Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-3.10/0161-3.10.62-all-fixes.patch

    Contents of /trunk/kernel-alx/patches-3.10/0161-3.10.62-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 2649 - (show annotations) (download)
    Tue Jul 21 16:20:21 2015 UTC (8 years, 9 months ago) by niro
    File size: 53878 byte(s) 
    -linux-3.10.62
    1 diff --git a/Makefile b/Makefile
    2 index 0d5ba80786b8..a0b86250d6ca 100644
    3 --- a/Makefile
    4 +++ b/Makefile
    5 @@ -1,6 +1,6 @@
    6 VERSION = 3
    7 PATCHLEVEL = 10
    8 -SUBLEVEL = 61
    9 +SUBLEVEL = 62
    10 EXTRAVERSION =
    11 NAME = TOSSUG Baby Fish
    12
    13 diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
    14 index 19da84172cc3..4562ebf8449d 100644
    15 --- a/arch/arm/mm/proc-v7.S
    16 +++ b/arch/arm/mm/proc-v7.S
    17 @@ -201,7 +201,6 @@ __v7_pj4b_setup:
    18 /* Auxiliary Debug Modes Control 1 Register */
    19 #define PJ4B_STATIC_BP (1 << 2) /* Enable Static BP */
    20 #define PJ4B_INTER_PARITY (1 << 8) /* Disable Internal Parity Handling */
    21 -#define PJ4B_BCK_OFF_STREX (1 << 5) /* Enable the back off of STREX instr */
    22 #define PJ4B_CLEAN_LINE (1 << 16) /* Disable data transfer for clean line */
    23
    24 /* Auxiliary Debug Modes Control 2 Register */
    25 @@ -224,7 +223,6 @@ __v7_pj4b_setup:
    26 /* Auxiliary Debug Modes Control 1 Register */
    27 mrc p15, 1, r0, c15, c1, 1
    28 orr r0, r0, #PJ4B_CLEAN_LINE
    29 - orr r0, r0, #PJ4B_BCK_OFF_STREX
    30 orr r0, r0, #PJ4B_INTER_PARITY
    31 bic r0, r0, #PJ4B_STATIC_BP
    32 mcr p15, 1, r0, c15, c1, 1
    33 diff --git a/arch/arm/mm/proc-xscale.S b/arch/arm/mm/proc-xscale.S
    34 index e766f889bfd6..08b51b7dbf69 100644
    35 --- a/arch/arm/mm/proc-xscale.S
    36 +++ b/arch/arm/mm/proc-xscale.S
    37 @@ -535,7 +535,7 @@ ENTRY(cpu_xscale_do_suspend)
    38 mrc p15, 0, r5, c15, c1, 0 @ CP access reg
    39 mrc p15, 0, r6, c13, c0, 0 @ PID
    40 mrc p15, 0, r7, c3, c0, 0 @ domain ID
    41 - mrc p15, 0, r8, c1, c1, 0 @ auxiliary control reg
    42 + mrc p15, 0, r8, c1, c0, 1 @ auxiliary control reg
    43 mrc p15, 0, r9, c1, c0, 0 @ control reg
    44 bic r4, r4, #2 @ clear frequency change bit
    45 stmia r0, {r4 - r9} @ store cp regs
    46 @@ -552,7 +552,7 @@ ENTRY(cpu_xscale_do_resume)
    47 mcr p15, 0, r6, c13, c0, 0 @ PID
    48 mcr p15, 0, r7, c3, c0, 0 @ domain ID
    49 mcr p15, 0, r1, c2, c0, 0 @ translation table base addr
    50 - mcr p15, 0, r8, c1, c1, 0 @ auxiliary control reg
    51 + mcr p15, 0, r8, c1, c0, 1 @ auxiliary control reg
    52 mov r0, r9 @ control register
    53 b cpu_resume_mmu
    54 ENDPROC(cpu_xscale_do_resume)
    55 diff --git a/arch/mips/loongson/common/Makefile b/arch/mips/loongson/common/Makefile
    56 index 4c57b3e5743f..33f76e658d19 100644
    57 --- a/arch/mips/loongson/common/Makefile
    58 +++ b/arch/mips/loongson/common/Makefile
    59 @@ -10,7 +10,8 @@ obj-$(CONFIG_GPIOLIB) += gpio.o
    60 # Serial port support
    61 #
    62 obj-$(CONFIG_EARLY_PRINTK) += early_printk.o
    63 -obj-$(CONFIG_SERIAL_8250) += serial.o
    64 +loongson-serial-$(CONFIG_SERIAL_8250) := serial.o
    65 +obj-y += $(loongson-serial-m) $(loongson-serial-y)
    66 obj-$(CONFIG_LOONGSON_UART_BASE) += uart_base.o
    67 obj-$(CONFIG_LOONGSON_MC146818) += rtc.o
    68
    69 diff --git a/arch/mips/oprofile/backtrace.c b/arch/mips/oprofile/backtrace.c
    70 index 6854ed5097d2..83a1dfd8f0e3 100644
    71 --- a/arch/mips/oprofile/backtrace.c
    72 +++ b/arch/mips/oprofile/backtrace.c
    73 @@ -92,7 +92,7 @@ static inline int unwind_user_frame(struct stackframe *old_frame,
    74 /* This marks the end of the previous function,
    75 which means we overran. */
    76 break;
    77 - stack_size = (unsigned) stack_adjustment;
    78 + stack_size = (unsigned long) stack_adjustment;
    79 } else if (is_ra_save_ins(&ip)) {
    80 int ra_slot = ip.i_format.simmediate;
    81 if (ra_slot < 0)
    82 diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
    83 index f75607c93e8a..b2bbb79bd99d 100644
    84 --- a/arch/powerpc/platforms/powernv/pci-ioda.c
    85 +++ b/arch/powerpc/platforms/powernv/pci-ioda.c
    86 @@ -789,7 +789,6 @@ static int pnv_pci_ioda_msi_setup(struct pnv_phb *phb, struct pci_dev *dev,
    87 unsigned int is_64, struct msi_msg *msg)
    88 {
    89 struct pnv_ioda_pe *pe = pnv_ioda_get_pe(dev);
    90 - struct pci_dn *pdn = pci_get_pdn(dev);
    91 struct irq_data *idata;
    92 struct irq_chip *ichip;
    93 unsigned int xive_num = hwirq - phb->msi_base;
    94 @@ -806,7 +805,7 @@ static int pnv_pci_ioda_msi_setup(struct pnv_phb *phb, struct pci_dev *dev,
    95 return -ENXIO;
    96
    97 /* Force 32-bit MSI on some broken devices */
    98 - if (pdn && pdn->force_32bit_msi)
    99 + if (dev->no_64bit_msi)
    100 is_64 = 0;
    101
    102 /* Assign XIVE to PE */
    103 diff --git a/arch/powerpc/platforms/powernv/pci.c b/arch/powerpc/platforms/powernv/pci.c
    104 index 277343cc6a3d..8ee842ce3aba 100644
    105 --- a/arch/powerpc/platforms/powernv/pci.c
    106 +++ b/arch/powerpc/platforms/powernv/pci.c
    107 @@ -1,3 +1,4 @@
    108 +
    109 /*
    110 * Support PCI/PCIe on PowerNV platforms
    111 *
    112 @@ -47,9 +48,8 @@ static int pnv_msi_check_device(struct pci_dev* pdev, int nvec, int type)
    113 {
    114 struct pci_controller *hose = pci_bus_to_host(pdev->bus);
    115 struct pnv_phb *phb = hose->private_data;
    116 - struct pci_dn *pdn = pci_get_pdn(pdev);
    117
    118 - if (pdn && pdn->force_32bit_msi && !phb->msi32_support)
    119 + if (pdev->no_64bit_msi && !phb->msi32_support)
    120 return -ENODEV;
    121
    122 return (phb && phb->msi_bmp.bitmap) ? 0 : -ENODEV;
    123 diff --git a/arch/powerpc/platforms/pseries/msi.c b/arch/powerpc/platforms/pseries/msi.c
    124 index 6d2f0abce6fa..3b350fb91285 100644
    125 --- a/arch/powerpc/platforms/pseries/msi.c
    126 +++ b/arch/powerpc/platforms/pseries/msi.c
    127 @@ -426,7 +426,7 @@ static int rtas_setup_msi_irqs(struct pci_dev *pdev, int nvec_in, int type)
    128 */
    129 again:
    130 if (type == PCI_CAP_ID_MSI) {
    131 - if (pdn->force_32bit_msi) {
    132 + if (pdev->no_64bit_msi) {
    133 rc = rtas_change_msi(pdn, RTAS_CHANGE_32MSI_FN, nvec);
    134 if (rc < 0) {
    135 /*
    136 diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
    137 index 96bf5bd30fbc..94599a65cc66 100644
    138 --- a/arch/powerpc/xmon/xmon.c
    139 +++ b/arch/powerpc/xmon/xmon.c
    140 @@ -288,10 +288,10 @@ static inline void disable_surveillance(void)
    141 args.token = rtas_token("set-indicator");
    142 if (args.token == RTAS_UNKNOWN_SERVICE)
    143 return;
    144 - args.nargs = 3;
    145 - args.nret = 1;
    146 + args.nargs = cpu_to_be32(3);
    147 + args.nret = cpu_to_be32(1);
    148 args.rets = &args.args[3];
    149 - args.args[0] = SURVEILLANCE_TOKEN;
    150 + args.args[0] = cpu_to_be32(SURVEILLANCE_TOKEN);
    151 args.args[1] = 0;
    152 args.args[2] = 0;
    153 enter_rtas(__pa(&args));
    154 diff --git a/arch/sparc/include/uapi/asm/swab.h b/arch/sparc/include/uapi/asm/swab.h
    155 index a34ad079487e..4c7c12d69bea 100644
    156 --- a/arch/sparc/include/uapi/asm/swab.h
    157 +++ b/arch/sparc/include/uapi/asm/swab.h
    158 @@ -9,9 +9,9 @@ static inline __u16 __arch_swab16p(const __u16 *addr)
    159 {
    160 __u16 ret;
    161
    162 - __asm__ __volatile__ ("lduha [%1] %2, %0"
    163 + __asm__ __volatile__ ("lduha [%2] %3, %0"
    164 : "=r" (ret)
    165 - : "r" (addr), "i" (ASI_PL));
    166 + : "m" (*addr), "r" (addr), "i" (ASI_PL));
    167 return ret;
    168 }
    169 #define __arch_swab16p __arch_swab16p
    170 @@ -20,9 +20,9 @@ static inline __u32 __arch_swab32p(const __u32 *addr)
    171 {
    172 __u32 ret;
    173
    174 - __asm__ __volatile__ ("lduwa [%1] %2, %0"
    175 + __asm__ __volatile__ ("lduwa [%2] %3, %0"
    176 : "=r" (ret)
    177 - : "r" (addr), "i" (ASI_PL));
    178 + : "m" (*addr), "r" (addr), "i" (ASI_PL));
    179 return ret;
    180 }
    181 #define __arch_swab32p __arch_swab32p
    182 @@ -31,9 +31,9 @@ static inline __u64 __arch_swab64p(const __u64 *addr)
    183 {
    184 __u64 ret;
    185
    186 - __asm__ __volatile__ ("ldxa [%1] %2, %0"
    187 + __asm__ __volatile__ ("ldxa [%2] %3, %0"
    188 : "=r" (ret)
    189 - : "r" (addr), "i" (ASI_PL));
    190 + : "m" (*addr), "r" (addr), "i" (ASI_PL));
    191 return ret;
    192 }
    193 #define __arch_swab64p __arch_swab64p
    194 diff --git a/arch/x86/include/asm/page_32_types.h b/arch/x86/include/asm/page_32_types.h
    195 index ef17af013475..4376b458aef7 100644
    196 --- a/arch/x86/include/asm/page_32_types.h
    197 +++ b/arch/x86/include/asm/page_32_types.h
    198 @@ -18,7 +18,6 @@
    199 #define THREAD_SIZE_ORDER 1
    200 #define THREAD_SIZE (PAGE_SIZE << THREAD_SIZE_ORDER)
    201
    202 -#define STACKFAULT_STACK 0
    203 #define DOUBLEFAULT_STACK 1
    204 #define NMI_STACK 0
    205 #define DEBUG_STACK 0
    206 diff --git a/arch/x86/include/asm/page_64_types.h b/arch/x86/include/asm/page_64_types.h
    207 index 6c896fbe21db..970f3097ee33 100644
    208 --- a/arch/x86/include/asm/page_64_types.h
    209 +++ b/arch/x86/include/asm/page_64_types.h
    210 @@ -14,12 +14,11 @@
    211 #define IRQ_STACK_ORDER 2
    212 #define IRQ_STACK_SIZE (PAGE_SIZE << IRQ_STACK_ORDER)
    213
    214 -#define STACKFAULT_STACK 1
    215 -#define DOUBLEFAULT_STACK 2
    216 -#define NMI_STACK 3
    217 -#define DEBUG_STACK 4
    218 -#define MCE_STACK 5
    219 -#define N_EXCEPTION_STACKS 5 /* hw limit: 7 */
    220 +#define DOUBLEFAULT_STACK 1
    221 +#define NMI_STACK 2
    222 +#define DEBUG_STACK 3
    223 +#define MCE_STACK 4
    224 +#define N_EXCEPTION_STACKS 4 /* hw limit: 7 */
    225
    226 #define PUD_PAGE_SIZE (_AC(1, UL) << PUD_SHIFT)
    227 #define PUD_PAGE_MASK (~(PUD_PAGE_SIZE-1))
    228 diff --git a/arch/x86/include/asm/thread_info.h b/arch/x86/include/asm/thread_info.h
    229 index a1df6e84691f..d3e0ff5962fe 100644
    230 --- a/arch/x86/include/asm/thread_info.h
    231 +++ b/arch/x86/include/asm/thread_info.h
    232 @@ -147,7 +147,7 @@ struct thread_info {
    233 /* Only used for 64 bit */
    234 #define _TIF_DO_NOTIFY_MASK \
    235 (_TIF_SIGPENDING | _TIF_MCE_NOTIFY | _TIF_NOTIFY_RESUME | \
    236 - _TIF_USER_RETURN_NOTIFY)
    237 + _TIF_USER_RETURN_NOTIFY | _TIF_UPROBE)
    238
    239 /* flags to check in __switch_to() */
    240 #define _TIF_WORK_CTXSW \
    241 diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
    242 index 6a7e3e9cffc3..564140155c36 100644
    243 --- a/arch/x86/kernel/cpu/common.c
    244 +++ b/arch/x86/kernel/cpu/common.c
    245 @@ -144,6 +144,8 @@ EXPORT_PER_CPU_SYMBOL_GPL(gdt_page);
    246
    247 static int __init x86_xsave_setup(char *s)
    248 {
    249 + if (strlen(s))
    250 + return 0;
    251 setup_clear_cpu_cap(X86_FEATURE_XSAVE);
    252 setup_clear_cpu_cap(X86_FEATURE_XSAVEOPT);
    253 setup_clear_cpu_cap(X86_FEATURE_AVX);
    254 diff --git a/arch/x86/kernel/dumpstack_64.c b/arch/x86/kernel/dumpstack_64.c
    255 index addb207dab92..66e274a3d968 100644
    256 --- a/arch/x86/kernel/dumpstack_64.c
    257 +++ b/arch/x86/kernel/dumpstack_64.c
    258 @@ -24,7 +24,6 @@ static char x86_stack_ids[][8] = {
    259 [ DEBUG_STACK-1 ] = "#DB",
    260 [ NMI_STACK-1 ] = "NMI",
    261 [ DOUBLEFAULT_STACK-1 ] = "#DF",
    262 - [ STACKFAULT_STACK-1 ] = "#SS",
    263 [ MCE_STACK-1 ] = "#MC",
    264 #if DEBUG_STKSZ > EXCEPTION_STKSZ
    265 [ N_EXCEPTION_STACKS ...
    266 diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
    267 index 8c6b5c2284c7..948b2e14df8c 100644
    268 --- a/arch/x86/kernel/entry_64.S
    269 +++ b/arch/x86/kernel/entry_64.S
    270 @@ -1068,9 +1068,15 @@ ENTRY(native_iret)
    271 jnz native_irq_return_ldt
    272 #endif
    273
    274 +.global native_irq_return_iret
    275 native_irq_return_iret:
    276 + /*
    277 + * This may fault. Non-paranoid faults on return to userspace are
    278 + * handled by fixup_bad_iret. These include #SS, #GP, and #NP.
    279 + * Double-faults due to espfix64 are handled in do_double_fault.
    280 + * Other faults here are fatal.
    281 + */
    282 iretq
    283 - _ASM_EXTABLE(native_irq_return_iret, bad_iret)
    284
    285 #ifdef CONFIG_X86_ESPFIX64
    286 native_irq_return_ldt:
    287 @@ -1098,25 +1104,6 @@ native_irq_return_ldt:
    288 jmp native_irq_return_iret
    289 #endif
    290
    291 - .section .fixup,"ax"
    292 -bad_iret:
    293 - /*
    294 - * The iret traps when the %cs or %ss being restored is bogus.
    295 - * We've lost the original trap vector and error code.
    296 - * #GPF is the most likely one to get for an invalid selector.
    297 - * So pretend we completed the iret and took the #GPF in user mode.
    298 - *
    299 - * We are now running with the kernel GS after exception recovery.
    300 - * But error_entry expects us to have user GS to match the user %cs,
    301 - * so swap back.
    302 - */
    303 - pushq $0
    304 -
    305 - SWAPGS
    306 - jmp general_protection
    307 -
    308 - .previous
    309 -
    310 /* edi: workmask, edx: work */
    311 retint_careful:
    312 CFI_RESTORE_STATE
    313 @@ -1164,37 +1151,6 @@ ENTRY(retint_kernel)
    314 CFI_ENDPROC
    315 END(common_interrupt)
    316
    317 - /*
    318 - * If IRET takes a fault on the espfix stack, then we
    319 - * end up promoting it to a doublefault. In that case,
    320 - * modify the stack to make it look like we just entered
    321 - * the #GP handler from user space, similar to bad_iret.
    322 - */
    323 -#ifdef CONFIG_X86_ESPFIX64
    324 - ALIGN
    325 -__do_double_fault:
    326 - XCPT_FRAME 1 RDI+8
    327 - movq RSP(%rdi),%rax /* Trap on the espfix stack? */
    328 - sarq $PGDIR_SHIFT,%rax
    329 - cmpl $ESPFIX_PGD_ENTRY,%eax
    330 - jne do_double_fault /* No, just deliver the fault */
    331 - cmpl $__KERNEL_CS,CS(%rdi)
    332 - jne do_double_fault
    333 - movq RIP(%rdi),%rax
    334 - cmpq $native_irq_return_iret,%rax
    335 - jne do_double_fault /* This shouldn't happen... */
    336 - movq PER_CPU_VAR(kernel_stack),%rax
    337 - subq $(6*8-KERNEL_STACK_OFFSET),%rax /* Reset to original stack */
    338 - movq %rax,RSP(%rdi)
    339 - movq $0,(%rax) /* Missing (lost) #GP error code */
    340 - movq $general_protection,RIP(%rdi)
    341 - retq
    342 - CFI_ENDPROC
    343 -END(__do_double_fault)
    344 -#else
    345 -# define __do_double_fault do_double_fault
    346 -#endif
    347 -
    348 /*
    349 * End of kprobes section
    350 */
    351 @@ -1363,7 +1319,7 @@ zeroentry overflow do_overflow
    352 zeroentry bounds do_bounds
    353 zeroentry invalid_op do_invalid_op
    354 zeroentry device_not_available do_device_not_available
    355 -paranoiderrorentry double_fault __do_double_fault
    356 +paranoiderrorentry double_fault do_double_fault
    357 zeroentry coprocessor_segment_overrun do_coprocessor_segment_overrun
    358 errorentry invalid_TSS do_invalid_TSS
    359 errorentry segment_not_present do_segment_not_present
    360 @@ -1533,7 +1489,7 @@ apicinterrupt HYPERVISOR_CALLBACK_VECTOR \
    361
    362 paranoidzeroentry_ist debug do_debug DEBUG_STACK
    363 paranoidzeroentry_ist int3 do_int3 DEBUG_STACK
    364 -paranoiderrorentry stack_segment do_stack_segment
    365 +errorentry stack_segment do_stack_segment
    366 #ifdef CONFIG_XEN
    367 zeroentry xen_debug do_debug
    368 zeroentry xen_int3 do_int3
    369 @@ -1643,16 +1599,15 @@ error_sti:
    370
    371 /*
    372 * There are two places in the kernel that can potentially fault with
    373 - * usergs. Handle them here. The exception handlers after iret run with
    374 - * kernel gs again, so don't set the user space flag. B stepping K8s
    375 - * sometimes report an truncated RIP for IRET exceptions returning to
    376 - * compat mode. Check for these here too.
    377 + * usergs. Handle them here. B stepping K8s sometimes report a
    378 + * truncated RIP for IRET exceptions returning to compat mode. Check
    379 + * for these here too.
    380 */
    381 error_kernelspace:
    382 incl %ebx
    383 leaq native_irq_return_iret(%rip),%rcx
    384 cmpq %rcx,RIP+8(%rsp)
    385 - je error_swapgs
    386 + je error_bad_iret
    387 movl %ecx,%eax /* zero extend */
    388 cmpq %rax,RIP+8(%rsp)
    389 je bstep_iret
    390 @@ -1663,7 +1618,15 @@ error_kernelspace:
    391 bstep_iret:
    392 /* Fix truncated RIP */
    393 movq %rcx,RIP+8(%rsp)
    394 - jmp error_swapgs
    395 + /* fall through */
    396 +
    397 +error_bad_iret:
    398 + SWAPGS
    399 + mov %rsp,%rdi
    400 + call fixup_bad_iret
    401 + mov %rax,%rsp
    402 + decl %ebx /* Return to usergs */
    403 + jmp error_sti
    404 CFI_ENDPROC
    405 END(error_entry)
    406
    407 diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
    408 index 772e2a846dec..332cafe909eb 100644
    409 --- a/arch/x86/kernel/traps.c
    410 +++ b/arch/x86/kernel/traps.c
    411 @@ -220,33 +220,41 @@ DO_ERROR(X86_TRAP_OLD_MF, SIGFPE, "coprocessor segment overrun",
    412 coprocessor_segment_overrun)
    413 DO_ERROR(X86_TRAP_TS, SIGSEGV, "invalid TSS", invalid_TSS)
    414 DO_ERROR(X86_TRAP_NP, SIGBUS, "segment not present", segment_not_present)
    415 -#ifdef CONFIG_X86_32
    416 DO_ERROR(X86_TRAP_SS, SIGBUS, "stack segment", stack_segment)
    417 -#endif
    418 DO_ERROR_INFO(X86_TRAP_AC, SIGBUS, "alignment check", alignment_check,
    419 BUS_ADRALN, 0)
    420
    421 #ifdef CONFIG_X86_64
    422 /* Runs on IST stack */
    423 -dotraplinkage void do_stack_segment(struct pt_regs *regs, long error_code)
    424 -{
    425 - enum ctx_state prev_state;
    426 -
    427 - prev_state = exception_enter();
    428 - if (notify_die(DIE_TRAP, "stack segment", regs, error_code,
    429 - X86_TRAP_SS, SIGBUS) != NOTIFY_STOP) {
    430 - preempt_conditional_sti(regs);
    431 - do_trap(X86_TRAP_SS, SIGBUS, "stack segment", regs, error_code, NULL);
    432 - preempt_conditional_cli(regs);
    433 - }
    434 - exception_exit(prev_state);
    435 -}
    436 -
    437 dotraplinkage void do_double_fault(struct pt_regs *regs, long error_code)
    438 {
    439 static const char str[] = "double fault";
    440 struct task_struct *tsk = current;
    441
    442 +#ifdef CONFIG_X86_ESPFIX64
    443 + extern unsigned char native_irq_return_iret[];
    444 +
    445 + /*
    446 + * If IRET takes a non-IST fault on the espfix64 stack, then we
    447 + * end up promoting it to a doublefault. In that case, modify
    448 + * the stack to make it look like we just entered the #GP
    449 + * handler from user space, similar to bad_iret.
    450 + */
    451 + if (((long)regs->sp >> PGDIR_SHIFT) == ESPFIX_PGD_ENTRY &&
    452 + regs->cs == __KERNEL_CS &&
    453 + regs->ip == (unsigned long)native_irq_return_iret)
    454 + {
    455 + struct pt_regs *normal_regs = task_pt_regs(current);
    456 +
    457 + /* Fake a #GP(0) from userspace. */
    458 + memmove(&normal_regs->ip, (void *)regs->sp, 5*8);
    459 + normal_regs->orig_ax = 0; /* Missing (lost) #GP error code */
    460 + regs->ip = (unsigned long)general_protection;
    461 + regs->sp = (unsigned long)&normal_regs->orig_ax;
    462 + return;
    463 + }
    464 +#endif
    465 +
    466 exception_enter();
    467 /* Return not checked because double check cannot be ignored */
    468 notify_die(DIE_TRAP, str, regs, error_code, X86_TRAP_DF, SIGSEGV);
    469 @@ -373,6 +381,35 @@ asmlinkage __kprobes struct pt_regs *sync_regs(struct pt_regs *eregs)
    470 *regs = *eregs;
    471 return regs;
    472 }
    473 +
    474 +struct bad_iret_stack {
    475 + void *error_entry_ret;
    476 + struct pt_regs regs;
    477 +};
    478 +
    479 +asmlinkage __visible
    480 +struct bad_iret_stack *fixup_bad_iret(struct bad_iret_stack *s)
    481 +{
    482 + /*
    483 + * This is called from entry_64.S early in handling a fault
    484 + * caused by a bad iret to user mode. To handle the fault
    485 + * correctly, we want move our stack frame to task_pt_regs
    486 + * and we want to pretend that the exception came from the
    487 + * iret target.
    488 + */
    489 + struct bad_iret_stack *new_stack =
    490 + container_of(task_pt_regs(current),
    491 + struct bad_iret_stack, regs);
    492 +
    493 + /* Copy the IRET target to the new stack. */
    494 + memmove(&new_stack->regs.ip, (void *)s->regs.sp, 5*8);
    495 +
    496 + /* Copy the remainder of the stack from the current stack. */
    497 + memmove(new_stack, s, offsetof(struct bad_iret_stack, regs.ip));
    498 +
    499 + BUG_ON(!user_mode_vm(&new_stack->regs));
    500 + return new_stack;
    501 +}
    502 #endif
    503
    504 /*
    505 @@ -745,7 +782,7 @@ void __init trap_init(void)
    506 set_intr_gate(X86_TRAP_OLD_MF, &coprocessor_segment_overrun);
    507 set_intr_gate(X86_TRAP_TS, &invalid_TSS);
    508 set_intr_gate(X86_TRAP_NP, &segment_not_present);
    509 - set_intr_gate_ist(X86_TRAP_SS, &stack_segment, STACKFAULT_STACK);
    510 + set_intr_gate(X86_TRAP_SS, stack_segment);
    511 set_intr_gate(X86_TRAP_GP, &general_protection);
    512 set_intr_gate(X86_TRAP_SPURIOUS, &spurious_interrupt_bug);
    513 set_intr_gate(X86_TRAP_MF, &coprocessor_error);
    514 diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
    515 index bb00c4672ad6..2db3f30bed75 100644
    516 --- a/arch/x86/mm/init_64.c
    517 +++ b/arch/x86/mm/init_64.c
    518 @@ -1142,7 +1142,7 @@ void mark_rodata_ro(void)
    519 unsigned long end = (unsigned long) &__end_rodata_hpage_align;
    520 unsigned long text_end = PFN_ALIGN(&__stop___ex_table);
    521 unsigned long rodata_end = PFN_ALIGN(&__end_rodata);
    522 - unsigned long all_end = PFN_ALIGN(&_end);
    523 + unsigned long all_end;
    524
    525 printk(KERN_INFO "Write protecting the kernel read-only data: %luk\n",
    526 (end - start) >> 10);
    527 @@ -1153,7 +1153,16 @@ void mark_rodata_ro(void)
    528 /*
    529 * The rodata/data/bss/brk section (but not the kernel text!)
    530 * should also be not-executable.
    531 + *
    532 + * We align all_end to PMD_SIZE because the existing mapping
    533 + * is a full PMD. If we would align _brk_end to PAGE_SIZE we
    534 + * split the PMD and the reminder between _brk_end and the end
    535 + * of the PMD will remain mapped executable.
    536 + *
    537 + * Any PMD which was setup after the one which covers _brk_end
    538 + * has been zapped already via cleanup_highmem().
    539 */
    540 + all_end = roundup((unsigned long)_brk_end, PMD_SIZE);
    541 set_memory_nx(rodata_start, (all_end - rodata_start) >> PAGE_SHIFT);
    542
    543 rodata_test();
    544 diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
    545 index acb3865710c2..5d4a4583d2df 100644
    546 --- a/drivers/infiniband/ulp/isert/ib_isert.c
    547 +++ b/drivers/infiniband/ulp/isert/ib_isert.c
    548 @@ -585,14 +585,25 @@ wake_up:
    549 complete(&isert_conn->conn_wait);
    550 }
    551
    552 -static void
    553 +static int
    554 isert_disconnected_handler(struct rdma_cm_id *cma_id, bool disconnect)
    555 {
    556 - struct isert_conn *isert_conn = (struct isert_conn *)cma_id->context;
    557 + struct isert_conn *isert_conn;
    558 +
    559 + if (!cma_id->qp) {
    560 + struct isert_np *isert_np = cma_id->context;
    561 +
    562 + isert_np->np_cm_id = NULL;
    563 + return -1;
    564 + }
    565 +
    566 + isert_conn = (struct isert_conn *)cma_id->context;
    567
    568 isert_conn->disconnect = disconnect;
    569 INIT_WORK(&isert_conn->conn_logout_work, isert_disconnect_work);
    570 schedule_work(&isert_conn->conn_logout_work);
    571 +
    572 + return 0;
    573 }
    574
    575 static int
    576 @@ -607,6 +618,9 @@ isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
    577 switch (event->event) {
    578 case RDMA_CM_EVENT_CONNECT_REQUEST:
    579 ret = isert_connect_request(cma_id, event);
    580 + if (ret)
    581 + pr_err("isert_cma_handler failed RDMA_CM_EVENT: 0x%08x %d\n",
    582 + event->event, ret);
    583 break;
    584 case RDMA_CM_EVENT_ESTABLISHED:
    585 isert_connected_handler(cma_id);
    586 @@ -616,7 +630,7 @@ isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
    587 case RDMA_CM_EVENT_DEVICE_REMOVAL: /* FALLTHRU */
    588 disconnect = true;
    589 case RDMA_CM_EVENT_TIMEWAIT_EXIT: /* FALLTHRU */
    590 - isert_disconnected_handler(cma_id, disconnect);
    591 + ret = isert_disconnected_handler(cma_id, disconnect);
    592 break;
    593 case RDMA_CM_EVENT_CONNECT_ERROR:
    594 default:
    595 @@ -624,12 +638,6 @@ isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
    596 break;
    597 }
    598
    599 - if (ret != 0) {
    600 - pr_err("isert_cma_handler failed RDMA_CM_EVENT: 0x%08x %d\n",
    601 - event->event, ret);
    602 - dump_stack();
    603 - }
    604 -
    605 return ret;
    606 }
    607
    608 @@ -2233,7 +2241,8 @@ isert_free_np(struct iscsi_np *np)
    609 {
    610 struct isert_np *isert_np = (struct isert_np *)np->np_context;
    611
    612 - rdma_destroy_id(isert_np->np_cm_id);
    613 + if (isert_np->np_cm_id)
    614 + rdma_destroy_id(isert_np->np_cm_id);
    615
    616 np->np_context = NULL;
    617 kfree(isert_np);
    618 diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
    619 index 64953dfa9d8a..fcf9f87bcfd9 100644
    620 --- a/drivers/infiniband/ulp/srpt/ib_srpt.c
    621 +++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
    622 @@ -2101,6 +2101,7 @@ static int srpt_create_ch_ib(struct srpt_rdma_ch *ch)
    623 if (!qp_init)
    624 goto out;
    625
    626 +retry:
    627 ch->cq = ib_create_cq(sdev->device, srpt_completion, NULL, ch,
    628 ch->rq_size + srp_sq_size, 0);
    629 if (IS_ERR(ch->cq)) {
    630 @@ -2124,6 +2125,13 @@ static int srpt_create_ch_ib(struct srpt_rdma_ch *ch)
    631 ch->qp = ib_create_qp(sdev->pd, qp_init);
    632 if (IS_ERR(ch->qp)) {
    633 ret = PTR_ERR(ch->qp);
    634 + if (ret == -ENOMEM) {
    635 + srp_sq_size /= 2;
    636 + if (srp_sq_size >= MIN_SRPT_SQ_SIZE) {
    637 + ib_destroy_cq(ch->cq);
    638 + goto retry;
    639 + }
    640 + }
    641 printk(KERN_ERR "failed to create_qp ret= %d\n", ret);
    642 goto err_destroy_cq;
    643 }
    644 diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
    645 index 75e3b102ce45..856c1b03e22d 100644
    646 --- a/drivers/input/joystick/xpad.c
    647 +++ b/drivers/input/joystick/xpad.c
    648 @@ -1002,9 +1002,19 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id
    649 }
    650
    651 ep_irq_in = &intf->cur_altsetting->endpoint[1].desc;
    652 - usb_fill_bulk_urb(xpad->bulk_out, udev,
    653 - usb_sndbulkpipe(udev, ep_irq_in->bEndpointAddress),
    654 - xpad->bdata, XPAD_PKT_LEN, xpad_bulk_out, xpad);
    655 + if (usb_endpoint_is_bulk_out(ep_irq_in)) {
    656 + usb_fill_bulk_urb(xpad->bulk_out, udev,
    657 + usb_sndbulkpipe(udev,
    658 + ep_irq_in->bEndpointAddress),
    659 + xpad->bdata, XPAD_PKT_LEN,
    660 + xpad_bulk_out, xpad);
    661 + } else {
    662 + usb_fill_int_urb(xpad->bulk_out, udev,
    663 + usb_sndintpipe(udev,
    664 + ep_irq_in->bEndpointAddress),
    665 + xpad->bdata, XPAD_PKT_LEN,
    666 + xpad_bulk_out, xpad, 0);
    667 + }
    668
    669 /*
    670 * Submit the int URB immediately rather than waiting for open
    671 diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
    672 index 539239d8e9ab..9bf47a064cdf 100644
    673 --- a/drivers/net/can/dev.c
    674 +++ b/drivers/net/can/dev.c
    675 @@ -385,7 +385,7 @@ void can_free_echo_skb(struct net_device *dev, unsigned int idx)
    676 BUG_ON(idx >= priv->echo_skb_max);
    677
    678 if (priv->echo_skb[idx]) {
    679 - kfree_skb(priv->echo_skb[idx]);
    680 + dev_kfree_skb_any(priv->echo_skb[idx]);
    681 priv->echo_skb[idx] = NULL;
    682 }
    683 }
    684 diff --git a/drivers/net/can/usb/esd_usb2.c b/drivers/net/can/usb/esd_usb2.c
    685 index 6aa7b3266c80..d5455c760618 100644
    686 --- a/drivers/net/can/usb/esd_usb2.c
    687 +++ b/drivers/net/can/usb/esd_usb2.c
    688 @@ -1132,6 +1132,7 @@ static void esd_usb2_disconnect(struct usb_interface *intf)
    689 }
    690 }
    691 unlink_all_urbs(dev);
    692 + kfree(dev);
    693 }
    694 }
    695
    696 diff --git a/drivers/net/ieee802154/fakehard.c b/drivers/net/ieee802154/fakehard.c
    697 index bf0d55e2dd63..6adbef89c4b0 100644
    698 --- a/drivers/net/ieee802154/fakehard.c
    699 +++ b/drivers/net/ieee802154/fakehard.c
    700 @@ -376,17 +376,20 @@ static int ieee802154fake_probe(struct platform_device *pdev)
    701
    702 err = wpan_phy_register(phy);
    703 if (err)
    704 - goto out;
    705 + goto err_phy_reg;
    706
    707 err = register_netdev(dev);
    708 - if (err < 0)
    709 - goto out;
    710 + if (err)
    711 + goto err_netdev_reg;
    712
    713 dev_info(&pdev->dev, "Added ieee802154 HardMAC hardware\n");
    714 return 0;
    715
    716 -out:
    717 - unregister_netdev(dev);
    718 +err_netdev_reg:
    719 + wpan_phy_unregister(phy);
    720 +err_phy_reg:
    721 + free_netdev(dev);
    722 + wpan_phy_free(phy);
    723 return err;
    724 }
    725
    726 diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
    727 index 8161c3f066a3..0d5a5faaf83b 100644
    728 --- a/drivers/net/ppp/pptp.c
    729 +++ b/drivers/net/ppp/pptp.c
    730 @@ -506,7 +506,9 @@ static int pptp_getname(struct socket *sock, struct sockaddr *uaddr,
    731 int len = sizeof(struct sockaddr_pppox);
    732 struct sockaddr_pppox sp;
    733
    734 - sp.sa_family = AF_PPPOX;
    735 + memset(&sp.sa_addr, 0, sizeof(sp.sa_addr));
    736 +
    737 + sp.sa_family = AF_PPPOX;
    738 sp.sa_protocol = PX_PROTO_PPTP;
    739 sp.sa_addr.pptp = pppox_sk(sock->sk)->proto.pptp.src_addr;
    740
    741 diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
    742 index 6c584f8a2268..43204f4be2da 100644
    743 --- a/drivers/net/usb/qmi_wwan.c
    744 +++ b/drivers/net/usb/qmi_wwan.c
    745 @@ -756,6 +756,7 @@ static const struct usb_device_id products[] = {
    746 {QMI_FIXED_INTF(0x413c, 0x81a4, 8)}, /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */
    747 {QMI_FIXED_INTF(0x413c, 0x81a8, 8)}, /* Dell Wireless 5808 Gobi(TM) 4G LTE Mobile Broadband Card */
    748 {QMI_FIXED_INTF(0x413c, 0x81a9, 8)}, /* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card */
    749 + {QMI_FIXED_INTF(0x03f0, 0x581d, 4)}, /* HP lt4112 LTE/HSPA+ Gobi 4G Module (Huawei me906e) */
    750
    751 /* 4. Gobi 1000 devices */
    752 {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)}, /* Acer Gobi Modem Device */
    753 diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
    754 index 1f17f5b64625..5be4eee63eb8 100644
    755 --- a/drivers/net/wireless/rt2x00/rt2x00queue.c
    756 +++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
    757 @@ -160,55 +160,29 @@ void rt2x00queue_align_frame(struct sk_buff *skb)
    758 skb_trim(skb, frame_length);
    759 }
    760
    761 -void rt2x00queue_insert_l2pad(struct sk_buff *skb, unsigned int header_length)
    762 +/*
    763 + * H/W needs L2 padding between the header and the paylod if header size
    764 + * is not 4 bytes aligned.
    765 + */
    766 +void rt2x00queue_insert_l2pad(struct sk_buff *skb, unsigned int hdr_len)
    767 {
    768 - unsigned int payload_length = skb->len - header_length;
    769 - unsigned int header_align = ALIGN_SIZE(skb, 0);
    770 - unsigned int payload_align = ALIGN_SIZE(skb, header_length);
    771 - unsigned int l2pad = payload_length ? L2PAD_SIZE(header_length) : 0;
    772 + unsigned int l2pad = (skb->len > hdr_len) ? L2PAD_SIZE(hdr_len) : 0;
    773
    774 - /*
    775 - * Adjust the header alignment if the payload needs to be moved more
    776 - * than the header.
    777 - */
    778 - if (payload_align > header_align)
    779 - header_align += 4;
    780 -
    781 - /* There is nothing to do if no alignment is needed */
    782 - if (!header_align)
    783 + if (!l2pad)
    784 return;
    785
    786 - /* Reserve the amount of space needed in front of the frame */
    787 - skb_push(skb, header_align);
    788 -
    789 - /*
    790 - * Move the header.
    791 - */
    792 - memmove(skb->data, skb->data + header_align, header_length);
    793 -
    794 - /* Move the payload, if present and if required */
    795 - if (payload_length && payload_align)
    796 - memmove(skb->data + header_length + l2pad,
    797 - skb->data + header_length + l2pad + payload_align,
    798 - payload_length);
    799 -
    800 - /* Trim the skb to the correct size */
    801 - skb_trim(skb, header_length + l2pad + payload_length);
    802 + skb_push(skb, l2pad);
    803 + memmove(skb->data, skb->data + l2pad, hdr_len);
    804 }
    805
    806 -void rt2x00queue_remove_l2pad(struct sk_buff *skb, unsigned int header_length)
    807 +void rt2x00queue_remove_l2pad(struct sk_buff *skb, unsigned int hdr_len)
    808 {
    809 - /*
    810 - * L2 padding is only present if the skb contains more than just the
    811 - * IEEE 802.11 header.
    812 - */
    813 - unsigned int l2pad = (skb->len > header_length) ?
    814 - L2PAD_SIZE(header_length) : 0;
    815 + unsigned int l2pad = (skb->len > hdr_len) ? L2PAD_SIZE(hdr_len) : 0;
    816
    817 if (!l2pad)
    818 return;
    819
    820 - memmove(skb->data + l2pad, skb->data, header_length);
    821 + memmove(skb->data + l2pad, skb->data, hdr_len);
    822 skb_pull(skb, l2pad);
    823 }
    824
    825 diff --git a/drivers/of/address.c b/drivers/of/address.c
    826 index 00bc55cc821c..8fb2b5769733 100644
    827 --- a/drivers/of/address.c
    828 +++ b/drivers/of/address.c
    829 @@ -334,6 +334,21 @@ static struct of_bus *of_match_bus(struct device_node *np)
    830 return NULL;
    831 }
    832
    833 +static int of_empty_ranges_quirk(void)
    834 +{
    835 + if (IS_ENABLED(CONFIG_PPC)) {
    836 + /* To save cycles, we cache the result */
    837 + static int quirk_state = -1;
    838 +
    839 + if (quirk_state < 0)
    840 + quirk_state =
    841 + of_machine_is_compatible("Power Macintosh") ||
    842 + of_machine_is_compatible("MacRISC");
    843 + return quirk_state;
    844 + }
    845 + return false;
    846 +}
    847 +
    848 static int of_translate_one(struct device_node *parent, struct of_bus *bus,
    849 struct of_bus *pbus, __be32 *addr,
    850 int na, int ns, int pna, const char *rprop)
    851 @@ -359,12 +374,10 @@ static int of_translate_one(struct device_node *parent, struct of_bus *bus,
    852 * This code is only enabled on powerpc. --gcl
    853 */
    854 ranges = of_get_property(parent, rprop, &rlen);
    855 -#if !defined(CONFIG_PPC)
    856 - if (ranges == NULL) {
    857 + if (ranges == NULL && !of_empty_ranges_quirk()) {
    858 pr_err("OF: no ranges; cannot translate\n");
    859 return 1;
    860 }
    861 -#endif /* !defined(CONFIG_PPC) */
    862 if (ranges == NULL || rlen == 0) {
    863 offset = of_read_number(addr, na);
    864 memset(addr, 0, pna * 4);
    865 diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
    866 index 2c1075213bec..402063ff889e 100644
    867 --- a/drivers/pci/msi.c
    868 +++ b/drivers/pci/msi.c
    869 @@ -530,6 +530,20 @@ out_unroll:
    870 return ret;
    871 }
    872
    873 +static int msi_verify_entries(struct pci_dev *dev)
    874 +{
    875 + struct msi_desc *entry;
    876 +
    877 + list_for_each_entry(entry, &dev->msi_list, list) {
    878 + if (!dev->no_64bit_msi || !entry->msg.address_hi)
    879 + continue;
    880 + dev_err(&dev->dev, "Device has broken 64-bit MSI but arch"
    881 + " tried to assign one above 4G\n");
    882 + return -EIO;
    883 + }
    884 + return 0;
    885 +}
    886 +
    887 /**
    888 * msi_capability_init - configure device's MSI capability structure
    889 * @dev: pointer to the pci_dev data structure of MSI device function
    890 @@ -583,6 +597,13 @@ static int msi_capability_init(struct pci_dev *dev, int nvec)
    891 return ret;
    892 }
    893
    894 + ret = msi_verify_entries(dev);
    895 + if (ret) {
    896 + msi_mask_irq(entry, mask, ~mask);
    897 + free_msi_irqs(dev);
    898 + return ret;
    899 + }
    900 +
    901 ret = populate_msi_sysfs(dev);
    902 if (ret) {
    903 msi_mask_irq(entry, mask, ~mask);
    904 @@ -698,6 +719,11 @@ static int msix_capability_init(struct pci_dev *dev,
    905 if (ret)
    906 goto error;
    907
    908 + /* Check if all MSI entries honor device restrictions */
    909 + ret = msi_verify_entries(dev);
    910 + if (ret)
    911 + goto error;
    912 +
    913 /*
    914 * Some devices require MSI-X to be enabled before we can touch the
    915 * MSI-X registers. We need to mask all the vectors to prevent
    916 diff --git a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
    917 index 69ac55495c1d..aad5535db782 100644
    918 --- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
    919 +++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
    920 @@ -411,6 +411,7 @@ static int bnx2fc_rcv(struct sk_buff *skb, struct net_device *dev,
    921 struct fc_frame_header *fh;
    922 struct fcoe_rcv_info *fr;
    923 struct fcoe_percpu_s *bg;
    924 + struct sk_buff *tmp_skb;
    925 unsigned short oxid;
    926
    927 interface = container_of(ptype, struct bnx2fc_interface,
    928 @@ -423,6 +424,12 @@ static int bnx2fc_rcv(struct sk_buff *skb, struct net_device *dev,
    929 goto err;
    930 }
    931
    932 + tmp_skb = skb_share_check(skb, GFP_ATOMIC);
    933 + if (!tmp_skb)
    934 + goto err;
    935 +
    936 + skb = tmp_skb;
    937 +
    938 if (unlikely(eth_hdr(skb)->h_proto != htons(ETH_P_FCOE))) {
    939 printk(KERN_ERR PFX "bnx2fc_rcv: Wrong FC type frame\n");
    940 goto err;
    941 diff --git a/drivers/spi/spi-dw.c b/drivers/spi/spi-dw.c
    942 index c1abc06899e7..137a4deba5a3 100644
    943 --- a/drivers/spi/spi-dw.c
    944 +++ b/drivers/spi/spi-dw.c
    945 @@ -394,9 +394,6 @@ static void pump_transfers(unsigned long data)
    946 chip = dws->cur_chip;
    947 spi = message->spi;
    948
    949 - if (unlikely(!chip->clk_div))
    950 - chip->clk_div = dws->max_freq / chip->speed_hz;
    951 -
    952 if (message->state == ERROR_STATE) {
    953 message->status = -EIO;
    954 goto early_exit;
    955 @@ -438,7 +435,7 @@ static void pump_transfers(unsigned long data)
    956 if (transfer->speed_hz) {
    957 speed = chip->speed_hz;
    958
    959 - if (transfer->speed_hz != speed) {
    960 + if ((transfer->speed_hz != speed) || (!chip->clk_div)) {
    961 speed = transfer->speed_hz;
    962 if (speed > dws->max_freq) {
    963 printk(KERN_ERR "MRST SPI0: unsupported"
    964 @@ -677,7 +674,6 @@ static int dw_spi_setup(struct spi_device *spi)
    965 dev_err(&spi->dev, "No max speed HZ parameter\n");
    966 return -EINVAL;
    967 }
    968 - chip->speed_hz = spi->max_speed_hz;
    969
    970 chip->tmode = 0; /* Tx & Rx */
    971 /* Default SPI mode is SCPOL = 0, SCPH = 0 */
    972 diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
    973 index 12342695ed79..dcc5daa0ff1c 100644
    974 --- a/drivers/target/target_core_transport.c
    975 +++ b/drivers/target/target_core_transport.c
    976 @@ -2128,7 +2128,7 @@ transport_generic_new_cmd(struct se_cmd *cmd)
    977 * and let it call back once the write buffers are ready.
    978 */
    979 target_add_to_state_list(cmd);
    980 - if (cmd->data_direction != DMA_TO_DEVICE) {
    981 + if (cmd->data_direction != DMA_TO_DEVICE || cmd->data_length == 0) {
    982 target_execute_cmd(cmd);
    983 return 0;
    984 }
    985 diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
    986 index a301b3fa622b..b73f3031a660 100644
    987 --- a/drivers/usb/core/quirks.c
    988 +++ b/drivers/usb/core/quirks.c
    989 @@ -43,6 +43,9 @@ static const struct usb_device_id usb_quirk_list[] = {
    990 /* Creative SB Audigy 2 NX */
    991 { USB_DEVICE(0x041e, 0x3020), .driver_info = USB_QUIRK_RESET_RESUME },
    992
    993 + /* Microsoft Wireless Laser Mouse 6000 Receiver */
    994 + { USB_DEVICE(0x045e, 0x00e1), .driver_info = USB_QUIRK_RESET_RESUME },
    995 +
    996 /* Microsoft LifeCam-VX700 v2.0 */
    997 { USB_DEVICE(0x045e, 0x0770), .driver_info = USB_QUIRK_RESET_RESUME },
    998
    999 diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
    1000 index df5834bd71f3..eb45ac843712 100644
    1001 --- a/drivers/usb/host/xhci-ring.c
    1002 +++ b/drivers/usb/host/xhci-ring.c
    1003 @@ -1178,9 +1178,8 @@ static void handle_reset_ep_completion(struct xhci_hcd *xhci,
    1004 false);
    1005 xhci_ring_cmd_db(xhci);
    1006 } else {
    1007 - /* Clear our internal halted state and restart the ring(s) */
    1008 + /* Clear our internal halted state */
    1009 xhci->devs[slot_id]->eps[ep_index].ep_state &= ~EP_HALTED;
    1010 - ring_doorbell_for_active_rings(xhci, slot_id, ep_index);
    1011 }
    1012 }
    1013
    1014 diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
    1015 index e9183eda39e0..a24714f6f88f 100644
    1016 --- a/drivers/usb/serial/cp210x.c
    1017 +++ b/drivers/usb/serial/cp210x.c
    1018 @@ -120,6 +120,7 @@ static const struct usb_device_id id_table[] = {
    1019 { USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */
    1020 { USB_DEVICE(0x10C4, 0x8664) }, /* AC-Services CAN-IF */
    1021 { USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */
    1022 + { USB_DEVICE(0x10C4, 0x8875) }, /* CEL MeshConnect USB Stick */
    1023 { USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */
    1024 { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */
    1025 { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */
    1026 diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
    1027 index 768c2b4722d1..c625f55667f1 100644
    1028 --- a/drivers/usb/serial/ftdi_sio.c
    1029 +++ b/drivers/usb/serial/ftdi_sio.c
    1030 @@ -486,6 +486,39 @@ static struct usb_device_id id_table_combined [] = {
    1031 { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_01FD_PID) },
    1032 { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_01FE_PID) },
    1033 { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_01FF_PID) },
    1034 + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_4701_PID) },
    1035 + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9300_PID) },
    1036 + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9301_PID) },
    1037 + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9302_PID) },
    1038 + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9303_PID) },
    1039 + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9304_PID) },
    1040 + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9305_PID) },
    1041 + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9306_PID) },
    1042 + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9307_PID) },
    1043 + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9308_PID) },
    1044 + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9309_PID) },
    1045 + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_930A_PID) },
    1046 + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_930B_PID) },
    1047 + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_930C_PID) },
    1048 + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_930D_PID) },
    1049 + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_930E_PID) },
    1050 + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_930F_PID) },
    1051 + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9310_PID) },
    1052 + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9311_PID) },
    1053 + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9312_PID) },
    1054 + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9313_PID) },
    1055 + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9314_PID) },
    1056 + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9315_PID) },
    1057 + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9316_PID) },
    1058 + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9317_PID) },
    1059 + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9318_PID) },
    1060 + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9319_PID) },
    1061 + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_931A_PID) },
    1062 + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_931B_PID) },
    1063 + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_931C_PID) },
    1064 + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_931D_PID) },
    1065 + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_931E_PID) },
    1066 + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_931F_PID) },
    1067 { USB_DEVICE(FTDI_VID, FTDI_PERLE_ULTRAPORT_PID) },
    1068 { USB_DEVICE(FTDI_VID, FTDI_PIEGROUP_PID) },
    1069 { USB_DEVICE(FTDI_VID, FTDI_TNC_X_PID) },
    1070 diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
    1071 index 302ab9a71f06..ac703a6e2115 100644
    1072 --- a/drivers/usb/serial/ftdi_sio_ids.h
    1073 +++ b/drivers/usb/serial/ftdi_sio_ids.h
    1074 @@ -926,8 +926,8 @@
    1075 #define BAYER_CONTOUR_CABLE_PID 0x6001
    1076
    1077 /*
    1078 - * The following are the values for the Matrix Orbital FTDI Range
    1079 - * Anything in this range will use an FT232RL.
    1080 + * Matrix Orbital Intelligent USB displays.
    1081 + * http://www.matrixorbital.com
    1082 */
    1083 #define MTXORB_VID 0x1B3D
    1084 #define MTXORB_FTDI_RANGE_0100_PID 0x0100
    1085 @@ -1186,8 +1186,39 @@
    1086 #define MTXORB_FTDI_RANGE_01FD_PID 0x01FD
    1087 #define MTXORB_FTDI_RANGE_01FE_PID 0x01FE
    1088 #define MTXORB_FTDI_RANGE_01FF_PID 0x01FF
    1089 -
    1090 -
    1091 +#define MTXORB_FTDI_RANGE_4701_PID 0x4701
    1092 +#define MTXORB_FTDI_RANGE_9300_PID 0x9300
    1093 +#define MTXORB_FTDI_RANGE_9301_PID 0x9301
    1094 +#define MTXORB_FTDI_RANGE_9302_PID 0x9302
    1095 +#define MTXORB_FTDI_RANGE_9303_PID 0x9303
    1096 +#define MTXORB_FTDI_RANGE_9304_PID 0x9304
    1097 +#define MTXORB_FTDI_RANGE_9305_PID 0x9305
    1098 +#define MTXORB_FTDI_RANGE_9306_PID 0x9306
    1099 +#define MTXORB_FTDI_RANGE_9307_PID 0x9307
    1100 +#define MTXORB_FTDI_RANGE_9308_PID 0x9308
    1101 +#define MTXORB_FTDI_RANGE_9309_PID 0x9309
    1102 +#define MTXORB_FTDI_RANGE_930A_PID 0x930A
    1103 +#define MTXORB_FTDI_RANGE_930B_PID 0x930B
    1104 +#define MTXORB_FTDI_RANGE_930C_PID 0x930C
    1105 +#define MTXORB_FTDI_RANGE_930D_PID 0x930D
    1106 +#define MTXORB_FTDI_RANGE_930E_PID 0x930E
    1107 +#define MTXORB_FTDI_RANGE_930F_PID 0x930F
    1108 +#define MTXORB_FTDI_RANGE_9310_PID 0x9310
    1109 +#define MTXORB_FTDI_RANGE_9311_PID 0x9311
    1110 +#define MTXORB_FTDI_RANGE_9312_PID 0x9312
    1111 +#define MTXORB_FTDI_RANGE_9313_PID 0x9313
    1112 +#define MTXORB_FTDI_RANGE_9314_PID 0x9314
    1113 +#define MTXORB_FTDI_RANGE_9315_PID 0x9315
    1114 +#define MTXORB_FTDI_RANGE_9316_PID 0x9316
    1115 +#define MTXORB_FTDI_RANGE_9317_PID 0x9317
    1116 +#define MTXORB_FTDI_RANGE_9318_PID 0x9318
    1117 +#define MTXORB_FTDI_RANGE_9319_PID 0x9319
    1118 +#define MTXORB_FTDI_RANGE_931A_PID 0x931A
    1119 +#define MTXORB_FTDI_RANGE_931B_PID 0x931B
    1120 +#define MTXORB_FTDI_RANGE_931C_PID 0x931C
    1121 +#define MTXORB_FTDI_RANGE_931D_PID 0x931D
    1122 +#define MTXORB_FTDI_RANGE_931E_PID 0x931E
    1123 +#define MTXORB_FTDI_RANGE_931F_PID 0x931F
    1124
    1125 /*
    1126 * The Mobility Lab (TML)
    1127 diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c
    1128 index 07fbdf0e7ab6..f0e65c970d35 100644
    1129 --- a/drivers/usb/serial/keyspan.c
    1130 +++ b/drivers/usb/serial/keyspan.c
    1131 @@ -308,24 +308,30 @@ static void usa26_indat_callback(struct urb *urb)
    1132 if ((data[0] & 0x80) == 0) {
    1133 /* no errors on individual bytes, only
    1134 possible overrun err */
    1135 - if (data[0] & RXERROR_OVERRUN)
    1136 - err = TTY_OVERRUN;
    1137 - else
    1138 - err = 0;
    1139 + if (data[0] & RXERROR_OVERRUN) {
    1140 + tty_insert_flip_char(&port->port, 0,
    1141 + TTY_OVERRUN);
    1142 + }
    1143 for (i = 1; i < urb->actual_length ; ++i)
    1144 - tty_insert_flip_char(&port->port, data[i], err);
    1145 + tty_insert_flip_char(&port->port, data[i],
    1146 + TTY_NORMAL);
    1147 } else {
    1148 /* some bytes had errors, every byte has status */
    1149 dev_dbg(&port->dev, "%s - RX error!!!!\n", __func__);
    1150 for (i = 0; i + 1 < urb->actual_length; i += 2) {
    1151 - int stat = data[i], flag = 0;
    1152 - if (stat & RXERROR_OVERRUN)
    1153 - flag |= TTY_OVERRUN;
    1154 - if (stat & RXERROR_FRAMING)
    1155 - flag |= TTY_FRAME;
    1156 - if (stat & RXERROR_PARITY)
    1157 - flag |= TTY_PARITY;
    1158 + int stat = data[i];
    1159 + int flag = TTY_NORMAL;
    1160 +
    1161 + if (stat & RXERROR_OVERRUN) {
    1162 + tty_insert_flip_char(&port->port, 0,
    1163 + TTY_OVERRUN);
    1164 + }
    1165 /* XXX should handle break (0x10) */
    1166 + if (stat & RXERROR_PARITY)
    1167 + flag = TTY_PARITY;
    1168 + else if (stat & RXERROR_FRAMING)
    1169 + flag = TTY_FRAME;
    1170 +
    1171 tty_insert_flip_char(&port->port, data[i+1],
    1172 flag);
    1173 }
    1174 @@ -672,14 +678,19 @@ static void usa49_indat_callback(struct urb *urb)
    1175 } else {
    1176 /* some bytes had errors, every byte has status */
    1177 for (i = 0; i + 1 < urb->actual_length; i += 2) {
    1178 - int stat = data[i], flag = 0;
    1179 - if (stat & RXERROR_OVERRUN)
    1180 - flag |= TTY_OVERRUN;
    1181 - if (stat & RXERROR_FRAMING)
    1182 - flag |= TTY_FRAME;
    1183 - if (stat & RXERROR_PARITY)
    1184 - flag |= TTY_PARITY;
    1185 + int stat = data[i];
    1186 + int flag = TTY_NORMAL;
    1187 +
    1188 + if (stat & RXERROR_OVERRUN) {
    1189 + tty_insert_flip_char(&port->port, 0,
    1190 + TTY_OVERRUN);
    1191 + }
    1192 /* XXX should handle break (0x10) */
    1193 + if (stat & RXERROR_PARITY)
    1194 + flag = TTY_PARITY;
    1195 + else if (stat & RXERROR_FRAMING)
    1196 + flag = TTY_FRAME;
    1197 +
    1198 tty_insert_flip_char(&port->port, data[i+1],
    1199 flag);
    1200 }
    1201 @@ -736,15 +747,19 @@ static void usa49wg_indat_callback(struct urb *urb)
    1202 */
    1203 for (x = 0; x + 1 < len &&
    1204 i + 1 < urb->actual_length; x += 2) {
    1205 - int stat = data[i], flag = 0;
    1206 + int stat = data[i];
    1207 + int flag = TTY_NORMAL;
    1208
    1209 - if (stat & RXERROR_OVERRUN)
    1210 - flag |= TTY_OVERRUN;
    1211 - if (stat & RXERROR_FRAMING)
    1212 - flag |= TTY_FRAME;
    1213 - if (stat & RXERROR_PARITY)
    1214 - flag |= TTY_PARITY;
    1215 + if (stat & RXERROR_OVERRUN) {
    1216 + tty_insert_flip_char(&port->port, 0,
    1217 + TTY_OVERRUN);
    1218 + }
    1219 /* XXX should handle break (0x10) */
    1220 + if (stat & RXERROR_PARITY)
    1221 + flag = TTY_PARITY;
    1222 + else if (stat & RXERROR_FRAMING)
    1223 + flag = TTY_FRAME;
    1224 +
    1225 tty_insert_flip_char(&port->port, data[i+1],
    1226 flag);
    1227 i += 2;
    1228 @@ -796,25 +811,31 @@ static void usa90_indat_callback(struct urb *urb)
    1229 if ((data[0] & 0x80) == 0) {
    1230 /* no errors on individual bytes, only
    1231 possible overrun err*/
    1232 - if (data[0] & RXERROR_OVERRUN)
    1233 - err = TTY_OVERRUN;
    1234 - else
    1235 - err = 0;
    1236 + if (data[0] & RXERROR_OVERRUN) {
    1237 + tty_insert_flip_char(&port->port, 0,
    1238 + TTY_OVERRUN);
    1239 + }
    1240 for (i = 1; i < urb->actual_length ; ++i)
    1241 tty_insert_flip_char(&port->port,
    1242 - data[i], err);
    1243 + data[i], TTY_NORMAL);
    1244 } else {
    1245 /* some bytes had errors, every byte has status */
    1246 dev_dbg(&port->dev, "%s - RX error!!!!\n", __func__);
    1247 for (i = 0; i + 1 < urb->actual_length; i += 2) {
    1248 - int stat = data[i], flag = 0;
    1249 - if (stat & RXERROR_OVERRUN)
    1250 - flag |= TTY_OVERRUN;
    1251 - if (stat & RXERROR_FRAMING)
    1252 - flag |= TTY_FRAME;
    1253 - if (stat & RXERROR_PARITY)
    1254 - flag |= TTY_PARITY;
    1255 + int stat = data[i];
    1256 + int flag = TTY_NORMAL;
    1257 +
    1258 + if (stat & RXERROR_OVERRUN) {
    1259 + tty_insert_flip_char(
    1260 + &port->port, 0,
    1261 + TTY_OVERRUN);
    1262 + }
    1263 /* XXX should handle break (0x10) */
    1264 + if (stat & RXERROR_PARITY)
    1265 + flag = TTY_PARITY;
    1266 + else if (stat & RXERROR_FRAMING)
    1267 + flag = TTY_FRAME;
    1268 +
    1269 tty_insert_flip_char(&port->port,
    1270 data[i+1], flag);
    1271 }
    1272 diff --git a/drivers/usb/serial/ssu100.c b/drivers/usb/serial/ssu100.c
    1273 index 5b62dbbdf996..8f5f36134864 100644
    1274 --- a/drivers/usb/serial/ssu100.c
    1275 +++ b/drivers/usb/serial/ssu100.c
    1276 @@ -495,10 +495,9 @@ static void ssu100_update_lsr(struct usb_serial_port *port, u8 lsr,
    1277 if (*tty_flag == TTY_NORMAL)
    1278 *tty_flag = TTY_FRAME;
    1279 }
    1280 - if (lsr & UART_LSR_OE){
    1281 + if (lsr & UART_LSR_OE) {
    1282 port->icount.overrun++;
    1283 - if (*tty_flag == TTY_NORMAL)
    1284 - *tty_flag = TTY_OVERRUN;
    1285 + tty_insert_flip_char(&port->port, 0, TTY_OVERRUN);
    1286 }
    1287 }
    1288
    1289 @@ -516,12 +515,8 @@ static void ssu100_process_read_urb(struct urb *urb)
    1290 if ((len >= 4) &&
    1291 (packet[0] == 0x1b) && (packet[1] == 0x1b) &&
    1292 ((packet[2] == 0x00) || (packet[2] == 0x01))) {
    1293 - if (packet[2] == 0x00) {
    1294 + if (packet[2] == 0x00)
    1295 ssu100_update_lsr(port, packet[3], &flag);
    1296 - if (flag == TTY_OVERRUN)
    1297 - tty_insert_flip_char(&port->port, 0,
    1298 - TTY_OVERRUN);
    1299 - }
    1300 if (packet[2] == 0x01)
    1301 ssu100_update_msr(port, packet[3]);
    1302
    1303 diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c
    1304 index cc8c5b32043c..f42bbe5fbc0a 100644
    1305 --- a/fs/nfsd/nfs4callback.c
    1306 +++ b/fs/nfsd/nfs4callback.c
    1307 @@ -784,8 +784,12 @@ static bool nfsd41_cb_get_slot(struct nfs4_client *clp, struct rpc_task *task)
    1308 {
    1309 if (test_and_set_bit(0, &clp->cl_cb_slot_busy) != 0) {
    1310 rpc_sleep_on(&clp->cl_cb_waitq, task, NULL);
    1311 - dprintk("%s slot is busy\n", __func__);
    1312 - return false;
    1313 + /* Race breaker */
    1314 + if (test_and_set_bit(0, &clp->cl_cb_slot_busy) != 0) {
    1315 + dprintk("%s slot is busy\n", __func__);
    1316 + return false;
    1317 + }
    1318 + rpc_wake_up_queued_task(&clp->cl_cb_waitq, task);
    1319 }
    1320 return true;
    1321 }
    1322 diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
    1323 index bdff771057d3..836307ae1f08 100644
    1324 --- a/fs/nfsd/nfs4state.c
    1325 +++ b/fs/nfsd/nfs4state.c
    1326 @@ -367,7 +367,6 @@ static struct nfs4_delegation *
    1327 alloc_init_deleg(struct nfs4_client *clp, struct nfs4_ol_stateid *stp, struct svc_fh *current_fh, u32 type)
    1328 {
    1329 struct nfs4_delegation *dp;
    1330 - struct nfs4_file *fp = stp->st_file;
    1331
    1332 dprintk("NFSD alloc_init_deleg\n");
    1333 /*
    1334 @@ -377,8 +376,6 @@ alloc_init_deleg(struct nfs4_client *clp, struct nfs4_ol_stateid *stp, struct sv
    1335 */
    1336 if (type != NFS4_OPEN_DELEGATE_READ)
    1337 return NULL;
    1338 - if (fp->fi_had_conflict)
    1339 - return NULL;
    1340 if (num_delegations > max_delegations)
    1341 return NULL;
    1342 dp = delegstateid(nfs4_alloc_stid(clp, deleg_slab));
    1343 @@ -395,8 +392,7 @@ alloc_init_deleg(struct nfs4_client *clp, struct nfs4_ol_stateid *stp, struct sv
    1344 INIT_LIST_HEAD(&dp->dl_perfile);
    1345 INIT_LIST_HEAD(&dp->dl_perclnt);
    1346 INIT_LIST_HEAD(&dp->dl_recall_lru);
    1347 - get_nfs4_file(fp);
    1348 - dp->dl_file = fp;
    1349 + dp->dl_file = NULL;
    1350 dp->dl_type = type;
    1351 fh_copy_shallow(&dp->dl_fh, &current_fh->fh_handle);
    1352 dp->dl_time = 0;
    1353 @@ -2965,22 +2961,35 @@ static int nfs4_setlease(struct nfs4_delegation *dp, int flag)
    1354 return 0;
    1355 }
    1356
    1357 -static int nfs4_set_delegation(struct nfs4_delegation *dp, int flag)
    1358 +static int nfs4_set_delegation(struct nfs4_delegation *dp, int flag, struct nfs4_file *fp)
    1359 {
    1360 - struct nfs4_file *fp = dp->dl_file;
    1361 + int status;
    1362
    1363 - if (!fp->fi_lease)
    1364 - return nfs4_setlease(dp, flag);
    1365 + if (fp->fi_had_conflict)
    1366 + return -EAGAIN;
    1367 + get_nfs4_file(fp);
    1368 + dp->dl_file = fp;
    1369 + if (!fp->fi_lease) {
    1370 + status = nfs4_setlease(dp, flag);
    1371 + if (status)
    1372 + goto out_free;
    1373 + return 0;
    1374 + }
    1375 spin_lock(&recall_lock);
    1376 if (fp->fi_had_conflict) {
    1377 spin_unlock(&recall_lock);
    1378 - return -EAGAIN;
    1379 + status = -EAGAIN;
    1380 + goto out_free;
    1381 }
    1382 atomic_inc(&fp->fi_delegees);
    1383 list_add(&dp->dl_perfile, &fp->fi_delegations);
    1384 spin_unlock(&recall_lock);
    1385 list_add(&dp->dl_perclnt, &dp->dl_stid.sc_client->cl_delegations);
    1386 return 0;
    1387 +out_free:
    1388 + put_nfs4_file(fp);
    1389 + dp->dl_file = fp;
    1390 + return status;
    1391 }
    1392
    1393 static void nfsd4_open_deleg_none_ext(struct nfsd4_open *open, int status)
    1394 @@ -3046,7 +3055,7 @@ nfs4_open_delegation(struct net *net, struct svc_fh *fh,
    1395 dp = alloc_init_deleg(oo->oo_owner.so_client, stp, fh, flag);
    1396 if (dp == NULL)
    1397 goto out_no_deleg;
    1398 - status = nfs4_set_delegation(dp, flag);
    1399 + status = nfs4_set_delegation(dp, flag, stp->st_file);
    1400 if (status)
    1401 goto out_free;
    1402
    1403 diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
    1404 index d9b298cbfe5c..81325ba8660a 100644
    1405 --- a/fs/nfsd/vfs.c
    1406 +++ b/fs/nfsd/vfs.c
    1407 @@ -508,6 +508,9 @@ set_nfsv4_acl_one(struct dentry *dentry, struct posix_acl *pacl, char *key)
    1408 char *buf = NULL;
    1409 int error = 0;
    1410
    1411 + if (!pacl)
    1412 + return vfs_setxattr(dentry, key, NULL, 0, 0);
    1413 +
    1414 buflen = posix_acl_xattr_size(pacl->a_count);
    1415 buf = kmalloc(buflen, GFP_KERNEL);
    1416 error = -ENOMEM;
    1417 diff --git a/include/linux/iio/events.h b/include/linux/iio/events.h
    1418 index 13ce220c7003..593ae7ce07c7 100644
    1419 --- a/include/linux/iio/events.h
    1420 +++ b/include/linux/iio/events.h
    1421 @@ -90,7 +90,7 @@ enum iio_event_direction {
    1422
    1423 #define IIO_EVENT_CODE_EXTRACT_TYPE(mask) ((mask >> 56) & 0xFF)
    1424
    1425 -#define IIO_EVENT_CODE_EXTRACT_DIR(mask) ((mask >> 48) & 0xCF)
    1426 +#define IIO_EVENT_CODE_EXTRACT_DIR(mask) ((mask >> 48) & 0x7F)
    1427
    1428 #define IIO_EVENT_CODE_EXTRACT_CHAN_TYPE(mask) ((mask >> 32) & 0xFF)
    1429
    1430 diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
    1431 index ea1e3b863890..770ecc90993b 100644
    1432 --- a/include/linux/inetdevice.h
    1433 +++ b/include/linux/inetdevice.h
    1434 @@ -261,7 +261,7 @@ static inline void in_dev_put(struct in_device *idev)
    1435 static __inline__ __be32 inet_make_mask(int logmask)
    1436 {
    1437 if (logmask)
    1438 - return htonl(~((1<<(32-logmask))-1));
    1439 + return htonl(~((1U<<(32-logmask))-1));
    1440 return 0;
    1441 }
    1442
    1443 diff --git a/include/linux/pci.h b/include/linux/pci.h
    1444 index 3a24e4ff3248..102136ab1a5f 100644
    1445 --- a/include/linux/pci.h
    1446 +++ b/include/linux/pci.h
    1447 @@ -310,6 +310,7 @@ struct pci_dev {
    1448 unsigned int is_added:1;
    1449 unsigned int is_busmaster:1; /* device is busmaster */
    1450 unsigned int no_msi:1; /* device may not use msi */
    1451 + unsigned int no_64bit_msi:1; /* device may only use 32-bit MSIs */
    1452 unsigned int block_cfg_access:1; /* config space access is blocked */
    1453 unsigned int broken_parity_status:1; /* Device generates false positive parity */
    1454 unsigned int irq_reroute_variant:2; /* device needs IRQ rerouting variant */
    1455 diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
    1456 index ad8e1bdca70e..8176caf6efd9 100644
    1457 --- a/kernel/events/uprobes.c
    1458 +++ b/kernel/events/uprobes.c
    1459 @@ -1511,7 +1511,6 @@ bool uprobe_deny_signal(void)
    1460 if (__fatal_signal_pending(t) || arch_uprobe_xol_was_trapped(t)) {
    1461 utask->state = UTASK_SSTEP_TRAPPED;
    1462 set_tsk_thread_flag(t, TIF_UPROBE);
    1463 - set_tsk_thread_flag(t, TIF_NOTIFY_RESUME);
    1464 }
    1465 }
    1466
    1467 diff --git a/net/ipv4/fib_rules.c b/net/ipv4/fib_rules.c
    1468 index 26aa65d1fce4..c5c8b248d8f6 100644
    1469 --- a/net/ipv4/fib_rules.c
    1470 +++ b/net/ipv4/fib_rules.c
    1471 @@ -62,6 +62,10 @@ int __fib_lookup(struct net *net, struct flowi4 *flp, struct fib_result *res)
    1472 else
    1473 res->tclassid = 0;
    1474 #endif
    1475 +
    1476 + if (err == -ESRCH)
    1477 + err = -ENETUNREACH;
    1478 +
    1479 return err;
    1480 }
    1481 EXPORT_SYMBOL_GPL(__fib_lookup);
    1482 diff --git a/net/ipx/af_ipx.c b/net/ipx/af_ipx.c
    1483 index e0897377b3b4..2665bf4b8d05 100644
    1484 --- a/net/ipx/af_ipx.c
    1485 +++ b/net/ipx/af_ipx.c
    1486 @@ -1778,6 +1778,7 @@ static int ipx_recvmsg(struct kiocb *iocb, struct socket *sock,
    1487 struct ipxhdr *ipx = NULL;
    1488 struct sk_buff *skb;
    1489 int copied, rc;
    1490 + bool locked = true;
    1491
    1492 lock_sock(sk);
    1493 /* put the autobinding in */
    1494 @@ -1804,6 +1805,8 @@ static int ipx_recvmsg(struct kiocb *iocb, struct socket *sock,
    1495 if (sock_flag(sk, SOCK_ZAPPED))
    1496 goto out;
    1497
    1498 + release_sock(sk);
    1499 + locked = false;
    1500 skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
    1501 flags & MSG_DONTWAIT, &rc);
    1502 if (!skb)
    1503 @@ -1837,7 +1840,8 @@ static int ipx_recvmsg(struct kiocb *iocb, struct socket *sock,
    1504 out_free:
    1505 skb_free_datagram(sk, skb);
    1506 out:
    1507 - release_sock(sk);
    1508 + if (locked)
    1509 + release_sock(sk);
    1510 return rc;
    1511 }
    1512
    1513 diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
    1514 index ea479388fb5c..23670737116e 100644
    1515 --- a/sound/soc/codecs/sgtl5000.c
    1516 +++ b/sound/soc/codecs/sgtl5000.c
    1517 @@ -1317,8 +1317,7 @@ static int sgtl5000_probe(struct snd_soc_codec *codec)
    1518
    1519 /* enable small pop, introduce 400ms delay in turning off */
    1520 snd_soc_update_bits(codec, SGTL5000_CHIP_REF_CTRL,
    1521 - SGTL5000_SMALL_POP,
    1522 - SGTL5000_SMALL_POP);
    1523 + SGTL5000_SMALL_POP, 1);
    1524
    1525 /* disable short cut detector */
    1526 snd_soc_write(codec, SGTL5000_CHIP_SHORT_CTRL, 0);
    1527 diff --git a/sound/soc/codecs/sgtl5000.h b/sound/soc/codecs/sgtl5000.h
    1528 index d3a68bbfea00..0bd6e1cd8200 100644
    1529 --- a/sound/soc/codecs/sgtl5000.h
    1530 +++ b/sound/soc/codecs/sgtl5000.h
    1531 @@ -275,7 +275,7 @@
    1532 #define SGTL5000_BIAS_CTRL_MASK 0x000e
    1533 #define SGTL5000_BIAS_CTRL_SHIFT 1
    1534 #define SGTL5000_BIAS_CTRL_WIDTH 3
    1535 -#define SGTL5000_SMALL_POP 0x0001
    1536 +#define SGTL5000_SMALL_POP 0
    1537
    1538 /*
    1539 * SGTL5000_CHIP_MIC_CTRL
    1540 diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
    1541 index ca1e999026e5..d785e46be47c 100644
    1542 --- a/sound/soc/codecs/wm_adsp.c
    1543 +++ b/sound/soc/codecs/wm_adsp.c
    1544 @@ -964,6 +964,7 @@ static int wm_adsp_load_coeff(struct wm_adsp *dsp)
    1545 file, blocks, pos - firmware->size);
    1546
    1547 out_fw:
    1548 + regmap_async_complete(regmap);
    1549 release_firmware(firmware);
    1550 wm_adsp_buf_free(&buf_list);
    1551 out:
    1552 diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
    1553 index 3879eae7e874..734c6579b194 100644
    1554 --- a/sound/usb/quirks.c
    1555 +++ b/sound/usb/quirks.c
    1556 @@ -914,6 +914,20 @@ void snd_usb_ctl_msg_quirk(struct usb_device *dev, unsigned int pipe,
    1557 if ((le16_to_cpu(dev->descriptor.idVendor) == 0x23ba) &&
    1558 (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)
    1559 mdelay(20);
    1560 +
    1561 + /* Marantz/Denon devices with USB DAC functionality need a delay
    1562 + * after each class compliant request
    1563 + */
    1564 + if ((le16_to_cpu(dev->descriptor.idVendor) == 0x154e) &&
    1565 + (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS) {
    1566 +
    1567 + switch (le16_to_cpu(dev->descriptor.idProduct)) {
    1568 + case 0x3005: /* Marantz HD-DAC1 */
    1569 + case 0x3006: /* Marantz SA-14S1 */
    1570 + mdelay(20);
    1571 + break;
    1572 + }
    1573 + }
    1574 }
    1575
    1576 /*