diff options
| -rw-r--r-- | 0000_README | 4 | ||||
| -rw-r--r-- | 1097_linux-3.4.98.patch | 1534 |
2 files changed, 1538 insertions, 0 deletions
diff --git a/0000_README b/0000_README index bacfd0f4..3c720761 100644 --- a/0000_README +++ b/0000_README @@ -427,6 +427,10 @@ Patch: 1096_linux-3.4.97.patch From: http://www.kernel.org Desc: Linux 3.4.97 +Patch: 1097_linux-3.4.98.patch +From: http://www.kernel.org +Desc: Linux 3.4.98 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1097_linux-3.4.98.patch b/1097_linux-3.4.98.patch new file mode 100644 index 00000000..db655a8c --- /dev/null +++ b/1097_linux-3.4.98.patch @@ -0,0 +1,1534 @@ +diff --git a/Makefile b/Makefile +index fdd7c32ea1f7..d277446ee8ee 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 4 +-SUBLEVEL = 97 ++SUBLEVEL = 98 + EXTRAVERSION = + NAME = Saber-toothed Squirrel + +diff --git a/arch/arm/mach-omap2/mux.c b/arch/arm/mach-omap2/mux.c +index 65c33911341f..90b33c55ac1b 100644 +--- a/arch/arm/mach-omap2/mux.c ++++ b/arch/arm/mach-omap2/mux.c +@@ -184,8 +184,10 @@ static int __init _omap_mux_get_by_name(struct omap_mux_partition *partition, + m0_entry = mux->muxnames[0]; + + /* First check for full name in mode0.muxmode format */ +- if (mode0_len && strncmp(muxname, m0_entry, mode0_len)) +- continue; ++ if (mode0_len) ++ if (strncmp(muxname, m0_entry, mode0_len) || ++ (strlen(m0_entry) != mode0_len)) ++ continue; + + /* Then check for muxmode only */ + for (i = 0; i < OMAP_MUX_NR_MODES; i++) { +diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S +index 8f880bc77c56..846a16378d01 100644 +--- a/arch/powerpc/kernel/exceptions-64s.S ++++ b/arch/powerpc/kernel/exceptions-64s.S +@@ -491,7 +491,7 @@ machine_check_common: + STD_EXCEPTION_COMMON(0xb00, trap_0b, .unknown_exception) + STD_EXCEPTION_COMMON(0xd00, single_step, .single_step_exception) + STD_EXCEPTION_COMMON(0xe00, trap_0e, .unknown_exception) +- STD_EXCEPTION_COMMON(0xe40, emulation_assist, .program_check_exception) ++ STD_EXCEPTION_COMMON(0xe40, emulation_assist, .emulation_assist_interrupt) + STD_EXCEPTION_COMMON(0xe60, hmi_exception, .unknown_exception) + STD_EXCEPTION_COMMON_ASYNC(0xf00, performance_monitor, .performance_monitor_exception) + STD_EXCEPTION_COMMON(0x1300, instruction_breakpoint, .instruction_breakpoint_exception) +diff --git a/arch/powerpc/kernel/lparcfg.c b/arch/powerpc/kernel/lparcfg.c +index f5725bce9ed2..f62fda1b6d61 100644 +--- a/arch/powerpc/kernel/lparcfg.c ++++ b/arch/powerpc/kernel/lparcfg.c +@@ -35,7 +35,13 @@ + #include <asm/vdso_datapage.h> + #include <asm/vio.h> + #include <asm/mmu.h> ++#include <asm/machdep.h> + ++ ++/* ++ * This isn't a module but we expose that to userspace ++ * via /proc so leave the definitions here ++ */ + #define MODULE_VERS "1.9" + #define MODULE_NAME "lparcfg" + +@@ -301,6 +307,7 @@ static void parse_system_parameter_string(struct seq_file *m) + __pa(rtas_data_buf), + RTAS_DATA_BUF_SIZE); + memcpy(local_buffer, rtas_data_buf, SPLPAR_MAXLENGTH); ++ local_buffer[SPLPAR_MAXLENGTH - 1] = '\0'; + spin_unlock(&rtas_data_buf_lock); + + if (call_status != 0) { +@@ -419,7 +426,8 @@ static void parse_em_data(struct seq_file *m) + { + unsigned long retbuf[PLPAR_HCALL_BUFSIZE]; + +- if (plpar_hcall(H_GET_EM_PARMS, retbuf) == H_SUCCESS) ++ if (firmware_has_feature(FW_FEATURE_LPAR) && ++ plpar_hcall(H_GET_EM_PARMS, retbuf) == H_SUCCESS) + seq_printf(m, "power_mode_data=%016lx\n", retbuf[0]); + } + +@@ -678,7 +686,6 @@ static int lparcfg_open(struct inode *inode, struct file *file) + } + + static const struct file_operations lparcfg_fops = { +- .owner = THIS_MODULE, + .read = seq_read, + .write = lparcfg_write, + .open = lparcfg_open, +@@ -704,15 +711,4 @@ static int __init lparcfg_init(void) + proc_ppc64_lparcfg = ent; + return 0; + } +- +-static void __exit lparcfg_cleanup(void) +-{ +- if (proc_ppc64_lparcfg) +- remove_proc_entry("lparcfg", proc_ppc64_lparcfg->parent); +-} +- +-module_init(lparcfg_init); +-module_exit(lparcfg_cleanup); +-MODULE_DESCRIPTION("Interface for LPAR configuration data"); +-MODULE_AUTHOR("Dave Engebretsen"); +-MODULE_LICENSE("GPL"); ++machine_device_initcall(pseries, lparcfg_init); +diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c +index 389bd4f0cdb1..5c9eccc602ef 100644 +--- a/arch/powerpc/kernel/setup_64.c ++++ b/arch/powerpc/kernel/setup_64.c +@@ -76,7 +76,7 @@ + #endif + + int boot_cpuid = 0; +-int __initdata spinning_secondaries; ++int spinning_secondaries; + u64 ppc64_pft_size; + + /* Pick defaults since we might want to patch instructions +diff --git a/arch/powerpc/kernel/sysfs.c b/arch/powerpc/kernel/sysfs.c +index 8302af649219..a191a72372fa 100644 +--- a/arch/powerpc/kernel/sysfs.c ++++ b/arch/powerpc/kernel/sysfs.c +@@ -17,6 +17,7 @@ + #include <asm/machdep.h> + #include <asm/smp.h> + #include <asm/pmc.h> ++#include <asm/firmware.h> + + #include "cacheinfo.h" + +@@ -179,15 +180,25 @@ SYSFS_PMCSETUP(spurr, SPRN_SPURR); + SYSFS_PMCSETUP(dscr, SPRN_DSCR); + SYSFS_PMCSETUP(pir, SPRN_PIR); + ++/* ++ Lets only enable read for phyp resources and ++ enable write when needed with a separate function. ++ Lets be conservative and default to pseries. ++ */ + static DEVICE_ATTR(mmcra, 0600, show_mmcra, store_mmcra); + static DEVICE_ATTR(spurr, 0600, show_spurr, NULL); + static DEVICE_ATTR(dscr, 0600, show_dscr, store_dscr); +-static DEVICE_ATTR(purr, 0600, show_purr, store_purr); ++static DEVICE_ATTR(purr, 0400, show_purr, store_purr); + static DEVICE_ATTR(pir, 0400, show_pir, NULL); + + unsigned long dscr_default = 0; + EXPORT_SYMBOL(dscr_default); + ++static void add_write_permission_dev_attr(struct device_attribute *attr) ++{ ++ attr->attr.mode |= 0200; ++} ++ + static ssize_t show_dscr_default(struct device *dev, + struct device_attribute *attr, char *buf) + { +@@ -394,8 +405,11 @@ static void __cpuinit register_cpu_online(unsigned int cpu) + if (cpu_has_feature(CPU_FTR_MMCRA)) + device_create_file(s, &dev_attr_mmcra); + +- if (cpu_has_feature(CPU_FTR_PURR)) ++ if (cpu_has_feature(CPU_FTR_PURR)) { ++ if (!firmware_has_feature(FW_FEATURE_LPAR)) ++ add_write_permission_dev_attr(&dev_attr_purr); + device_create_file(s, &dev_attr_purr); ++ } + + if (cpu_has_feature(CPU_FTR_SPURR)) + device_create_file(s, &dev_attr_spurr); +diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c +index eb6b72faec0d..b32729b694c2 100644 +--- a/arch/powerpc/kernel/time.c ++++ b/arch/powerpc/kernel/time.c +@@ -212,8 +212,6 @@ static u64 scan_dispatch_log(u64 stop_tb) + if (i == vpa->dtl_idx) + return 0; + while (i < vpa->dtl_idx) { +- if (dtl_consumer) +- dtl_consumer(dtl, i); + dtb = dtl->timebase; + tb_delta = dtl->enqueue_to_dispatch_time + + dtl->ready_to_enqueue_time; +@@ -226,6 +224,8 @@ static u64 scan_dispatch_log(u64 stop_tb) + } + if (dtb > stop_tb) + break; ++ if (dtl_consumer) ++ dtl_consumer(dtl, i); + stolen += tb_delta; + ++i; + ++dtl; +diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c +index 3bb7197a7bdc..5557044b78ab 100644 +--- a/arch/powerpc/kernel/traps.c ++++ b/arch/powerpc/kernel/traps.c +@@ -1074,6 +1074,16 @@ void __kprobes program_check_exception(struct pt_regs *regs) + _exception(SIGILL, regs, ILL_ILLOPC, regs->nip); + } + ++/* ++ * This occurs when running in hypervisor mode on POWER6 or later ++ * and an illegal instruction is encountered. ++ */ ++void __kprobes emulation_assist_interrupt(struct pt_regs *regs) ++{ ++ regs->msr |= REASON_ILLEGAL; ++ program_check_exception(regs); ++} ++ + void alignment_exception(struct pt_regs *regs) + { + int sig, code, fixed = 0; +diff --git a/arch/powerpc/lib/checksum_64.S b/arch/powerpc/lib/checksum_64.S +index afa2ebaee174..3cdbc648d979 100644 +--- a/arch/powerpc/lib/checksum_64.S ++++ b/arch/powerpc/lib/checksum_64.S +@@ -229,19 +229,35 @@ _GLOBAL(csum_partial) + blr + + +- .macro source ++ .macro srcnr + 100: + .section __ex_table,"a" + .align 3 +- .llong 100b,.Lsrc_error ++ .llong 100b,.Lsrc_error_nr + .previous + .endm + +- .macro dest ++ .macro source ++150: ++ .section __ex_table,"a" ++ .align 3 ++ .llong 150b,.Lsrc_error ++ .previous ++ .endm ++ ++ .macro dstnr + 200: + .section __ex_table,"a" + .align 3 +- .llong 200b,.Ldest_error ++ .llong 200b,.Ldest_error_nr ++ .previous ++ .endm ++ ++ .macro dest ++250: ++ .section __ex_table,"a" ++ .align 3 ++ .llong 250b,.Ldest_error + .previous + .endm + +@@ -277,11 +293,11 @@ _GLOBAL(csum_partial_copy_generic) + mtctr r6 + + 1: +-source; lhz r6,0(r3) /* align to doubleword */ ++srcnr; lhz r6,0(r3) /* align to doubleword */ + subi r5,r5,2 + addi r3,r3,2 + adde r0,r0,r6 +-dest; sth r6,0(r4) ++dstnr; sth r6,0(r4) + addi r4,r4,2 + bdnz 1b + +@@ -395,10 +411,10 @@ dest; std r16,56(r4) + + mtctr r6 + 3: +-source; ld r6,0(r3) ++srcnr; ld r6,0(r3) + addi r3,r3,8 + adde r0,r0,r6 +-dest; std r6,0(r4) ++dstnr; std r6,0(r4) + addi r4,r4,8 + bdnz 3b + +@@ -408,10 +424,10 @@ dest; std r6,0(r4) + srdi. r6,r5,2 + beq .Lcopy_tail_halfword + +-source; lwz r6,0(r3) ++srcnr; lwz r6,0(r3) + addi r3,r3,4 + adde r0,r0,r6 +-dest; stw r6,0(r4) ++dstnr; stw r6,0(r4) + addi r4,r4,4 + subi r5,r5,4 + +@@ -419,10 +435,10 @@ dest; stw r6,0(r4) + srdi. r6,r5,1 + beq .Lcopy_tail_byte + +-source; lhz r6,0(r3) ++srcnr; lhz r6,0(r3) + addi r3,r3,2 + adde r0,r0,r6 +-dest; sth r6,0(r4) ++dstnr; sth r6,0(r4) + addi r4,r4,2 + subi r5,r5,2 + +@@ -430,10 +446,10 @@ dest; sth r6,0(r4) + andi. r6,r5,1 + beq .Lcopy_finish + +-source; lbz r6,0(r3) ++srcnr; lbz r6,0(r3) + sldi r9,r6,8 /* Pad the byte out to 16 bits */ + adde r0,r0,r9 +-dest; stb r6,0(r4) ++dstnr; stb r6,0(r4) + + .Lcopy_finish: + addze r0,r0 /* add in final carry */ +@@ -443,6 +459,11 @@ dest; stb r6,0(r4) + blr + + .Lsrc_error: ++ ld r14,STK_REG(r14)(r1) ++ ld r15,STK_REG(r15)(r1) ++ ld r16,STK_REG(r16)(r1) ++ addi r1,r1,STACKFRAMESIZE ++.Lsrc_error_nr: + cmpdi 0,r7,0 + beqlr + li r6,-EFAULT +@@ -450,6 +471,11 @@ dest; stb r6,0(r4) + blr + + .Ldest_error: ++ ld r14,STK_REG(r14)(r1) ++ ld r15,STK_REG(r15)(r1) ++ ld r16,STK_REG(r16)(r1) ++ addi r1,r1,STACKFRAMESIZE ++.Ldest_error_nr: + cmpdi 0,r8,0 + beqlr + li r6,-EFAULT +diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h +index d57eacb9fcf6..944471f4d142 100644 +--- a/arch/x86/include/asm/kvm_host.h ++++ b/arch/x86/include/asm/kvm_host.h +@@ -102,7 +102,7 @@ + #define KVM_REFILL_PAGES 25 + #define KVM_MAX_CPUID_ENTRIES 80 + #define KVM_NR_FIXED_MTRR_REGION 88 +-#define KVM_NR_VAR_MTRR 8 ++#define KVM_NR_VAR_MTRR 10 + + #define ASYNC_PF_PER_VCPU 64 + +@@ -436,7 +436,7 @@ struct kvm_vcpu_arch { + bool nmi_injected; /* Trying to inject an NMI this entry */ + + struct mtrr_state_type mtrr_state; +- u32 pat; ++ u64 pat; + + int switch_db_regs; + unsigned long db[KVM_NR_DB_REGS]; +diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c +index 415448af36bf..8c5ad89a65a5 100644 +--- a/drivers/acpi/video.c ++++ b/drivers/acpi/video.c +@@ -463,6 +463,22 @@ static struct dmi_system_id video_dmi_table[] __initdata = { + DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion m4 Notebook PC"), + }, + }, ++ { ++ .callback = video_ignore_initial_backlight, ++ .ident = "HP 1000 Notebook PC", ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "Hewlett-Packard"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "HP 1000 Notebook PC"), ++ }, ++ }, ++ { ++ .callback = video_ignore_initial_backlight, ++ .ident = "HP Pavilion dm4", ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "Hewlett-Packard"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dm4 Notebook PC"), ++ }, ++ }, + {} + }; + +diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c +index 45d8097ef4cf..144088717b86 100644 +--- a/drivers/acpi/video_detect.c ++++ b/drivers/acpi/video_detect.c +@@ -132,6 +132,49 @@ find_video(acpi_handle handle, u32 lvl, void *context, void **rv) + return AE_OK; + } + ++/* Force to use vendor driver when the ACPI device is known to be ++ * buggy */ ++static int video_detect_force_vendor(const struct dmi_system_id *d) ++{ ++ acpi_video_support |= ACPI_VIDEO_BACKLIGHT_DMI_VENDOR; ++ return 0; ++} ++ ++static struct dmi_system_id video_detect_dmi_table[] = { ++ /* On Samsung X360, the BIOS will set a flag (VDRV) if generic ++ * ACPI backlight device is used. This flag will definitively break ++ * the backlight interface (even the vendor interface) untill next ++ * reboot. It's why we should prevent video.ko from being used here ++ * and we can't rely on a later call to acpi_video_unregister(). ++ */ ++ { ++ .callback = video_detect_force_vendor, ++ .ident = "X360", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "X360"), ++ DMI_MATCH(DMI_BOARD_NAME, "X360"), ++ }, ++ }, ++ { ++ .callback = video_detect_force_vendor, ++ .ident = "Asus UL30VT", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "UL30VT"), ++ }, ++ }, ++ { ++ .callback = video_detect_force_vendor, ++ .ident = "Asus UL30A", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "UL30A"), ++ }, ++ }, ++ { }, ++}; ++ + /* + * Returns the video capabilities of a specific ACPI graphics device + * +@@ -164,6 +207,8 @@ long acpi_video_get_capabilities(acpi_handle graphics_handle) + * ACPI_VIDEO_BACKLIGHT_DMI_VENDOR; + *} + */ ++ ++ dmi_check_system(video_detect_dmi_table); + } else { + status = acpi_bus_get_device(graphics_handle, &tmp_dev); + if (ACPI_FAILURE(status)) { +diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c +index dc612efbeb7a..d51c08da3f69 100644 +--- a/drivers/gpu/drm/radeon/atombios_crtc.c ++++ b/drivers/gpu/drm/radeon/atombios_crtc.c +@@ -863,14 +863,16 @@ static void atombios_crtc_program_pll(struct drm_crtc *crtc, + args.v5.ucMiscInfo = 0; /* HDMI depth, etc. */ + if (ss_enabled && (ss->type & ATOM_EXTERNAL_SS_MASK)) + args.v5.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_REF_DIV_SRC; +- switch (bpc) { +- case 8: +- default: +- args.v5.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_HDMI_24BPP; +- break; +- case 10: +- args.v5.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_HDMI_30BPP; +- break; ++ if (encoder_mode == ATOM_ENCODER_MODE_HDMI) { ++ switch (bpc) { ++ case 8: ++ default: ++ args.v5.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_HDMI_24BPP; ++ break; ++ case 10: ++ args.v5.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_HDMI_30BPP; ++ break; ++ } + } + args.v5.ucTransmitterID = encoder_id; + args.v5.ucEncoderMode = encoder_mode; +@@ -885,20 +887,22 @@ static void atombios_crtc_program_pll(struct drm_crtc *crtc, + args.v6.ucMiscInfo = 0; /* HDMI depth, etc. */ + if (ss_enabled && (ss->type & ATOM_EXTERNAL_SS_MASK)) + args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_REF_DIV_SRC; +- switch (bpc) { +- case 8: +- default: +- args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_24BPP; +- break; +- case 10: +- args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_30BPP; +- break; +- case 12: +- args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_36BPP; +- break; +- case 16: +- args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_48BPP; +- break; ++ if (encoder_mode == ATOM_ENCODER_MODE_HDMI) { ++ switch (bpc) { ++ case 8: ++ default: ++ args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_24BPP; ++ break; ++ case 10: ++ args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_30BPP; ++ break; ++ case 12: ++ args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_36BPP; ++ break; ++ case 16: ++ args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_48BPP; ++ break; ++ } + } + args.v6.ucTransmitterID = encoder_id; + args.v6.ucEncoderMode = encoder_mode; +diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c +index 072229dca464..dd5c14e917e0 100644 +--- a/drivers/gpu/drm/radeon/atombios_encoders.c ++++ b/drivers/gpu/drm/radeon/atombios_encoders.c +@@ -1666,8 +1666,11 @@ atombios_set_encoder_crtc_source(struct drm_encoder *encoder) + args.v2.ucEncodeMode = ATOM_ENCODER_MODE_CRT; + else + args.v2.ucEncodeMode = atombios_get_encoder_mode(encoder); +- } else ++ } else if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT)) { ++ args.v2.ucEncodeMode = ATOM_ENCODER_MODE_LVDS; ++ } else { + args.v2.ucEncodeMode = atombios_get_encoder_mode(encoder); ++ } + switch (radeon_encoder->encoder_id) { + case ENCODER_OBJECT_ID_INTERNAL_UNIPHY: + case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1: +diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c +index 1334dbd15c1b..9184bbe7c602 100644 +--- a/drivers/gpu/drm/radeon/radeon_connectors.c ++++ b/drivers/gpu/drm/radeon/radeon_connectors.c +@@ -1279,7 +1279,7 @@ bool radeon_connector_is_dp12_capable(struct drm_connector *connector) + struct radeon_device *rdev = dev->dev_private; + + if (ASIC_IS_DCE5(rdev) && +- (rdev->clock.dp_extclk >= 53900) && ++ (rdev->clock.default_dispclk >= 53900) && + radeon_connector_encoder_is_hbr2(connector)) { + return true; + } +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c +index 6651cb328598..7fc3dc7f9985 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c +@@ -179,7 +179,6 @@ static int vmw_fb_set_par(struct fb_info *info) + vmw_write(vmw_priv, SVGA_REG_DISPLAY_POSITION_Y, info->var.yoffset); + vmw_write(vmw_priv, SVGA_REG_DISPLAY_WIDTH, info->var.xres); + vmw_write(vmw_priv, SVGA_REG_DISPLAY_HEIGHT, info->var.yres); +- vmw_write(vmw_priv, SVGA_REG_BYTES_PER_LINE, info->fix.line_length); + vmw_write(vmw_priv, SVGA_REG_DISPLAY_ID, SVGA_ID_INVALID); + } + +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 3a8ef589d8c0..17e2f526457c 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -7180,6 +7180,19 @@ void md_do_sync(struct mddev *mddev) + rdev->recovery_offset < j) + j = rdev->recovery_offset; + rcu_read_unlock(); ++ ++ /* If there is a bitmap, we need to make sure all ++ * writes that started before we added a spare ++ * complete before we start doing a recovery. ++ * Otherwise the write might complete and (via ++ * bitmap_endwrite) set a bit in the bitmap after the ++ * recovery has checked that bit and skipped that ++ * region. ++ */ ++ if (mddev->bitmap) { ++ mddev->pers->quiesce(mddev, 1); ++ mddev->pers->quiesce(mddev, 0); ++ } + } + + printk(KERN_INFO "md: %s of RAID array %s\n", desc, mdname(mddev)); +diff --git a/drivers/mtd/nand/pxa3xx_nand.c b/drivers/mtd/nand/pxa3xx_nand.c +index def50caa6f84..fd11af4a702a 100644 +--- a/drivers/mtd/nand/pxa3xx_nand.c ++++ b/drivers/mtd/nand/pxa3xx_nand.c +@@ -93,10 +93,10 @@ + + /* macros for registers read/write */ + #define nand_writel(info, off, val) \ +- __raw_writel((val), (info)->mmio_base + (off)) ++ writel_relaxed((val), (info)->mmio_base + (off)) + + #define nand_readl(info, off) \ +- __raw_readl((info)->mmio_base + (off)) ++ readl_relaxed((info)->mmio_base + (off)) + + /* error code and state */ + enum { +diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c +index 9db0f8e132e6..ad3961177c68 100644 +--- a/drivers/net/wireless/b43/xmit.c ++++ b/drivers/net/wireless/b43/xmit.c +@@ -808,9 +808,13 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr) + break; + case B43_PHYTYPE_G: + status.band = IEEE80211_BAND_2GHZ; +- /* chanid is the radio channel cookie value as used +- * to tune the radio. */ +- status.freq = chanid + 2400; ++ /* Somewhere between 478.104 and 508.1084 firmware for G-PHY ++ * has been modified to be compatible with N-PHY and others. ++ */ ++ if (dev->fw.rev >= 508) ++ status.freq = ieee80211_channel_to_frequency(chanid, status.band); ++ else ++ status.freq = chanid + 2400; + break; + case B43_PHYTYPE_N: + case B43_PHYTYPE_LP: +diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c +index aa10c48c0dfa..f8ea77c87b20 100644 +--- a/drivers/net/wireless/rt2x00/rt2500pci.c ++++ b/drivers/net/wireless/rt2x00/rt2500pci.c +@@ -1679,8 +1679,13 @@ static int rt2500pci_init_eeprom(struct rt2x00_dev *rt2x00dev) + /* + * Detect if this device has an hardware controlled radio. + */ +- if (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_HARDWARE_RADIO)) ++ if (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_HARDWARE_RADIO)) { + __set_bit(CAPABILITY_HW_BUTTON, &rt2x00dev->cap_flags); ++ /* ++ * On this device RFKILL initialized during probe does not work. ++ */ ++ __set_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags); ++ } + + /* + * Check if the BBP tuning should be enabled. +diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h +index c264dfa6e611..4be11e36e3ca 100644 +--- a/drivers/net/wireless/rt2x00/rt2x00.h ++++ b/drivers/net/wireless/rt2x00/rt2x00.h +@@ -717,6 +717,7 @@ enum rt2x00_capability_flags { + REQUIRE_SW_SEQNO, + REQUIRE_HT_TX_DESC, + REQUIRE_PS_AUTOWAKE, ++ REQUIRE_DELAYED_RFKILL, + + /* + * Capabilities +diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c +index 8f2c88e2c339..da65f8e97754 100644 +--- a/drivers/net/wireless/rt2x00/rt2x00dev.c ++++ b/drivers/net/wireless/rt2x00/rt2x00dev.c +@@ -1022,9 +1022,10 @@ static void rt2x00lib_uninitialize(struct rt2x00_dev *rt2x00dev) + return; + + /* +- * Unregister extra components. ++ * Stop rfkill polling. + */ +- rt2x00rfkill_unregister(rt2x00dev); ++ if (test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags)) ++ rt2x00rfkill_unregister(rt2x00dev); + + /* + * Allow the HW to uninitialize. +@@ -1062,6 +1063,12 @@ static int rt2x00lib_initialize(struct rt2x00_dev *rt2x00dev) + + set_bit(DEVICE_STATE_INITIALIZED, &rt2x00dev->flags); + ++ /* ++ * Start rfkill polling. ++ */ ++ if (test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags)) ++ rt2x00rfkill_register(rt2x00dev); ++ + return 0; + } + +@@ -1207,7 +1214,12 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev) + rt2x00link_register(rt2x00dev); + rt2x00leds_register(rt2x00dev); + rt2x00debug_register(rt2x00dev); +- rt2x00rfkill_register(rt2x00dev); ++ ++ /* ++ * Start rfkill polling. ++ */ ++ if (!test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags)) ++ rt2x00rfkill_register(rt2x00dev); + + return 0; + +@@ -1223,6 +1235,12 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev) + clear_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags); + + /* ++ * Stop rfkill polling. ++ */ ++ if (!test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags)) ++ rt2x00rfkill_unregister(rt2x00dev); ++ ++ /* + * Disable radio. + */ + rt2x00lib_disable_radio(rt2x00dev); +diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c +index af247b06c842..e6daf129cc36 100644 +--- a/drivers/net/wireless/rt2x00/rt2x00mac.c ++++ b/drivers/net/wireless/rt2x00/rt2x00mac.c +@@ -517,6 +517,8 @@ int rt2x00mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, + crypto.cipher = rt2x00crypto_key_to_cipher(key); + if (crypto.cipher == CIPHER_NONE) + return -EOPNOTSUPP; ++ if (crypto.cipher == CIPHER_TKIP && rt2x00_is_usb(rt2x00dev)) ++ return -EOPNOTSUPP; + + crypto.cmd = cmd; + +diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c +index 337e8b33d9aa..ac58ee344790 100644 +--- a/drivers/scsi/ibmvscsi/ibmvscsi.c ++++ b/drivers/scsi/ibmvscsi/ibmvscsi.c +@@ -484,7 +484,8 @@ static void purge_requests(struct ibmvscsi_host_data *hostdata, int error_code) + evt->hostdata->dev); + if (evt->cmnd_done) + evt->cmnd_done(evt->cmnd); +- } else if (evt->done) ++ } else if (evt->done && evt->crq.format != VIOSRP_MAD_FORMAT && ++ evt->iu.srp.login_req.opcode != SRP_LOGIN_REQ) + evt->done(evt); + free_event_struct(&evt->hostdata->pool, evt); + spin_lock_irqsave(hostdata->host->host_lock, flags); +diff --git a/drivers/scsi/sym53c8xx_2/sym_hipd.c b/drivers/scsi/sym53c8xx_2/sym_hipd.c +index d92fe4037e94..6b349e301869 100644 +--- a/drivers/scsi/sym53c8xx_2/sym_hipd.c ++++ b/drivers/scsi/sym53c8xx_2/sym_hipd.c +@@ -3000,7 +3000,11 @@ sym_dequeue_from_squeue(struct sym_hcb *np, int i, int target, int lun, int task + if ((target == -1 || cp->target == target) && + (lun == -1 || cp->lun == lun) && + (task == -1 || cp->tag == task)) { ++#ifdef SYM_OPT_HANDLE_DEVICE_QUEUEING + sym_set_cam_status(cp->cmd, DID_SOFT_ERROR); ++#else ++ sym_set_cam_status(cp->cmd, DID_REQUEUE); ++#endif + sym_remque(&cp->link_ccbq); + sym_insque_tail(&cp->link_ccbq, &np->comp_ccbq); + } +diff --git a/drivers/staging/bcm/InterfaceInit.c b/drivers/staging/bcm/InterfaceInit.c +index 8e3c586a699c..e0f40ae358ed 100644 +--- a/drivers/staging/bcm/InterfaceInit.c ++++ b/drivers/staging/bcm/InterfaceInit.c +@@ -4,10 +4,12 @@ static struct usb_device_id InterfaceUsbtable[] = { + { USB_DEVICE(BCM_USB_VENDOR_ID_T3, BCM_USB_PRODUCT_ID_T3) }, + { USB_DEVICE(BCM_USB_VENDOR_ID_T3, BCM_USB_PRODUCT_ID_T3B) }, + { USB_DEVICE(BCM_USB_VENDOR_ID_T3, BCM_USB_PRODUCT_ID_T3L) }, +- { USB_DEVICE(BCM_USB_VENDOR_ID_T3, BCM_USB_PRODUCT_ID_SM250) }, ++ { USB_DEVICE(BCM_USB_VENDOR_ID_T3, BCM_USB_PRODUCT_ID_SYM) }, + { USB_DEVICE(BCM_USB_VENDOR_ID_ZTE, BCM_USB_PRODUCT_ID_226) }, + { USB_DEVICE(BCM_USB_VENDOR_ID_FOXCONN, BCM_USB_PRODUCT_ID_1901) }, + { USB_DEVICE(BCM_USB_VENDOR_ID_ZTE, BCM_USB_PRODUCT_ID_ZTE_TU25) }, ++ { USB_DEVICE(BCM_USB_VENDOR_ID_ZTE, BCM_USB_PRODUCT_ID_ZTE_226) }, ++ { USB_DEVICE(BCM_USB_VENDOR_ID_ZTE, BCM_USB_PRODUCT_ID_ZTE_326) }, + { } + }; + MODULE_DEVICE_TABLE(usb, InterfaceUsbtable); +diff --git a/drivers/staging/bcm/InterfaceInit.h b/drivers/staging/bcm/InterfaceInit.h +index 058315a64c05..6fa4f09a37c6 100644 +--- a/drivers/staging/bcm/InterfaceInit.h ++++ b/drivers/staging/bcm/InterfaceInit.h +@@ -8,10 +8,11 @@ + #define BCM_USB_PRODUCT_ID_T3 0x0300 + #define BCM_USB_PRODUCT_ID_T3B 0x0210 + #define BCM_USB_PRODUCT_ID_T3L 0x0220 +-#define BCM_USB_PRODUCT_ID_SM250 0xbccd + #define BCM_USB_PRODUCT_ID_SYM 0x15E + #define BCM_USB_PRODUCT_ID_1901 0xe017 +-#define BCM_USB_PRODUCT_ID_226 0x0132 ++#define BCM_USB_PRODUCT_ID_226 0x0132 /* not sure if this is valid */ ++#define BCM_USB_PRODUCT_ID_ZTE_226 0x172 ++#define BCM_USB_PRODUCT_ID_ZTE_326 0x173 /* ZTE AX326 */ + #define BCM_USB_PRODUCT_ID_ZTE_TU25 0x0007 + + #define BCM_USB_MINOR_BASE 192 +diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c +index 50dc93e2a227..fff275753416 100644 +--- a/drivers/staging/comedi/comedi_fops.c ++++ b/drivers/staging/comedi/comedi_fops.c +@@ -1078,22 +1078,19 @@ static int do_cmd_ioctl(struct comedi_device *dev, + DPRINTK("subdevice busy\n"); + return -EBUSY; + } +- s->busy = file; + + /* make sure channel/gain list isn't too long */ + if (user_cmd.chanlist_len > s->len_chanlist) { + DPRINTK("channel/gain list too long %u > %d\n", + user_cmd.chanlist_len, s->len_chanlist); +- ret = -EINVAL; +- goto cleanup; ++ return -EINVAL; + } + + /* make sure channel/gain list isn't too short */ + if (user_cmd.chanlist_len < 1) { + DPRINTK("channel/gain list too short %u < 1\n", + user_cmd.chanlist_len); +- ret = -EINVAL; +- goto cleanup; ++ return -EINVAL; + } + + async->cmd = user_cmd; +@@ -1103,8 +1100,7 @@ static int do_cmd_ioctl(struct comedi_device *dev, + kmalloc(async->cmd.chanlist_len * sizeof(int), GFP_KERNEL); + if (!async->cmd.chanlist) { + DPRINTK("allocation failed\n"); +- ret = -ENOMEM; +- goto cleanup; ++ return -ENOMEM; + } + + if (copy_from_user(async->cmd.chanlist, user_cmd.chanlist, +@@ -1156,6 +1152,9 @@ static int do_cmd_ioctl(struct comedi_device *dev, + + comedi_set_subdevice_runflags(s, ~0, SRF_USER | SRF_RUNNING); + ++ /* set s->busy _after_ setting SRF_RUNNING flag to avoid race with ++ * comedi_read() or comedi_write() */ ++ s->busy = file; + ret = s->do_cmd(dev, s); + if (ret == 0) + return 0; +@@ -1658,6 +1657,7 @@ static ssize_t comedi_write(struct file *file, const char __user *buf, + + if (!(comedi_get_subdevice_runflags(s) & SRF_RUNNING)) { + if (count == 0) { ++ mutex_lock(&dev->mutex); + if (comedi_get_subdevice_runflags(s) & + SRF_ERROR) { + retval = -EPIPE; +@@ -1665,6 +1665,7 @@ static ssize_t comedi_write(struct file *file, const char __user *buf, + retval = 0; + } + do_become_nonbusy(dev, s); ++ mutex_unlock(&dev->mutex); + } + break; + } +@@ -1779,6 +1780,7 @@ static ssize_t comedi_read(struct file *file, char __user *buf, size_t nbytes, + + if (n == 0) { + if (!(comedi_get_subdevice_runflags(s) & SRF_RUNNING)) { ++ mutex_lock(&dev->mutex); + do_become_nonbusy(dev, s); + if (comedi_get_subdevice_runflags(s) & + SRF_ERROR) { +@@ -1786,6 +1788,7 @@ static ssize_t comedi_read(struct file *file, char __user *buf, size_t nbytes, + } else { + retval = 0; + } ++ mutex_unlock(&dev->mutex); + break; + } + if (file->f_flags & O_NONBLOCK) { +@@ -1823,9 +1826,11 @@ static ssize_t comedi_read(struct file *file, char __user *buf, size_t nbytes, + buf += n; + break; /* makes device work like a pipe */ + } +- if (!(comedi_get_subdevice_runflags(s) & (SRF_ERROR | SRF_RUNNING)) && +- async->buf_read_count - async->buf_write_count == 0) { +- do_become_nonbusy(dev, s); ++ if (!(comedi_get_subdevice_runflags(s) & (SRF_ERROR | SRF_RUNNING))) { ++ mutex_lock(&dev->mutex); ++ if (async->buf_read_count - async->buf_write_count == 0) ++ do_become_nonbusy(dev, s); ++ mutex_unlock(&dev->mutex); + } + set_current_state(TASK_RUNNING); + remove_wait_queue(&async->wait_head, &wait); +diff --git a/drivers/staging/comedi/drivers/das08.c b/drivers/staging/comedi/drivers/das08.c +index d2dd75e2af7f..e16d1f38ca64 100644 +--- a/drivers/staging/comedi/drivers/das08.c ++++ b/drivers/staging/comedi/drivers/das08.c +@@ -385,7 +385,7 @@ static const struct das08_board_struct das08_boards[] = { + .ai = das08_ai_rinsn, + .ai_nbits = 16, + .ai_pg = das08_pg_none, +- .ai_encoding = das08_encode12, ++ .ai_encoding = das08_encode16, + .ao = das08jr_ao_winsn, + .ao_nbits = 16, + .di = das08jr_di_rbits, +diff --git a/drivers/staging/wlags49_h2/wl_priv.c b/drivers/staging/wlags49_h2/wl_priv.c +index f30e5ee4bca3..ff459b206756 100644 +--- a/drivers/staging/wlags49_h2/wl_priv.c ++++ b/drivers/staging/wlags49_h2/wl_priv.c +@@ -570,6 +570,7 @@ int wvlan_uil_put_info( struct uilreq *urq, struct wl_private *lp ) + ltv_t *pLtv; + bool_t ltvAllocated = FALSE; + ENCSTRCT sEncryption; ++ size_t len; + + #ifdef USE_WDS + hcf_16 hcfPort = HCF_PORT_0; +@@ -686,7 +687,8 @@ int wvlan_uil_put_info( struct uilreq *urq, struct wl_private *lp ) + break; + case CFG_CNF_OWN_NAME: + memset( lp->StationName, 0, sizeof( lp->StationName )); +- memcpy( (void *)lp->StationName, (void *)&pLtv->u.u8[2], (size_t)pLtv->u.u16[0]); ++ len = min_t(size_t, pLtv->u.u16[0], sizeof(lp->StationName)); ++ strlcpy(lp->StationName, &pLtv->u.u8[2], len); + pLtv->u.u16[0] = CNV_INT_TO_LITTLE( pLtv->u.u16[0] ); + break; + case CFG_CNF_LOAD_BALANCING: +@@ -1800,6 +1802,7 @@ int wvlan_set_station_nickname(struct net_device *dev, + { + struct wl_private *lp = wl_priv(dev); + unsigned long flags; ++ size_t len; + int ret = 0; + /*------------------------------------------------------------------------*/ + +@@ -1810,8 +1813,8 @@ int wvlan_set_station_nickname(struct net_device *dev, + wl_lock(lp, &flags); + + memset( lp->StationName, 0, sizeof( lp->StationName )); +- +- memcpy( lp->StationName, extra, wrqu->data.length); ++ len = min_t(size_t, wrqu->data.length, sizeof(lp->StationName)); ++ strlcpy(lp->StationName, extra, len); + + /* Commit the adapter parameters */ + wl_apply( lp ); +diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c +index f52cb1ae45d9..32d1effe3d44 100644 +--- a/drivers/usb/gadget/f_fs.c ++++ b/drivers/usb/gadget/f_fs.c +@@ -1361,11 +1361,13 @@ static int functionfs_bind(struct ffs_data *ffs, struct usb_composite_dev *cdev) + ffs->ep0req->context = ffs; + + lang = ffs->stringtabs; +- for (lang = ffs->stringtabs; *lang; ++lang) { +- struct usb_string *str = (*lang)->strings; +- int id = first_id; +- for (; str->s; ++id, ++str) +- str->id = id; ++ if (lang) { ++ for (; *lang; ++lang) { ++ struct usb_string *str = (*lang)->strings; ++ int id = first_id; ++ for (; str->s; ++id, ++str) ++ str->id = id; ++ } + } + + ffs->gadget = cdev->gadget; +diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c +index 87ee28e1e65e..6f1b36d15419 100644 +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -3588,7 +3588,7 @@ static unsigned int xhci_get_burst_count(struct xhci_hcd *xhci, + return 0; + + max_burst = urb->ep->ss_ep_comp.bMaxBurst; +- return roundup(total_packet_count, max_burst + 1) - 1; ++ return DIV_ROUND_UP(total_packet_count, max_burst + 1) - 1; + } + + /* +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 7299a06af9db..424d9cf9d9a0 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -963,7 +963,7 @@ int xhci_suspend(struct xhci_hcd *xhci) + */ + int xhci_resume(struct xhci_hcd *xhci, bool hibernated) + { +- u32 command, temp = 0; ++ u32 command, temp = 0, status; + struct usb_hcd *hcd = xhci_to_hcd(xhci); + struct usb_hcd *secondary_hcd; + int retval = 0; +@@ -1087,8 +1087,12 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated) + + done: + if (retval == 0) { +- usb_hcd_resume_root_hub(hcd); +- usb_hcd_resume_root_hub(xhci->shared_hcd); ++ /* Resume root hubs only when have pending events. */ ++ status = readl(&xhci->op_regs->status); ++ if (status & STS_EINT) { ++ usb_hcd_resume_root_hub(hcd); ++ usb_hcd_resume_root_hub(xhci->shared_hcd); ++ } + } + + /* +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index bb9f4111d1b8..ed1650fb910d 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -1593,14 +1593,17 @@ static void ftdi_set_max_packet_size(struct usb_serial_port *port) + struct usb_device *udev = serial->dev; + + struct usb_interface *interface = serial->interface; +- struct usb_endpoint_descriptor *ep_desc = &interface->cur_altsetting->endpoint[1].desc; ++ struct usb_endpoint_descriptor *ep_desc; + + unsigned num_endpoints; +- int i; ++ unsigned i; + + num_endpoints = interface->cur_altsetting->desc.bNumEndpoints; + dev_info(&udev->dev, "Number of endpoints %d\n", num_endpoints); + ++ if (!num_endpoints) ++ return; ++ + /* NOTE: some customers have programmed FT232R/FT245R devices + * with an endpoint size of 0 - not good. In this case, we + * want to override the endpoint descriptor setting and use a +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index f7ccfbcdbf04..58fcaa5ae548 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -357,6 +357,9 @@ static void option_instat_callback(struct urb *urb); + /* Zoom */ + #define ZOOM_PRODUCT_4597 0x9607 + ++/* SpeedUp SU9800 usb 3g modem */ ++#define SPEEDUP_PRODUCT_SU9800 0x9800 ++ + /* Haier products */ + #define HAIER_VENDOR_ID 0x201e + #define HAIER_PRODUCT_CE100 0x2009 +@@ -377,8 +380,12 @@ static void option_instat_callback(struct urb *urb); + /* Olivetti products */ + #define OLIVETTI_VENDOR_ID 0x0b3c + #define OLIVETTI_PRODUCT_OLICARD100 0xc000 ++#define OLIVETTI_PRODUCT_OLICARD120 0xc001 ++#define OLIVETTI_PRODUCT_OLICARD140 0xc002 + #define OLIVETTI_PRODUCT_OLICARD145 0xc003 ++#define OLIVETTI_PRODUCT_OLICARD155 0xc004 + #define OLIVETTI_PRODUCT_OLICARD200 0xc005 ++#define OLIVETTI_PRODUCT_OLICARD160 0xc00a + #define OLIVETTI_PRODUCT_OLICARD500 0xc00b + + /* Celot products */ +@@ -1597,6 +1604,7 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14), + .driver_info = (kernel_ulong_t)&four_g_w14_blacklist + }, ++ { USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, SPEEDUP_PRODUCT_SU9800, 0xff) }, + { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) }, + { USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) }, + { USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) }, +@@ -1631,15 +1639,21 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDMNET) }, + { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, /* HC28 enumerates with Siemens or Cinterion VID depending on FW revision */ + { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) }, +- +- { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) }, ++ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100), ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, ++ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD120), ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, ++ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD140), ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD145) }, ++ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD155), ++ .driver_info = (kernel_ulong_t)&net_intf6_blacklist }, + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD200), +- .driver_info = (kernel_ulong_t)&net_intf6_blacklist +- }, ++ .driver_info = (kernel_ulong_t)&net_intf6_blacklist }, ++ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD160), ++ .driver_info = (kernel_ulong_t)&net_intf6_blacklist }, + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD500), +- .driver_info = (kernel_ulong_t)&net_intf4_blacklist +- }, ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */ + { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/ + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM600) }, +diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c +index 6a8568c6466f..f2da2bd20188 100644 +--- a/fs/cifs/cifs_unicode.c ++++ b/fs/cifs/cifs_unicode.c +@@ -290,7 +290,8 @@ int + cifsConvertToUTF16(__le16 *target, const char *source, int srclen, + const struct nls_table *cp, int mapChars) + { +- int i, j, charlen; ++ int i, charlen; ++ int j = 0; + char src_char; + __le16 dst_char; + wchar_t tmp; +@@ -298,12 +299,11 @@ cifsConvertToUTF16(__le16 *target, const char *source, int srclen, + if (!mapChars) + return cifs_strtoUTF16(target, source, PATH_MAX, cp); + +- for (i = 0, j = 0; i < srclen; j++) { ++ for (i = 0; i < srclen; j++) { + src_char = source[i]; + charlen = 1; + switch (src_char) { + case 0: +- put_unaligned(0, &target[j]); + goto ctoUTF16_out; + case ':': + dst_char = cpu_to_le16(UNI_COLON); +@@ -350,6 +350,7 @@ cifsConvertToUTF16(__le16 *target, const char *source, int srclen, + } + + ctoUTF16_out: ++ put_unaligned(0, &target[j]); /* Null terminate target unicode string */ + return j; + } + +diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c +index 97a142cde23b..22beaff3544a 100644 +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -543,15 +543,6 @@ nfsd4_create(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, + + switch (create->cr_type) { + case NF4LNK: +- /* ugh! we have to null-terminate the linktext, or +- * vfs_symlink() will choke. it is always safe to +- * null-terminate by brute force, since at worst we +- * will overwrite the first byte of the create namelen +- * in the XDR buffer, which has already been extracted +- * during XDR decode. +- */ +- create->cr_linkname[create->cr_linklen] = 0; +- + status = nfsd_symlink(rqstp, &cstate->current_fh, + create->cr_name, create->cr_namelen, + create->cr_linkname, create->cr_linklen, +diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c +index ba7bf4a11855..04a1ce42e32b 100644 +--- a/fs/nfsd/nfs4xdr.c ++++ b/fs/nfsd/nfs4xdr.c +@@ -465,7 +465,18 @@ nfsd4_decode_create(struct nfsd4_compoundargs *argp, struct nfsd4_create *create + READ_BUF(4); + READ32(create->cr_linklen); + READ_BUF(create->cr_linklen); +- SAVEMEM(create->cr_linkname, create->cr_linklen); ++ /* ++ * The VFS will want a null-terminated string, and ++ * null-terminating in place isn't safe since this might ++ * end on a page boundary: ++ */ ++ create->cr_linkname = ++ kmalloc(create->cr_linklen + 1, GFP_KERNEL); ++ if (!create->cr_linkname) ++ return nfserr_jukebox; ++ memcpy(create->cr_linkname, p, create->cr_linklen); ++ create->cr_linkname[create->cr_linklen] = '\0'; ++ defer_free(argp, kfree, create->cr_linkname); + break; + case NF4BLK: + case NF4CHR: +diff --git a/include/linux/usb.h b/include/linux/usb.h +index 4e8e6685f513..473907ac9104 100644 +--- a/include/linux/usb.h ++++ b/include/linux/usb.h +@@ -715,6 +715,22 @@ static inline int usb_make_path(struct usb_device *dev, char *buf, size_t size) + .bcdDevice_hi = (hi) + + /** ++ * USB_DEVICE_INTERFACE_CLASS - describe a usb device with a specific interface class ++ * @vend: the 16 bit USB Vendor ID ++ * @prod: the 16 bit USB Product ID ++ * @cl: bInterfaceClass value ++ * ++ * This macro is used to create a struct usb_device_id that matches a ++ * specific interface class of devices. ++ */ ++#define USB_DEVICE_INTERFACE_CLASS(vend, prod, cl) \ ++ .match_flags = USB_DEVICE_ID_MATCH_DEVICE | \ ++ USB_DEVICE_ID_MATCH_INT_CLASS, \ ++ .idVendor = (vend), \ ++ .idProduct = (prod), \ ++ .bInterfaceClass = (cl) ++ ++/** + * USB_DEVICE_INTERFACE_PROTOCOL - describe a usb device with a specific interface protocol + * @vend: the 16 bit USB Vendor ID + * @prod: the 16 bit USB Product ID +diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h +index 4886c1144972..7d6cb0b2d061 100644 +--- a/include/net/bluetooth/hci_core.h ++++ b/include/net/bluetooth/hci_core.h +@@ -1068,7 +1068,6 @@ void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max, + u16 latency, u16 to_multiplier); + void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8], + __u8 ltk[16]); +-void hci_le_ltk_reply(struct hci_conn *conn, u8 ltk[16]); + void hci_le_ltk_neg_reply(struct hci_conn *conn); + + int hci_do_inquiry(struct hci_dev *hdev, u8 length); +diff --git a/mm/hugetlb.c b/mm/hugetlb.c +index d5facc8d78a4..0d4e0ad97a04 100644 +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -2276,6 +2276,31 @@ static void set_huge_ptep_writable(struct vm_area_struct *vma, + update_mmu_cache(vma, address, ptep); + } + ++static int is_hugetlb_entry_migration(pte_t pte) ++{ ++ swp_entry_t swp; ++ ++ if (huge_pte_none(pte) || pte_present(pte)) ++ return 0; ++ swp = pte_to_swp_entry(pte); ++ if (non_swap_entry(swp) && is_migration_entry(swp)) ++ return 1; ++ else ++ return 0; ++} ++ ++static int is_hugetlb_entry_hwpoisoned(pte_t pte) ++{ ++ swp_entry_t swp; ++ ++ if (huge_pte_none(pte) || pte_present(pte)) ++ return 0; ++ swp = pte_to_swp_entry(pte); ++ if (non_swap_entry(swp) && is_hwpoison_entry(swp)) ++ return 1; ++ else ++ return 0; ++} + + int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src, + struct vm_area_struct *vma) +@@ -2303,10 +2328,26 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src, + + spin_lock(&dst->page_table_lock); + spin_lock_nested(&src->page_table_lock, SINGLE_DEPTH_NESTING); +- if (!huge_pte_none(huge_ptep_get(src_pte))) { ++ entry = huge_ptep_get(src_pte); ++ if (huge_pte_none(entry)) { /* skip none entry */ ++ ; ++ } else if (unlikely(is_hugetlb_entry_migration(entry) || ++ is_hugetlb_entry_hwpoisoned(entry))) { ++ swp_entry_t swp_entry = pte_to_swp_entry(entry); ++ ++ if (is_write_migration_entry(swp_entry) && cow) { ++ /* ++ * COW mappings require pages in both ++ * parent and child to be set to read. ++ */ ++ make_migration_entry_read(&swp_entry); ++ entry = swp_entry_to_pte(swp_entry); ++ set_huge_pte_at(src, addr, src_pte, entry); ++ } ++ set_huge_pte_at(dst, addr, dst_pte, entry); ++ } else { + if (cow) + huge_ptep_set_wrprotect(src, addr, src_pte); +- entry = huge_ptep_get(src_pte); + ptepage = pte_page(entry); + get_page(ptepage); + page_dup_rmap(ptepage); +@@ -2321,32 +2362,6 @@ nomem: + return -ENOMEM; + } + +-static int is_hugetlb_entry_migration(pte_t pte) +-{ +- swp_entry_t swp; +- +- if (huge_pte_none(pte) || pte_present(pte)) +- return 0; +- swp = pte_to_swp_entry(pte); +- if (non_swap_entry(swp) && is_migration_entry(swp)) +- return 1; +- else +- return 0; +-} +- +-static int is_hugetlb_entry_hwpoisoned(pte_t pte) +-{ +- swp_entry_t swp; +- +- if (huge_pte_none(pte) || pte_present(pte)) +- return 0; +- swp = pte_to_swp_entry(pte); +- if (non_swap_entry(swp) && is_hwpoison_entry(swp)) +- return 1; +- else +- return 0; +-} +- + void __unmap_hugepage_range(struct vm_area_struct *vma, unsigned long start, + unsigned long end, struct page *ref_page) + { +diff --git a/mm/mempolicy.c b/mm/mempolicy.c +index 82f1b027ba1c..ee50c256fdc3 100644 +--- a/mm/mempolicy.c ++++ b/mm/mempolicy.c +@@ -566,24 +566,24 @@ static inline int check_pgd_range(struct vm_area_struct *vma, + * If pagelist != NULL then isolate pages from the LRU and + * put them on the pagelist. + */ +-static struct vm_area_struct * ++static int + check_range(struct mm_struct *mm, unsigned long start, unsigned long end, + const nodemask_t *nodes, unsigned long flags, void *private) + { +- int err; +- struct vm_area_struct *first, *vma, *prev; ++ int err = 0; ++ struct vm_area_struct *vma, *prev; + + +- first = find_vma(mm, start); +- if (!first) +- return ERR_PTR(-EFAULT); ++ vma = find_vma(mm, start); ++ if (!vma) ++ return -EFAULT; + prev = NULL; +- for (vma = first; vma && vma->vm_start < end; vma = vma->vm_next) { ++ for (; vma && vma->vm_start < end; vma = vma->vm_next) { + if (!(flags & MPOL_MF_DISCONTIG_OK)) { + if (!vma->vm_next && vma->vm_end < end) +- return ERR_PTR(-EFAULT); ++ return -EFAULT; + if (prev && prev->vm_end < vma->vm_start) +- return ERR_PTR(-EFAULT); ++ return -EFAULT; + } + if (!is_vm_hugetlb_page(vma) && + ((flags & MPOL_MF_STRICT) || +@@ -597,14 +597,12 @@ check_range(struct mm_struct *mm, unsigned long start, unsigned long end, + start = vma->vm_start; + err = check_pgd_range(vma, start, endvma, nodes, + flags, private); +- if (err) { +- first = ERR_PTR(err); ++ if (err) + break; +- } + } + prev = vma; + } +- return first; ++ return err; + } + + /* +@@ -945,16 +943,15 @@ static int migrate_to_node(struct mm_struct *mm, int source, int dest, + { + nodemask_t nmask; + LIST_HEAD(pagelist); +- int err = 0; +- struct vm_area_struct *vma; ++ int err; + + nodes_clear(nmask); + node_set(source, nmask); + +- vma = check_range(mm, mm->mmap->vm_start, mm->task_size, &nmask, ++ err = check_range(mm, mm->mmap->vm_start, mm->task_size, &nmask, + flags | MPOL_MF_DISCONTIG_OK, &pagelist); +- if (IS_ERR(vma)) +- return PTR_ERR(vma); ++ if (err) ++ return err; + + if (!list_empty(&pagelist)) { + err = migrate_pages(&pagelist, new_node_page, dest, +@@ -1058,16 +1055,17 @@ out: + + /* + * Allocate a new page for page migration based on vma policy. +- * Start assuming that page is mapped by vma pointed to by @private. ++ * Start by assuming the page is mapped by the same vma as contains @start. + * Search forward from there, if not. N.B., this assumes that the + * list of pages handed to migrate_pages()--which is how we get here-- + * is in virtual address order. + */ +-static struct page *new_vma_page(struct page *page, unsigned long private, int **x) ++static struct page *new_page(struct page *page, unsigned long start, int **x) + { +- struct vm_area_struct *vma = (struct vm_area_struct *)private; ++ struct vm_area_struct *vma; + unsigned long uninitialized_var(address); + ++ vma = find_vma(current->mm, start); + while (vma) { + address = page_address_in_vma(page, vma); + if (address != -EFAULT) +@@ -1093,7 +1091,7 @@ int do_migrate_pages(struct mm_struct *mm, + return -ENOSYS; + } + +-static struct page *new_vma_page(struct page *page, unsigned long private, int **x) ++static struct page *new_page(struct page *page, unsigned long start, int **x) + { + return NULL; + } +@@ -1103,7 +1101,6 @@ static long do_mbind(unsigned long start, unsigned long len, + unsigned short mode, unsigned short mode_flags, + nodemask_t *nmask, unsigned long flags) + { +- struct vm_area_struct *vma; + struct mm_struct *mm = current->mm; + struct mempolicy *new; + unsigned long end; +@@ -1167,19 +1164,17 @@ static long do_mbind(unsigned long start, unsigned long len, + if (err) + goto mpol_out; + +- vma = check_range(mm, start, end, nmask, ++ err = check_range(mm, start, end, nmask, + flags | MPOL_MF_INVERT, &pagelist); + +- err = PTR_ERR(vma); +- if (!IS_ERR(vma)) { ++ if (!err) { + int nr_failed = 0; + + err = mbind_range(mm, start, end, new); + + if (!list_empty(&pagelist)) { +- nr_failed = migrate_pages(&pagelist, new_vma_page, +- (unsigned long)vma, +- false, true); ++ nr_failed = migrate_pages(&pagelist, new_page, ++ start, false, true); + if (nr_failed) + putback_lru_pages(&pagelist); + } +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index 39b2baf6c1d5..70bdb7d1d6df 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -224,22 +224,6 @@ void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8], + } + EXPORT_SYMBOL(hci_le_start_enc); + +-void hci_le_ltk_reply(struct hci_conn *conn, u8 ltk[16]) +-{ +- struct hci_dev *hdev = conn->hdev; +- struct hci_cp_le_ltk_reply cp; +- +- BT_DBG("%p", conn); +- +- memset(&cp, 0, sizeof(cp)); +- +- cp.handle = cpu_to_le16(conn->handle); +- memcpy(cp.ltk, ltk, sizeof(ltk)); +- +- hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp); +-} +-EXPORT_SYMBOL(hci_le_ltk_reply); +- + void hci_le_ltk_neg_reply(struct hci_conn *conn) + { + struct hci_dev *hdev = conn->hdev; +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index 21b2de18c3b7..04bff67d5efc 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -3156,8 +3156,11 @@ static inline void hci_user_confirm_request_evt(struct hci_dev *hdev, + + /* If we're not the initiators request authorization to + * proceed from user space (mgmt_user_confirm with +- * confirm_hint set to 1). */ +- if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags)) { ++ * confirm_hint set to 1). The exception is if neither ++ * side had MITM in which case we do auto-accept. ++ */ ++ if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ++ (loc_mitm || rem_mitm)) { + BT_DBG("Confirming auto-accept as acceptor"); + confirm_hint = 1; + goto confirm; +diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c +index 30f99c344847..d5404cc0248d 100644 +--- a/net/mac80211/debugfs_netdev.c ++++ b/net/mac80211/debugfs_netdev.c +@@ -33,8 +33,7 @@ static ssize_t ieee80211_if_read( + ssize_t ret = -EINVAL; + + read_lock(&dev_base_lock); +- if (sdata->dev->reg_state == NETREG_REGISTERED) +- ret = (*format)(sdata, buf, sizeof(buf)); ++ ret = (*format)(sdata, buf, sizeof(buf)); + read_unlock(&dev_base_lock); + + if (ret >= 0) +@@ -61,8 +60,7 @@ static ssize_t ieee80211_if_write( + + ret = -ENODEV; + rtnl_lock(); +- if (sdata->dev->reg_state == NETREG_REGISTERED) +- ret = (*write)(sdata, buf, count); ++ ret = (*write)(sdata, buf, count); + rtnl_unlock(); + + return ret; +diff --git a/tools/usb/ffs-test.c b/tools/usb/ffs-test.c +index 8674b9ec14f6..b3dbf8e1ff05 100644 +--- a/tools/usb/ffs-test.c ++++ b/tools/usb/ffs-test.c +@@ -116,8 +116,8 @@ static const struct { + .header = { + .magic = cpu_to_le32(FUNCTIONFS_DESCRIPTORS_MAGIC), + .length = cpu_to_le32(sizeof descriptors), +- .fs_count = 3, +- .hs_count = 3, ++ .fs_count = cpu_to_le32(3), ++ .hs_count = cpu_to_le32(3), + }, + .fs_descs = { + .intf = { |