Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-3.14/0111-3.14.12-all-fixes.patch

    Annotation of /trunk/kernel-alx/patches-3.14/0111-3.14.12-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 2506 - (hide annotations) (download)
    Fri Oct 17 07:55:45 2014 UTC (9 years, 6 months ago) by niro
    File size: 112706 byte(s) 
    -patches for 3.14
    1 niro 2506 diff --git a/Documentation/sysctl/vm.txt b/Documentation/sysctl/vm.txt
    2     index d614a9b6a280..b602784b289f 100644
    3     --- a/Documentation/sysctl/vm.txt
    4     +++ b/Documentation/sysctl/vm.txt
    5     @@ -681,7 +681,8 @@ The batch value of each per cpu pagelist is also updated as a result. It is
    6     set to pcp->high/4. The upper limit of batch is (PAGE_SHIFT * 8)
    7    
    8     The initial value is zero. Kernel does not use this value at boot time to set
    9     -the high water marks for each per cpu page list.
    10     +the high water marks for each per cpu page list. If the user writes '0' to this
    11     +sysctl, it will revert to this default behavior.
    12    
    13     ==============================================================
    14    
    15     diff --git a/Makefile b/Makefile
    16     index f1bbec5ece95..13d8f323ae43 100644
    17     --- a/Makefile
    18     +++ b/Makefile
    19     @@ -1,6 +1,6 @@
    20     VERSION = 3
    21     PATCHLEVEL = 14
    22     -SUBLEVEL = 11
    23     +SUBLEVEL = 12
    24     EXTRAVERSION =
    25     NAME = Remembering Coco
    26    
    27     diff --git a/arch/arm/mach-omap2/mux.c b/arch/arm/mach-omap2/mux.c
    28     index 48094b58c88f..b12a4f9fc9d0 100644
    29     --- a/arch/arm/mach-omap2/mux.c
    30     +++ b/arch/arm/mach-omap2/mux.c
    31     @@ -183,8 +183,10 @@ static int __init _omap_mux_get_by_name(struct omap_mux_partition *partition,
    32     m0_entry = mux->muxnames[0];
    33    
    34     /* First check for full name in mode0.muxmode format */
    35     - if (mode0_len && strncmp(muxname, m0_entry, mode0_len))
    36     - continue;
    37     + if (mode0_len)
    38     + if (strncmp(muxname, m0_entry, mode0_len) ||
    39     + (strlen(m0_entry) != mode0_len))
    40     + continue;
    41    
    42     /* Then check for muxmode only */
    43     for (i = 0; i < OMAP_MUX_NR_MODES; i++) {
    44     diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
    45     index 39ac630d83de..a8e4bdbbb4b8 100644
    46     --- a/arch/arm64/kernel/entry.S
    47     +++ b/arch/arm64/kernel/entry.S
    48     @@ -275,7 +275,6 @@ el1_sp_pc:
    49     * Stack or PC alignment exception handling
    50     */
    51     mrs x0, far_el1
    52     - mov x1, x25
    53     mov x2, sp
    54     b do_sp_pc_abort
    55     el1_undef:
    56     diff --git a/arch/arm64/mm/flush.c b/arch/arm64/mm/flush.c
    57     index e4193e3adc7f..0d64089d28b5 100644
    58     --- a/arch/arm64/mm/flush.c
    59     +++ b/arch/arm64/mm/flush.c
    60     @@ -79,7 +79,8 @@ void __sync_icache_dcache(pte_t pte, unsigned long addr)
    61     return;
    62    
    63     if (!test_and_set_bit(PG_dcache_clean, &page->flags)) {
    64     - __flush_dcache_area(page_address(page), PAGE_SIZE);
    65     + __flush_dcache_area(page_address(page),
    66     + PAGE_SIZE << compound_order(page));
    67     __flush_icache_all();
    68     } else if (icache_is_aivivt()) {
    69     __flush_icache_all();
    70     diff --git a/arch/unicore32/mm/alignment.c b/arch/unicore32/mm/alignment.c
    71     index de7dc5fdd58b..24e836023e6c 100644
    72     --- a/arch/unicore32/mm/alignment.c
    73     +++ b/arch/unicore32/mm/alignment.c
    74     @@ -21,6 +21,7 @@
    75     #include <linux/sched.h>
    76     #include <linux/uaccess.h>
    77    
    78     +#include <asm/pgtable.h>
    79     #include <asm/tlbflush.h>
    80     #include <asm/unaligned.h>
    81    
    82     diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
    83     index fdf83afbb7d9..3092300a07cd 100644
    84     --- a/arch/x86/include/asm/kvm_host.h
    85     +++ b/arch/x86/include/asm/kvm_host.h
    86     @@ -99,7 +99,7 @@ static inline gfn_t gfn_to_index(gfn_t gfn, gfn_t base_gfn, int level)
    87     #define KVM_REFILL_PAGES 25
    88     #define KVM_MAX_CPUID_ENTRIES 80
    89     #define KVM_NR_FIXED_MTRR_REGION 88
    90     -#define KVM_NR_VAR_MTRR 8
    91     +#define KVM_NR_VAR_MTRR 10
    92    
    93     #define ASYNC_PF_PER_VCPU 64
    94    
    95     @@ -462,7 +462,7 @@ struct kvm_vcpu_arch {
    96     bool nmi_injected; /* Trying to inject an NMI this entry */
    97    
    98     struct mtrr_state_type mtrr_state;
    99     - u32 pat;
    100     + u64 pat;
    101    
    102     int switch_db_regs;
    103     unsigned long db[KVM_NR_DB_REGS];
    104     diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
    105     index ee0c3b554a38..8fbd1a772272 100644
    106     --- a/arch/x86/kvm/x86.c
    107     +++ b/arch/x86/kvm/x86.c
    108     @@ -1866,7 +1866,7 @@ static int set_msr_hyperv_pw(struct kvm_vcpu *vcpu, u32 msr, u64 data)
    109     if (!(data & HV_X64_MSR_TSC_REFERENCE_ENABLE))
    110     break;
    111     gfn = data >> HV_X64_MSR_TSC_REFERENCE_ADDRESS_SHIFT;
    112     - if (kvm_write_guest(kvm, data,
    113     + if (kvm_write_guest(kvm, gfn << HV_X64_MSR_TSC_REFERENCE_ADDRESS_SHIFT,
    114     &tsc_ref, sizeof(tsc_ref)))
    115     return 1;
    116     mark_page_dirty(kvm, gfn);
    117     diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
    118     index 4e491d9b5292..dd0dd2d4ceca 100644
    119     --- a/block/blk-cgroup.c
    120     +++ b/block/blk-cgroup.c
    121     @@ -80,7 +80,7 @@ static struct blkcg_gq *blkg_alloc(struct blkcg *blkcg, struct request_queue *q,
    122     blkg->q = q;
    123     INIT_LIST_HEAD(&blkg->q_node);
    124     blkg->blkcg = blkcg;
    125     - blkg->refcnt = 1;
    126     + atomic_set(&blkg->refcnt, 1);
    127    
    128     /* root blkg uses @q->root_rl, init rl only for !root blkgs */
    129     if (blkcg != &blkcg_root) {
    130     @@ -399,11 +399,8 @@ void __blkg_release_rcu(struct rcu_head *rcu_head)
    131    
    132     /* release the blkcg and parent blkg refs this blkg has been holding */
    133     css_put(&blkg->blkcg->css);
    134     - if (blkg->parent) {
    135     - spin_lock_irq(blkg->q->queue_lock);
    136     + if (blkg->parent)
    137     blkg_put(blkg->parent);
    138     - spin_unlock_irq(blkg->q->queue_lock);
    139     - }
    140    
    141     blkg_free(blkg);
    142     }
    143     diff --git a/block/blk-cgroup.h b/block/blk-cgroup.h
    144     index 86154eab9523..c135f5660702 100644
    145     --- a/block/blk-cgroup.h
    146     +++ b/block/blk-cgroup.h
    147     @@ -18,6 +18,7 @@
    148     #include <linux/seq_file.h>
    149     #include <linux/radix-tree.h>
    150     #include <linux/blkdev.h>
    151     +#include <linux/atomic.h>
    152    
    153     /* Max limits for throttle policy */
    154     #define THROTL_IOPS_MAX UINT_MAX
    155     @@ -104,7 +105,7 @@ struct blkcg_gq {
    156     struct request_list rl;
    157    
    158     /* reference count */
    159     - int refcnt;
    160     + atomic_t refcnt;
    161    
    162     /* is this blkg online? protected by both blkcg and q locks */
    163     bool online;
    164     @@ -253,13 +254,12 @@ static inline int blkg_path(struct blkcg_gq *blkg, char *buf, int buflen)
    165     * blkg_get - get a blkg reference
    166     * @blkg: blkg to get
    167     *
    168     - * The caller should be holding queue_lock and an existing reference.
    169     + * The caller should be holding an existing reference.
    170     */
    171     static inline void blkg_get(struct blkcg_gq *blkg)
    172     {
    173     - lockdep_assert_held(blkg->q->queue_lock);
    174     - WARN_ON_ONCE(!blkg->refcnt);
    175     - blkg->refcnt++;
    176     + WARN_ON_ONCE(atomic_read(&blkg->refcnt) <= 0);
    177     + atomic_inc(&blkg->refcnt);
    178     }
    179    
    180     void __blkg_release_rcu(struct rcu_head *rcu);
    181     @@ -267,14 +267,11 @@ void __blkg_release_rcu(struct rcu_head *rcu);
    182     /**
    183     * blkg_put - put a blkg reference
    184     * @blkg: blkg to put
    185     - *
    186     - * The caller should be holding queue_lock.
    187     */
    188     static inline void blkg_put(struct blkcg_gq *blkg)
    189     {
    190     - lockdep_assert_held(blkg->q->queue_lock);
    191     - WARN_ON_ONCE(blkg->refcnt <= 0);
    192     - if (!--blkg->refcnt)
    193     + WARN_ON_ONCE(atomic_read(&blkg->refcnt) <= 0);
    194     + if (atomic_dec_and_test(&blkg->refcnt))
    195     call_rcu(&blkg->rcu_head, __blkg_release_rcu);
    196     }
    197    
    198     diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
    199     index 7f2d09fbb10b..7296c7f074bd 100644
    200     --- a/drivers/block/rbd.c
    201     +++ b/drivers/block/rbd.c
    202     @@ -1366,6 +1366,14 @@ static bool obj_request_exists_test(struct rbd_obj_request *obj_request)
    203     return test_bit(OBJ_REQ_EXISTS, &obj_request->flags) != 0;
    204     }
    205    
    206     +static bool obj_request_overlaps_parent(struct rbd_obj_request *obj_request)
    207     +{
    208     + struct rbd_device *rbd_dev = obj_request->img_request->rbd_dev;
    209     +
    210     + return obj_request->img_offset <
    211     + round_up(rbd_dev->parent_overlap, rbd_obj_bytes(&rbd_dev->header));
    212     +}
    213     +
    214     static void rbd_obj_request_get(struct rbd_obj_request *obj_request)
    215     {
    216     dout("%s: obj %p (was %d)\n", __func__, obj_request,
    217     @@ -1382,6 +1390,13 @@ static void rbd_obj_request_put(struct rbd_obj_request *obj_request)
    218     kref_put(&obj_request->kref, rbd_obj_request_destroy);
    219     }
    220    
    221     +static void rbd_img_request_get(struct rbd_img_request *img_request)
    222     +{
    223     + dout("%s: img %p (was %d)\n", __func__, img_request,
    224     + atomic_read(&img_request->kref.refcount));
    225     + kref_get(&img_request->kref);
    226     +}
    227     +
    228     static bool img_request_child_test(struct rbd_img_request *img_request);
    229     static void rbd_parent_request_destroy(struct kref *kref);
    230     static void rbd_img_request_destroy(struct kref *kref);
    231     @@ -2128,6 +2143,7 @@ static void rbd_img_obj_callback(struct rbd_obj_request *obj_request)
    232     img_request->next_completion = which;
    233     out:
    234     spin_unlock_irq(&img_request->completion_lock);
    235     + rbd_img_request_put(img_request);
    236    
    237     if (!more)
    238     rbd_img_request_complete(img_request);
    239     @@ -2225,6 +2241,7 @@ static int rbd_img_request_fill(struct rbd_img_request *img_request,
    240     goto out_partial;
    241     obj_request->osd_req = osd_req;
    242     obj_request->callback = rbd_img_obj_callback;
    243     + rbd_img_request_get(img_request);
    244    
    245     osd_req_op_extent_init(osd_req, 0, opcode, offset, length,
    246     0, 0);
    247     @@ -2647,7 +2664,7 @@ static int rbd_img_obj_request_submit(struct rbd_obj_request *obj_request)
    248     */
    249     if (!img_request_write_test(img_request) ||
    250     !img_request_layered_test(img_request) ||
    251     - rbd_dev->parent_overlap <= obj_request->img_offset ||
    252     + !obj_request_overlaps_parent(obj_request) ||
    253     ((known = obj_request_known_test(obj_request)) &&
    254     obj_request_exists_test(obj_request))) {
    255    
    256     diff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c
    257     index 00f878a04d3f..0996a3a39855 100644
    258     --- a/drivers/clk/qcom/clk-rcg2.c
    259     +++ b/drivers/clk/qcom/clk-rcg2.c
    260     @@ -55,7 +55,7 @@ static int clk_rcg2_is_enabled(struct clk_hw *hw)
    261     if (ret)
    262     return ret;
    263    
    264     - return (cmd & CMD_ROOT_OFF) != 0;
    265     + return (cmd & CMD_ROOT_OFF) == 0;
    266     }
    267    
    268     static u8 clk_rcg2_get_parent(struct clk_hw *hw)
    269     diff --git a/drivers/clk/qcom/mmcc-msm8974.c b/drivers/clk/qcom/mmcc-msm8974.c
    270     index c95774514b81..6a0ae77d1939 100644
    271     --- a/drivers/clk/qcom/mmcc-msm8974.c
    272     +++ b/drivers/clk/qcom/mmcc-msm8974.c
    273     @@ -169,6 +169,7 @@ static struct clk_pll mmpll0 = {
    274     .config_reg = 0x0014,
    275     .mode_reg = 0x0000,
    276     .status_reg = 0x001c,
    277     + .status_bit = 17,
    278     .clkr.hw.init = &(struct clk_init_data){
    279     .name = "mmpll0",
    280     .parent_names = (const char *[]){ "xo" },
    281     @@ -192,9 +193,10 @@ static struct clk_pll mmpll1 = {
    282     .l_reg = 0x0044,
    283     .m_reg = 0x0048,
    284     .n_reg = 0x004c,
    285     - .config_reg = 0x0054,
    286     + .config_reg = 0x0050,
    287     .mode_reg = 0x0040,
    288     .status_reg = 0x005c,
    289     + .status_bit = 17,
    290     .clkr.hw.init = &(struct clk_init_data){
    291     .name = "mmpll1",
    292     .parent_names = (const char *[]){ "xo" },
    293     @@ -218,7 +220,7 @@ static struct clk_pll mmpll2 = {
    294     .l_reg = 0x4104,
    295     .m_reg = 0x4108,
    296     .n_reg = 0x410c,
    297     - .config_reg = 0x4114,
    298     + .config_reg = 0x4110,
    299     .mode_reg = 0x4100,
    300     .status_reg = 0x411c,
    301     .clkr.hw.init = &(struct clk_init_data){
    302     @@ -233,9 +235,10 @@ static struct clk_pll mmpll3 = {
    303     .l_reg = 0x0084,
    304     .m_reg = 0x0088,
    305     .n_reg = 0x008c,
    306     - .config_reg = 0x0094,
    307     + .config_reg = 0x0090,
    308     .mode_reg = 0x0080,
    309     .status_reg = 0x009c,
    310     + .status_bit = 17,
    311     .clkr.hw.init = &(struct clk_init_data){
    312     .name = "mmpll3",
    313     .parent_names = (const char *[]){ "xo" },
    314     @@ -2318,7 +2321,7 @@ static const struct pll_config mmpll1_config = {
    315     .vco_val = 0x0,
    316     .vco_mask = 0x3 << 20,
    317     .pre_div_val = 0x0,
    318     - .pre_div_mask = 0x3 << 12,
    319     + .pre_div_mask = 0x7 << 12,
    320     .post_div_val = 0x0,
    321     .post_div_mask = 0x3 << 8,
    322     .mn_ena_mask = BIT(24),
    323     @@ -2332,7 +2335,7 @@ static struct pll_config mmpll3_config = {
    324     .vco_val = 0x0,
    325     .vco_mask = 0x3 << 20,
    326     .pre_div_val = 0x0,
    327     - .pre_div_mask = 0x3 << 12,
    328     + .pre_div_mask = 0x7 << 12,
    329     .post_div_val = 0x0,
    330     .post_div_mask = 0x3 << 8,
    331     .mn_ena_mask = BIT(24),
    332     diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
    333     index de9ef4a1986d..6d98c37c87ad 100644
    334     --- a/drivers/cpufreq/intel_pstate.c
    335     +++ b/drivers/cpufreq/intel_pstate.c
    336     @@ -200,10 +200,7 @@ static signed int pid_calc(struct _pid *pid, int32_t busy)
    337     pid->last_err = fp_error;
    338    
    339     result = pterm + mul_fp(pid->integral, pid->i_gain) + dterm;
    340     - if (result >= 0)
    341     - result = result + (1 << (FRAC_BITS-1));
    342     - else
    343     - result = result - (1 << (FRAC_BITS-1));
    344     + result = result + (1 << (FRAC_BITS-1));
    345     return (signed int)fp_toint(result);
    346     }
    347    
    348     diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
    349     index 19a4f0535b63..fd98bec78816 100644
    350     --- a/drivers/gpu/drm/i915/intel_panel.c
    351     +++ b/drivers/gpu/drm/i915/intel_panel.c
    352     @@ -736,9 +736,6 @@ static void i965_enable_backlight(struct intel_connector *connector)
    353     ctl = freq << 16;
    354     I915_WRITE(BLC_PWM_CTL, ctl);
    355    
    356     - /* XXX: combine this into above write? */
    357     - intel_panel_actually_set_backlight(connector, panel->backlight.level);
    358     -
    359     ctl2 = BLM_PIPE(pipe);
    360     if (panel->backlight.combination_mode)
    361     ctl2 |= BLM_COMBINATION_MODE;
    362     @@ -747,6 +744,8 @@ static void i965_enable_backlight(struct intel_connector *connector)
    363     I915_WRITE(BLC_PWM_CTL2, ctl2);
    364     POSTING_READ(BLC_PWM_CTL2);
    365     I915_WRITE(BLC_PWM_CTL2, ctl2 | BLM_PWM_ENABLE);
    366     +
    367     + intel_panel_actually_set_backlight(connector, panel->backlight.level);
    368     }
    369    
    370     static void vlv_enable_backlight(struct intel_connector *connector)
    371     diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
    372     index bd1b00344dac..8e7245151b96 100644
    373     --- a/drivers/gpu/drm/i915/intel_pm.c
    374     +++ b/drivers/gpu/drm/i915/intel_pm.c
    375     @@ -5138,10 +5138,25 @@ bool intel_display_power_enabled_sw(struct drm_device *dev,
    376     {
    377     struct drm_i915_private *dev_priv = dev->dev_private;
    378     struct i915_power_domains *power_domains;
    379     + struct i915_power_well *power_well;
    380     + bool is_enabled;
    381     + int i;
    382     +
    383     + if (dev_priv->pm.suspended)
    384     + return false;
    385    
    386     power_domains = &dev_priv->power_domains;
    387     + is_enabled = true;
    388     + for_each_power_well_rev(i, power_well, BIT(domain), power_domains) {
    389     + if (power_well->always_on)
    390     + continue;
    391    
    392     - return power_domains->domain_use_count[domain];
    393     + if (!power_well->count) {
    394     + is_enabled = false;
    395     + break;
    396     + }
    397     + }
    398     + return is_enabled;
    399     }
    400    
    401     bool intel_display_power_enabled(struct drm_device *dev,
    402     diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
    403     index cbc2feeda59d..1890264cf115 100644
    404     --- a/drivers/gpu/drm/i915/intel_sdvo.c
    405     +++ b/drivers/gpu/drm/i915/intel_sdvo.c
    406     @@ -1383,7 +1383,9 @@ static void intel_sdvo_get_config(struct intel_encoder *encoder,
    407     >> SDVO_PORT_MULTIPLY_SHIFT) + 1;
    408     }
    409    
    410     - dotclock = pipe_config->port_clock / pipe_config->pixel_multiplier;
    411     + dotclock = pipe_config->port_clock;
    412     + if (pipe_config->pixel_multiplier)
    413     + dotclock /= pipe_config->pixel_multiplier;
    414    
    415     if (HAS_PCH_SPLIT(dev))
    416     ironlake_check_encoder_dotclock(pipe_config, dotclock);
    417     diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/nv04.c b/drivers/gpu/drm/nouveau/core/engine/disp/nv04.c
    418     index 7cf8b1348632..6fdf6e385bf7 100644
    419     --- a/drivers/gpu/drm/nouveau/core/engine/disp/nv04.c
    420     +++ b/drivers/gpu/drm/nouveau/core/engine/disp/nv04.c
    421     @@ -51,6 +51,14 @@ nv04_disp_scanoutpos(struct nouveau_object *object, u32 mthd,
    422     args->htotal = nv_rd32(priv, 0x680824 + (head * 0x2000)) & 0xffff;
    423     args->hblanke = args->htotal - 1;
    424    
    425     + /*
    426     + * If output is vga instead of digital then vtotal/htotal is invalid
    427     + * so we have to give up and trigger the timestamping fallback in the
    428     + * drm core.
    429     + */
    430     + if (!args->vtotal || !args->htotal)
    431     + return -ENOTSUPP;
    432     +
    433     args->time[0] = ktime_to_ns(ktime_get());
    434     line = nv_rd32(priv, 0x600868 + (head * 0x2000));
    435     args->time[1] = ktime_to_ns(ktime_get());
    436     diff --git a/drivers/gpu/drm/nouveau/core/engine/graph/ctxnv108.c b/drivers/gpu/drm/nouveau/core/engine/graph/ctxnv108.c
    437     index a86bd3352bf8..e69bfde37aef 100644
    438     --- a/drivers/gpu/drm/nouveau/core/engine/graph/ctxnv108.c
    439     +++ b/drivers/gpu/drm/nouveau/core/engine/graph/ctxnv108.c
    440     @@ -1318,10 +1318,12 @@ nv108_grctx_generate_mods(struct nvc0_graph_priv *priv, struct nvc0_grctx *info)
    441     mmio_list(0x408010, 0x80000000, 0, 0);
    442     mmio_list(0x419004, 0x00000000, 8, 1);
    443     mmio_list(0x419008, 0x00000000, 0, 0);
    444     + mmio_list(0x4064cc, 0x80000000, 0, 0);
    445     mmio_list(0x408004, 0x00000000, 8, 0);
    446     mmio_list(0x408008, 0x80000030, 0, 0);
    447     mmio_list(0x418808, 0x00000000, 8, 0);
    448     mmio_list(0x41880c, 0x80000030, 0, 0);
    449     + mmio_list(0x4064c8, 0x00c20200, 0, 0);
    450     mmio_list(0x418810, 0x80000000, 12, 2);
    451     mmio_list(0x419848, 0x10000000, 12, 2);
    452    
    453     diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c
    454     index e8822a934c48..90d8bf8ce0dc 100644
    455     --- a/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c
    456     +++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c
    457     @@ -26,6 +26,7 @@
    458    
    459     const struct nouveau_mc_intr
    460     nv50_mc_intr[] = {
    461     + { 0x04000000, NVDEV_ENGINE_DISP }, /* DISP before FIFO, so pageflip-timestamping works! */
    462     { 0x00000001, NVDEV_ENGINE_MPEG },
    463     { 0x00000100, NVDEV_ENGINE_FIFO },
    464     { 0x00001000, NVDEV_ENGINE_GR },
    465     @@ -34,7 +35,6 @@ nv50_mc_intr[] = {
    466     { 0x00020000, NVDEV_ENGINE_VP }, /* NV84- */
    467     { 0x00100000, NVDEV_SUBDEV_TIMER },
    468     { 0x00200000, NVDEV_SUBDEV_GPIO },
    469     - { 0x04000000, NVDEV_ENGINE_DISP },
    470     { 0x10000000, NVDEV_SUBDEV_BUS },
    471     { 0x80000000, NVDEV_ENGINE_SW },
    472     { 0x0002d101, NVDEV_SUBDEV_FB },
    473     diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv98.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nv98.c
    474     index f8a6f18e2d34..95b3d35388a8 100644
    475     --- a/drivers/gpu/drm/nouveau/core/subdev/mc/nv98.c
    476     +++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv98.c
    477     @@ -26,6 +26,7 @@
    478    
    479     static const struct nouveau_mc_intr
    480     nv98_mc_intr[] = {
    481     + { 0x04000000, NVDEV_ENGINE_DISP }, /* DISP first, so pageflip timestamps work */
    482     { 0x00000001, NVDEV_ENGINE_PPP },
    483     { 0x00000100, NVDEV_ENGINE_FIFO },
    484     { 0x00001000, NVDEV_ENGINE_GR },
    485     @@ -37,7 +38,6 @@ nv98_mc_intr[] = {
    486     { 0x00100000, NVDEV_SUBDEV_TIMER },
    487     { 0x00200000, NVDEV_SUBDEV_GPIO },
    488     { 0x00400000, NVDEV_ENGINE_COPY0 }, /* NVA3- */
    489     - { 0x04000000, NVDEV_ENGINE_DISP },
    490     { 0x10000000, NVDEV_SUBDEV_BUS },
    491     { 0x80000000, NVDEV_ENGINE_SW },
    492     { 0x0042d101, NVDEV_SUBDEV_FB },
    493     diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nvc0.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nvc0.c
    494     index 34472d317097..ac7f99a15fa7 100644
    495     --- a/drivers/gpu/drm/nouveau/core/subdev/mc/nvc0.c
    496     +++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nvc0.c
    497     @@ -26,6 +26,7 @@
    498    
    499     const struct nouveau_mc_intr
    500     nvc0_mc_intr[] = {
    501     + { 0x04000000, NVDEV_ENGINE_DISP }, /* DISP first, so pageflip timestamps work. */
    502     { 0x00000001, NVDEV_ENGINE_PPP },
    503     { 0x00000020, NVDEV_ENGINE_COPY0 },
    504     { 0x00000040, NVDEV_ENGINE_COPY1 },
    505     @@ -40,7 +41,6 @@ nvc0_mc_intr[] = {
    506     { 0x00200000, NVDEV_SUBDEV_GPIO },
    507     { 0x01000000, NVDEV_SUBDEV_PWR },
    508     { 0x02000000, NVDEV_SUBDEV_LTCG },
    509     - { 0x04000000, NVDEV_ENGINE_DISP },
    510     { 0x08000000, NVDEV_SUBDEV_FB },
    511     { 0x10000000, NVDEV_SUBDEV_BUS },
    512     { 0x40000000, NVDEV_SUBDEV_IBUS },
    513     diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
    514     index 5524a3705224..6601690ab29c 100644
    515     --- a/drivers/gpu/drm/nouveau/nouveau_display.c
    516     +++ b/drivers/gpu/drm/nouveau/nouveau_display.c
    517     @@ -734,6 +734,9 @@ nouveau_crtc_page_flip(struct drm_crtc *crtc, struct drm_framebuffer *fb,
    518     fb->bits_per_pixel, fb->pitches[0], crtc->x, crtc->y,
    519     new_bo->bo.offset };
    520    
    521     + /* Keep vblanks on during flip, for the target crtc of this flip */
    522     + drm_vblank_get(dev, nouveau_crtc(crtc)->index);
    523     +
    524     /* Emit a page flip */
    525     if (nv_device(drm->device)->card_type >= NV_50) {
    526     ret = nv50_display_flip_next(crtc, fb, chan, swap_interval);
    527     @@ -777,6 +780,7 @@ nouveau_crtc_page_flip(struct drm_crtc *crtc, struct drm_framebuffer *fb,
    528     return 0;
    529    
    530     fail_unreserve:
    531     + drm_vblank_put(dev, nouveau_crtc(crtc)->index);
    532     ttm_bo_unreserve(&old_bo->bo);
    533     fail_unpin:
    534     mutex_unlock(&chan->cli->mutex);
    535     @@ -796,6 +800,7 @@ nouveau_finish_page_flip(struct nouveau_channel *chan,
    536     struct drm_device *dev = drm->dev;
    537     struct nouveau_page_flip_state *s;
    538     unsigned long flags;
    539     + int crtcid = -1;
    540    
    541     spin_lock_irqsave(&dev->event_lock, flags);
    542    
    543     @@ -806,8 +811,16 @@ nouveau_finish_page_flip(struct nouveau_channel *chan,
    544     }
    545    
    546     s = list_first_entry(&fctx->flip, struct nouveau_page_flip_state, head);
    547     - if (s->event)
    548     - drm_send_vblank_event(dev, s->crtc, s->event);
    549     + if (s->event) {
    550     + /* Vblank timestamps/counts are only correct on >= NV-50 */
    551     + if (nv_device(drm->device)->card_type >= NV_50)
    552     + crtcid = s->crtc;
    553     +
    554     + drm_send_vblank_event(dev, crtcid, s->event);
    555     + }
    556     +
    557     + /* Give up ownership of vblank for page-flipped crtc */
    558     + drm_vblank_put(dev, s->crtc);
    559    
    560     list_del(&s->head);
    561     if (ps)
    562     diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
    563     index 41a9a9cb271a..0cca5f24196a 100644
    564     --- a/drivers/gpu/drm/radeon/atombios_crtc.c
    565     +++ b/drivers/gpu/drm/radeon/atombios_crtc.c
    566     @@ -862,14 +862,16 @@ static void atombios_crtc_program_pll(struct drm_crtc *crtc,
    567     args.v5.ucMiscInfo = 0; /* HDMI depth, etc. */
    568     if (ss_enabled && (ss->type & ATOM_EXTERNAL_SS_MASK))
    569     args.v5.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_REF_DIV_SRC;
    570     - switch (bpc) {
    571     - case 8:
    572     - default:
    573     - args.v5.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_HDMI_24BPP;
    574     - break;
    575     - case 10:
    576     - args.v5.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_HDMI_30BPP;
    577     - break;
    578     + if (encoder_mode == ATOM_ENCODER_MODE_HDMI) {
    579     + switch (bpc) {
    580     + case 8:
    581     + default:
    582     + args.v5.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_HDMI_24BPP;
    583     + break;
    584     + case 10:
    585     + args.v5.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_HDMI_30BPP;
    586     + break;
    587     + }
    588     }
    589     args.v5.ucTransmitterID = encoder_id;
    590     args.v5.ucEncoderMode = encoder_mode;
    591     @@ -884,20 +886,22 @@ static void atombios_crtc_program_pll(struct drm_crtc *crtc,
    592     args.v6.ucMiscInfo = 0; /* HDMI depth, etc. */
    593     if (ss_enabled && (ss->type & ATOM_EXTERNAL_SS_MASK))
    594     args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_REF_DIV_SRC;
    595     - switch (bpc) {
    596     - case 8:
    597     - default:
    598     - args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_24BPP;
    599     - break;
    600     - case 10:
    601     - args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_30BPP;
    602     - break;
    603     - case 12:
    604     - args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_36BPP;
    605     - break;
    606     - case 16:
    607     - args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_48BPP;
    608     - break;
    609     + if (encoder_mode == ATOM_ENCODER_MODE_HDMI) {
    610     + switch (bpc) {
    611     + case 8:
    612     + default:
    613     + args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_24BPP;
    614     + break;
    615     + case 10:
    616     + args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_30BPP;
    617     + break;
    618     + case 12:
    619     + args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_36BPP;
    620     + break;
    621     + case 16:
    622     + args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_48BPP;
    623     + break;
    624     + }
    625     }
    626     args.v6.ucTransmitterID = encoder_id;
    627     args.v6.ucEncoderMode = encoder_mode;
    628     diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
    629     index 4ad7643fce5f..5727dbdeda7f 100644
    630     --- a/drivers/gpu/drm/radeon/atombios_dp.c
    631     +++ b/drivers/gpu/drm/radeon/atombios_dp.c
    632     @@ -386,6 +386,19 @@ static int dp_get_max_dp_pix_clock(int link_rate,
    633    
    634     /***** radeon specific DP functions *****/
    635    
    636     +static int radeon_dp_get_max_link_rate(struct drm_connector *connector,
    637     + u8 dpcd[DP_DPCD_SIZE])
    638     +{
    639     + int max_link_rate;
    640     +
    641     + if (radeon_connector_is_dp12_capable(connector))
    642     + max_link_rate = min(drm_dp_max_link_rate(dpcd), 540000);
    643     + else
    644     + max_link_rate = min(drm_dp_max_link_rate(dpcd), 270000);
    645     +
    646     + return max_link_rate;
    647     +}
    648     +
    649     /* First get the min lane# when low rate is used according to pixel clock
    650     * (prefer low rate), second check max lane# supported by DP panel,
    651     * if the max lane# < low rate lane# then use max lane# instead.
    652     @@ -395,7 +408,7 @@ static int radeon_dp_get_dp_lane_number(struct drm_connector *connector,
    653     int pix_clock)
    654     {
    655     int bpp = convert_bpc_to_bpp(radeon_get_monitor_bpc(connector));
    656     - int max_link_rate = drm_dp_max_link_rate(dpcd);
    657     + int max_link_rate = radeon_dp_get_max_link_rate(connector, dpcd);
    658     int max_lane_num = drm_dp_max_lane_count(dpcd);
    659     int lane_num;
    660     int max_dp_pix_clock;
    661     @@ -433,7 +446,7 @@ static int radeon_dp_get_dp_link_clock(struct drm_connector *connector,
    662     return 540000;
    663     }
    664    
    665     - return drm_dp_max_link_rate(dpcd);
    666     + return radeon_dp_get_max_link_rate(connector, dpcd);
    667     }
    668    
    669     static u8 radeon_dp_encoder_service(struct radeon_device *rdev,
    670     diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
    671     index 607dc14d195e..ccca8b224d18 100644
    672     --- a/drivers/gpu/drm/radeon/atombios_encoders.c
    673     +++ b/drivers/gpu/drm/radeon/atombios_encoders.c
    674     @@ -1898,8 +1898,11 @@ atombios_set_encoder_crtc_source(struct drm_encoder *encoder)
    675     args.v2.ucEncodeMode = ATOM_ENCODER_MODE_CRT;
    676     else
    677     args.v2.ucEncodeMode = atombios_get_encoder_mode(encoder);
    678     - } else
    679     + } else if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT)) {
    680     + args.v2.ucEncodeMode = ATOM_ENCODER_MODE_LVDS;
    681     + } else {
    682     args.v2.ucEncodeMode = atombios_get_encoder_mode(encoder);
    683     + }
    684     switch (radeon_encoder->encoder_id) {
    685     case ENCODER_OBJECT_ID_INTERNAL_UNIPHY:
    686     case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1:
    687     diff --git a/drivers/gpu/drm/radeon/cikd.h b/drivers/gpu/drm/radeon/cikd.h
    688     index d1b2c71b192a..a0a9f974cdd7 100644
    689     --- a/drivers/gpu/drm/radeon/cikd.h
    690     +++ b/drivers/gpu/drm/radeon/cikd.h
    691     @@ -1745,12 +1745,12 @@
    692     #define EOP_TC_WB_ACTION_EN (1 << 15) /* L2 */
    693     #define EOP_TCL1_ACTION_EN (1 << 16)
    694     #define EOP_TC_ACTION_EN (1 << 17) /* L2 */
    695     +#define EOP_TCL2_VOLATILE (1 << 24)
    696     #define EOP_CACHE_POLICY(x) ((x) << 25)
    697     /* 0 - LRU
    698     * 1 - Stream
    699     * 2 - Bypass
    700     */
    701     -#define EOP_TCL2_VOLATILE (1 << 27)
    702     #define DATA_SEL(x) ((x) << 29)
    703     /* 0 - discard
    704     * 1 - send low 32bit data
    705     diff --git a/drivers/gpu/drm/radeon/cypress_dpm.c b/drivers/gpu/drm/radeon/cypress_dpm.c
    706     index cf783fc0ef21..cf777193c85f 100644
    707     --- a/drivers/gpu/drm/radeon/cypress_dpm.c
    708     +++ b/drivers/gpu/drm/radeon/cypress_dpm.c
    709     @@ -1551,7 +1551,7 @@ int cypress_populate_smc_voltage_tables(struct radeon_device *rdev,
    710    
    711     table->voltageMaskTable.highMask[RV770_SMC_VOLTAGEMASK_VDDCI] = 0;
    712     table->voltageMaskTable.lowMask[RV770_SMC_VOLTAGEMASK_VDDCI] =
    713     - cpu_to_be32(eg_pi->vddc_voltage_table.mask_low);
    714     + cpu_to_be32(eg_pi->vddci_voltage_table.mask_low);
    715     }
    716    
    717     return 0;
    718     diff --git a/drivers/gpu/drm/radeon/ni_dpm.c b/drivers/gpu/drm/radeon/ni_dpm.c
    719     index ca814276b075..03f08a3cf864 100644
    720     --- a/drivers/gpu/drm/radeon/ni_dpm.c
    721     +++ b/drivers/gpu/drm/radeon/ni_dpm.c
    722     @@ -1315,7 +1315,7 @@ static void ni_populate_smc_voltage_tables(struct radeon_device *rdev,
    723    
    724     table->voltageMaskTable.highMask[NISLANDS_SMC_VOLTAGEMASK_VDDCI] = 0;
    725     table->voltageMaskTable.lowMask[NISLANDS_SMC_VOLTAGEMASK_VDDCI] =
    726     - cpu_to_be32(eg_pi->vddc_voltage_table.mask_low);
    727     + cpu_to_be32(eg_pi->vddci_voltage_table.mask_low);
    728     }
    729     }
    730    
    731     diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
    732     index 82d4f865546e..4d36b9e86275 100644
    733     --- a/drivers/gpu/drm/radeon/radeon_connectors.c
    734     +++ b/drivers/gpu/drm/radeon/radeon_connectors.c
    735     @@ -1402,7 +1402,7 @@ bool radeon_connector_is_dp12_capable(struct drm_connector *connector)
    736     struct radeon_device *rdev = dev->dev_private;
    737    
    738     if (ASIC_IS_DCE5(rdev) &&
    739     - (rdev->clock.dp_extclk >= 53900) &&
    740     + (rdev->clock.default_dispclk >= 53900) &&
    741     radeon_connector_encoder_is_hbr2(connector)) {
    742     return true;
    743     }
    744     diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
    745     index 7993aec86acc..7f2d6c0d11c1 100644
    746     --- a/drivers/gpu/drm/radeon/radeon_cs.c
    747     +++ b/drivers/gpu/drm/radeon/radeon_cs.c
    748     @@ -97,6 +97,12 @@ static int radeon_cs_parser_relocs(struct radeon_cs_parser *p)
    749     uint32_t domain = r->write_domain ?
    750     r->write_domain : r->read_domains;
    751    
    752     + if (domain & RADEON_GEM_DOMAIN_CPU) {
    753     + DRM_ERROR("RADEON_GEM_DOMAIN_CPU is not valid "
    754     + "for command submission\n");
    755     + return -EINVAL;
    756     + }
    757     +
    758     p->relocs[i].lobj.domain = domain;
    759     if (domain == RADEON_GEM_DOMAIN_VRAM)
    760     domain |= RADEON_GEM_DOMAIN_GTT;
    761     diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
    762     index 021b5227e783..1b0f34bd3a03 100644
    763     --- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
    764     +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
    765     @@ -179,7 +179,6 @@ static int vmw_fb_set_par(struct fb_info *info)
    766     vmw_write(vmw_priv, SVGA_REG_DISPLAY_POSITION_Y, info->var.yoffset);
    767     vmw_write(vmw_priv, SVGA_REG_DISPLAY_WIDTH, info->var.xres);
    768     vmw_write(vmw_priv, SVGA_REG_DISPLAY_HEIGHT, info->var.yres);
    769     - vmw_write(vmw_priv, SVGA_REG_BYTES_PER_LINE, info->fix.line_length);
    770     vmw_write(vmw_priv, SVGA_REG_DISPLAY_ID, SVGA_ID_INVALID);
    771     }
    772    
    773     diff --git a/drivers/gpu/vga/vga_switcheroo.c b/drivers/gpu/vga/vga_switcheroo.c
    774     index ec0ae2d1686a..6866448083b2 100644
    775     --- a/drivers/gpu/vga/vga_switcheroo.c
    776     +++ b/drivers/gpu/vga/vga_switcheroo.c
    777     @@ -623,7 +623,8 @@ static int vga_switcheroo_runtime_suspend(struct device *dev)
    778     ret = dev->bus->pm->runtime_suspend(dev);
    779     if (ret)
    780     return ret;
    781     -
    782     + if (vgasr_priv.handler->switchto)
    783     + vgasr_priv.handler->switchto(VGA_SWITCHEROO_IGD);
    784     vga_switcheroo_power_switch(pdev, VGA_SWITCHEROO_OFF);
    785     return 0;
    786     }
    787     diff --git a/drivers/hwmon/ina2xx.c b/drivers/hwmon/ina2xx.c
    788     index 93d26e8af3e2..bfd3f3eeabcd 100644
    789     --- a/drivers/hwmon/ina2xx.c
    790     +++ b/drivers/hwmon/ina2xx.c
    791     @@ -148,7 +148,8 @@ static int ina2xx_get_value(struct ina2xx_data *data, u8 reg)
    792    
    793     switch (reg) {
    794     case INA2XX_SHUNT_VOLTAGE:
    795     - val = DIV_ROUND_CLOSEST(data->regs[reg],
    796     + /* signed register */
    797     + val = DIV_ROUND_CLOSEST((s16)data->regs[reg],
    798     data->config->shunt_div);
    799     break;
    800     case INA2XX_BUS_VOLTAGE:
    801     @@ -160,8 +161,8 @@ static int ina2xx_get_value(struct ina2xx_data *data, u8 reg)
    802     val = data->regs[reg] * data->config->power_lsb;
    803     break;
    804     case INA2XX_CURRENT:
    805     - /* LSB=1mA (selected). Is in mA */
    806     - val = data->regs[reg];
    807     + /* signed register, LSB=1mA (selected), in mA */
    808     + val = (s16)data->regs[reg];
    809     break;
    810     default:
    811     /* programmer goofed */
    812     diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c
    813     index 0cf5f8e06cfc..1e8e94d4db7d 100644
    814     --- a/drivers/iio/inkern.c
    815     +++ b/drivers/iio/inkern.c
    816     @@ -183,7 +183,7 @@ static struct iio_channel *of_iio_channel_get_by_name(struct device_node *np,
    817     else if (name && index >= 0) {
    818     pr_err("ERROR: could not get IIO channel %s:%s(%i)\n",
    819     np->full_name, name ? name : "", index);
    820     - return chan;
    821     + return NULL;
    822     }
    823    
    824     /*
    825     @@ -193,8 +193,9 @@ static struct iio_channel *of_iio_channel_get_by_name(struct device_node *np,
    826     */
    827     np = np->parent;
    828     if (np && !of_get_property(np, "io-channel-ranges", NULL))
    829     - break;
    830     + return NULL;
    831     }
    832     +
    833     return chan;
    834     }
    835    
    836     @@ -317,6 +318,7 @@ struct iio_channel *iio_channel_get(struct device *dev,
    837     if (channel != NULL)
    838     return channel;
    839     }
    840     +
    841     return iio_channel_get_sys(name, channel_name);
    842     }
    843     EXPORT_SYMBOL_GPL(iio_channel_get);
    844     diff --git a/drivers/irqchip/spear-shirq.c b/drivers/irqchip/spear-shirq.c
    845     index 8527743b5cef..391b9cea73ed 100644
    846     --- a/drivers/irqchip/spear-shirq.c
    847     +++ b/drivers/irqchip/spear-shirq.c
    848     @@ -125,7 +125,7 @@ static struct spear_shirq spear320_shirq_ras2 = {
    849     };
    850    
    851     static struct spear_shirq spear320_shirq_ras3 = {
    852     - .irq_nr = 3,
    853     + .irq_nr = 7,
    854     .irq_bit_off = 0,
    855     .invalid_irq = 1,
    856     .regs = {
    857     diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
    858     index 94d2ac1b493e..359af3a519b5 100644
    859     --- a/drivers/md/dm-thin.c
    860     +++ b/drivers/md/dm-thin.c
    861     @@ -2925,7 +2925,8 @@ static void set_discard_limits(struct pool_c *pt, struct queue_limits *limits)
    862     */
    863     if (pt->adjusted_pf.discard_passdown) {
    864     data_limits = &bdev_get_queue(pt->data_dev->bdev)->limits;
    865     - limits->discard_granularity = data_limits->discard_granularity;
    866     + limits->discard_granularity = max(data_limits->discard_granularity,
    867     + pool->sectors_per_block << SECTOR_SHIFT);
    868     } else
    869     limits->discard_granularity = pool->sectors_per_block << SECTOR_SHIFT;
    870     }
    871     diff --git a/drivers/md/md.c b/drivers/md/md.c
    872     index 8b013f87c9d8..73aedcb639c0 100644
    873     --- a/drivers/md/md.c
    874     +++ b/drivers/md/md.c
    875     @@ -7505,6 +7505,19 @@ void md_do_sync(struct md_thread *thread)
    876     rdev->recovery_offset < j)
    877     j = rdev->recovery_offset;
    878     rcu_read_unlock();
    879     +
    880     + /* If there is a bitmap, we need to make sure all
    881     + * writes that started before we added a spare
    882     + * complete before we start doing a recovery.
    883     + * Otherwise the write might complete and (via
    884     + * bitmap_endwrite) set a bit in the bitmap after the
    885     + * recovery has checked that bit and skipped that
    886     + * region.
    887     + */
    888     + if (mddev->bitmap) {
    889     + mddev->pers->quiesce(mddev, 1);
    890     + mddev->pers->quiesce(mddev, 0);
    891     + }
    892     }
    893    
    894     printk(KERN_INFO "md: %s of RAID array %s\n", desc, mdname(mddev));
    895     diff --git a/drivers/mmc/host/rtsx_pci_sdmmc.c b/drivers/mmc/host/rtsx_pci_sdmmc.c
    896     index c46feda07d56..7e1866175e7b 100644
    897     --- a/drivers/mmc/host/rtsx_pci_sdmmc.c
    898     +++ b/drivers/mmc/host/rtsx_pci_sdmmc.c
    899     @@ -246,6 +246,9 @@ static void sd_send_cmd_get_rsp(struct realtek_pci_sdmmc *host,
    900     case MMC_RSP_R1:
    901     rsp_type = SD_RSP_TYPE_R1;
    902     break;
    903     + case MMC_RSP_R1 & ~MMC_RSP_CRC:
    904     + rsp_type = SD_RSP_TYPE_R1 | SD_NO_CHECK_CRC7;
    905     + break;
    906     case MMC_RSP_R1B:
    907     rsp_type = SD_RSP_TYPE_R1b;
    908     break;
    909     diff --git a/drivers/mtd/nand/fsl_elbc_nand.c b/drivers/mtd/nand/fsl_elbc_nand.c
    910     index bcf60800c3ce..c09ab95a2219 100644
    911     --- a/drivers/mtd/nand/fsl_elbc_nand.c
    912     +++ b/drivers/mtd/nand/fsl_elbc_nand.c
    913     @@ -724,6 +724,19 @@ static int fsl_elbc_write_page(struct mtd_info *mtd, struct nand_chip *chip,
    914     return 0;
    915     }
    916    
    917     +/* ECC will be calculated automatically, and errors will be detected in
    918     + * waitfunc.
    919     + */
    920     +static int fsl_elbc_write_subpage(struct mtd_info *mtd, struct nand_chip *chip,
    921     + uint32_t offset, uint32_t data_len,
    922     + const uint8_t *buf, int oob_required)
    923     +{
    924     + fsl_elbc_write_buf(mtd, buf, mtd->writesize);
    925     + fsl_elbc_write_buf(mtd, chip->oob_poi, mtd->oobsize);
    926     +
    927     + return 0;
    928     +}
    929     +
    930     static int fsl_elbc_chip_init(struct fsl_elbc_mtd *priv)
    931     {
    932     struct fsl_lbc_ctrl *ctrl = priv->ctrl;
    933     @@ -762,6 +775,7 @@ static int fsl_elbc_chip_init(struct fsl_elbc_mtd *priv)
    934    
    935     chip->ecc.read_page = fsl_elbc_read_page;
    936     chip->ecc.write_page = fsl_elbc_write_page;
    937     + chip->ecc.write_subpage = fsl_elbc_write_subpage;
    938    
    939     /* If CS Base Register selects full hardware ECC then use it */
    940     if ((in_be32(&lbc->bank[priv->bank].br) & BR_DECC) ==
    941     diff --git a/drivers/mtd/nand/omap2.c b/drivers/mtd/nand/omap2.c
    942     index bf642ceef681..6f55d92dc233 100644
    943     --- a/drivers/mtd/nand/omap2.c
    944     +++ b/drivers/mtd/nand/omap2.c
    945     @@ -1451,7 +1451,7 @@ static int omap_elm_correct_data(struct mtd_info *mtd, u_char *data,
    946    
    947     /* Check if any error reported */
    948     if (!is_error_reported)
    949     - return 0;
    950     + return stat;
    951    
    952     /* Decode BCH error using ELM module */
    953     elm_decode_bch_error_page(info->elm_dev, ecc_vec, err_vec);
    954     diff --git a/drivers/mtd/nand/pxa3xx_nand.c b/drivers/mtd/nand/pxa3xx_nand.c
    955     index 2a7a0b27ac38..51e15fd53108 100644
    956     --- a/drivers/mtd/nand/pxa3xx_nand.c
    957     +++ b/drivers/mtd/nand/pxa3xx_nand.c
    958     @@ -128,10 +128,10 @@
    959    
    960     /* macros for registers read/write */
    961     #define nand_writel(info, off, val) \
    962     - __raw_writel((val), (info)->mmio_base + (off))
    963     + writel_relaxed((val), (info)->mmio_base + (off))
    964    
    965     #define nand_readl(info, off) \
    966     - __raw_readl((info)->mmio_base + (off))
    967     + readl_relaxed((info)->mmio_base + (off))
    968    
    969     /* error code and state */
    970     enum {
    971     diff --git a/drivers/net/ethernet/allwinner/sun4i-emac.c b/drivers/net/ethernet/allwinner/sun4i-emac.c
    972     index 511f6eecd58b..62db510b70ea 100644
    973     --- a/drivers/net/ethernet/allwinner/sun4i-emac.c
    974     +++ b/drivers/net/ethernet/allwinner/sun4i-emac.c
    975     @@ -725,6 +725,7 @@ static int emac_open(struct net_device *dev)
    976    
    977     ret = emac_mdio_probe(dev);
    978     if (ret < 0) {
    979     + free_irq(dev->irq, dev);
    980     netdev_err(dev, "cannot probe MDIO bus\n");
    981     return ret;
    982     }
    983     diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.c b/drivers/net/ethernet/mellanox/mlx4/fw.c
    984     index 7e2995ecea6f..84e41920b5ff 100644
    985     --- a/drivers/net/ethernet/mellanox/mlx4/fw.c
    986     +++ b/drivers/net/ethernet/mellanox/mlx4/fw.c
    987     @@ -398,7 +398,7 @@ int mlx4_QUERY_FUNC_CAP(struct mlx4_dev *dev, u32 gen_or_port,
    988    
    989     MLX4_GET(func_cap->flags1, outbox, QUERY_FUNC_CAP_FLAGS1_OFFSET);
    990     if (dev->caps.port_type[gen_or_port] == MLX4_PORT_TYPE_ETH) {
    991     - if (func_cap->flags1 & QUERY_FUNC_CAP_FLAGS1_OFFSET) {
    992     + if (func_cap->flags1 & QUERY_FUNC_CAP_FLAGS1_FORCE_VLAN) {
    993     mlx4_err(dev, "VLAN is enforced on this port\n");
    994     err = -EPROTONOSUPPORT;
    995     goto out;
    996     diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c
    997     index 50e5ddb12fb3..628ff628e04a 100644
    998     --- a/drivers/net/wireless/b43/xmit.c
    999     +++ b/drivers/net/wireless/b43/xmit.c
    1000     @@ -810,9 +810,13 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr)
    1001     break;
    1002     case B43_PHYTYPE_G:
    1003     status.band = IEEE80211_BAND_2GHZ;
    1004     - /* chanid is the radio channel cookie value as used
    1005     - * to tune the radio. */
    1006     - status.freq = chanid + 2400;
    1007     + /* Somewhere between 478.104 and 508.1084 firmware for G-PHY
    1008     + * has been modified to be compatible with N-PHY and others.
    1009     + */
    1010     + if (dev->fw.rev >= 508)
    1011     + status.freq = ieee80211_channel_to_frequency(chanid, status.band);
    1012     + else
    1013     + status.freq = chanid + 2400;
    1014     break;
    1015     case B43_PHYTYPE_N:
    1016     case B43_PHYTYPE_LP:
    1017     diff --git a/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c b/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c
    1018     index 82bf3c5d3cdc..2de2736eb332 100644
    1019     --- a/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c
    1020     +++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c
    1021     @@ -300,10 +300,10 @@ brcmf_sdio_ai_coredisable(struct brcmf_sdio_dev *sdiodev,
    1022    
    1023     wrapbase = ci->c_inf[idx].wrapbase;
    1024    
    1025     - /* if core is already in reset, just return */
    1026     + /* if core is already in reset, skip reset */
    1027     regdata = brcmf_sdiod_regrl(sdiodev, wrapbase + BCMA_RESET_CTL, NULL);
    1028     if ((regdata & BCMA_RESET_CTL_RESET) != 0)
    1029     - return;
    1030     + goto post_reset_config;
    1031    
    1032     /* configure reset */
    1033     brcmf_sdiod_regwl(sdiodev, wrapbase + BCMA_IOCTL, pre_resetbits |
    1034     @@ -319,6 +319,7 @@ brcmf_sdio_ai_coredisable(struct brcmf_sdio_dev *sdiodev,
    1035     SPINWAIT(brcmf_sdiod_regrl(sdiodev, wrapbase + BCMA_RESET_CTL, NULL) !=
    1036     BCMA_RESET_CTL_RESET, 300);
    1037    
    1038     +post_reset_config:
    1039     /* post reset configure */
    1040     brcmf_sdiod_regwl(sdiodev, wrapbase + BCMA_IOCTL, pre_resetbits |
    1041     BCMA_IOCTL_FGC | BCMA_IOCTL_CLK, NULL);
    1042     diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
    1043     index 8d42fd9b0811..16be0c07c64a 100644
    1044     --- a/drivers/net/wireless/iwlwifi/pcie/trans.c
    1045     +++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
    1046     @@ -318,6 +318,7 @@ static int iwl_pcie_prepare_card_hw(struct iwl_trans *trans)
    1047     {
    1048     int ret;
    1049     int t = 0;
    1050     + int iter;
    1051    
    1052     IWL_DEBUG_INFO(trans, "iwl_trans_prepare_card_hw enter\n");
    1053    
    1054     @@ -326,18 +327,23 @@ static int iwl_pcie_prepare_card_hw(struct iwl_trans *trans)
    1055     if (ret >= 0)
    1056     return 0;
    1057    
    1058     - /* If HW is not ready, prepare the conditions to check again */
    1059     - iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG,
    1060     - CSR_HW_IF_CONFIG_REG_PREPARE);
    1061     + for (iter = 0; iter < 10; iter++) {
    1062     + /* If HW is not ready, prepare the conditions to check again */
    1063     + iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG,
    1064     + CSR_HW_IF_CONFIG_REG_PREPARE);
    1065     +
    1066     + do {
    1067     + ret = iwl_pcie_set_hw_ready(trans);
    1068     + if (ret >= 0)
    1069     + return 0;
    1070    
    1071     - do {
    1072     - ret = iwl_pcie_set_hw_ready(trans);
    1073     - if (ret >= 0)
    1074     - return 0;
    1075     + usleep_range(200, 1000);
    1076     + t += 200;
    1077     + } while (t < 150000);
    1078     + msleep(25);
    1079     + }
    1080    
    1081     - usleep_range(200, 1000);
    1082     - t += 200;
    1083     - } while (t < 150000);
    1084     + IWL_DEBUG_INFO(trans, "got NIC after %d iterations\n", iter);
    1085    
    1086     return ret;
    1087     }
    1088     diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
    1089     index 2f1cd929c6f6..a511cccc9f01 100644
    1090     --- a/drivers/net/wireless/rt2x00/rt2500pci.c
    1091     +++ b/drivers/net/wireless/rt2x00/rt2500pci.c
    1092     @@ -1681,8 +1681,13 @@ static int rt2500pci_init_eeprom(struct rt2x00_dev *rt2x00dev)
    1093     /*
    1094     * Detect if this device has an hardware controlled radio.
    1095     */
    1096     - if (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_HARDWARE_RADIO))
    1097     + if (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_HARDWARE_RADIO)) {
    1098     __set_bit(CAPABILITY_HW_BUTTON, &rt2x00dev->cap_flags);
    1099     + /*
    1100     + * On this device RFKILL initialized during probe does not work.
    1101     + */
    1102     + __set_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags);
    1103     + }
    1104    
    1105     /*
    1106     * Check if the BBP tuning should be enabled.
    1107     diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
    1108     index e3b885d8f7db..5d45a1a740a4 100644
    1109     --- a/drivers/net/wireless/rt2x00/rt2x00.h
    1110     +++ b/drivers/net/wireless/rt2x00/rt2x00.h
    1111     @@ -693,6 +693,7 @@ enum rt2x00_capability_flags {
    1112     REQUIRE_SW_SEQNO,
    1113     REQUIRE_HT_TX_DESC,
    1114     REQUIRE_PS_AUTOWAKE,
    1115     + REQUIRE_DELAYED_RFKILL,
    1116    
    1117     /*
    1118     * Capabilities
    1119     diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
    1120     index 2bde6729f5e6..4fa43a2eeb73 100644
    1121     --- a/drivers/net/wireless/rt2x00/rt2x00dev.c
    1122     +++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
    1123     @@ -1126,9 +1126,10 @@ static void rt2x00lib_uninitialize(struct rt2x00_dev *rt2x00dev)
    1124     return;
    1125    
    1126     /*
    1127     - * Unregister extra components.
    1128     + * Stop rfkill polling.
    1129     */
    1130     - rt2x00rfkill_unregister(rt2x00dev);
    1131     + if (test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
    1132     + rt2x00rfkill_unregister(rt2x00dev);
    1133    
    1134     /*
    1135     * Allow the HW to uninitialize.
    1136     @@ -1166,6 +1167,12 @@ static int rt2x00lib_initialize(struct rt2x00_dev *rt2x00dev)
    1137    
    1138     set_bit(DEVICE_STATE_INITIALIZED, &rt2x00dev->flags);
    1139    
    1140     + /*
    1141     + * Start rfkill polling.
    1142     + */
    1143     + if (test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
    1144     + rt2x00rfkill_register(rt2x00dev);
    1145     +
    1146     return 0;
    1147     }
    1148    
    1149     @@ -1375,7 +1382,12 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
    1150     rt2x00link_register(rt2x00dev);
    1151     rt2x00leds_register(rt2x00dev);
    1152     rt2x00debug_register(rt2x00dev);
    1153     - rt2x00rfkill_register(rt2x00dev);
    1154     +
    1155     + /*
    1156     + * Start rfkill polling.
    1157     + */
    1158     + if (!test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
    1159     + rt2x00rfkill_register(rt2x00dev);
    1160    
    1161     return 0;
    1162    
    1163     @@ -1391,6 +1403,12 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
    1164     clear_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
    1165    
    1166     /*
    1167     + * Stop rfkill polling.
    1168     + */
    1169     + if (!test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
    1170     + rt2x00rfkill_unregister(rt2x00dev);
    1171     +
    1172     + /*
    1173     * Disable radio.
    1174     */
    1175     rt2x00lib_disable_radio(rt2x00dev);
    1176     diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
    1177     index a87ee9b6585a..87a8ad5d2eb7 100644
    1178     --- a/drivers/net/wireless/rt2x00/rt2x00mac.c
    1179     +++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
    1180     @@ -487,6 +487,8 @@ int rt2x00mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
    1181     crypto.cipher = rt2x00crypto_key_to_cipher(key);
    1182     if (crypto.cipher == CIPHER_NONE)
    1183     return -EOPNOTSUPP;
    1184     + if (crypto.cipher == CIPHER_TKIP && rt2x00_is_usb(rt2x00dev))
    1185     + return -EOPNOTSUPP;
    1186    
    1187     crypto.cmd = cmd;
    1188    
    1189     diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c
    1190     index fa764406df68..c5bb0e0a36b9 100644
    1191     --- a/drivers/scsi/ibmvscsi/ibmvscsi.c
    1192     +++ b/drivers/scsi/ibmvscsi/ibmvscsi.c
    1193     @@ -185,6 +185,11 @@ static struct viosrp_crq *crq_queue_next_crq(struct crq_queue *queue)
    1194     if (crq->valid & 0x80) {
    1195     if (++queue->cur == queue->size)
    1196     queue->cur = 0;
    1197     +
    1198     + /* Ensure the read of the valid bit occurs before reading any
    1199     + * other bits of the CRQ entry
    1200     + */
    1201     + rmb();
    1202     } else
    1203     crq = NULL;
    1204     spin_unlock_irqrestore(&queue->lock, flags);
    1205     @@ -203,6 +208,11 @@ static int ibmvscsi_send_crq(struct ibmvscsi_host_data *hostdata,
    1206     {
    1207     struct vio_dev *vdev = to_vio_dev(hostdata->dev);
    1208    
    1209     + /*
    1210     + * Ensure the command buffer is flushed to memory before handing it
    1211     + * over to the VIOS to prevent it from fetching any stale data.
    1212     + */
    1213     + mb();
    1214     return plpar_hcall_norets(H_SEND_CRQ, vdev->unit_address, word1, word2);
    1215     }
    1216    
    1217     @@ -797,7 +807,8 @@ static void purge_requests(struct ibmvscsi_host_data *hostdata, int error_code)
    1218     evt->hostdata->dev);
    1219     if (evt->cmnd_done)
    1220     evt->cmnd_done(evt->cmnd);
    1221     - } else if (evt->done)
    1222     + } else if (evt->done && evt->crq.format != VIOSRP_MAD_FORMAT &&
    1223     + evt->iu.srp.login_req.opcode != SRP_LOGIN_REQ)
    1224     evt->done(evt);
    1225     free_event_struct(&evt->hostdata->pool, evt);
    1226     spin_lock_irqsave(hostdata->host->host_lock, flags);
    1227     diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
    1228     index ef29636d4c9b..edb4d46fa874 100644
    1229     --- a/drivers/scsi/scsi_error.c
    1230     +++ b/drivers/scsi/scsi_error.c
    1231     @@ -131,7 +131,7 @@ scmd_eh_abort_handler(struct work_struct *work)
    1232     "aborting command %p\n", scmd));
    1233     rtn = scsi_try_to_abort_cmd(sdev->host->hostt, scmd);
    1234     if (rtn == SUCCESS) {
    1235     - scmd->result |= DID_TIME_OUT << 16;
    1236     + set_host_byte(scmd, DID_TIME_OUT);
    1237     if (scsi_host_eh_past_deadline(sdev->host)) {
    1238     SCSI_LOG_ERROR_RECOVERY(3,
    1239     scmd_printk(KERN_INFO, scmd,
    1240     @@ -167,7 +167,7 @@ scmd_eh_abort_handler(struct work_struct *work)
    1241     scmd_printk(KERN_WARNING, scmd,
    1242     "scmd %p terminate "
    1243     "aborted command\n", scmd));
    1244     - scmd->result |= DID_TIME_OUT << 16;
    1245     + set_host_byte(scmd, DID_TIME_OUT);
    1246     scsi_finish_command(scmd);
    1247     }
    1248     }
    1249     @@ -290,7 +290,7 @@ enum blk_eh_timer_return scsi_times_out(struct request *req)
    1250     if (scsi_abort_command(scmd) == SUCCESS)
    1251     return BLK_EH_NOT_HANDLED;
    1252    
    1253     - scmd->result |= DID_TIME_OUT << 16;
    1254     + set_host_byte(scmd, DID_TIME_OUT);
    1255    
    1256     if (unlikely(rtn == BLK_EH_NOT_HANDLED &&
    1257     !scsi_eh_scmd_add(scmd, SCSI_EH_CANCEL_CMD)))
    1258     @@ -1773,7 +1773,7 @@ int scsi_decide_disposition(struct scsi_cmnd *scmd)
    1259     break;
    1260     case DID_ABORT:
    1261     if (scmd->eh_eflags & SCSI_EH_ABORT_SCHEDULED) {
    1262     - scmd->result |= DID_TIME_OUT << 16;
    1263     + set_host_byte(scmd, DID_TIME_OUT);
    1264     return SUCCESS;
    1265     }
    1266     case DID_NO_CONNECT:
    1267     diff --git a/drivers/scsi/sym53c8xx_2/sym_hipd.c b/drivers/scsi/sym53c8xx_2/sym_hipd.c
    1268     index d92fe4037e94..6b349e301869 100644
    1269     --- a/drivers/scsi/sym53c8xx_2/sym_hipd.c
    1270     +++ b/drivers/scsi/sym53c8xx_2/sym_hipd.c
    1271     @@ -3000,7 +3000,11 @@ sym_dequeue_from_squeue(struct sym_hcb *np, int i, int target, int lun, int task
    1272     if ((target == -1 || cp->target == target) &&
    1273     (lun == -1 || cp->lun == lun) &&
    1274     (task == -1 || cp->tag == task)) {
    1275     +#ifdef SYM_OPT_HANDLE_DEVICE_QUEUEING
    1276     sym_set_cam_status(cp->cmd, DID_SOFT_ERROR);
    1277     +#else
    1278     + sym_set_cam_status(cp->cmd, DID_REQUEUE);
    1279     +#endif
    1280     sym_remque(&cp->link_ccbq);
    1281     sym_insque_tail(&cp->link_ccbq, &np->comp_ccbq);
    1282     }
    1283     diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
    1284     index db3b494e5926..8490aa411739 100644
    1285     --- a/drivers/scsi/virtio_scsi.c
    1286     +++ b/drivers/scsi/virtio_scsi.c
    1287     @@ -273,6 +273,16 @@ static void virtscsi_req_done(struct virtqueue *vq)
    1288     virtscsi_vq_done(vscsi, req_vq, virtscsi_complete_cmd);
    1289     };
    1290    
    1291     +static void virtscsi_poll_requests(struct virtio_scsi *vscsi)
    1292     +{
    1293     + int i, num_vqs;
    1294     +
    1295     + num_vqs = vscsi->num_queues;
    1296     + for (i = 0; i < num_vqs; i++)
    1297     + virtscsi_vq_done(vscsi, &vscsi->req_vqs[i],
    1298     + virtscsi_complete_cmd);
    1299     +}
    1300     +
    1301     static void virtscsi_complete_free(struct virtio_scsi *vscsi, void *buf)
    1302     {
    1303     struct virtio_scsi_cmd *cmd = buf;
    1304     @@ -291,6 +301,8 @@ static void virtscsi_ctrl_done(struct virtqueue *vq)
    1305     virtscsi_vq_done(vscsi, &vscsi->ctrl_vq, virtscsi_complete_free);
    1306     };
    1307    
    1308     +static void virtscsi_handle_event(struct work_struct *work);
    1309     +
    1310     static int virtscsi_kick_event(struct virtio_scsi *vscsi,
    1311     struct virtio_scsi_event_node *event_node)
    1312     {
    1313     @@ -298,6 +310,7 @@ static int virtscsi_kick_event(struct virtio_scsi *vscsi,
    1314     struct scatterlist sg;
    1315     unsigned long flags;
    1316    
    1317     + INIT_WORK(&event_node->work, virtscsi_handle_event);
    1318     sg_init_one(&sg, &event_node->event, sizeof(struct virtio_scsi_event));
    1319    
    1320     spin_lock_irqsave(&vscsi->event_vq.vq_lock, flags);
    1321     @@ -415,7 +428,6 @@ static void virtscsi_complete_event(struct virtio_scsi *vscsi, void *buf)
    1322     {
    1323     struct virtio_scsi_event_node *event_node = buf;
    1324    
    1325     - INIT_WORK(&event_node->work, virtscsi_handle_event);
    1326     schedule_work(&event_node->work);
    1327     }
    1328    
    1329     @@ -605,6 +617,18 @@ static int virtscsi_tmf(struct virtio_scsi *vscsi, struct virtio_scsi_cmd *cmd)
    1330     cmd->resp.tmf.response == VIRTIO_SCSI_S_FUNCTION_SUCCEEDED)
    1331     ret = SUCCESS;
    1332    
    1333     + /*
    1334     + * The spec guarantees that all requests related to the TMF have
    1335     + * been completed, but the callback might not have run yet if
    1336     + * we're using independent interrupts (e.g. MSI). Poll the
    1337     + * virtqueues once.
    1338     + *
    1339     + * In the abort case, sc->scsi_done will do nothing, because
    1340     + * the block layer must have detected a timeout and as a result
    1341     + * REQ_ATOM_COMPLETE has been set.
    1342     + */
    1343     + virtscsi_poll_requests(vscsi);
    1344     +
    1345     out:
    1346     mempool_free(cmd, virtscsi_cmd_pool);
    1347     return ret;
    1348     diff --git a/drivers/staging/iio/adc/ad7291.c b/drivers/staging/iio/adc/ad7291.c
    1349     index 357cef2a6f4c..7194bd138762 100644
    1350     --- a/drivers/staging/iio/adc/ad7291.c
    1351     +++ b/drivers/staging/iio/adc/ad7291.c
    1352     @@ -465,7 +465,7 @@ static int ad7291_probe(struct i2c_client *client,
    1353     struct ad7291_platform_data *pdata = client->dev.platform_data;
    1354     struct ad7291_chip_info *chip;
    1355     struct iio_dev *indio_dev;
    1356     - int ret = 0;
    1357     + int ret;
    1358    
    1359     indio_dev = devm_iio_device_alloc(&client->dev, sizeof(*chip));
    1360     if (!indio_dev)
    1361     @@ -475,7 +475,7 @@ static int ad7291_probe(struct i2c_client *client,
    1362     if (pdata && pdata->use_external_ref) {
    1363     chip->reg = devm_regulator_get(&client->dev, "vref");
    1364     if (IS_ERR(chip->reg))
    1365     - return ret;
    1366     + return PTR_ERR(chip->reg);
    1367    
    1368     ret = regulator_enable(chip->reg);
    1369     if (ret)
    1370     diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
    1371     index e36d1f5ca191..28ac3f3b7ec3 100644
    1372     --- a/drivers/tty/n_tty.c
    1373     +++ b/drivers/tty/n_tty.c
    1374     @@ -1214,15 +1214,16 @@ static void n_tty_receive_parity_error(struct tty_struct *tty, unsigned char c)
    1375     {
    1376     struct n_tty_data *ldata = tty->disc_data;
    1377    
    1378     - if (I_IGNPAR(tty))
    1379     - return;
    1380     - if (I_PARMRK(tty)) {
    1381     - put_tty_queue('\377', ldata);
    1382     - put_tty_queue('\0', ldata);
    1383     - put_tty_queue(c, ldata);
    1384     - } else if (I_INPCK(tty))
    1385     - put_tty_queue('\0', ldata);
    1386     - else
    1387     + if (I_INPCK(tty)) {
    1388     + if (I_IGNPAR(tty))
    1389     + return;
    1390     + if (I_PARMRK(tty)) {
    1391     + put_tty_queue('\377', ldata);
    1392     + put_tty_queue('\0', ldata);
    1393     + put_tty_queue(c, ldata);
    1394     + } else
    1395     + put_tty_queue('\0', ldata);
    1396     + } else
    1397     put_tty_queue(c, ldata);
    1398     if (waitqueue_active(&tty->read_wait))
    1399     wake_up_interruptible(&tty->read_wait);
    1400     diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
    1401     index 29a7f632b354..612dfc720738 100644
    1402     --- a/drivers/tty/serial/8250/8250_core.c
    1403     +++ b/drivers/tty/serial/8250/8250_core.c
    1404     @@ -2356,7 +2356,7 @@ serial8250_do_set_termios(struct uart_port *port, struct ktermios *termios,
    1405     port->read_status_mask = UART_LSR_OE | UART_LSR_THRE | UART_LSR_DR;
    1406     if (termios->c_iflag & INPCK)
    1407     port->read_status_mask |= UART_LSR_FE | UART_LSR_PE;
    1408     - if (termios->c_iflag & (BRKINT | PARMRK))
    1409     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    1410     port->read_status_mask |= UART_LSR_BI;
    1411    
    1412     /*
    1413     diff --git a/drivers/tty/serial/altera_uart.c b/drivers/tty/serial/altera_uart.c
    1414     index 501667e3e3f5..323376668b72 100644
    1415     --- a/drivers/tty/serial/altera_uart.c
    1416     +++ b/drivers/tty/serial/altera_uart.c
    1417     @@ -185,6 +185,12 @@ static void altera_uart_set_termios(struct uart_port *port,
    1418     uart_update_timeout(port, termios->c_cflag, baud);
    1419     altera_uart_writel(port, baudclk, ALTERA_UART_DIVISOR_REG);
    1420     spin_unlock_irqrestore(&port->lock, flags);
    1421     +
    1422     + /*
    1423     + * FIXME: port->read_status_mask and port->ignore_status_mask
    1424     + * need to be initialized based on termios settings for
    1425     + * INPCK, IGNBRK, IGNPAR, PARMRK, BRKINT
    1426     + */
    1427     }
    1428    
    1429     static void altera_uart_rx_chars(struct altera_uart *pp)
    1430     diff --git a/drivers/tty/serial/amba-pl010.c b/drivers/tty/serial/amba-pl010.c
    1431     index 01c9e72433e1..971af1e22d0f 100644
    1432     --- a/drivers/tty/serial/amba-pl010.c
    1433     +++ b/drivers/tty/serial/amba-pl010.c
    1434     @@ -420,7 +420,7 @@ pl010_set_termios(struct uart_port *port, struct ktermios *termios,
    1435     uap->port.read_status_mask = UART01x_RSR_OE;
    1436     if (termios->c_iflag & INPCK)
    1437     uap->port.read_status_mask |= UART01x_RSR_FE | UART01x_RSR_PE;
    1438     - if (termios->c_iflag & (BRKINT | PARMRK))
    1439     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    1440     uap->port.read_status_mask |= UART01x_RSR_BE;
    1441    
    1442     /*
    1443     diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
    1444     index d58783d364e3..b569011ac713 100644
    1445     --- a/drivers/tty/serial/amba-pl011.c
    1446     +++ b/drivers/tty/serial/amba-pl011.c
    1447     @@ -1744,7 +1744,7 @@ pl011_set_termios(struct uart_port *port, struct ktermios *termios,
    1448     port->read_status_mask = UART011_DR_OE | 255;
    1449     if (termios->c_iflag & INPCK)
    1450     port->read_status_mask |= UART011_DR_FE | UART011_DR_PE;
    1451     - if (termios->c_iflag & (BRKINT | PARMRK))
    1452     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    1453     port->read_status_mask |= UART011_DR_BE;
    1454    
    1455     /*
    1456     diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
    1457     index a49f10d269b2..ce352b81e230 100644
    1458     --- a/drivers/tty/serial/atmel_serial.c
    1459     +++ b/drivers/tty/serial/atmel_serial.c
    1460     @@ -1811,7 +1811,7 @@ static void atmel_set_termios(struct uart_port *port, struct ktermios *termios,
    1461     port->read_status_mask = ATMEL_US_OVRE;
    1462     if (termios->c_iflag & INPCK)
    1463     port->read_status_mask |= (ATMEL_US_FRAME | ATMEL_US_PARE);
    1464     - if (termios->c_iflag & (BRKINT | PARMRK))
    1465     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    1466     port->read_status_mask |= ATMEL_US_RXBRK;
    1467    
    1468     if (atmel_use_pdc_rx(port))
    1469     diff --git a/drivers/tty/serial/bcm63xx_uart.c b/drivers/tty/serial/bcm63xx_uart.c
    1470     index 78e82b017b92..e0b87d507670 100644
    1471     --- a/drivers/tty/serial/bcm63xx_uart.c
    1472     +++ b/drivers/tty/serial/bcm63xx_uart.c
    1473     @@ -565,7 +565,7 @@ static void bcm_uart_set_termios(struct uart_port *port,
    1474     port->read_status_mask |= UART_FIFO_FRAMEERR_MASK;
    1475     port->read_status_mask |= UART_FIFO_PARERR_MASK;
    1476     }
    1477     - if (new->c_iflag & (BRKINT))
    1478     + if (new->c_iflag & (IGNBRK | BRKINT))
    1479     port->read_status_mask |= UART_FIFO_BRKDET_MASK;
    1480    
    1481     port->ignore_status_mask = 0;
    1482     diff --git a/drivers/tty/serial/bfin_uart.c b/drivers/tty/serial/bfin_uart.c
    1483     index 869ceba2ec57..ac86a20992e9 100644
    1484     --- a/drivers/tty/serial/bfin_uart.c
    1485     +++ b/drivers/tty/serial/bfin_uart.c
    1486     @@ -833,7 +833,7 @@ bfin_serial_set_termios(struct uart_port *port, struct ktermios *termios,
    1487     port->read_status_mask = OE;
    1488     if (termios->c_iflag & INPCK)
    1489     port->read_status_mask |= (FE | PE);
    1490     - if (termios->c_iflag & (BRKINT | PARMRK))
    1491     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    1492     port->read_status_mask |= BI;
    1493    
    1494     /*
    1495     diff --git a/drivers/tty/serial/dz.c b/drivers/tty/serial/dz.c
    1496     index 2f2b2e538a54..cdbbc788230a 100644
    1497     --- a/drivers/tty/serial/dz.c
    1498     +++ b/drivers/tty/serial/dz.c
    1499     @@ -625,7 +625,7 @@ static void dz_set_termios(struct uart_port *uport, struct ktermios *termios,
    1500     dport->port.read_status_mask = DZ_OERR;
    1501     if (termios->c_iflag & INPCK)
    1502     dport->port.read_status_mask |= DZ_FERR | DZ_PERR;
    1503     - if (termios->c_iflag & (BRKINT | PARMRK))
    1504     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    1505     dport->port.read_status_mask |= DZ_BREAK;
    1506    
    1507     /* characters to ignore */
    1508     diff --git a/drivers/tty/serial/efm32-uart.c b/drivers/tty/serial/efm32-uart.c
    1509     index 0eb5b5673ede..948f17b6b497 100644
    1510     --- a/drivers/tty/serial/efm32-uart.c
    1511     +++ b/drivers/tty/serial/efm32-uart.c
    1512     @@ -407,7 +407,7 @@ static void efm32_uart_set_termios(struct uart_port *port,
    1513     if (new->c_iflag & INPCK)
    1514     port->read_status_mask |=
    1515     UARTn_RXDATAX_FERR | UARTn_RXDATAX_PERR;
    1516     - if (new->c_iflag & (BRKINT | PARMRK))
    1517     + if (new->c_iflag & (IGNBRK | BRKINT | PARMRK))
    1518     port->read_status_mask |= SW_UARTn_RXDATAX_BERR;
    1519    
    1520     port->ignore_status_mask = 0;
    1521     diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
    1522     index 8978dc9a58b7..175f123f4f09 100644
    1523     --- a/drivers/tty/serial/fsl_lpuart.c
    1524     +++ b/drivers/tty/serial/fsl_lpuart.c
    1525     @@ -496,7 +496,7 @@ lpuart_set_termios(struct uart_port *port, struct ktermios *termios,
    1526     sport->port.read_status_mask = 0;
    1527     if (termios->c_iflag & INPCK)
    1528     sport->port.read_status_mask |= (UARTSR1_FE | UARTSR1_PE);
    1529     - if (termios->c_iflag & (BRKINT | PARMRK))
    1530     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    1531     sport->port.read_status_mask |= UARTSR1_FE;
    1532    
    1533     /* characters to ignore */
    1534     diff --git a/drivers/tty/serial/ip22zilog.c b/drivers/tty/serial/ip22zilog.c
    1535     index 1d9420548e16..1efd4c36ba0c 100644
    1536     --- a/drivers/tty/serial/ip22zilog.c
    1537     +++ b/drivers/tty/serial/ip22zilog.c
    1538     @@ -850,7 +850,7 @@ ip22zilog_convert_to_zs(struct uart_ip22zilog_port *up, unsigned int cflag,
    1539     up->port.read_status_mask = Rx_OVR;
    1540     if (iflag & INPCK)
    1541     up->port.read_status_mask |= CRC_ERR | PAR_ERR;
    1542     - if (iflag & (BRKINT | PARMRK))
    1543     + if (iflag & (IGNBRK | BRKINT | PARMRK))
    1544     up->port.read_status_mask |= BRK_ABRT;
    1545    
    1546     up->port.ignore_status_mask = 0;
    1547     diff --git a/drivers/tty/serial/m32r_sio.c b/drivers/tty/serial/m32r_sio.c
    1548     index 9cd9b4eba9fc..68f2c53e0b54 100644
    1549     --- a/drivers/tty/serial/m32r_sio.c
    1550     +++ b/drivers/tty/serial/m32r_sio.c
    1551     @@ -737,7 +737,7 @@ static void m32r_sio_set_termios(struct uart_port *port,
    1552     up->port.read_status_mask = UART_LSR_OE | UART_LSR_THRE | UART_LSR_DR;
    1553     if (termios->c_iflag & INPCK)
    1554     up->port.read_status_mask |= UART_LSR_FE | UART_LSR_PE;
    1555     - if (termios->c_iflag & (BRKINT | PARMRK))
    1556     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    1557     up->port.read_status_mask |= UART_LSR_BI;
    1558    
    1559     /*
    1560     diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c
    1561     index 8d71e4047bb3..558af637cd0c 100644
    1562     --- a/drivers/tty/serial/max310x.c
    1563     +++ b/drivers/tty/serial/max310x.c
    1564     @@ -842,7 +842,7 @@ static void max310x_set_termios(struct uart_port *port,
    1565     if (termios->c_iflag & INPCK)
    1566     port->read_status_mask |= MAX310X_LSR_RXPAR_BIT |
    1567     MAX310X_LSR_FRERR_BIT;
    1568     - if (termios->c_iflag & (BRKINT | PARMRK))
    1569     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    1570     port->read_status_mask |= MAX310X_LSR_RXBRK_BIT;
    1571    
    1572     /* Set status ignore mask */
    1573     diff --git a/drivers/tty/serial/mcf.c b/drivers/tty/serial/mcf.c
    1574     index 0edfaf8cd269..a6f085717f94 100644
    1575     --- a/drivers/tty/serial/mcf.c
    1576     +++ b/drivers/tty/serial/mcf.c
    1577     @@ -248,6 +248,12 @@ static void mcf_set_termios(struct uart_port *port, struct ktermios *termios,
    1578     mr1 |= MCFUART_MR1_PARITYNONE;
    1579     }
    1580    
    1581     + /*
    1582     + * FIXME: port->read_status_mask and port->ignore_status_mask
    1583     + * need to be initialized based on termios settings for
    1584     + * INPCK, IGNBRK, IGNPAR, PARMRK, BRKINT
    1585     + */
    1586     +
    1587     if (termios->c_cflag & CSTOPB)
    1588     mr2 |= MCFUART_MR2_STOP2;
    1589     else
    1590     diff --git a/drivers/tty/serial/mfd.c b/drivers/tty/serial/mfd.c
    1591     index 52c930fac210..445799dc9846 100644
    1592     --- a/drivers/tty/serial/mfd.c
    1593     +++ b/drivers/tty/serial/mfd.c
    1594     @@ -977,7 +977,7 @@ serial_hsu_set_termios(struct uart_port *port, struct ktermios *termios,
    1595     up->port.read_status_mask = UART_LSR_OE | UART_LSR_THRE | UART_LSR_DR;
    1596     if (termios->c_iflag & INPCK)
    1597     up->port.read_status_mask |= UART_LSR_FE | UART_LSR_PE;
    1598     - if (termios->c_iflag & (BRKINT | PARMRK))
    1599     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    1600     up->port.read_status_mask |= UART_LSR_BI;
    1601    
    1602     /* Characters to ignore */
    1603     diff --git a/drivers/tty/serial/mpsc.c b/drivers/tty/serial/mpsc.c
    1604     index e30a3ca3cea3..759c6a6fa74a 100644
    1605     --- a/drivers/tty/serial/mpsc.c
    1606     +++ b/drivers/tty/serial/mpsc.c
    1607     @@ -1458,7 +1458,7 @@ static void mpsc_set_termios(struct uart_port *port, struct ktermios *termios,
    1608     pi->port.read_status_mask |= SDMA_DESC_CMDSTAT_PE
    1609     | SDMA_DESC_CMDSTAT_FR;
    1610    
    1611     - if (termios->c_iflag & (BRKINT | PARMRK))
    1612     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    1613     pi->port.read_status_mask |= SDMA_DESC_CMDSTAT_BR;
    1614    
    1615     /* Characters/events to ignore */
    1616     diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c
    1617     index b5d779cd3c2b..c0f2b3e5452f 100644
    1618     --- a/drivers/tty/serial/msm_serial.c
    1619     +++ b/drivers/tty/serial/msm_serial.c
    1620     @@ -570,7 +570,7 @@ static void msm_set_termios(struct uart_port *port, struct ktermios *termios,
    1621     port->read_status_mask = 0;
    1622     if (termios->c_iflag & INPCK)
    1623     port->read_status_mask |= UART_SR_PAR_FRAME_ERR;
    1624     - if (termios->c_iflag & (BRKINT | PARMRK))
    1625     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    1626     port->read_status_mask |= UART_SR_RX_BREAK;
    1627    
    1628     uart_update_timeout(port, termios->c_cflag, baud);
    1629     diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c
    1630     index aa97fd845b4d..d98f1d4a9bd3 100644
    1631     --- a/drivers/tty/serial/mxs-auart.c
    1632     +++ b/drivers/tty/serial/mxs-auart.c
    1633     @@ -604,7 +604,7 @@ static void mxs_auart_settermios(struct uart_port *u,
    1634    
    1635     if (termios->c_iflag & INPCK)
    1636     u->read_status_mask |= AUART_STAT_PERR;
    1637     - if (termios->c_iflag & (BRKINT | PARMRK))
    1638     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    1639     u->read_status_mask |= AUART_STAT_BERR;
    1640    
    1641     /*
    1642     diff --git a/drivers/tty/serial/netx-serial.c b/drivers/tty/serial/netx-serial.c
    1643     index 0a4dd70d29eb..7a6745601d4e 100644
    1644     --- a/drivers/tty/serial/netx-serial.c
    1645     +++ b/drivers/tty/serial/netx-serial.c
    1646     @@ -419,7 +419,7 @@ netx_set_termios(struct uart_port *port, struct ktermios *termios,
    1647     }
    1648    
    1649     port->read_status_mask = 0;
    1650     - if (termios->c_iflag & (BRKINT | PARMRK))
    1651     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    1652     port->read_status_mask |= SR_BE;
    1653     if (termios->c_iflag & INPCK)
    1654     port->read_status_mask |= SR_PE | SR_FE;
    1655     diff --git a/drivers/tty/serial/pmac_zilog.c b/drivers/tty/serial/pmac_zilog.c
    1656     index e9d420ff3931..8193635103ee 100644
    1657     --- a/drivers/tty/serial/pmac_zilog.c
    1658     +++ b/drivers/tty/serial/pmac_zilog.c
    1659     @@ -1092,7 +1092,7 @@ static void pmz_convert_to_zs(struct uart_pmac_port *uap, unsigned int cflag,
    1660     uap->port.read_status_mask = Rx_OVR;
    1661     if (iflag & INPCK)
    1662     uap->port.read_status_mask |= CRC_ERR | PAR_ERR;
    1663     - if (iflag & (BRKINT | PARMRK))
    1664     + if (iflag & (IGNBRK | BRKINT | PARMRK))
    1665     uap->port.read_status_mask |= BRK_ABRT;
    1666    
    1667     uap->port.ignore_status_mask = 0;
    1668     diff --git a/drivers/tty/serial/pnx8xxx_uart.c b/drivers/tty/serial/pnx8xxx_uart.c
    1669     index de6c05c63683..2ba24a45c97f 100644
    1670     --- a/drivers/tty/serial/pnx8xxx_uart.c
    1671     +++ b/drivers/tty/serial/pnx8xxx_uart.c
    1672     @@ -477,7 +477,7 @@ pnx8xxx_set_termios(struct uart_port *port, struct ktermios *termios,
    1673     sport->port.read_status_mask |=
    1674     FIFO_TO_SM(PNX8XXX_UART_FIFO_RXFE) |
    1675     FIFO_TO_SM(PNX8XXX_UART_FIFO_RXPAR);
    1676     - if (termios->c_iflag & (BRKINT | PARMRK))
    1677     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    1678     sport->port.read_status_mask |=
    1679     ISTAT_TO_SM(PNX8XXX_UART_INT_BREAK);
    1680    
    1681     diff --git a/drivers/tty/serial/pxa.c b/drivers/tty/serial/pxa.c
    1682     index f9f20f383760..fc3f308cd6c1 100644
    1683     --- a/drivers/tty/serial/pxa.c
    1684     +++ b/drivers/tty/serial/pxa.c
    1685     @@ -492,7 +492,7 @@ serial_pxa_set_termios(struct uart_port *port, struct ktermios *termios,
    1686     up->port.read_status_mask = UART_LSR_OE | UART_LSR_THRE | UART_LSR_DR;
    1687     if (termios->c_iflag & INPCK)
    1688     up->port.read_status_mask |= UART_LSR_FE | UART_LSR_PE;
    1689     - if (termios->c_iflag & (BRKINT | PARMRK))
    1690     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    1691     up->port.read_status_mask |= UART_LSR_BI;
    1692    
    1693     /*
    1694     diff --git a/drivers/tty/serial/sb1250-duart.c b/drivers/tty/serial/sb1250-duart.c
    1695     index a7cdec2962dd..771f361c47ea 100644
    1696     --- a/drivers/tty/serial/sb1250-duart.c
    1697     +++ b/drivers/tty/serial/sb1250-duart.c
    1698     @@ -596,7 +596,7 @@ static void sbd_set_termios(struct uart_port *uport, struct ktermios *termios,
    1699     if (termios->c_iflag & INPCK)
    1700     uport->read_status_mask |= M_DUART_FRM_ERR |
    1701     M_DUART_PARITY_ERR;
    1702     - if (termios->c_iflag & (BRKINT | PARMRK))
    1703     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    1704     uport->read_status_mask |= M_DUART_RCVD_BRK;
    1705    
    1706     uport->ignore_status_mask = 0;
    1707     diff --git a/drivers/tty/serial/sccnxp.c b/drivers/tty/serial/sccnxp.c
    1708     index a447f71538ef..75ea83278ba4 100644
    1709     --- a/drivers/tty/serial/sccnxp.c
    1710     +++ b/drivers/tty/serial/sccnxp.c
    1711     @@ -667,7 +667,7 @@ static void sccnxp_set_termios(struct uart_port *port,
    1712     port->read_status_mask = SR_OVR;
    1713     if (termios->c_iflag & INPCK)
    1714     port->read_status_mask |= SR_PE | SR_FE;
    1715     - if (termios->c_iflag & (BRKINT | PARMRK))
    1716     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    1717     port->read_status_mask |= SR_BRK;
    1718    
    1719     /* Set status ignore mask */
    1720     diff --git a/drivers/tty/serial/serial_ks8695.c b/drivers/tty/serial/serial_ks8695.c
    1721     index e1caa99e3d3b..5c79bdab985d 100644
    1722     --- a/drivers/tty/serial/serial_ks8695.c
    1723     +++ b/drivers/tty/serial/serial_ks8695.c
    1724     @@ -437,7 +437,7 @@ static void ks8695uart_set_termios(struct uart_port *port, struct ktermios *term
    1725     port->read_status_mask = URLS_URROE;
    1726     if (termios->c_iflag & INPCK)
    1727     port->read_status_mask |= (URLS_URFE | URLS_URPE);
    1728     - if (termios->c_iflag & (BRKINT | PARMRK))
    1729     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    1730     port->read_status_mask |= URLS_URBI;
    1731    
    1732     /*
    1733     diff --git a/drivers/tty/serial/serial_txx9.c b/drivers/tty/serial/serial_txx9.c
    1734     index 90a080b1f9ee..cbf501da5df3 100644
    1735     --- a/drivers/tty/serial/serial_txx9.c
    1736     +++ b/drivers/tty/serial/serial_txx9.c
    1737     @@ -702,7 +702,7 @@ serial_txx9_set_termios(struct uart_port *port, struct ktermios *termios,
    1738     TXX9_SIDISR_TDIS | TXX9_SIDISR_RDIS;
    1739     if (termios->c_iflag & INPCK)
    1740     up->port.read_status_mask |= TXX9_SIDISR_UFER | TXX9_SIDISR_UPER;
    1741     - if (termios->c_iflag & (BRKINT | PARMRK))
    1742     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    1743     up->port.read_status_mask |= TXX9_SIDISR_UBRK;
    1744    
    1745     /*
    1746     diff --git a/drivers/tty/serial/sirfsoc_uart.c b/drivers/tty/serial/sirfsoc_uart.c
    1747     index b7bfe24d4ebc..020fe220d0e9 100644
    1748     --- a/drivers/tty/serial/sirfsoc_uart.c
    1749     +++ b/drivers/tty/serial/sirfsoc_uart.c
    1750     @@ -908,7 +908,7 @@ static void sirfsoc_uart_set_termios(struct uart_port *port,
    1751     if (termios->c_iflag & INPCK)
    1752     port->read_status_mask |= uint_en->sirfsoc_frm_err_en;
    1753     }
    1754     - if (termios->c_iflag & (BRKINT | PARMRK))
    1755     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    1756     port->read_status_mask |= uint_en->sirfsoc_rxd_brk_en;
    1757     if (sirfport->uart_reg->uart_type == SIRF_REAL_UART) {
    1758     if (termios->c_iflag & IGNPAR)
    1759     diff --git a/drivers/tty/serial/st-asc.c b/drivers/tty/serial/st-asc.c
    1760     index 21e6e84c0df8..0ee31755cb5a 100644
    1761     --- a/drivers/tty/serial/st-asc.c
    1762     +++ b/drivers/tty/serial/st-asc.c
    1763     @@ -547,7 +547,7 @@ static void asc_set_termios(struct uart_port *port, struct ktermios *termios,
    1764     ascport->port.read_status_mask = ASC_RXBUF_DUMMY_OE;
    1765     if (termios->c_iflag & INPCK)
    1766     ascport->port.read_status_mask |= ASC_RXBUF_FE | ASC_RXBUF_PE;
    1767     - if (termios->c_iflag & (BRKINT | PARMRK))
    1768     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    1769     ascport->port.read_status_mask |= ASC_RXBUF_DUMMY_BE;
    1770    
    1771     /*
    1772     diff --git a/drivers/tty/serial/sunsab.c b/drivers/tty/serial/sunsab.c
    1773     index 5faa8e905e98..80a58eca785b 100644
    1774     --- a/drivers/tty/serial/sunsab.c
    1775     +++ b/drivers/tty/serial/sunsab.c
    1776     @@ -719,7 +719,7 @@ static void sunsab_convert_to_sab(struct uart_sunsab_port *up, unsigned int cfla
    1777     if (iflag & INPCK)
    1778     up->port.read_status_mask |= (SAB82532_ISR0_PERR |
    1779     SAB82532_ISR0_FERR);
    1780     - if (iflag & (BRKINT | PARMRK))
    1781     + if (iflag & (IGNBRK | BRKINT | PARMRK))
    1782     up->port.read_status_mask |= (SAB82532_ISR1_BRK << 8);
    1783    
    1784     /*
    1785     diff --git a/drivers/tty/serial/sunsu.c b/drivers/tty/serial/sunsu.c
    1786     index 9a0f24f83720..5326ae195e5f 100644
    1787     --- a/drivers/tty/serial/sunsu.c
    1788     +++ b/drivers/tty/serial/sunsu.c
    1789     @@ -834,7 +834,7 @@ sunsu_change_speed(struct uart_port *port, unsigned int cflag,
    1790     up->port.read_status_mask = UART_LSR_OE | UART_LSR_THRE | UART_LSR_DR;
    1791     if (iflag & INPCK)
    1792     up->port.read_status_mask |= UART_LSR_FE | UART_LSR_PE;
    1793     - if (iflag & (BRKINT | PARMRK))
    1794     + if (iflag & (IGNBRK | BRKINT | PARMRK))
    1795     up->port.read_status_mask |= UART_LSR_BI;
    1796    
    1797     /*
    1798     diff --git a/drivers/tty/serial/sunzilog.c b/drivers/tty/serial/sunzilog.c
    1799     index a2c40ed287d2..a85db8b87156 100644
    1800     --- a/drivers/tty/serial/sunzilog.c
    1801     +++ b/drivers/tty/serial/sunzilog.c
    1802     @@ -915,7 +915,7 @@ sunzilog_convert_to_zs(struct uart_sunzilog_port *up, unsigned int cflag,
    1803     up->port.read_status_mask = Rx_OVR;
    1804     if (iflag & INPCK)
    1805     up->port.read_status_mask |= CRC_ERR | PAR_ERR;
    1806     - if (iflag & (BRKINT | PARMRK))
    1807     + if (iflag & (IGNBRK | BRKINT | PARMRK))
    1808     up->port.read_status_mask |= BRK_ABRT;
    1809    
    1810     up->port.ignore_status_mask = 0;
    1811     diff --git a/drivers/tty/serial/ucc_uart.c b/drivers/tty/serial/ucc_uart.c
    1812     index d569ca58bab6..1c52074c38df 100644
    1813     --- a/drivers/tty/serial/ucc_uart.c
    1814     +++ b/drivers/tty/serial/ucc_uart.c
    1815     @@ -936,7 +936,7 @@ static void qe_uart_set_termios(struct uart_port *port,
    1816     port->read_status_mask = BD_SC_EMPTY | BD_SC_OV;
    1817     if (termios->c_iflag & INPCK)
    1818     port->read_status_mask |= BD_SC_FR | BD_SC_PR;
    1819     - if (termios->c_iflag & (BRKINT | PARMRK))
    1820     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    1821     port->read_status_mask |= BD_SC_BR;
    1822    
    1823     /*
    1824     diff --git a/drivers/tty/serial/vr41xx_siu.c b/drivers/tty/serial/vr41xx_siu.c
    1825     index a63c14bc9a24..db0c8a4ab03e 100644
    1826     --- a/drivers/tty/serial/vr41xx_siu.c
    1827     +++ b/drivers/tty/serial/vr41xx_siu.c
    1828     @@ -559,7 +559,7 @@ static void siu_set_termios(struct uart_port *port, struct ktermios *new,
    1829     port->read_status_mask = UART_LSR_THRE | UART_LSR_OE | UART_LSR_DR;
    1830     if (c_iflag & INPCK)
    1831     port->read_status_mask |= UART_LSR_FE | UART_LSR_PE;
    1832     - if (c_iflag & (BRKINT | PARMRK))
    1833     + if (c_iflag & (IGNBRK | BRKINT | PARMRK))
    1834     port->read_status_mask |= UART_LSR_BI;
    1835    
    1836     port->ignore_status_mask = 0;
    1837     diff --git a/drivers/tty/serial/zs.c b/drivers/tty/serial/zs.c
    1838     index 6a169877109b..2b65bb7ffb8a 100644
    1839     --- a/drivers/tty/serial/zs.c
    1840     +++ b/drivers/tty/serial/zs.c
    1841     @@ -923,7 +923,7 @@ static void zs_set_termios(struct uart_port *uport, struct ktermios *termios,
    1842     uport->read_status_mask = Rx_OVR;
    1843     if (termios->c_iflag & INPCK)
    1844     uport->read_status_mask |= FRM_ERR | PAR_ERR;
    1845     - if (termios->c_iflag & (BRKINT | PARMRK))
    1846     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    1847     uport->read_status_mask |= Rx_BRK;
    1848    
    1849     uport->ignore_status_mask = 0;
    1850     diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
    1851     index 4ab2cb62dfce..3314516018c6 100644
    1852     --- a/drivers/usb/chipidea/udc.c
    1853     +++ b/drivers/usb/chipidea/udc.c
    1854     @@ -1326,6 +1326,7 @@ static int ep_dequeue(struct usb_ep *ep, struct usb_request *req)
    1855     struct ci_hw_ep *hwep = container_of(ep, struct ci_hw_ep, ep);
    1856     struct ci_hw_req *hwreq = container_of(req, struct ci_hw_req, req);
    1857     unsigned long flags;
    1858     + struct td_node *node, *tmpnode;
    1859    
    1860     if (ep == NULL || req == NULL || hwreq->req.status != -EALREADY ||
    1861     hwep->ep.desc == NULL || list_empty(&hwreq->queue) ||
    1862     @@ -1336,6 +1337,12 @@ static int ep_dequeue(struct usb_ep *ep, struct usb_request *req)
    1863    
    1864     hw_ep_flush(hwep->ci, hwep->num, hwep->dir);
    1865    
    1866     + list_for_each_entry_safe(node, tmpnode, &hwreq->tds, td) {
    1867     + dma_pool_free(hwep->td_pool, node->ptr, node->dma);
    1868     + list_del(&node->td);
    1869     + kfree(node);
    1870     + }
    1871     +
    1872     /* pop request */
    1873     list_del_init(&hwreq->queue);
    1874    
    1875     diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c
    1876     index 2b4334394076..5bcf7d001259 100644
    1877     --- a/drivers/usb/gadget/f_fs.c
    1878     +++ b/drivers/usb/gadget/f_fs.c
    1879     @@ -1227,11 +1227,13 @@ static int functionfs_bind(struct ffs_data *ffs, struct usb_composite_dev *cdev)
    1880     ffs->ep0req->context = ffs;
    1881    
    1882     lang = ffs->stringtabs;
    1883     - for (lang = ffs->stringtabs; *lang; ++lang) {
    1884     - struct usb_string *str = (*lang)->strings;
    1885     - int id = first_id;
    1886     - for (; str->s; ++id, ++str)
    1887     - str->id = id;
    1888     + if (lang) {
    1889     + for (; *lang; ++lang) {
    1890     + struct usb_string *str = (*lang)->strings;
    1891     + int id = first_id;
    1892     + for (; str->s; ++id, ++str)
    1893     + str->id = id;
    1894     + }
    1895     }
    1896    
    1897     ffs->gadget = cdev->gadget;
    1898     diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
    1899     index dff9b5ead3b3..65091d9aa997 100644
    1900     --- a/drivers/usb/host/xhci-ring.c
    1901     +++ b/drivers/usb/host/xhci-ring.c
    1902     @@ -1578,8 +1578,11 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
    1903     xhci_handle_cmd_reset_ep(xhci, slot_id, cmd_trb, cmd_comp_code);
    1904     break;
    1905     case TRB_RESET_DEV:
    1906     - WARN_ON(slot_id != TRB_TO_SLOT_ID(
    1907     - le32_to_cpu(cmd_trb->generic.field[3])));
    1908     + /* SLOT_ID field in reset device cmd completion event TRB is 0.
    1909     + * Use the SLOT_ID from the command TRB instead (xhci 4.6.11)
    1910     + */
    1911     + slot_id = TRB_TO_SLOT_ID(
    1912     + le32_to_cpu(cmd_trb->generic.field[3]));
    1913     xhci_handle_cmd_reset_dev(xhci, slot_id, event);
    1914     break;
    1915     case TRB_NEC_GET_FW:
    1916     @@ -3663,7 +3666,7 @@ static unsigned int xhci_get_burst_count(struct xhci_hcd *xhci,
    1917     return 0;
    1918    
    1919     max_burst = urb->ep->ss_ep_comp.bMaxBurst;
    1920     - return roundup(total_packet_count, max_burst + 1) - 1;
    1921     + return DIV_ROUND_UP(total_packet_count, max_burst + 1) - 1;
    1922     }
    1923    
    1924     /*
    1925     diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
    1926     index cca289667cf6..ab831048e8a4 100644
    1927     --- a/drivers/usb/host/xhci.c
    1928     +++ b/drivers/usb/host/xhci.c
    1929     @@ -928,7 +928,7 @@ int xhci_suspend(struct xhci_hcd *xhci)
    1930     */
    1931     int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
    1932     {
    1933     - u32 command, temp = 0;
    1934     + u32 command, temp = 0, status;
    1935     struct usb_hcd *hcd = xhci_to_hcd(xhci);
    1936     struct usb_hcd *secondary_hcd;
    1937     int retval = 0;
    1938     @@ -1046,8 +1046,12 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
    1939    
    1940     done:
    1941     if (retval == 0) {
    1942     - usb_hcd_resume_root_hub(hcd);
    1943     - usb_hcd_resume_root_hub(xhci->shared_hcd);
    1944     + /* Resume root hubs only when have pending events. */
    1945     + status = readl(&xhci->op_regs->status);
    1946     + if (status & STS_EINT) {
    1947     + usb_hcd_resume_root_hub(hcd);
    1948     + usb_hcd_resume_root_hub(xhci->shared_hcd);
    1949     + }
    1950     }
    1951    
    1952     /*
    1953     diff --git a/drivers/usb/musb/musb_am335x.c b/drivers/usb/musb/musb_am335x.c
    1954     index d2353781bd2d..1e58ed2361cc 100644
    1955     --- a/drivers/usb/musb/musb_am335x.c
    1956     +++ b/drivers/usb/musb/musb_am335x.c
    1957     @@ -19,21 +19,6 @@ err:
    1958     return ret;
    1959     }
    1960    
    1961     -static int of_remove_populated_child(struct device *dev, void *d)
    1962     -{
    1963     - struct platform_device *pdev = to_platform_device(dev);
    1964     -
    1965     - of_device_unregister(pdev);
    1966     - return 0;
    1967     -}
    1968     -
    1969     -static int am335x_child_remove(struct platform_device *pdev)
    1970     -{
    1971     - device_for_each_child(&pdev->dev, NULL, of_remove_populated_child);
    1972     - pm_runtime_disable(&pdev->dev);
    1973     - return 0;
    1974     -}
    1975     -
    1976     static const struct of_device_id am335x_child_of_match[] = {
    1977     { .compatible = "ti,am33xx-usb" },
    1978     { },
    1979     @@ -42,13 +27,17 @@ MODULE_DEVICE_TABLE(of, am335x_child_of_match);
    1980    
    1981     static struct platform_driver am335x_child_driver = {
    1982     .probe = am335x_child_probe,
    1983     - .remove = am335x_child_remove,
    1984     .driver = {
    1985     .name = "am335x-usb-childs",
    1986     .of_match_table = am335x_child_of_match,
    1987     },
    1988     };
    1989    
    1990     -module_platform_driver(am335x_child_driver);
    1991     +static int __init am335x_child_init(void)
    1992     +{
    1993     + return platform_driver_register(&am335x_child_driver);
    1994     +}
    1995     +module_init(am335x_child_init);
    1996     +
    1997     MODULE_DESCRIPTION("AM33xx child devices");
    1998     MODULE_LICENSE("GPL v2");
    1999     diff --git a/drivers/usb/musb/musb_cppi41.c b/drivers/usb/musb/musb_cppi41.c
    2000     index f88929609bac..c2d5afc57e22 100644
    2001     --- a/drivers/usb/musb/musb_cppi41.c
    2002     +++ b/drivers/usb/musb/musb_cppi41.c
    2003     @@ -266,7 +266,7 @@ static void cppi41_dma_callback(void *private_data)
    2004     }
    2005     list_add_tail(&cppi41_channel->tx_check,
    2006     &controller->early_tx_list);
    2007     - if (!hrtimer_active(&controller->early_tx)) {
    2008     + if (!hrtimer_is_queued(&controller->early_tx)) {
    2009     hrtimer_start_range_ns(&controller->early_tx,
    2010     ktime_set(0, 140 * NSEC_PER_USEC),
    2011     40 * NSEC_PER_USEC,
    2012     diff --git a/drivers/usb/musb/ux500.c b/drivers/usb/musb/ux500.c
    2013     index c2e45e632723..f202e5088461 100644
    2014     --- a/drivers/usb/musb/ux500.c
    2015     +++ b/drivers/usb/musb/ux500.c
    2016     @@ -274,7 +274,6 @@ static int ux500_probe(struct platform_device *pdev)
    2017     musb->dev.parent = &pdev->dev;
    2018     musb->dev.dma_mask = &pdev->dev.coherent_dma_mask;
    2019     musb->dev.coherent_dma_mask = pdev->dev.coherent_dma_mask;
    2020     - musb->dev.of_node = pdev->dev.of_node;
    2021    
    2022     glue->dev = &pdev->dev;
    2023     glue->musb = musb;
    2024     diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
    2025     index edf3b124583c..115662c16dcc 100644
    2026     --- a/drivers/usb/serial/ftdi_sio.c
    2027     +++ b/drivers/usb/serial/ftdi_sio.c
    2028     @@ -1566,14 +1566,17 @@ static void ftdi_set_max_packet_size(struct usb_serial_port *port)
    2029     struct usb_device *udev = serial->dev;
    2030    
    2031     struct usb_interface *interface = serial->interface;
    2032     - struct usb_endpoint_descriptor *ep_desc = &interface->cur_altsetting->endpoint[1].desc;
    2033     + struct usb_endpoint_descriptor *ep_desc;
    2034    
    2035     unsigned num_endpoints;
    2036     - int i;
    2037     + unsigned i;
    2038    
    2039     num_endpoints = interface->cur_altsetting->desc.bNumEndpoints;
    2040     dev_info(&udev->dev, "Number of endpoints %d\n", num_endpoints);
    2041    
    2042     + if (!num_endpoints)
    2043     + return;
    2044     +
    2045     /* NOTE: some customers have programmed FT232R/FT245R devices
    2046     * with an endpoint size of 0 - not good. In this case, we
    2047     * want to override the endpoint descriptor setting and use a
    2048     diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
    2049     index 70ede84f4f6b..e25e8ca09fe2 100644
    2050     --- a/drivers/usb/serial/option.c
    2051     +++ b/drivers/usb/serial/option.c
    2052     @@ -352,6 +352,9 @@ static void option_instat_callback(struct urb *urb);
    2053     /* Zoom */
    2054     #define ZOOM_PRODUCT_4597 0x9607
    2055    
    2056     +/* SpeedUp SU9800 usb 3g modem */
    2057     +#define SPEEDUP_PRODUCT_SU9800 0x9800
    2058     +
    2059     /* Haier products */
    2060     #define HAIER_VENDOR_ID 0x201e
    2061     #define HAIER_PRODUCT_CE100 0x2009
    2062     @@ -372,8 +375,12 @@ static void option_instat_callback(struct urb *urb);
    2063     /* Olivetti products */
    2064     #define OLIVETTI_VENDOR_ID 0x0b3c
    2065     #define OLIVETTI_PRODUCT_OLICARD100 0xc000
    2066     +#define OLIVETTI_PRODUCT_OLICARD120 0xc001
    2067     +#define OLIVETTI_PRODUCT_OLICARD140 0xc002
    2068     #define OLIVETTI_PRODUCT_OLICARD145 0xc003
    2069     +#define OLIVETTI_PRODUCT_OLICARD155 0xc004
    2070     #define OLIVETTI_PRODUCT_OLICARD200 0xc005
    2071     +#define OLIVETTI_PRODUCT_OLICARD160 0xc00a
    2072     #define OLIVETTI_PRODUCT_OLICARD500 0xc00b
    2073    
    2074     /* Celot products */
    2075     @@ -1577,6 +1584,7 @@ static const struct usb_device_id option_ids[] = {
    2076     { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14),
    2077     .driver_info = (kernel_ulong_t)&four_g_w14_blacklist
    2078     },
    2079     + { USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, SPEEDUP_PRODUCT_SU9800, 0xff) },
    2080     { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) },
    2081     { USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) },
    2082     { USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) },
    2083     @@ -1611,15 +1619,21 @@ static const struct usb_device_id option_ids[] = {
    2084     { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDMNET) },
    2085     { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, /* HC28 enumerates with Siemens or Cinterion VID depending on FW revision */
    2086     { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) },
    2087     -
    2088     - { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) },
    2089     + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100),
    2090     + .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    2091     + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD120),
    2092     + .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    2093     + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD140),
    2094     + .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    2095     { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD145) },
    2096     + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD155),
    2097     + .driver_info = (kernel_ulong_t)&net_intf6_blacklist },
    2098     { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD200),
    2099     - .driver_info = (kernel_ulong_t)&net_intf6_blacklist
    2100     - },
    2101     + .driver_info = (kernel_ulong_t)&net_intf6_blacklist },
    2102     + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD160),
    2103     + .driver_info = (kernel_ulong_t)&net_intf6_blacklist },
    2104     { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD500),
    2105     - .driver_info = (kernel_ulong_t)&net_intf4_blacklist
    2106     - },
    2107     + .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    2108     { USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */
    2109     { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/
    2110     { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM600) },
    2111     diff --git a/drivers/video/fb-puv3.c b/drivers/video/fb-puv3.c
    2112     index 6db9ebd042a3..88fa2e70a0bb 100644
    2113     --- a/drivers/video/fb-puv3.c
    2114     +++ b/drivers/video/fb-puv3.c
    2115     @@ -18,8 +18,10 @@
    2116     #include <linux/fb.h>
    2117     #include <linux/init.h>
    2118     #include <linux/console.h>
    2119     +#include <linux/mm.h>
    2120    
    2121     #include <asm/sizes.h>
    2122     +#include <asm/pgtable.h>
    2123     #include <mach/hardware.h>
    2124    
    2125     /* Platform_data reserved for unifb registers. */
    2126     diff --git a/fs/aio.c b/fs/aio.c
    2127     index 19e7d9530dbe..e609e15f36b9 100644
    2128     --- a/fs/aio.c
    2129     +++ b/fs/aio.c
    2130     @@ -112,6 +112,11 @@ struct kioctx {
    2131    
    2132     struct work_struct free_work;
    2133    
    2134     + /*
    2135     + * signals when all in-flight requests are done
    2136     + */
    2137     + struct completion *requests_done;
    2138     +
    2139     struct {
    2140     /*
    2141     * This counts the number of available slots in the ringbuffer,
    2142     @@ -508,6 +513,10 @@ static void free_ioctx_reqs(struct percpu_ref *ref)
    2143     {
    2144     struct kioctx *ctx = container_of(ref, struct kioctx, reqs);
    2145    
    2146     + /* At this point we know that there are no any in-flight requests */
    2147     + if (ctx->requests_done)
    2148     + complete(ctx->requests_done);
    2149     +
    2150     INIT_WORK(&ctx->free_work, free_ioctx);
    2151     schedule_work(&ctx->free_work);
    2152     }
    2153     @@ -718,7 +727,8 @@ err:
    2154     * when the processes owning a context have all exited to encourage
    2155     * the rapid destruction of the kioctx.
    2156     */
    2157     -static void kill_ioctx(struct mm_struct *mm, struct kioctx *ctx)
    2158     +static void kill_ioctx(struct mm_struct *mm, struct kioctx *ctx,
    2159     + struct completion *requests_done)
    2160     {
    2161     if (!atomic_xchg(&ctx->dead, 1)) {
    2162     struct kioctx_table *table;
    2163     @@ -747,7 +757,11 @@ static void kill_ioctx(struct mm_struct *mm, struct kioctx *ctx)
    2164     if (ctx->mmap_size)
    2165     vm_munmap(ctx->mmap_base, ctx->mmap_size);
    2166    
    2167     + ctx->requests_done = requests_done;
    2168     percpu_ref_kill(&ctx->users);
    2169     + } else {
    2170     + if (requests_done)
    2171     + complete(requests_done);
    2172     }
    2173     }
    2174    
    2175     @@ -809,7 +823,7 @@ void exit_aio(struct mm_struct *mm)
    2176     */
    2177     ctx->mmap_size = 0;
    2178    
    2179     - kill_ioctx(mm, ctx);
    2180     + kill_ioctx(mm, ctx, NULL);
    2181     }
    2182     }
    2183    
    2184     @@ -1187,7 +1201,7 @@ SYSCALL_DEFINE2(io_setup, unsigned, nr_events, aio_context_t __user *, ctxp)
    2185     if (!IS_ERR(ioctx)) {
    2186     ret = put_user(ioctx->user_id, ctxp);
    2187     if (ret)
    2188     - kill_ioctx(current->mm, ioctx);
    2189     + kill_ioctx(current->mm, ioctx, NULL);
    2190     percpu_ref_put(&ioctx->users);
    2191     }
    2192    
    2193     @@ -1205,8 +1219,22 @@ SYSCALL_DEFINE1(io_destroy, aio_context_t, ctx)
    2194     {
    2195     struct kioctx *ioctx = lookup_ioctx(ctx);
    2196     if (likely(NULL != ioctx)) {
    2197     - kill_ioctx(current->mm, ioctx);
    2198     + struct completion requests_done =
    2199     + COMPLETION_INITIALIZER_ONSTACK(requests_done);
    2200     +
    2201     + /* Pass requests_done to kill_ioctx() where it can be set
    2202     + * in a thread-safe way. If we try to set it here then we have
    2203     + * a race condition if two io_destroy() called simultaneously.
    2204     + */
    2205     + kill_ioctx(current->mm, ioctx, &requests_done);
    2206     percpu_ref_put(&ioctx->users);
    2207     +
    2208     + /* Wait until all IO for the context are done. Otherwise kernel
    2209     + * keep using user-space buffers even if user thinks the context
    2210     + * is destroyed.
    2211     + */
    2212     + wait_for_completion(&requests_done);
    2213     +
    2214     return 0;
    2215     }
    2216     pr_debug("EINVAL: io_destroy: invalid context id\n");
    2217     diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c
    2218     index 0227b45ef00a..15e9505aa35f 100644
    2219     --- a/fs/cifs/cifs_unicode.c
    2220     +++ b/fs/cifs/cifs_unicode.c
    2221     @@ -290,7 +290,8 @@ int
    2222     cifsConvertToUTF16(__le16 *target, const char *source, int srclen,
    2223     const struct nls_table *cp, int mapChars)
    2224     {
    2225     - int i, j, charlen;
    2226     + int i, charlen;
    2227     + int j = 0;
    2228     char src_char;
    2229     __le16 dst_char;
    2230     wchar_t tmp;
    2231     @@ -298,12 +299,11 @@ cifsConvertToUTF16(__le16 *target, const char *source, int srclen,
    2232     if (!mapChars)
    2233     return cifs_strtoUTF16(target, source, PATH_MAX, cp);
    2234    
    2235     - for (i = 0, j = 0; i < srclen; j++) {
    2236     + for (i = 0; i < srclen; j++) {
    2237     src_char = source[i];
    2238     charlen = 1;
    2239     switch (src_char) {
    2240     case 0:
    2241     - put_unaligned(0, &target[j]);
    2242     goto ctoUTF16_out;
    2243     case ':':
    2244     dst_char = cpu_to_le16(UNI_COLON);
    2245     @@ -350,6 +350,7 @@ cifsConvertToUTF16(__le16 *target, const char *source, int srclen,
    2246     }
    2247    
    2248     ctoUTF16_out:
    2249     + put_unaligned(0, &target[j]); /* Null terminate target unicode string */
    2250     return j;
    2251     }
    2252    
    2253     diff --git a/fs/cifs/link.c b/fs/cifs/link.c
    2254     index 264ece71bdb2..68559fd557fb 100644
    2255     --- a/fs/cifs/link.c
    2256     +++ b/fs/cifs/link.c
    2257     @@ -374,7 +374,7 @@ cifs_create_mf_symlink(unsigned int xid, struct cifs_tcon *tcon,
    2258     oparms.cifs_sb = cifs_sb;
    2259     oparms.desired_access = GENERIC_WRITE;
    2260     oparms.create_options = create_options;
    2261     - oparms.disposition = FILE_OPEN;
    2262     + oparms.disposition = FILE_CREATE;
    2263     oparms.path = path;
    2264     oparms.fid = &fid;
    2265     oparms.reconnect = false;
    2266     diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c
    2267     index 594009f5f523..e6574d7b6642 100644
    2268     --- a/fs/ext4/indirect.c
    2269     +++ b/fs/ext4/indirect.c
    2270     @@ -389,7 +389,13 @@ static int ext4_alloc_branch(handle_t *handle, struct inode *inode,
    2271     return 0;
    2272     failed:
    2273     for (; i >= 0; i--) {
    2274     - if (i != indirect_blks && branch[i].bh)
    2275     + /*
    2276     + * We want to ext4_forget() only freshly allocated indirect
    2277     + * blocks. Buffer for new_blocks[i-1] is at branch[i].bh and
    2278     + * buffer at branch[0].bh is indirect block / inode already
    2279     + * existing before ext4_alloc_branch() was called.
    2280     + */
    2281     + if (i > 0 && i != indirect_blks && branch[i].bh)
    2282     ext4_forget(handle, 1, inode, branch[i].bh,
    2283     branch[i].bh->b_blocknr);
    2284     ext4_free_blocks(handle, inode, NULL, new_blocks[i],
    2285     @@ -1312,16 +1318,24 @@ static int free_hole_blocks(handle_t *handle, struct inode *inode,
    2286     blk = *i_data;
    2287     if (level > 0) {
    2288     ext4_lblk_t first2;
    2289     + ext4_lblk_t count2;
    2290     +
    2291     bh = sb_bread(inode->i_sb, le32_to_cpu(blk));
    2292     if (!bh) {
    2293     EXT4_ERROR_INODE_BLOCK(inode, le32_to_cpu(blk),
    2294     "Read failure");
    2295     return -EIO;
    2296     }
    2297     - first2 = (first > offset) ? first - offset : 0;
    2298     + if (first > offset) {
    2299     + first2 = first - offset;
    2300     + count2 = count;
    2301     + } else {
    2302     + first2 = 0;
    2303     + count2 = count - (offset - first);
    2304     + }
    2305     ret = free_hole_blocks(handle, inode, bh,
    2306     (__le32 *)bh->b_data, level - 1,
    2307     - first2, count - offset,
    2308     + first2, count2,
    2309     inode->i_sb->s_blocksize >> 2);
    2310     if (ret) {
    2311     brelse(bh);
    2312     diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
    2313     index 9a914e892bb1..f23a6ca37504 100644
    2314     --- a/fs/nfsd/nfs4proc.c
    2315     +++ b/fs/nfsd/nfs4proc.c
    2316     @@ -618,15 +618,6 @@ nfsd4_create(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
    2317    
    2318     switch (create->cr_type) {
    2319     case NF4LNK:
    2320     - /* ugh! we have to null-terminate the linktext, or
    2321     - * vfs_symlink() will choke. it is always safe to
    2322     - * null-terminate by brute force, since at worst we
    2323     - * will overwrite the first byte of the create namelen
    2324     - * in the XDR buffer, which has already been extracted
    2325     - * during XDR decode.
    2326     - */
    2327     - create->cr_linkname[create->cr_linklen] = 0;
    2328     -
    2329     status = nfsd_symlink(rqstp, &cstate->current_fh,
    2330     create->cr_name, create->cr_namelen,
    2331     create->cr_linkname, create->cr_linklen,
    2332     diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
    2333     index bc11bf68ec7f..86573350350e 100644
    2334     --- a/fs/nfsd/nfs4xdr.c
    2335     +++ b/fs/nfsd/nfs4xdr.c
    2336     @@ -602,7 +602,18 @@ nfsd4_decode_create(struct nfsd4_compoundargs *argp, struct nfsd4_create *create
    2337     READ_BUF(4);
    2338     READ32(create->cr_linklen);
    2339     READ_BUF(create->cr_linklen);
    2340     - SAVEMEM(create->cr_linkname, create->cr_linklen);
    2341     + /*
    2342     + * The VFS will want a null-terminated string, and
    2343     + * null-terminating in place isn't safe since this might
    2344     + * end on a page boundary:
    2345     + */
    2346     + create->cr_linkname =
    2347     + kmalloc(create->cr_linklen + 1, GFP_KERNEL);
    2348     + if (!create->cr_linkname)
    2349     + return nfserr_jukebox;
    2350     + memcpy(create->cr_linkname, p, create->cr_linklen);
    2351     + create->cr_linkname[create->cr_linklen] = '\0';
    2352     + defer_free(argp, kfree, create->cr_linkname);
    2353     break;
    2354     case NF4BLK:
    2355     case NF4CHR:
    2356     diff --git a/include/uapi/linux/usb/functionfs.h b/include/uapi/linux/usb/functionfs.h
    2357     index d6b01283f85c..29e9c7aa9c66 100644
    2358     --- a/include/uapi/linux/usb/functionfs.h
    2359     +++ b/include/uapi/linux/usb/functionfs.h
    2360     @@ -27,6 +27,13 @@ struct usb_endpoint_descriptor_no_audio {
    2361     __u8 bInterval;
    2362     } __attribute__((packed));
    2363    
    2364     +/* Legacy format, deprecated as of 3.14. */
    2365     +struct usb_functionfs_descs_head {
    2366     + __le32 magic;
    2367     + __le32 length;
    2368     + __le32 fs_count;
    2369     + __le32 hs_count;
    2370     +} __attribute__((packed, deprecated));
    2371    
    2372     /*
    2373     * All numbers must be in little endian order.
    2374     diff --git a/kernel/auditsc.c b/kernel/auditsc.c
    2375     index 37e621606807..619b58d3fcdf 100644
    2376     --- a/kernel/auditsc.c
    2377     +++ b/kernel/auditsc.c
    2378     @@ -1991,7 +1991,7 @@ static void audit_log_set_loginuid(kuid_t koldloginuid, kuid_t kloginuid,
    2379     if (!ab)
    2380     return;
    2381     audit_log_format(ab, "pid=%d uid=%u"
    2382     - " old-auid=%u new-auid=%u old-ses=%u new-ses=%u"
    2383     + " old-auid=%u auid=%u old-ses=%u ses=%u"
    2384     " res=%d",
    2385     current->pid, uid,
    2386     oldloginuid, loginuid, oldsessionid, sessionid,
    2387     diff --git a/kernel/sysctl.c b/kernel/sysctl.c
    2388     index aae21e842918..c1b26e176aa6 100644
    2389     --- a/kernel/sysctl.c
    2390     +++ b/kernel/sysctl.c
    2391     @@ -139,7 +139,6 @@ static unsigned long dirty_bytes_min = 2 * PAGE_SIZE;
    2392     /* this is needed for the proc_dointvec_minmax for [fs_]overflow UID and GID */
    2393     static int maxolduid = 65535;
    2394     static int minolduid;
    2395     -static int min_percpu_pagelist_fract = 8;
    2396    
    2397     static int ngroups_max = NGROUPS_MAX;
    2398     static const int cap_last_cap = CAP_LAST_CAP;
    2399     @@ -1324,7 +1323,7 @@ static struct ctl_table vm_table[] = {
    2400     .maxlen = sizeof(percpu_pagelist_fraction),
    2401     .mode = 0644,
    2402     .proc_handler = percpu_pagelist_fraction_sysctl_handler,
    2403     - .extra1 = &min_percpu_pagelist_fract,
    2404     + .extra1 = &zero,
    2405     },
    2406     #ifdef CONFIG_MMU
    2407     {
    2408     diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
    2409     index f0831c22760c..fd21e601a891 100644
    2410     --- a/kernel/trace/trace.c
    2411     +++ b/kernel/trace/trace.c
    2412     @@ -1355,7 +1355,6 @@ void tracing_start(void)
    2413    
    2414     arch_spin_unlock(&ftrace_max_lock);
    2415    
    2416     - ftrace_start();
    2417     out:
    2418     raw_spin_unlock_irqrestore(&global_trace.start_lock, flags);
    2419     }
    2420     @@ -1402,7 +1401,6 @@ void tracing_stop(void)
    2421     struct ring_buffer *buffer;
    2422     unsigned long flags;
    2423    
    2424     - ftrace_stop();
    2425     raw_spin_lock_irqsave(&global_trace.start_lock, flags);
    2426     if (global_trace.stop_count++)
    2427     goto out;
    2428     diff --git a/mm/hugetlb.c b/mm/hugetlb.c
    2429     index 06a9bc0a3120..30dd6265a141 100644
    2430     --- a/mm/hugetlb.c
    2431     +++ b/mm/hugetlb.c
    2432     @@ -2338,6 +2338,31 @@ static void set_huge_ptep_writable(struct vm_area_struct *vma,
    2433     update_mmu_cache(vma, address, ptep);
    2434     }
    2435    
    2436     +static int is_hugetlb_entry_migration(pte_t pte)
    2437     +{
    2438     + swp_entry_t swp;
    2439     +
    2440     + if (huge_pte_none(pte) || pte_present(pte))
    2441     + return 0;
    2442     + swp = pte_to_swp_entry(pte);
    2443     + if (non_swap_entry(swp) && is_migration_entry(swp))
    2444     + return 1;
    2445     + else
    2446     + return 0;
    2447     +}
    2448     +
    2449     +static int is_hugetlb_entry_hwpoisoned(pte_t pte)
    2450     +{
    2451     + swp_entry_t swp;
    2452     +
    2453     + if (huge_pte_none(pte) || pte_present(pte))
    2454     + return 0;
    2455     + swp = pte_to_swp_entry(pte);
    2456     + if (non_swap_entry(swp) && is_hwpoison_entry(swp))
    2457     + return 1;
    2458     + else
    2459     + return 0;
    2460     +}
    2461    
    2462     int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
    2463     struct vm_area_struct *vma)
    2464     @@ -2377,10 +2402,26 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
    2465     dst_ptl = huge_pte_lock(h, dst, dst_pte);
    2466     src_ptl = huge_pte_lockptr(h, src, src_pte);
    2467     spin_lock_nested(src_ptl, SINGLE_DEPTH_NESTING);
    2468     - if (!huge_pte_none(huge_ptep_get(src_pte))) {
    2469     + entry = huge_ptep_get(src_pte);
    2470     + if (huge_pte_none(entry)) { /* skip none entry */
    2471     + ;
    2472     + } else if (unlikely(is_hugetlb_entry_migration(entry) ||
    2473     + is_hugetlb_entry_hwpoisoned(entry))) {
    2474     + swp_entry_t swp_entry = pte_to_swp_entry(entry);
    2475     +
    2476     + if (is_write_migration_entry(swp_entry) && cow) {
    2477     + /*
    2478     + * COW mappings require pages in both
    2479     + * parent and child to be set to read.
    2480     + */
    2481     + make_migration_entry_read(&swp_entry);
    2482     + entry = swp_entry_to_pte(swp_entry);
    2483     + set_huge_pte_at(src, addr, src_pte, entry);
    2484     + }
    2485     + set_huge_pte_at(dst, addr, dst_pte, entry);
    2486     + } else {
    2487     if (cow)
    2488     huge_ptep_set_wrprotect(src, addr, src_pte);
    2489     - entry = huge_ptep_get(src_pte);
    2490     ptepage = pte_page(entry);
    2491     get_page(ptepage);
    2492     page_dup_rmap(ptepage);
    2493     @@ -2396,32 +2437,6 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
    2494     return ret;
    2495     }
    2496    
    2497     -static int is_hugetlb_entry_migration(pte_t pte)
    2498     -{
    2499     - swp_entry_t swp;
    2500     -
    2501     - if (huge_pte_none(pte) || pte_present(pte))
    2502     - return 0;
    2503     - swp = pte_to_swp_entry(pte);
    2504     - if (non_swap_entry(swp) && is_migration_entry(swp))
    2505     - return 1;
    2506     - else
    2507     - return 0;
    2508     -}
    2509     -
    2510     -static int is_hugetlb_entry_hwpoisoned(pte_t pte)
    2511     -{
    2512     - swp_entry_t swp;
    2513     -
    2514     - if (huge_pte_none(pte) || pte_present(pte))
    2515     - return 0;
    2516     - swp = pte_to_swp_entry(pte);
    2517     - if (non_swap_entry(swp) && is_hwpoison_entry(swp))
    2518     - return 1;
    2519     - else
    2520     - return 0;
    2521     -}
    2522     -
    2523     void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma,
    2524     unsigned long start, unsigned long end,
    2525     struct page *ref_page)
    2526     diff --git a/mm/memory.c b/mm/memory.c
    2527     index 49e930f9ed46..2121d8b8db56 100644
    2528     --- a/mm/memory.c
    2529     +++ b/mm/memory.c
    2530     @@ -3756,9 +3756,6 @@ static int __handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
    2531     }
    2532     }
    2533    
    2534     - /* THP should already have been handled */
    2535     - BUG_ON(pmd_numa(*pmd));
    2536     -
    2537     /*
    2538     * Use __pte_alloc instead of pte_alloc_map, because we can't
    2539     * run pte_offset_map on the pmd, if an huge pmd could
    2540     diff --git a/mm/mempolicy.c b/mm/mempolicy.c
    2541     index 56224d998c39..9c6288aea4f9 100644
    2542     --- a/mm/mempolicy.c
    2543     +++ b/mm/mempolicy.c
    2544     @@ -653,19 +653,18 @@ static unsigned long change_prot_numa(struct vm_area_struct *vma,
    2545     * @nodes and @flags,) it's isolated and queued to the pagelist which is
    2546     * passed via @private.)
    2547     */
    2548     -static struct vm_area_struct *
    2549     +static int
    2550     queue_pages_range(struct mm_struct *mm, unsigned long start, unsigned long end,
    2551     const nodemask_t *nodes, unsigned long flags, void *private)
    2552     {
    2553     - int err;
    2554     - struct vm_area_struct *first, *vma, *prev;
    2555     -
    2556     + int err = 0;
    2557     + struct vm_area_struct *vma, *prev;
    2558    
    2559     - first = find_vma(mm, start);
    2560     - if (!first)
    2561     - return ERR_PTR(-EFAULT);
    2562     + vma = find_vma(mm, start);
    2563     + if (!vma)
    2564     + return -EFAULT;
    2565     prev = NULL;
    2566     - for (vma = first; vma && vma->vm_start < end; vma = vma->vm_next) {
    2567     + for (; vma && vma->vm_start < end; vma = vma->vm_next) {
    2568     unsigned long endvma = vma->vm_end;
    2569    
    2570     if (endvma > end)
    2571     @@ -675,9 +674,9 @@ queue_pages_range(struct mm_struct *mm, unsigned long start, unsigned long end,
    2572    
    2573     if (!(flags & MPOL_MF_DISCONTIG_OK)) {
    2574     if (!vma->vm_next && vma->vm_end < end)
    2575     - return ERR_PTR(-EFAULT);
    2576     + return -EFAULT;
    2577     if (prev && prev->vm_end < vma->vm_start)
    2578     - return ERR_PTR(-EFAULT);
    2579     + return -EFAULT;
    2580     }
    2581    
    2582     if (flags & MPOL_MF_LAZY) {
    2583     @@ -691,15 +690,13 @@ queue_pages_range(struct mm_struct *mm, unsigned long start, unsigned long end,
    2584    
    2585     err = queue_pages_pgd_range(vma, start, endvma, nodes,
    2586     flags, private);
    2587     - if (err) {
    2588     - first = ERR_PTR(err);
    2589     + if (err)
    2590     break;
    2591     - }
    2592     }
    2593     next:
    2594     prev = vma;
    2595     }
    2596     - return first;
    2597     + return err;
    2598     }
    2599    
    2600     /*
    2601     @@ -1184,16 +1181,17 @@ out:
    2602    
    2603     /*
    2604     * Allocate a new page for page migration based on vma policy.
    2605     - * Start assuming that page is mapped by vma pointed to by @private.
    2606     + * Start by assuming the page is mapped by the same vma as contains @start.
    2607     * Search forward from there, if not. N.B., this assumes that the
    2608     * list of pages handed to migrate_pages()--which is how we get here--
    2609     * is in virtual address order.
    2610     */
    2611     -static struct page *new_vma_page(struct page *page, unsigned long private, int **x)
    2612     +static struct page *new_page(struct page *page, unsigned long start, int **x)
    2613     {
    2614     - struct vm_area_struct *vma = (struct vm_area_struct *)private;
    2615     + struct vm_area_struct *vma;
    2616     unsigned long uninitialized_var(address);
    2617    
    2618     + vma = find_vma(current->mm, start);
    2619     while (vma) {
    2620     address = page_address_in_vma(page, vma);
    2621     if (address != -EFAULT)
    2622     @@ -1223,7 +1221,7 @@ int do_migrate_pages(struct mm_struct *mm, const nodemask_t *from,
    2623     return -ENOSYS;
    2624     }
    2625    
    2626     -static struct page *new_vma_page(struct page *page, unsigned long private, int **x)
    2627     +static struct page *new_page(struct page *page, unsigned long start, int **x)
    2628     {
    2629     return NULL;
    2630     }
    2631     @@ -1233,7 +1231,6 @@ static long do_mbind(unsigned long start, unsigned long len,
    2632     unsigned short mode, unsigned short mode_flags,
    2633     nodemask_t *nmask, unsigned long flags)
    2634     {
    2635     - struct vm_area_struct *vma;
    2636     struct mm_struct *mm = current->mm;
    2637     struct mempolicy *new;
    2638     unsigned long end;
    2639     @@ -1299,11 +1296,9 @@ static long do_mbind(unsigned long start, unsigned long len,
    2640     if (err)
    2641     goto mpol_out;
    2642    
    2643     - vma = queue_pages_range(mm, start, end, nmask,
    2644     + err = queue_pages_range(mm, start, end, nmask,
    2645     flags | MPOL_MF_INVERT, &pagelist);
    2646     -
    2647     - err = PTR_ERR(vma); /* maybe ... */
    2648     - if (!IS_ERR(vma))
    2649     + if (!err)
    2650     err = mbind_range(mm, start, end, new);
    2651    
    2652     if (!err) {
    2653     @@ -1311,9 +1306,8 @@ static long do_mbind(unsigned long start, unsigned long len,
    2654    
    2655     if (!list_empty(&pagelist)) {
    2656     WARN_ON_ONCE(flags & MPOL_MF_LAZY);
    2657     - nr_failed = migrate_pages(&pagelist, new_vma_page,
    2658     - (unsigned long)vma,
    2659     - MIGRATE_SYNC, MR_MEMPOLICY_MBIND);
    2660     + nr_failed = migrate_pages(&pagelist, new_page,
    2661     + start, MIGRATE_SYNC, MR_MEMPOLICY_MBIND);
    2662     if (nr_failed)
    2663     putback_movable_pages(&pagelist);
    2664     }
    2665     diff --git a/mm/page_alloc.c b/mm/page_alloc.c
    2666     index 4b5d4f6360d2..7e7f94755ab5 100644
    2667     --- a/mm/page_alloc.c
    2668     +++ b/mm/page_alloc.c
    2669     @@ -69,6 +69,7 @@
    2670    
    2671     /* prevent >1 _updater_ of zone percpu pageset ->high and ->batch fields */
    2672     static DEFINE_MUTEX(pcp_batch_high_lock);
    2673     +#define MIN_PERCPU_PAGELIST_FRACTION (8)
    2674    
    2675     #ifdef CONFIG_USE_PERCPU_NUMA_NODE_ID
    2676     DEFINE_PER_CPU(int, numa_node);
    2677     @@ -798,9 +799,21 @@ void __init init_cma_reserved_pageblock(struct page *page)
    2678     set_page_count(p, 0);
    2679     } while (++p, --i);
    2680    
    2681     - set_page_refcounted(page);
    2682     set_pageblock_migratetype(page, MIGRATE_CMA);
    2683     - __free_pages(page, pageblock_order);
    2684     +
    2685     + if (pageblock_order >= MAX_ORDER) {
    2686     + i = pageblock_nr_pages;
    2687     + p = page;
    2688     + do {
    2689     + set_page_refcounted(p);
    2690     + __free_pages(p, MAX_ORDER - 1);
    2691     + p += MAX_ORDER_NR_PAGES;
    2692     + } while (i -= MAX_ORDER_NR_PAGES);
    2693     + } else {
    2694     + set_page_refcounted(page);
    2695     + __free_pages(page, pageblock_order);
    2696     + }
    2697     +
    2698     adjust_managed_page_count(page, pageblock_nr_pages);
    2699     }
    2700     #endif
    2701     @@ -4106,7 +4119,7 @@ static void __meminit zone_init_free_lists(struct zone *zone)
    2702     memmap_init_zone((size), (nid), (zone), (start_pfn), MEMMAP_EARLY)
    2703     #endif
    2704    
    2705     -static int __meminit zone_batchsize(struct zone *zone)
    2706     +static int zone_batchsize(struct zone *zone)
    2707     {
    2708     #ifdef CONFIG_MMU
    2709     int batch;
    2710     @@ -4222,8 +4235,8 @@ static void pageset_set_high(struct per_cpu_pageset *p,
    2711     pageset_update(&p->pcp, high, batch);
    2712     }
    2713    
    2714     -static void __meminit pageset_set_high_and_batch(struct zone *zone,
    2715     - struct per_cpu_pageset *pcp)
    2716     +static void pageset_set_high_and_batch(struct zone *zone,
    2717     + struct per_cpu_pageset *pcp)
    2718     {
    2719     if (percpu_pagelist_fraction)
    2720     pageset_set_high(pcp,
    2721     @@ -5848,23 +5861,38 @@ int percpu_pagelist_fraction_sysctl_handler(ctl_table *table, int write,
    2722     void __user *buffer, size_t *length, loff_t *ppos)
    2723     {
    2724     struct zone *zone;
    2725     - unsigned int cpu;
    2726     + int old_percpu_pagelist_fraction;
    2727     int ret;
    2728    
    2729     + mutex_lock(&pcp_batch_high_lock);
    2730     + old_percpu_pagelist_fraction = percpu_pagelist_fraction;
    2731     +
    2732     ret = proc_dointvec_minmax(table, write, buffer, length, ppos);
    2733     - if (!write || (ret < 0))
    2734     - return ret;
    2735     + if (!write || ret < 0)
    2736     + goto out;
    2737     +
    2738     + /* Sanity checking to avoid pcp imbalance */
    2739     + if (percpu_pagelist_fraction &&
    2740     + percpu_pagelist_fraction < MIN_PERCPU_PAGELIST_FRACTION) {
    2741     + percpu_pagelist_fraction = old_percpu_pagelist_fraction;
    2742     + ret = -EINVAL;
    2743     + goto out;
    2744     + }
    2745     +
    2746     + /* No change? */
    2747     + if (percpu_pagelist_fraction == old_percpu_pagelist_fraction)
    2748     + goto out;
    2749    
    2750     - mutex_lock(&pcp_batch_high_lock);
    2751     for_each_populated_zone(zone) {
    2752     - unsigned long high;
    2753     - high = zone->managed_pages / percpu_pagelist_fraction;
    2754     + unsigned int cpu;
    2755     +
    2756     for_each_possible_cpu(cpu)
    2757     - pageset_set_high(per_cpu_ptr(zone->pageset, cpu),
    2758     - high);
    2759     + pageset_set_high_and_batch(zone,
    2760     + per_cpu_ptr(zone->pageset, cpu));
    2761     }
    2762     +out:
    2763     mutex_unlock(&pcp_batch_high_lock);
    2764     - return 0;
    2765     + return ret;
    2766     }
    2767    
    2768     int hashdist = HASHDIST_DEFAULT;
    2769     diff --git a/mm/slab.c b/mm/slab.c
    2770     index b264214c77ea..6dd8d5f3a3ac 100644
    2771     --- a/mm/slab.c
    2772     +++ b/mm/slab.c
    2773     @@ -375,6 +375,39 @@ static void **dbg_userword(struct kmem_cache *cachep, void *objp)
    2774    
    2775     #endif
    2776    
    2777     +#define OBJECT_FREE (0)
    2778     +#define OBJECT_ACTIVE (1)
    2779     +
    2780     +#ifdef CONFIG_DEBUG_SLAB_LEAK
    2781     +
    2782     +static void set_obj_status(struct page *page, int idx, int val)
    2783     +{
    2784     + int freelist_size;
    2785     + char *status;
    2786     + struct kmem_cache *cachep = page->slab_cache;
    2787     +
    2788     + freelist_size = cachep->num * sizeof(unsigned int);
    2789     + status = (char *)page->freelist + freelist_size;
    2790     + status[idx] = val;
    2791     +}
    2792     +
    2793     +static inline unsigned int get_obj_status(struct page *page, int idx)
    2794     +{
    2795     + int freelist_size;
    2796     + char *status;
    2797     + struct kmem_cache *cachep = page->slab_cache;
    2798     +
    2799     + freelist_size = cachep->num * sizeof(unsigned int);
    2800     + status = (char *)page->freelist + freelist_size;
    2801     +
    2802     + return status[idx];
    2803     +}
    2804     +
    2805     +#else
    2806     +static inline void set_obj_status(struct page *page, int idx, int val) {}
    2807     +
    2808     +#endif
    2809     +
    2810     /*
    2811     * Do not go above this order unless 0 objects fit into the slab or
    2812     * overridden on the command line.
    2813     @@ -565,9 +598,18 @@ static inline struct array_cache *cpu_cache_get(struct kmem_cache *cachep)
    2814     return cachep->array[smp_processor_id()];
    2815     }
    2816    
    2817     -static size_t slab_mgmt_size(size_t nr_objs, size_t align)
    2818     +static size_t calculate_freelist_size(int nr_objs, size_t align)
    2819     {
    2820     - return ALIGN(nr_objs * sizeof(unsigned int), align);
    2821     + size_t freelist_size;
    2822     +
    2823     + freelist_size = nr_objs * sizeof(unsigned int);
    2824     + if (IS_ENABLED(CONFIG_DEBUG_SLAB_LEAK))
    2825     + freelist_size += nr_objs * sizeof(char);
    2826     +
    2827     + if (align)
    2828     + freelist_size = ALIGN(freelist_size, align);
    2829     +
    2830     + return freelist_size;
    2831     }
    2832    
    2833     /*
    2834     @@ -600,6 +642,10 @@ static void cache_estimate(unsigned long gfporder, size_t buffer_size,
    2835     nr_objs = slab_size / buffer_size;
    2836    
    2837     } else {
    2838     + int extra_space = 0;
    2839     +
    2840     + if (IS_ENABLED(CONFIG_DEBUG_SLAB_LEAK))
    2841     + extra_space = sizeof(char);
    2842     /*
    2843     * Ignore padding for the initial guess. The padding
    2844     * is at most @align-1 bytes, and @buffer_size is at
    2845     @@ -608,17 +654,18 @@ static void cache_estimate(unsigned long gfporder, size_t buffer_size,
    2846     * into the memory allocation when taking the padding
    2847     * into account.
    2848     */
    2849     - nr_objs = (slab_size) / (buffer_size + sizeof(unsigned int));
    2850     + nr_objs = (slab_size) /
    2851     + (buffer_size + sizeof(unsigned int) + extra_space);
    2852    
    2853     /*
    2854     * This calculated number will be either the right
    2855     * amount, or one greater than what we want.
    2856     */
    2857     - if (slab_mgmt_size(nr_objs, align) + nr_objs*buffer_size
    2858     - > slab_size)
    2859     + if (calculate_freelist_size(nr_objs, align) >
    2860     + slab_size - nr_objs * buffer_size)
    2861     nr_objs--;
    2862    
    2863     - mgmt_size = slab_mgmt_size(nr_objs, align);
    2864     + mgmt_size = calculate_freelist_size(nr_objs, align);
    2865     }
    2866     *num = nr_objs;
    2867     *left_over = slab_size - nr_objs*buffer_size - mgmt_size;
    2868     @@ -2011,13 +2058,16 @@ static size_t calculate_slab_order(struct kmem_cache *cachep,
    2869     continue;
    2870    
    2871     if (flags & CFLGS_OFF_SLAB) {
    2872     + size_t freelist_size_per_obj = sizeof(unsigned int);
    2873     /*
    2874     * Max number of objs-per-slab for caches which
    2875     * use off-slab slabs. Needed to avoid a possible
    2876     * looping condition in cache_grow().
    2877     */
    2878     + if (IS_ENABLED(CONFIG_DEBUG_SLAB_LEAK))
    2879     + freelist_size_per_obj += sizeof(char);
    2880     offslab_limit = size;
    2881     - offslab_limit /= sizeof(unsigned int);
    2882     + offslab_limit /= freelist_size_per_obj;
    2883    
    2884     if (num > offslab_limit)
    2885     break;
    2886     @@ -2258,8 +2308,7 @@ __kmem_cache_create (struct kmem_cache *cachep, unsigned long flags)
    2887     if (!cachep->num)
    2888     return -E2BIG;
    2889    
    2890     - freelist_size =
    2891     - ALIGN(cachep->num * sizeof(unsigned int), cachep->align);
    2892     + freelist_size = calculate_freelist_size(cachep->num, cachep->align);
    2893    
    2894     /*
    2895     * If the slab has been placed off-slab, and we have enough space then
    2896     @@ -2272,7 +2321,7 @@ __kmem_cache_create (struct kmem_cache *cachep, unsigned long flags)
    2897    
    2898     if (flags & CFLGS_OFF_SLAB) {
    2899     /* really off slab. No need for manual alignment */
    2900     - freelist_size = cachep->num * sizeof(unsigned int);
    2901     + freelist_size = calculate_freelist_size(cachep->num, 0);
    2902    
    2903     #ifdef CONFIG_PAGE_POISONING
    2904     /* If we're going to use the generic kernel_map_pages()
    2905     @@ -2589,6 +2638,7 @@ static void cache_init_objs(struct kmem_cache *cachep,
    2906     if (cachep->ctor)
    2907     cachep->ctor(objp);
    2908     #endif
    2909     + set_obj_status(page, i, OBJECT_FREE);
    2910     slab_freelist(page)[i] = i;
    2911     }
    2912     }
    2913     @@ -2797,6 +2847,7 @@ static void *cache_free_debugcheck(struct kmem_cache *cachep, void *objp,
    2914     BUG_ON(objnr >= cachep->num);
    2915     BUG_ON(objp != index_to_obj(cachep, page, objnr));
    2916    
    2917     + set_obj_status(page, objnr, OBJECT_FREE);
    2918     if (cachep->flags & SLAB_POISON) {
    2919     #ifdef CONFIG_DEBUG_PAGEALLOC
    2920     if ((cachep->size % PAGE_SIZE)==0 && OFF_SLAB(cachep)) {
    2921     @@ -2930,6 +2981,8 @@ static inline void cache_alloc_debugcheck_before(struct kmem_cache *cachep,
    2922     static void *cache_alloc_debugcheck_after(struct kmem_cache *cachep,
    2923     gfp_t flags, void *objp, unsigned long caller)
    2924     {
    2925     + struct page *page;
    2926     +
    2927     if (!objp)
    2928     return objp;
    2929     if (cachep->flags & SLAB_POISON) {
    2930     @@ -2960,6 +3013,9 @@ static void *cache_alloc_debugcheck_after(struct kmem_cache *cachep,
    2931     *dbg_redzone1(cachep, objp) = RED_ACTIVE;
    2932     *dbg_redzone2(cachep, objp) = RED_ACTIVE;
    2933     }
    2934     +
    2935     + page = virt_to_head_page(objp);
    2936     + set_obj_status(page, obj_to_index(cachep, page, objp), OBJECT_ACTIVE);
    2937     objp += obj_offset(cachep);
    2938     if (cachep->ctor && cachep->flags & SLAB_POISON)
    2939     cachep->ctor(objp);
    2940     @@ -4201,21 +4257,12 @@ static void handle_slab(unsigned long *n, struct kmem_cache *c,
    2941     struct page *page)
    2942     {
    2943     void *p;
    2944     - int i, j;
    2945     + int i;
    2946    
    2947     if (n[0] == n[1])
    2948     return;
    2949     for (i = 0, p = page->s_mem; i < c->num; i++, p += c->size) {
    2950     - bool active = true;
    2951     -
    2952     - for (j = page->active; j < c->num; j++) {
    2953     - /* Skip freed item */
    2954     - if (slab_freelist(page)[j] == i) {
    2955     - active = false;
    2956     - break;
    2957     - }
    2958     - }
    2959     - if (!active)
    2960     + if (get_obj_status(page, i) != OBJECT_ACTIVE)
    2961     continue;
    2962    
    2963     if (!add_caller(n, (unsigned long)*dbg_userword(c, p)))
    2964     diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
    2965     index 9a6bc9df5e81..1c6e950b9ae7 100644
    2966     --- a/net/bluetooth/hci_conn.c
    2967     +++ b/net/bluetooth/hci_conn.c
    2968     @@ -759,7 +759,7 @@ static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
    2969     /* If we're already encrypted set the REAUTH_PEND flag,
    2970     * otherwise set the ENCRYPT_PEND.
    2971     */
    2972     - if (conn->key_type != 0xff)
    2973     + if (conn->link_mode & HCI_LM_ENCRYPT)
    2974     set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
    2975     else
    2976     set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
    2977     diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
    2978     index 66ada7794ed0..2e8c5765e5ea 100644
    2979     --- a/net/bluetooth/hci_event.c
    2980     +++ b/net/bluetooth/hci_event.c
    2981     @@ -48,6 +48,10 @@ static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
    2982     smp_mb__after_clear_bit(); /* wake_up_bit advises about this barrier */
    2983     wake_up_bit(&hdev->flags, HCI_INQUIRY);
    2984    
    2985     + hci_dev_lock(hdev);
    2986     + hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
    2987     + hci_dev_unlock(hdev);
    2988     +
    2989     hci_conn_check_pending(hdev);
    2990     }
    2991    
    2992     @@ -3177,8 +3181,11 @@ static void hci_user_confirm_request_evt(struct hci_dev *hdev,
    2993    
    2994     /* If we're not the initiators request authorization to
    2995     * proceed from user space (mgmt_user_confirm with
    2996     - * confirm_hint set to 1). */
    2997     - if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
    2998     + * confirm_hint set to 1). The exception is if neither
    2999     + * side had MITM in which case we do auto-accept.
    3000     + */
    3001     + if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
    3002     + (loc_mitm || rem_mitm)) {
    3003     BT_DBG("Confirming auto-accept as acceptor");
    3004     confirm_hint = 1;
    3005     goto confirm;
    3006     diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
    3007     index d4b7702d900f..27ae84154586 100644
    3008     --- a/net/bluetooth/l2cap_sock.c
    3009     +++ b/net/bluetooth/l2cap_sock.c
    3010     @@ -778,11 +778,6 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
    3011    
    3012     /*change security for LE channels */
    3013     if (chan->scid == L2CAP_CID_ATT) {
    3014     - if (!conn->hcon->out) {
    3015     - err = -EINVAL;
    3016     - break;
    3017     - }
    3018     -
    3019     if (smp_conn_security(conn->hcon, sec.level))
    3020     break;
    3021     sk->sk_state = BT_CONFIG;
    3022     diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
    3023     index a03ca3ca91bf..f1ac2a754acc 100644
    3024     --- a/net/bluetooth/mgmt.c
    3025     +++ b/net/bluetooth/mgmt.c
    3026     @@ -2826,8 +2826,13 @@ static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
    3027     }
    3028    
    3029     if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
    3030     - /* Continue with pairing via SMP */
    3031     + /* Continue with pairing via SMP. The hdev lock must be
    3032     + * released as SMP may try to recquire it for crypto
    3033     + * purposes.
    3034     + */
    3035     + hci_dev_unlock(hdev);
    3036     err = smp_user_confirm_reply(conn, mgmt_op, passkey);
    3037     + hci_dev_lock(hdev);
    3038    
    3039     if (!err)
    3040     err = cmd_complete(sk, hdev->id, mgmt_op,
    3041     diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
    3042     index ebf80f3abd83..653ce5d9e6e0 100644
    3043     --- a/net/mac80211/debugfs_netdev.c
    3044     +++ b/net/mac80211/debugfs_netdev.c
    3045     @@ -34,8 +34,7 @@ static ssize_t ieee80211_if_read(
    3046     ssize_t ret = -EINVAL;
    3047    
    3048     read_lock(&dev_base_lock);
    3049     - if (sdata->dev->reg_state == NETREG_REGISTERED)
    3050     - ret = (*format)(sdata, buf, sizeof(buf));
    3051     + ret = (*format)(sdata, buf, sizeof(buf));
    3052     read_unlock(&dev_base_lock);
    3053    
    3054     if (ret >= 0)
    3055     @@ -62,8 +61,7 @@ static ssize_t ieee80211_if_write(
    3056    
    3057     ret = -ENODEV;
    3058     rtnl_lock();
    3059     - if (sdata->dev->reg_state == NETREG_REGISTERED)
    3060     - ret = (*write)(sdata, buf, count);
    3061     + ret = (*write)(sdata, buf, count);
    3062     rtnl_unlock();
    3063    
    3064     return ret;
    3065     diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
    3066     index 2796a198728f..ea7013cb7e52 100644
    3067     --- a/net/mac80211/ibss.c
    3068     +++ b/net/mac80211/ibss.c
    3069     @@ -1655,6 +1655,7 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
    3070     sdata->u.ibss.control_port = params->control_port;
    3071     sdata->u.ibss.userspace_handles_dfs = params->userspace_handles_dfs;
    3072     sdata->u.ibss.basic_rates = params->basic_rates;
    3073     + sdata->u.ibss.last_scan_completed = jiffies;
    3074    
    3075     /* fix basic_rates if channel does not support these rates */
    3076     rate_flags = ieee80211_chandef_rate_flags(&params->chandef);
    3077     diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
    3078     index 137a192e64bc..bedaeecdab97 100644
    3079     --- a/net/mac80211/sta_info.c
    3080     +++ b/net/mac80211/sta_info.c
    3081     @@ -240,6 +240,7 @@ void sta_info_free(struct ieee80211_local *local, struct sta_info *sta)
    3082    
    3083     sta_dbg(sta->sdata, "Destroyed STA %pM\n", sta->sta.addr);
    3084    
    3085     + kfree(rcu_dereference_raw(sta->sta.rates));
    3086     kfree(sta);
    3087     }
    3088    
    3089     diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
    3090     index 52ca952b802c..23247a0d2b69 100644
    3091     --- a/net/netfilter/nf_nat_core.c
    3092     +++ b/net/netfilter/nf_nat_core.c
    3093     @@ -517,6 +517,39 @@ static int nf_nat_proto_remove(struct nf_conn *i, void *data)
    3094     return i->status & IPS_NAT_MASK ? 1 : 0;
    3095     }
    3096    
    3097     +static int nf_nat_proto_clean(struct nf_conn *ct, void *data)
    3098     +{
    3099     + struct nf_conn_nat *nat = nfct_nat(ct);
    3100     +
    3101     + if (nf_nat_proto_remove(ct, data))
    3102     + return 1;
    3103     +
    3104     + if (!nat || !nat->ct)
    3105     + return 0;
    3106     +
    3107     + /* This netns is being destroyed, and conntrack has nat null binding.
    3108     + * Remove it from bysource hash, as the table will be freed soon.
    3109     + *
    3110     + * Else, when the conntrack is destoyed, nf_nat_cleanup_conntrack()
    3111     + * will delete entry from already-freed table.
    3112     + */
    3113     + if (!del_timer(&ct->timeout))
    3114     + return 1;
    3115     +
    3116     + spin_lock_bh(&nf_nat_lock);
    3117     + hlist_del_rcu(&nat->bysource);
    3118     + ct->status &= ~IPS_NAT_DONE_MASK;
    3119     + nat->ct = NULL;
    3120     + spin_unlock_bh(&nf_nat_lock);
    3121     +
    3122     + add_timer(&ct->timeout);
    3123     +
    3124     + /* don't delete conntrack. Although that would make things a lot
    3125     + * simpler, we'd end up flushing all conntracks on nat rmmod.
    3126     + */
    3127     + return 0;
    3128     +}
    3129     +
    3130     static void nf_nat_l4proto_clean(u8 l3proto, u8 l4proto)
    3131     {
    3132     struct nf_nat_proto_clean clean = {
    3133     @@ -787,7 +820,7 @@ static void __net_exit nf_nat_net_exit(struct net *net)
    3134     {
    3135     struct nf_nat_proto_clean clean = {};
    3136    
    3137     - nf_ct_iterate_cleanup(net, &nf_nat_proto_remove, &clean, 0, 0);
    3138     + nf_ct_iterate_cleanup(net, nf_nat_proto_clean, &clean, 0, 0);
    3139     synchronize_rcu();
    3140     nf_ct_free_hashtable(net->ct.nat_bysource, net->ct.nat_htable_size);
    3141     }
    3142     diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
    3143     index ca3256d6fde3..ede4b92710aa 100644
    3144     --- a/sound/usb/pcm.c
    3145     +++ b/sound/usb/pcm.c
    3146     @@ -1488,7 +1488,8 @@ static void retire_playback_urb(struct snd_usb_substream *subs,
    3147     * on two reads of a counter updated every ms.
    3148     */
    3149     if (abs(est_delay - subs->last_delay) * 1000 > runtime->rate * 2)
    3150     - snd_printk(KERN_DEBUG "delay: estimated %d, actual %d\n",
    3151     + dev_dbg_ratelimited(&subs->dev->dev,
    3152     + "delay: estimated %d, actual %d\n",
    3153     est_delay, subs->last_delay);
    3154    
    3155     if (!subs->running) {
    3156     diff --git a/tools/usb/ffs-test.c b/tools/usb/ffs-test.c
    3157     index fe1e66b6ef40..a87e99f37c52 100644
    3158     --- a/tools/usb/ffs-test.c
    3159     +++ b/tools/usb/ffs-test.c
    3160     @@ -116,8 +116,8 @@ static const struct {
    3161     .header = {
    3162     .magic = cpu_to_le32(FUNCTIONFS_DESCRIPTORS_MAGIC),
    3163     .length = cpu_to_le32(sizeof descriptors),
    3164     - .fs_count = 3,
    3165     - .hs_count = 3,
    3166     + .fs_count = cpu_to_le32(3),
    3167     + .hs_count = cpu_to_le32(3),
    3168     },
    3169     .fs_descs = {
    3170     .intf = {