MASTER; ++ snd_ctl_add_vmaster_hook(hook->sw_kctl, vmaster_hook, hook); + if (!expose_enum_ctl) + return 0; + kctl = snd_ctl_new1(&vmaster_mute_mode, hook); +@@ -2859,14 +2869,7 @@ void snd_hda_sync_vmaster_hook(struct hda_vmaster_mute_hook *hook) + */ + if (hook->codec->bus->shutdown) + return; +- switch (hook->mute_mode) { +- case HDA_VMUTE_FOLLOW_MASTER: +- snd_ctl_sync_vmaster_hook(hook->sw_kctl); +- break; +- default: +- hook->hook(hook->codec, hook->mute_mode); +- break; +- } ++ snd_ctl_sync_vmaster_hook(hook->sw_kctl); + } + EXPORT_SYMBOL_HDA(snd_hda_sync_vmaster_hook); + +diff --git a/sound/synth/emux/emux_oss.c b/sound/synth/emux/emux_oss.c +index 319754cf6208..daf61abc3670 100644 +--- a/sound/synth/emux/emux_oss.c ++++ b/sound/synth/emux/emux_oss.c +@@ -118,12 +118,8 @@ snd_emux_open_seq_oss(struct snd_seq_oss_arg *arg, void *closure) + if (snd_BUG_ON(!arg || !emu)) + return -ENXIO; + +- mutex_lock(&emu->register_mutex); +- +- if (!snd_emux_inc_count(emu)) { +- mutex_unlock(&emu->register_mutex); ++ if (!snd_emux_inc_count(emu)) + return -EFAULT; +- } + + memset(&callback, 0, sizeof(callback)); + callback.owner = THIS_MODULE; +@@ -135,7 +131,6 @@ snd_emux_open_seq_oss(struct snd_seq_oss_arg *arg, void *closure) + if (p == NULL) { + snd_printk(KERN_ERR "can't create port\n"); + snd_emux_dec_count(emu); +- mutex_unlock(&emu->register_mutex); + return -ENOMEM; + } + +@@ -148,8 +143,6 @@ snd_emux_open_seq_oss(struct snd_seq_oss_arg *arg, void *closure) + reset_port_mode(p, arg->seq_mode); + + snd_emux_reset_port(p); +- +- mutex_unlock(&emu->register_mutex); + return 0; + } + +@@ -195,13 +188,11 @@ snd_emux_close_seq_oss(struct snd_seq_oss_arg *arg) + if (snd_BUG_ON(!emu)) + return -ENXIO; + +- mutex_lock(&emu->register_mutex); + snd_emux_sounds_off_all(p); + snd_soundfont_close_check(emu->sflist, SF_CLIENT_NO(p->chset.port)); + snd_seq_event_port_detach(p->chset.client, p->chset.port); + snd_emux_dec_count(emu); + +- mutex_unlock(&emu->register_mutex); + return 0; + } + +diff --git a/sound/synth/emux/emux_seq.c b/sound/synth/emux/emux_seq.c +index 7778b8e19782..a0209204ae48 100644 +--- a/sound/synth/emux/emux_seq.c ++++ b/sound/synth/emux/emux_seq.c +@@ -124,12 +124,10 @@ snd_emux_detach_seq(struct snd_emux *emu) + if (emu->voices) + snd_emux_terminate_all(emu); + +- mutex_lock(&emu->register_mutex); + if (emu->client >= 0) { + snd_seq_delete_kernel_client(emu->client); + emu->client = -1; + } +- mutex_unlock(&emu->register_mutex); + } + + +@@ -269,8 +267,8 @@ snd_emux_event_input(struct snd_seq_event *ev, int direct, void *private_data, + /* + * increment usage count + */ +-int +-snd_emux_inc_count(struct snd_emux *emu) ++static int ++__snd_emux_inc_count(struct snd_emux *emu) + { + emu->used++; + if (!try_module_get(emu->ops.owner)) +@@ -284,12 +282,21 @@ snd_emux_inc_count(struct snd_emux *emu) + return 1; + } + ++int snd_emux_inc_count(struct snd_emux *emu) ++{ ++ int ret; ++ ++ mutex_lock(&emu->register_mutex); ++ ret = __snd_emux_inc_count(emu); ++ mutex_unlock(&emu->register_mutex); ++ return ret; ++} + + /* + * decrease usage count + */ +-void +-snd_emux_dec_count(struct snd_emux *emu) ++static void ++__snd_emux_dec_count(struct snd_emux *emu) + { + module_put(emu->card->module); + emu->used--; +@@ -298,6 +305,12 @@ snd_emux_dec_count(struct snd_emux *emu) + module_put(emu->ops.owner); + } + ++void snd_emux_dec_count(struct snd_emux *emu) ++{ ++ mutex_lock(&emu->register_mutex); ++ __snd_emux_dec_count(emu); ++ mutex_unlock(&emu->register_mutex); ++} + + /* + * Routine that is called upon a first use of a particular port +@@ -317,7 +330,7 @@ snd_emux_use(void *private_data, struct snd_seq_port_subscribe *info) + + mutex_lock(&emu->register_mutex); + snd_emux_init_port(p); +- snd_emux_inc_count(emu); ++ __snd_emux_inc_count(emu); + mutex_unlock(&emu->register_mutex); + return 0; + } +@@ -340,7 +353,7 @@ snd_emux_unuse(void *private_data, struct snd_seq_port_subscribe *info) + + mutex_lock(&emu->register_mutex); + snd_emux_sounds_off_all(p); +- snd_emux_dec_count(emu); ++ __snd_emux_dec_count(emu); + mutex_unlock(&emu->register_mutex); + return 0; + } +diff --git a/tools/lib/traceevent/kbuffer-parse.c b/tools/lib/traceevent/kbuffer-parse.c +index dcc665228c71..deb3569ab004 100644 +--- a/tools/lib/traceevent/kbuffer-parse.c ++++ b/tools/lib/traceevent/kbuffer-parse.c +@@ -372,7 +372,6 @@ translate_data(struct kbuffer *kbuf, void *data, void **rptr, + switch (type_len) { + case KBUFFER_TYPE_PADDING: + *length = read_4(kbuf, data); +- data += *length; + break; + + case KBUFFER_TYPE_TIME_EXTEND: +diff --git a/tools/power/x86/turbostat/Makefile b/tools/power/x86/turbostat/Makefile +index d1b3a361e526..4039854560d0 100644 +--- a/tools/power/x86/turbostat/Makefile ++++ b/tools/power/x86/turbostat/Makefile +@@ -1,8 +1,12 @@ + CC = $(CROSS_COMPILE)gcc +-BUILD_OUTPUT := $(PWD) ++BUILD_OUTPUT := $(CURDIR) + PREFIX := /usr + DESTDIR := + ++ifeq ("$(origin O)", "command line") ++ BUILD_OUTPUT := $(O) ++endif ++ + turbostat : turbostat.c + CFLAGS += -Wall + CFLAGS += -DMSRHEADER='"../../../../arch/x86/include/uapi/asm/msr-index.h"' +diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c +index e068d0017fb8..a3510441f7d7 100644 +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -1540,8 +1540,8 @@ int kvm_gfn_to_hva_cache_init(struct kvm *kvm, struct gfn_to_hva_cache *ghc, + ghc->generation = slots->generation; + ghc->len = len; + ghc->memslot = gfn_to_memslot(kvm, start_gfn); +- ghc->hva = gfn_to_hva_many(ghc->memslot, start_gfn, &nr_pages_avail); +- if (!kvm_is_error_hva(ghc->hva) && nr_pages_avail >= nr_pages_needed) { ++ ghc->hva = gfn_to_hva_many(ghc->memslot, start_gfn, NULL); ++ if (!kvm_is_error_hva(ghc->hva) && nr_pages_needed <= 1) { + ghc->hva += offset; + } else { + /* |