Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-3.4/0115-3.4.16-all-fixes.patch

    Annotation of /trunk/kernel-alx/patches-3.4/0115-3.4.16-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 1946 - (hide annotations) (download)
    Wed Nov 14 15:25:09 2012 UTC (11 years, 6 months ago) by niro
    File size: 59894 byte(s) 
    3.4.18-alx-r1
    1 niro 1946 diff --git a/arch/s390/boot/compressed/vmlinux.lds.S b/arch/s390/boot/compressed/vmlinux.lds.S
    2     index d80f79d..8e1fb82 100644
    3     --- a/arch/s390/boot/compressed/vmlinux.lds.S
    4     +++ b/arch/s390/boot/compressed/vmlinux.lds.S
    5     @@ -5,7 +5,7 @@ OUTPUT_FORMAT("elf64-s390", "elf64-s390", "elf64-s390")
    6     OUTPUT_ARCH(s390:64-bit)
    7     #else
    8     OUTPUT_FORMAT("elf32-s390", "elf32-s390", "elf32-s390")
    9     -OUTPUT_ARCH(s390)
    10     +OUTPUT_ARCH(s390:31-bit)
    11     #endif
    12    
    13     ENTRY(startup)
    14     diff --git a/arch/s390/kernel/vmlinux.lds.S b/arch/s390/kernel/vmlinux.lds.S
    15     index 21109c6..1343d7c 100644
    16     --- a/arch/s390/kernel/vmlinux.lds.S
    17     +++ b/arch/s390/kernel/vmlinux.lds.S
    18     @@ -8,7 +8,7 @@
    19    
    20     #ifndef CONFIG_64BIT
    21     OUTPUT_FORMAT("elf32-s390", "elf32-s390", "elf32-s390")
    22     -OUTPUT_ARCH(s390)
    23     +OUTPUT_ARCH(s390:31-bit)
    24     ENTRY(startup)
    25     jiffies = jiffies_64 + 4;
    26     #else
    27     diff --git a/arch/sparc/kernel/perf_event.c b/arch/sparc/kernel/perf_event.c
    28     index 28559ce..602eca8 100644
    29     --- a/arch/sparc/kernel/perf_event.c
    30     +++ b/arch/sparc/kernel/perf_event.c
    31     @@ -557,11 +557,13 @@ static u64 nop_for_index(int idx)
    32    
    33     static inline void sparc_pmu_enable_event(struct cpu_hw_events *cpuc, struct hw_perf_event *hwc, int idx)
    34     {
    35     - u64 val, mask = mask_for_index(idx);
    36     + u64 enc, val, mask = mask_for_index(idx);
    37     +
    38     + enc = perf_event_get_enc(cpuc->events[idx]);
    39    
    40     val = cpuc->pcr;
    41     val &= ~mask;
    42     - val |= hwc->config;
    43     + val |= event_encoding(enc, idx);
    44     cpuc->pcr = val;
    45    
    46     pcr_ops->write(cpuc->pcr);
    47     @@ -1428,8 +1430,6 @@ static void perf_callchain_user_64(struct perf_callchain_entry *entry,
    48     {
    49     unsigned long ufp;
    50    
    51     - perf_callchain_store(entry, regs->tpc);
    52     -
    53     ufp = regs->u_regs[UREG_I6] + STACK_BIAS;
    54     do {
    55     struct sparc_stackf *usf, sf;
    56     @@ -1450,8 +1450,6 @@ static void perf_callchain_user_32(struct perf_callchain_entry *entry,
    57     {
    58     unsigned long ufp;
    59    
    60     - perf_callchain_store(entry, regs->tpc);
    61     -
    62     ufp = regs->u_regs[UREG_I6] & 0xffffffffUL;
    63     do {
    64     struct sparc_stackf32 *usf, sf;
    65     @@ -1470,6 +1468,11 @@ static void perf_callchain_user_32(struct perf_callchain_entry *entry,
    66     void
    67     perf_callchain_user(struct perf_callchain_entry *entry, struct pt_regs *regs)
    68     {
    69     + perf_callchain_store(entry, regs->tpc);
    70     +
    71     + if (!current->mm)
    72     + return;
    73     +
    74     flushw_user();
    75     if (test_thread_flag(TIF_32BIT))
    76     perf_callchain_user_32(entry, regs);
    77     diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
    78     index 3ee51f1..57b7cab 100644
    79     --- a/arch/sparc/kernel/sys_sparc_64.c
    80     +++ b/arch/sparc/kernel/sys_sparc_64.c
    81     @@ -519,12 +519,12 @@ SYSCALL_DEFINE1(sparc64_personality, unsigned long, personality)
    82     {
    83     int ret;
    84    
    85     - if (current->personality == PER_LINUX32 &&
    86     - personality == PER_LINUX)
    87     - personality = PER_LINUX32;
    88     + if (personality(current->personality) == PER_LINUX32 &&
    89     + personality(personality) == PER_LINUX)
    90     + personality |= PER_LINUX32;
    91     ret = sys_personality(personality);
    92     - if (ret == PER_LINUX32)
    93     - ret = PER_LINUX;
    94     + if (personality(ret) == PER_LINUX32)
    95     + ret &= ~PER_LINUX32;
    96    
    97     return ret;
    98     }
    99     diff --git a/arch/sparc/kernel/syscalls.S b/arch/sparc/kernel/syscalls.S
    100     index 1d7e274..7f5f65d 100644
    101     --- a/arch/sparc/kernel/syscalls.S
    102     +++ b/arch/sparc/kernel/syscalls.S
    103     @@ -212,24 +212,20 @@ linux_sparc_syscall:
    104     3: stx %o0, [%sp + PTREGS_OFF + PT_V9_I0]
    105     ret_sys_call:
    106     ldx [%sp + PTREGS_OFF + PT_V9_TSTATE], %g3
    107     - ldx [%sp + PTREGS_OFF + PT_V9_TNPC], %l1 ! pc = npc
    108     sra %o0, 0, %o0
    109     mov %ulo(TSTATE_XCARRY | TSTATE_ICARRY), %g2
    110     sllx %g2, 32, %g2
    111    
    112     - /* Check if force_successful_syscall_return()
    113     - * was invoked.
    114     - */
    115     - ldub [%g6 + TI_SYS_NOERROR], %l2
    116     - brnz,a,pn %l2, 80f
    117     - stb %g0, [%g6 + TI_SYS_NOERROR]
    118     -
    119     cmp %o0, -ERESTART_RESTARTBLOCK
    120     bgeu,pn %xcc, 1f
    121     - andcc %l0, (_TIF_SYSCALL_TRACE|_TIF_SECCOMP|_TIF_SYSCALL_AUDIT|_TIF_SYSCALL_TRACEPOINT), %l6
    122     -80:
    123     + andcc %l0, (_TIF_SYSCALL_TRACE|_TIF_SECCOMP|_TIF_SYSCALL_AUDIT|_TIF_SYSCALL_TRACEPOINT), %g0
    124     + ldx [%sp + PTREGS_OFF + PT_V9_TNPC], %l1 ! pc = npc
    125     +
    126     +2:
    127     + stb %g0, [%g6 + TI_SYS_NOERROR]
    128     /* System call success, clear Carry condition code. */
    129     andn %g3, %g2, %g3
    130     +3:
    131     stx %g3, [%sp + PTREGS_OFF + PT_V9_TSTATE]
    132     bne,pn %icc, linux_syscall_trace2
    133     add %l1, 0x4, %l2 ! npc = npc+4
    134     @@ -238,20 +234,20 @@ ret_sys_call:
    135     stx %l2, [%sp + PTREGS_OFF + PT_V9_TNPC]
    136    
    137     1:
    138     + /* Check if force_successful_syscall_return()
    139     + * was invoked.
    140     + */
    141     + ldub [%g6 + TI_SYS_NOERROR], %l2
    142     + brnz,pn %l2, 2b
    143     + ldx [%sp + PTREGS_OFF + PT_V9_TNPC], %l1 ! pc = npc
    144     /* System call failure, set Carry condition code.
    145     * Also, get abs(errno) to return to the process.
    146     */
    147     - andcc %l0, (_TIF_SYSCALL_TRACE|_TIF_SECCOMP|_TIF_SYSCALL_AUDIT|_TIF_SYSCALL_TRACEPOINT), %l6
    148     sub %g0, %o0, %o0
    149     - or %g3, %g2, %g3
    150     stx %o0, [%sp + PTREGS_OFF + PT_V9_I0]
    151     - stx %g3, [%sp + PTREGS_OFF + PT_V9_TSTATE]
    152     - bne,pn %icc, linux_syscall_trace2
    153     - add %l1, 0x4, %l2 ! npc = npc+4
    154     - stx %l1, [%sp + PTREGS_OFF + PT_V9_TPC]
    155     + ba,pt %xcc, 3b
    156     + or %g3, %g2, %g3
    157    
    158     - b,pt %xcc, rtrap
    159     - stx %l2, [%sp + PTREGS_OFF + PT_V9_TNPC]
    160     linux_syscall_trace2:
    161     call syscall_trace_leave
    162     add %sp, PTREGS_OFF, %o0
    163     diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
    164     index 21faaee..0791618 100644
    165     --- a/arch/sparc/mm/init_64.c
    166     +++ b/arch/sparc/mm/init_64.c
    167     @@ -2099,6 +2099,9 @@ EXPORT_SYMBOL(_PAGE_CACHE);
    168     #ifdef CONFIG_SPARSEMEM_VMEMMAP
    169     unsigned long vmemmap_table[VMEMMAP_SIZE];
    170    
    171     +static long __meminitdata addr_start, addr_end;
    172     +static int __meminitdata node_start;
    173     +
    174     int __meminit vmemmap_populate(struct page *start, unsigned long nr, int node)
    175     {
    176     unsigned long vstart = (unsigned long) start;
    177     @@ -2129,15 +2132,30 @@ int __meminit vmemmap_populate(struct page *start, unsigned long nr, int node)
    178    
    179     *vmem_pp = pte_base | __pa(block);
    180    
    181     - printk(KERN_INFO "[%p-%p] page_structs=%lu "
    182     - "node=%d entry=%lu/%lu\n", start, block, nr,
    183     - node,
    184     - addr >> VMEMMAP_CHUNK_SHIFT,
    185     - VMEMMAP_SIZE);
    186     + /* check to see if we have contiguous blocks */
    187     + if (addr_end != addr || node_start != node) {
    188     + if (addr_start)
    189     + printk(KERN_DEBUG " [%lx-%lx] on node %d\n",
    190     + addr_start, addr_end-1, node_start);
    191     + addr_start = addr;
    192     + node_start = node;
    193     + }
    194     + addr_end = addr + VMEMMAP_CHUNK;
    195     }
    196     }
    197     return 0;
    198     }
    199     +
    200     +void __meminit vmemmap_populate_print_last(void)
    201     +{
    202     + if (addr_start) {
    203     + printk(KERN_DEBUG " [%lx-%lx] on node %d\n",
    204     + addr_start, addr_end-1, node_start);
    205     + addr_start = 0;
    206     + addr_end = 0;
    207     + node_start = 0;
    208     + }
    209     +}
    210     #endif /* CONFIG_SPARSEMEM_VMEMMAP */
    211    
    212     static void prot_init_common(unsigned long page_none,
    213     diff --git a/arch/tile/Makefile b/arch/tile/Makefile
    214     index 9520bc5..99f461d 100644
    215     --- a/arch/tile/Makefile
    216     +++ b/arch/tile/Makefile
    217     @@ -26,6 +26,10 @@ $(error Set TILERA_ROOT or CROSS_COMPILE when building $(ARCH) on $(HOST_ARCH))
    218     endif
    219     endif
    220    
    221     +# The tile compiler may emit .eh_frame information for backtracing.
    222     +# In kernel modules, this causes load failures due to unsupported relocations.
    223     +KBUILD_CFLAGS += -fno-asynchronous-unwind-tables
    224     +
    225     ifneq ($(CONFIG_DEBUG_EXTRA_FLAGS),"")
    226     KBUILD_CFLAGS += $(CONFIG_DEBUG_EXTRA_FLAGS)
    227     endif
    228     diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
    229     index 7b784f4..6d4f7ba 100644
    230     --- a/arch/x86/kernel/entry_32.S
    231     +++ b/arch/x86/kernel/entry_32.S
    232     @@ -1025,7 +1025,7 @@ ENTRY(xen_sysenter_target)
    233    
    234     ENTRY(xen_hypervisor_callback)
    235     CFI_STARTPROC
    236     - pushl_cfi $0
    237     + pushl_cfi $-1 /* orig_ax = -1 => not a system call */
    238     SAVE_ALL
    239     TRACE_IRQS_OFF
    240    
    241     @@ -1067,14 +1067,16 @@ ENTRY(xen_failsafe_callback)
    242     2: mov 8(%esp),%es
    243     3: mov 12(%esp),%fs
    244     4: mov 16(%esp),%gs
    245     + /* EAX == 0 => Category 1 (Bad segment)
    246     + EAX != 0 => Category 2 (Bad IRET) */
    247     testl %eax,%eax
    248     popl_cfi %eax
    249     lea 16(%esp),%esp
    250     CFI_ADJUST_CFA_OFFSET -16
    251     jz 5f
    252     addl $16,%esp
    253     - jmp iret_exc # EAX != 0 => Category 2 (Bad IRET)
    254     -5: pushl_cfi $0 # EAX == 0 => Category 1 (Bad segment)
    255     + jmp iret_exc
    256     +5: pushl_cfi $-1 /* orig_ax = -1 => not a system call */
    257     SAVE_ALL
    258     jmp ret_from_exception
    259     CFI_ENDPROC
    260     diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
    261     index cdc79b5..bd6f592 100644
    262     --- a/arch/x86/kernel/entry_64.S
    263     +++ b/arch/x86/kernel/entry_64.S
    264     @@ -1351,7 +1351,7 @@ ENTRY(xen_failsafe_callback)
    265     CFI_RESTORE r11
    266     addq $0x30,%rsp
    267     CFI_ADJUST_CFA_OFFSET -0x30
    268     - pushq_cfi $0
    269     + pushq_cfi $-1 /* orig_ax = -1 => not a system call */
    270     SAVE_ALL
    271     jmp error_exit
    272     CFI_ENDPROC
    273     diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
    274     index 1a29015..fbbd1eb 100644
    275     --- a/arch/x86/kernel/setup.c
    276     +++ b/arch/x86/kernel/setup.c
    277     @@ -927,8 +927,21 @@ void __init setup_arch(char **cmdline_p)
    278    
    279     #ifdef CONFIG_X86_64
    280     if (max_pfn > max_low_pfn) {
    281     - max_pfn_mapped = init_memory_mapping(1UL<<32,
    282     - max_pfn<<PAGE_SHIFT);
    283     + int i;
    284     + for (i = 0; i < e820.nr_map; i++) {
    285     + struct e820entry *ei = &e820.map[i];
    286     +
    287     + if (ei->addr + ei->size <= 1UL << 32)
    288     + continue;
    289     +
    290     + if (ei->type == E820_RESERVED)
    291     + continue;
    292     +
    293     + max_pfn_mapped = init_memory_mapping(
    294     + ei->addr < 1UL << 32 ? 1UL << 32 : ei->addr,
    295     + ei->addr + ei->size);
    296     + }
    297     +
    298     /* can we preseve max_low_pfn ?*/
    299     max_low_pfn = max_pfn;
    300     }
    301     diff --git a/arch/x86/oprofile/nmi_int.c b/arch/x86/oprofile/nmi_int.c
    302     index 26b8a85..48768df 100644
    303     --- a/arch/x86/oprofile/nmi_int.c
    304     +++ b/arch/x86/oprofile/nmi_int.c
    305     @@ -55,7 +55,7 @@ u64 op_x86_get_ctrl(struct op_x86_model_spec const *model,
    306     val |= counter_config->extra;
    307     event &= model->event_mask ? model->event_mask : 0xFF;
    308     val |= event & 0xFF;
    309     - val |= (event & 0x0F00) << 24;
    310     + val |= (u64)(event & 0x0F00) << 24;
    311    
    312     return val;
    313     }
    314     diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
    315     index 7ef73c9..a8bfe1c 100644
    316     --- a/drivers/edac/amd64_edac.c
    317     +++ b/drivers/edac/amd64_edac.c
    318     @@ -170,8 +170,11 @@ static int __amd64_set_scrub_rate(struct pci_dev *ctl, u32 new_bw, u32 min_rate)
    319     * memory controller and apply to register. Search for the first
    320     * bandwidth entry that is greater or equal than the setting requested
    321     * and program that. If at last entry, turn off DRAM scrubbing.
    322     + *
    323     + * If no suitable bandwidth is found, turn off DRAM scrubbing entirely
    324     + * by falling back to the last element in scrubrates[].
    325     */
    326     - for (i = 0; i < ARRAY_SIZE(scrubrates); i++) {
    327     + for (i = 0; i < ARRAY_SIZE(scrubrates) - 1; i++) {
    328     /*
    329     * skip scrub rates which aren't recommended
    330     * (see F10 BKDG, F3x58)
    331     @@ -181,12 +184,6 @@ static int __amd64_set_scrub_rate(struct pci_dev *ctl, u32 new_bw, u32 min_rate)
    332    
    333     if (scrubrates[i].bandwidth <= new_bw)
    334     break;
    335     -
    336     - /*
    337     - * if no suitable bandwidth found, turn off DRAM scrubbing
    338     - * entirely by falling back to the last element in the
    339     - * scrubrates array.
    340     - */
    341     }
    342    
    343     scrubval = scrubrates[i].scrubval;
    344     diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
    345     index e3e470f..67432e2 100644
    346     --- a/drivers/infiniband/core/cma.c
    347     +++ b/drivers/infiniband/core/cma.c
    348     @@ -3451,7 +3451,8 @@ out:
    349     }
    350    
    351     static const struct ibnl_client_cbs cma_cb_table[] = {
    352     - [RDMA_NL_RDMA_CM_ID_STATS] = { .dump = cma_get_id_stats },
    353     + [RDMA_NL_RDMA_CM_ID_STATS] = { .dump = cma_get_id_stats,
    354     + .module = THIS_MODULE },
    355     };
    356    
    357     static int __init cma_init(void)
    358     diff --git a/drivers/infiniband/core/netlink.c b/drivers/infiniband/core/netlink.c
    359     index 396e293..8c3b08a 100644
    360     --- a/drivers/infiniband/core/netlink.c
    361     +++ b/drivers/infiniband/core/netlink.c
    362     @@ -151,6 +151,7 @@ static int ibnl_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
    363     {
    364     struct netlink_dump_control c = {
    365     .dump = client->cb_table[op].dump,
    366     + .module = client->cb_table[op].module,
    367     };
    368     return netlink_dump_start(nls, skb, nlh, &c);
    369     }
    370     diff --git a/drivers/iommu/tegra-smmu.c b/drivers/iommu/tegra-smmu.c
    371     index 17ef6c4..035f28e 100644
    372     --- a/drivers/iommu/tegra-smmu.c
    373     +++ b/drivers/iommu/tegra-smmu.c
    374     @@ -148,7 +148,7 @@
    375    
    376     #define SMMU_ADDR_TO_PFN(addr) ((addr) >> 12)
    377     #define SMMU_ADDR_TO_PDN(addr) ((addr) >> 22)
    378     -#define SMMU_PDN_TO_ADDR(addr) ((pdn) << 22)
    379     +#define SMMU_PDN_TO_ADDR(pdn) ((pdn) << 22)
    380    
    381     #define _READABLE (1 << SMMU_PTB_DATA_ASID_READABLE_SHIFT)
    382     #define _WRITABLE (1 << SMMU_PTB_DATA_ASID_WRITABLE_SHIFT)
    383     diff --git a/drivers/media/video/au0828/au0828-video.c b/drivers/media/video/au0828/au0828-video.c
    384     index 0b3e481..eab0641 100644
    385     --- a/drivers/media/video/au0828/au0828-video.c
    386     +++ b/drivers/media/video/au0828/au0828-video.c
    387     @@ -1692,14 +1692,18 @@ static int vidioc_streamoff(struct file *file, void *priv,
    388     (AUVI_INPUT(i).audio_setup)(dev, 0);
    389     }
    390    
    391     - videobuf_streamoff(&fh->vb_vidq);
    392     - res_free(fh, AU0828_RESOURCE_VIDEO);
    393     + if (res_check(fh, AU0828_RESOURCE_VIDEO)) {
    394     + videobuf_streamoff(&fh->vb_vidq);
    395     + res_free(fh, AU0828_RESOURCE_VIDEO);
    396     + }
    397     } else if (fh->type == V4L2_BUF_TYPE_VBI_CAPTURE) {
    398     dev->vbi_timeout_running = 0;
    399     del_timer_sync(&dev->vbi_timeout);
    400    
    401     - videobuf_streamoff(&fh->vb_vbiq);
    402     - res_free(fh, AU0828_RESOURCE_VBI);
    403     + if (res_check(fh, AU0828_RESOURCE_VBI)) {
    404     + videobuf_streamoff(&fh->vb_vbiq);
    405     + res_free(fh, AU0828_RESOURCE_VBI);
    406     + }
    407     }
    408    
    409     return 0;
    410     diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
    411     index 47b19c0..eb9f5fb 100644
    412     --- a/drivers/mtd/nand/nand_base.c
    413     +++ b/drivers/mtd/nand/nand_base.c
    414     @@ -2897,9 +2897,7 @@ static int nand_flash_detect_onfi(struct mtd_info *mtd, struct nand_chip *chip,
    415     if (le16_to_cpu(p->features) & 1)
    416     *busw = NAND_BUSWIDTH_16;
    417    
    418     - chip->options &= ~NAND_CHIPOPTIONS_MSK;
    419     - chip->options |= (NAND_NO_READRDY |
    420     - NAND_NO_AUTOINCR) & NAND_CHIPOPTIONS_MSK;
    421     + chip->options |= NAND_NO_READRDY | NAND_NO_AUTOINCR;
    422    
    423     pr_info("ONFI flash detected\n");
    424     return 1;
    425     @@ -3064,9 +3062,8 @@ static struct nand_flash_dev *nand_get_flash_type(struct mtd_info *mtd,
    426     mtd->erasesize <<= ((id_data[3] & 0x03) << 1);
    427     }
    428     }
    429     - /* Get chip options, preserve non chip based options */
    430     - chip->options &= ~NAND_CHIPOPTIONS_MSK;
    431     - chip->options |= type->options & NAND_CHIPOPTIONS_MSK;
    432     + /* Get chip options */
    433     + chip->options |= type->options;
    434    
    435     /*
    436     * Check if chip is not a Samsung device. Do not clear the
    437     diff --git a/drivers/net/ethernet/marvell/skge.c b/drivers/net/ethernet/marvell/skge.c
    438     index 5a30bf8..f4be8f7 100644
    439     --- a/drivers/net/ethernet/marvell/skge.c
    440     +++ b/drivers/net/ethernet/marvell/skge.c
    441     @@ -4153,6 +4153,13 @@ static struct dmi_system_id skge_32bit_dma_boards[] = {
    442     DMI_MATCH(DMI_BOARD_NAME, "nForce"),
    443     },
    444     },
    445     + {
    446     + .ident = "ASUS P5NSLI",
    447     + .matches = {
    448     + DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK Computer INC."),
    449     + DMI_MATCH(DMI_BOARD_NAME, "P5NSLI")
    450     + },
    451     + },
    452     {}
    453     };
    454    
    455     diff --git a/drivers/pcmcia/pxa2xx_sharpsl.c b/drivers/pcmcia/pxa2xx_sharpsl.c
    456     index b066273..7dd879c 100644
    457     --- a/drivers/pcmcia/pxa2xx_sharpsl.c
    458     +++ b/drivers/pcmcia/pxa2xx_sharpsl.c
    459     @@ -194,7 +194,7 @@ static void sharpsl_pcmcia_socket_suspend(struct soc_pcmcia_socket *skt)
    460     sharpsl_pcmcia_init_reset(skt);
    461     }
    462    
    463     -static struct pcmcia_low_level sharpsl_pcmcia_ops __initdata = {
    464     +static struct pcmcia_low_level sharpsl_pcmcia_ops = {
    465     .owner = THIS_MODULE,
    466     .hw_init = sharpsl_pcmcia_hw_init,
    467     .socket_state = sharpsl_pcmcia_socket_state,
    468     diff --git a/drivers/pinctrl/pinctrl-tegra.c b/drivers/pinctrl/pinctrl-tegra.c
    469     index 9b32968..2a32a2f 100644
    470     --- a/drivers/pinctrl/pinctrl-tegra.c
    471     +++ b/drivers/pinctrl/pinctrl-tegra.c
    472     @@ -259,7 +259,7 @@ static int tegra_pinconf_reg(struct tegra_pmx *pmx,
    473     *bank = g->drv_bank;
    474     *reg = g->drv_reg;
    475     *bit = g->lpmd_bit;
    476     - *width = 1;
    477     + *width = 2;
    478     break;
    479     case TEGRA_PINCONF_PARAM_DRIVE_DOWN_STRENGTH:
    480     *bank = g->drv_bank;
    481     diff --git a/drivers/pinctrl/pinctrl-tegra30.c b/drivers/pinctrl/pinctrl-tegra30.c
    482     index 4d7571d..636d96c 100644
    483     --- a/drivers/pinctrl/pinctrl-tegra30.c
    484     +++ b/drivers/pinctrl/pinctrl-tegra30.c
    485     @@ -3343,10 +3343,10 @@ static const struct tegra_function tegra30_functions[] = {
    486     FUNCTION(vi_alt3),
    487     };
    488    
    489     -#define MUXCTL_REG_A 0x3000
    490     -#define PINGROUP_REG_A 0x868
    491     +#define DRV_PINGROUP_REG_A 0x868 /* bank 0 */
    492     +#define PINGROUP_REG_A 0x3000 /* bank 1 */
    493    
    494     -#define PINGROUP_REG_Y(r) ((r) - MUXCTL_REG_A)
    495     +#define PINGROUP_REG_Y(r) ((r) - PINGROUP_REG_A)
    496     #define PINGROUP_REG_N(r) -1
    497    
    498     #define PINGROUP(pg_name, f0, f1, f2, f3, f_safe, r, od, ior) \
    499     @@ -3362,25 +3362,25 @@ static const struct tegra_function tegra30_functions[] = {
    500     }, \
    501     .func_safe = TEGRA_MUX_ ## f_safe, \
    502     .mux_reg = PINGROUP_REG_Y(r), \
    503     - .mux_bank = 0, \
    504     + .mux_bank = 1, \
    505     .mux_bit = 0, \
    506     .pupd_reg = PINGROUP_REG_Y(r), \
    507     - .pupd_bank = 0, \
    508     + .pupd_bank = 1, \
    509     .pupd_bit = 2, \
    510     .tri_reg = PINGROUP_REG_Y(r), \
    511     - .tri_bank = 0, \
    512     + .tri_bank = 1, \
    513     .tri_bit = 4, \
    514     .einput_reg = PINGROUP_REG_Y(r), \
    515     - .einput_bank = 0, \
    516     + .einput_bank = 1, \
    517     .einput_bit = 5, \
    518     .odrain_reg = PINGROUP_REG_##od(r), \
    519     - .odrain_bank = 0, \
    520     + .odrain_bank = 1, \
    521     .odrain_bit = 6, \
    522     .lock_reg = PINGROUP_REG_Y(r), \
    523     - .lock_bank = 0, \
    524     + .lock_bank = 1, \
    525     .lock_bit = 7, \
    526     .ioreset_reg = PINGROUP_REG_##ior(r), \
    527     - .ioreset_bank = 0, \
    528     + .ioreset_bank = 1, \
    529     .ioreset_bit = 8, \
    530     .drv_reg = -1, \
    531     }
    532     @@ -3399,8 +3399,8 @@ static const struct tegra_function tegra30_functions[] = {
    533     .odrain_reg = -1, \
    534     .lock_reg = -1, \
    535     .ioreset_reg = -1, \
    536     - .drv_reg = ((r) - PINGROUP_REG_A), \
    537     - .drv_bank = 1, \
    538     + .drv_reg = ((r) - DRV_PINGROUP_REG_A), \
    539     + .drv_bank = 0, \
    540     .hsm_bit = hsm_b, \
    541     .schmitt_bit = schmitt_b, \
    542     .lpmd_bit = lpmd_b, \
    543     diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
    544     index 7f2fac1..c5f7eae 100644
    545     --- a/drivers/usb/class/cdc-acm.c
    546     +++ b/drivers/usb/class/cdc-acm.c
    547     @@ -818,10 +818,6 @@ static const __u32 acm_tty_speed[] = {
    548     2500000, 3000000, 3500000, 4000000
    549     };
    550    
    551     -static const __u8 acm_tty_size[] = {
    552     - 5, 6, 7, 8
    553     -};
    554     -
    555     static void acm_tty_set_termios(struct tty_struct *tty,
    556     struct ktermios *termios_old)
    557     {
    558     @@ -835,7 +831,21 @@ static void acm_tty_set_termios(struct tty_struct *tty,
    559     newline.bParityType = termios->c_cflag & PARENB ?
    560     (termios->c_cflag & PARODD ? 1 : 2) +
    561     (termios->c_cflag & CMSPAR ? 2 : 0) : 0;
    562     - newline.bDataBits = acm_tty_size[(termios->c_cflag & CSIZE) >> 4];
    563     + switch (termios->c_cflag & CSIZE) {
    564     + case CS5:
    565     + newline.bDataBits = 5;
    566     + break;
    567     + case CS6:
    568     + newline.bDataBits = 6;
    569     + break;
    570     + case CS7:
    571     + newline.bDataBits = 7;
    572     + break;
    573     + case CS8:
    574     + default:
    575     + newline.bDataBits = 8;
    576     + break;
    577     + }
    578     /* FIXME: Needs to clear unsupported bits in the termios */
    579     acm->clocal = ((termios->c_cflag & CLOCAL) != 0);
    580    
    581     @@ -1234,7 +1244,7 @@ made_compressed_probe:
    582    
    583     if (usb_endpoint_xfer_int(epwrite))
    584     usb_fill_int_urb(snd->urb, usb_dev,
    585     - usb_sndbulkpipe(usb_dev, epwrite->bEndpointAddress),
    586     + usb_sndintpipe(usb_dev, epwrite->bEndpointAddress),
    587     NULL, acm->writesize, acm_write_bulk, snd, epwrite->bInterval);
    588     else
    589     usb_fill_bulk_urb(snd->urb, usb_dev,
    590     diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
    591     index b8d4697..cee0c3e 100644
    592     --- a/drivers/usb/dwc3/gadget.c
    593     +++ b/drivers/usb/dwc3/gadget.c
    594     @@ -1777,6 +1777,7 @@ static void dwc3_stop_active_transfer(struct dwc3 *dwc, u32 epnum)
    595     ret = dwc3_send_gadget_ep_cmd(dwc, dep->number, cmd, &params);
    596     WARN_ON_ONCE(ret);
    597     dep->res_trans_idx = 0;
    598     + dep->flags &= ~DWC3_EP_BUSY;
    599     }
    600     }
    601    
    602     diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
    603     index f756231..e52ddfe 100644
    604     --- a/drivers/usb/host/xhci.c
    605     +++ b/drivers/usb/host/xhci.c
    606     @@ -479,7 +479,8 @@ static bool compliance_mode_recovery_timer_quirk_check(void)
    607    
    608     if (strstr(dmi_product_name, "Z420") ||
    609     strstr(dmi_product_name, "Z620") ||
    610     - strstr(dmi_product_name, "Z820"))
    611     + strstr(dmi_product_name, "Z820") ||
    612     + strstr(dmi_product_name, "Z1"))
    613     return true;
    614    
    615     return false;
    616     diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
    617     index 57de734..17ec21e 100644
    618     --- a/drivers/usb/serial/option.c
    619     +++ b/drivers/usb/serial/option.c
    620     @@ -503,11 +503,19 @@ static const struct option_blacklist_info net_intf5_blacklist = {
    621     .reserved = BIT(5),
    622     };
    623    
    624     +static const struct option_blacklist_info net_intf6_blacklist = {
    625     + .reserved = BIT(6),
    626     +};
    627     +
    628     static const struct option_blacklist_info zte_mf626_blacklist = {
    629     .sendsetup = BIT(0) | BIT(1),
    630     .reserved = BIT(4),
    631     };
    632    
    633     +static const struct option_blacklist_info zte_1255_blacklist = {
    634     + .reserved = BIT(3) | BIT(4),
    635     +};
    636     +
    637     static const struct usb_device_id option_ids[] = {
    638     { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
    639     { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) },
    640     @@ -853,13 +861,19 @@ static const struct usb_device_id option_ids[] = {
    641     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0113, 0xff, 0xff, 0xff),
    642     .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
    643     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0117, 0xff, 0xff, 0xff) },
    644     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0118, 0xff, 0xff, 0xff) },
    645     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0121, 0xff, 0xff, 0xff) },
    646     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0118, 0xff, 0xff, 0xff),
    647     + .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
    648     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0121, 0xff, 0xff, 0xff),
    649     + .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
    650     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0122, 0xff, 0xff, 0xff) },
    651     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0123, 0xff, 0xff, 0xff) },
    652     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0124, 0xff, 0xff, 0xff) },
    653     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0125, 0xff, 0xff, 0xff) },
    654     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0126, 0xff, 0xff, 0xff) },
    655     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0123, 0xff, 0xff, 0xff),
    656     + .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    657     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0124, 0xff, 0xff, 0xff),
    658     + .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
    659     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0125, 0xff, 0xff, 0xff),
    660     + .driver_info = (kernel_ulong_t)&net_intf6_blacklist },
    661     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0126, 0xff, 0xff, 0xff),
    662     + .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
    663     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0128, 0xff, 0xff, 0xff) },
    664     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0142, 0xff, 0xff, 0xff) },
    665     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0143, 0xff, 0xff, 0xff) },
    666     @@ -872,7 +886,8 @@ static const struct usb_device_id option_ids[] = {
    667     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0156, 0xff, 0xff, 0xff) },
    668     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0157, 0xff, 0xff, 0xff),
    669     .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
    670     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0158, 0xff, 0xff, 0xff) },
    671     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0158, 0xff, 0xff, 0xff),
    672     + .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
    673     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0159, 0xff, 0xff, 0xff) },
    674     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0161, 0xff, 0xff, 0xff) },
    675     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0162, 0xff, 0xff, 0xff) },
    676     @@ -880,13 +895,22 @@ static const struct usb_device_id option_ids[] = {
    677     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0165, 0xff, 0xff, 0xff) },
    678     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0167, 0xff, 0xff, 0xff),
    679     .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    680     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0191, 0xff, 0xff, 0xff), /* ZTE EuFi890 */
    681     + .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    682     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0199, 0xff, 0xff, 0xff), /* ZTE MF820S */
    683     + .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
    684     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0257, 0xff, 0xff, 0xff), /* ZTE MF821 */
    685     + .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
    686     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0326, 0xff, 0xff, 0xff),
    687     .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    688     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1008, 0xff, 0xff, 0xff),
    689     .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    690     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1010, 0xff, 0xff, 0xff),
    691     .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    692     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1012, 0xff, 0xff, 0xff) },
    693     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1012, 0xff, 0xff, 0xff),
    694     + .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    695     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1021, 0xff, 0xff, 0xff),
    696     + .driver_info = (kernel_ulong_t)&net_intf2_blacklist },
    697     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1057, 0xff, 0xff, 0xff) },
    698     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1058, 0xff, 0xff, 0xff) },
    699     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1059, 0xff, 0xff, 0xff) },
    700     @@ -1002,18 +1026,24 @@ static const struct usb_device_id option_ids[] = {
    701     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1169, 0xff, 0xff, 0xff) },
    702     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1170, 0xff, 0xff, 0xff) },
    703     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1244, 0xff, 0xff, 0xff) },
    704     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1245, 0xff, 0xff, 0xff) },
    705     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1245, 0xff, 0xff, 0xff),
    706     + .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    707     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1246, 0xff, 0xff, 0xff) },
    708     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1247, 0xff, 0xff, 0xff) },
    709     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1247, 0xff, 0xff, 0xff),
    710     + .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    711     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1248, 0xff, 0xff, 0xff) },
    712     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1249, 0xff, 0xff, 0xff) },
    713     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1250, 0xff, 0xff, 0xff) },
    714     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1251, 0xff, 0xff, 0xff) },
    715     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1252, 0xff, 0xff, 0xff) },
    716     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1252, 0xff, 0xff, 0xff),
    717     + .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    718     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1253, 0xff, 0xff, 0xff) },
    719     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1254, 0xff, 0xff, 0xff) },
    720     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1255, 0xff, 0xff, 0xff) },
    721     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1256, 0xff, 0xff, 0xff) },
    722     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1254, 0xff, 0xff, 0xff),
    723     + .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    724     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1255, 0xff, 0xff, 0xff),
    725     + .driver_info = (kernel_ulong_t)&zte_1255_blacklist },
    726     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1256, 0xff, 0xff, 0xff),
    727     + .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    728     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1257, 0xff, 0xff, 0xff) },
    729     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1258, 0xff, 0xff, 0xff) },
    730     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1259, 0xff, 0xff, 0xff) },
    731     @@ -1058,8 +1088,16 @@ static const struct usb_device_id option_ids[] = {
    732     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1298, 0xff, 0xff, 0xff) },
    733     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1299, 0xff, 0xff, 0xff) },
    734     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1300, 0xff, 0xff, 0xff) },
    735     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1401, 0xff, 0xff, 0xff),
    736     + .driver_info = (kernel_ulong_t)&net_intf2_blacklist },
    737     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1402, 0xff, 0xff, 0xff),
    738     .driver_info = (kernel_ulong_t)&net_intf2_blacklist },
    739     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1424, 0xff, 0xff, 0xff),
    740     + .driver_info = (kernel_ulong_t)&net_intf2_blacklist },
    741     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1425, 0xff, 0xff, 0xff),
    742     + .driver_info = (kernel_ulong_t)&net_intf2_blacklist },
    743     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1426, 0xff, 0xff, 0xff), /* ZTE MF91 */
    744     + .driver_info = (kernel_ulong_t)&net_intf2_blacklist },
    745     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff,
    746     0xff, 0xff), .driver_info = (kernel_ulong_t)&zte_k3765_z_blacklist },
    747     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2003, 0xff, 0xff, 0xff) },
    748     @@ -1071,15 +1109,21 @@ static const struct usb_device_id option_ids[] = {
    749     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0070, 0xff, 0xff, 0xff) },
    750     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0073, 0xff, 0xff, 0xff) },
    751     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0094, 0xff, 0xff, 0xff) },
    752     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0130, 0xff, 0xff, 0xff) },
    753     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0133, 0xff, 0xff, 0xff) },
    754     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0141, 0xff, 0xff, 0xff) },
    755     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0130, 0xff, 0xff, 0xff),
    756     + .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
    757     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0133, 0xff, 0xff, 0xff),
    758     + .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
    759     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0141, 0xff, 0xff, 0xff),
    760     + .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
    761     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0147, 0xff, 0xff, 0xff) },
    762     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0152, 0xff, 0xff, 0xff) },
    763     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0168, 0xff, 0xff, 0xff) },
    764     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0168, 0xff, 0xff, 0xff),
    765     + .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    766     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0170, 0xff, 0xff, 0xff) },
    767     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0176, 0xff, 0xff, 0xff) },
    768     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0178, 0xff, 0xff, 0xff) },
    769     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0176, 0xff, 0xff, 0xff),
    770     + .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
    771     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0178, 0xff, 0xff, 0xff),
    772     + .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
    773    
    774     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH, 0xff, 0xff, 0xff) },
    775     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710, 0xff, 0xff, 0xff) },
    776     diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
    777     index 8b384cc..c215985 100644
    778     --- a/fs/ext4/extents.c
    779     +++ b/fs/ext4/extents.c
    780     @@ -52,6 +52,9 @@
    781     #define EXT4_EXT_MARK_UNINIT1 0x2 /* mark first half uninitialized */
    782     #define EXT4_EXT_MARK_UNINIT2 0x4 /* mark second half uninitialized */
    783    
    784     +#define EXT4_EXT_DATA_VALID1 0x8 /* first half contains valid data */
    785     +#define EXT4_EXT_DATA_VALID2 0x10 /* second half contains valid data */
    786     +
    787     static int ext4_split_extent(handle_t *handle,
    788     struct inode *inode,
    789     struct ext4_ext_path *path,
    790     @@ -2829,6 +2832,9 @@ static int ext4_split_extent_at(handle_t *handle,
    791     unsigned int ee_len, depth;
    792     int err = 0;
    793    
    794     + BUG_ON((split_flag & (EXT4_EXT_DATA_VALID1 | EXT4_EXT_DATA_VALID2)) ==
    795     + (EXT4_EXT_DATA_VALID1 | EXT4_EXT_DATA_VALID2));
    796     +
    797     ext_debug("ext4_split_extents_at: inode %lu, logical"
    798     "block %llu\n", inode->i_ino, (unsigned long long)split);
    799    
    800     @@ -2887,7 +2893,14 @@ static int ext4_split_extent_at(handle_t *handle,
    801    
    802     err = ext4_ext_insert_extent(handle, inode, path, &newex, flags);
    803     if (err == -ENOSPC && (EXT4_EXT_MAY_ZEROOUT & split_flag)) {
    804     - err = ext4_ext_zeroout(inode, &orig_ex);
    805     + if (split_flag & (EXT4_EXT_DATA_VALID1|EXT4_EXT_DATA_VALID2)) {
    806     + if (split_flag & EXT4_EXT_DATA_VALID1)
    807     + err = ext4_ext_zeroout(inode, ex2);
    808     + else
    809     + err = ext4_ext_zeroout(inode, ex);
    810     + } else
    811     + err = ext4_ext_zeroout(inode, &orig_ex);
    812     +
    813     if (err)
    814     goto fix_extent_len;
    815     /* update the extent length and mark as initialized */
    816     @@ -2940,12 +2953,13 @@ static int ext4_split_extent(handle_t *handle,
    817     uninitialized = ext4_ext_is_uninitialized(ex);
    818    
    819     if (map->m_lblk + map->m_len < ee_block + ee_len) {
    820     - split_flag1 = split_flag & EXT4_EXT_MAY_ZEROOUT ?
    821     - EXT4_EXT_MAY_ZEROOUT : 0;
    822     + split_flag1 = split_flag & EXT4_EXT_MAY_ZEROOUT;
    823     flags1 = flags | EXT4_GET_BLOCKS_PRE_IO;
    824     if (uninitialized)
    825     split_flag1 |= EXT4_EXT_MARK_UNINIT1 |
    826     EXT4_EXT_MARK_UNINIT2;
    827     + if (split_flag & EXT4_EXT_DATA_VALID2)
    828     + split_flag1 |= EXT4_EXT_DATA_VALID1;
    829     err = ext4_split_extent_at(handle, inode, path,
    830     map->m_lblk + map->m_len, split_flag1, flags1);
    831     if (err)
    832     @@ -2958,8 +2972,8 @@ static int ext4_split_extent(handle_t *handle,
    833     return PTR_ERR(path);
    834    
    835     if (map->m_lblk >= ee_block) {
    836     - split_flag1 = split_flag & EXT4_EXT_MAY_ZEROOUT ?
    837     - EXT4_EXT_MAY_ZEROOUT : 0;
    838     + split_flag1 = split_flag & (EXT4_EXT_MAY_ZEROOUT |
    839     + EXT4_EXT_DATA_VALID2);
    840     if (uninitialized)
    841     split_flag1 |= EXT4_EXT_MARK_UNINIT1;
    842     if (split_flag & EXT4_EXT_MARK_UNINIT2)
    843     @@ -3237,26 +3251,47 @@ static int ext4_split_unwritten_extents(handle_t *handle,
    844    
    845     split_flag |= ee_block + ee_len <= eof_block ? EXT4_EXT_MAY_ZEROOUT : 0;
    846     split_flag |= EXT4_EXT_MARK_UNINIT2;
    847     -
    848     + if (flags & EXT4_GET_BLOCKS_CONVERT)
    849     + split_flag |= EXT4_EXT_DATA_VALID2;
    850     flags |= EXT4_GET_BLOCKS_PRE_IO;
    851     return ext4_split_extent(handle, inode, path, map, split_flag, flags);
    852     }
    853    
    854     static int ext4_convert_unwritten_extents_endio(handle_t *handle,
    855     - struct inode *inode,
    856     - struct ext4_ext_path *path)
    857     + struct inode *inode,
    858     + struct ext4_map_blocks *map,
    859     + struct ext4_ext_path *path)
    860     {
    861     struct ext4_extent *ex;
    862     + ext4_lblk_t ee_block;
    863     + unsigned int ee_len;
    864     int depth;
    865     int err = 0;
    866    
    867     depth = ext_depth(inode);
    868     ex = path[depth].p_ext;
    869     + ee_block = le32_to_cpu(ex->ee_block);
    870     + ee_len = ext4_ext_get_actual_len(ex);
    871    
    872     ext_debug("ext4_convert_unwritten_extents_endio: inode %lu, logical"
    873     "block %llu, max_blocks %u\n", inode->i_ino,
    874     - (unsigned long long)le32_to_cpu(ex->ee_block),
    875     - ext4_ext_get_actual_len(ex));
    876     + (unsigned long long)ee_block, ee_len);
    877     +
    878     + /* If extent is larger than requested then split is required */
    879     + if (ee_block != map->m_lblk || ee_len > map->m_len) {
    880     + err = ext4_split_unwritten_extents(handle, inode, map, path,
    881     + EXT4_GET_BLOCKS_CONVERT);
    882     + if (err < 0)
    883     + goto out;
    884     + ext4_ext_drop_refs(path);
    885     + path = ext4_ext_find_extent(inode, map->m_lblk, path);
    886     + if (IS_ERR(path)) {
    887     + err = PTR_ERR(path);
    888     + goto out;
    889     + }
    890     + depth = ext_depth(inode);
    891     + ex = path[depth].p_ext;
    892     + }
    893    
    894     err = ext4_ext_get_access(handle, inode, path + depth);
    895     if (err)
    896     @@ -3564,7 +3599,7 @@ ext4_ext_handle_uninitialized_extents(handle_t *handle, struct inode *inode,
    897     }
    898     /* IO end_io complete, convert the filled extent to written */
    899     if ((flags & EXT4_GET_BLOCKS_CONVERT)) {
    900     - ret = ext4_convert_unwritten_extents_endio(handle, inode,
    901     + ret = ext4_convert_unwritten_extents_endio(handle, inode, map,
    902     path);
    903     if (ret >= 0) {
    904     ext4_update_inode_fsync_trans(handle, inode, 1);
    905     diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
    906     index 6b0a57e..e77c4fe 100644
    907     --- a/fs/ext4/mballoc.c
    908     +++ b/fs/ext4/mballoc.c
    909     @@ -4984,8 +4984,9 @@ int ext4_trim_fs(struct super_block *sb, struct fstrim_range *range)
    910     end = start + (range->len >> sb->s_blocksize_bits) - 1;
    911     minlen = range->minlen >> sb->s_blocksize_bits;
    912    
    913     - if (unlikely(minlen > EXT4_CLUSTERS_PER_GROUP(sb)) ||
    914     - unlikely(start >= max_blks))
    915     + if (minlen > EXT4_CLUSTERS_PER_GROUP(sb) ||
    916     + start >= max_blks ||
    917     + range->len < sb->s_blocksize)
    918     return -EINVAL;
    919     if (end >= max_blks)
    920     end = max_blks - 1;
    921     diff --git a/fs/lockd/clntxdr.c b/fs/lockd/clntxdr.c
    922     index d269ada..982d267 100644
    923     --- a/fs/lockd/clntxdr.c
    924     +++ b/fs/lockd/clntxdr.c
    925     @@ -223,7 +223,7 @@ static void encode_nlm_stat(struct xdr_stream *xdr,
    926     {
    927     __be32 *p;
    928    
    929     - BUG_ON(be32_to_cpu(stat) > NLM_LCK_DENIED_GRACE_PERIOD);
    930     + WARN_ON_ONCE(be32_to_cpu(stat) > NLM_LCK_DENIED_GRACE_PERIOD);
    931     p = xdr_reserve_space(xdr, 4);
    932     *p = stat;
    933     }
    934     diff --git a/fs/lockd/svcproc.c b/fs/lockd/svcproc.c
    935     index d27aab1..d413af3 100644
    936     --- a/fs/lockd/svcproc.c
    937     +++ b/fs/lockd/svcproc.c
    938     @@ -67,7 +67,8 @@ nlmsvc_retrieve_args(struct svc_rqst *rqstp, struct nlm_args *argp,
    939    
    940     /* Obtain file pointer. Not used by FREE_ALL call. */
    941     if (filp != NULL) {
    942     - if ((error = nlm_lookup_file(rqstp, &file, &lock->fh)) != 0)
    943     + error = cast_status(nlm_lookup_file(rqstp, &file, &lock->fh));
    944     + if (error != 0)
    945     goto no_locks;
    946     *filp = file;
    947    
    948     diff --git a/fs/proc/stat.c b/fs/proc/stat.c
    949     index 64c3b31..e296572 100644
    950     --- a/fs/proc/stat.c
    951     +++ b/fs/proc/stat.c
    952     @@ -45,10 +45,13 @@ static cputime64_t get_iowait_time(int cpu)
    953    
    954     static u64 get_idle_time(int cpu)
    955     {
    956     - u64 idle, idle_time = get_cpu_idle_time_us(cpu, NULL);
    957     + u64 idle, idle_time = -1ULL;
    958     +
    959     + if (cpu_online(cpu))
    960     + idle_time = get_cpu_idle_time_us(cpu, NULL);
    961    
    962     if (idle_time == -1ULL)
    963     - /* !NO_HZ so we can rely on cpustat.idle */
    964     + /* !NO_HZ or cpu offline so we can rely on cpustat.idle */
    965     idle = kcpustat_cpu(cpu).cpustat[CPUTIME_IDLE];
    966     else
    967     idle = usecs_to_cputime64(idle_time);
    968     @@ -58,10 +61,13 @@ static u64 get_idle_time(int cpu)
    969    
    970     static u64 get_iowait_time(int cpu)
    971     {
    972     - u64 iowait, iowait_time = get_cpu_iowait_time_us(cpu, NULL);
    973     + u64 iowait, iowait_time = -1ULL;
    974     +
    975     + if (cpu_online(cpu))
    976     + iowait_time = get_cpu_iowait_time_us(cpu, NULL);
    977    
    978     if (iowait_time == -1ULL)
    979     - /* !NO_HZ so we can rely on cpustat.iowait */
    980     + /* !NO_HZ or cpu offline so we can rely on cpustat.iowait */
    981     iowait = kcpustat_cpu(cpu).cpustat[CPUTIME_IOWAIT];
    982     else
    983     iowait = usecs_to_cputime64(iowait_time);
    984     diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h
    985     index a810987..561e130 100644
    986     --- a/include/linux/if_vlan.h
    987     +++ b/include/linux/if_vlan.h
    988     @@ -82,6 +82,8 @@ static inline int is_vlan_dev(struct net_device *dev)
    989     }
    990    
    991     #define vlan_tx_tag_present(__skb) ((__skb)->vlan_tci & VLAN_TAG_PRESENT)
    992     +#define vlan_tx_nonzero_tag_present(__skb) \
    993     + (vlan_tx_tag_present(__skb) && ((__skb)->vlan_tci & VLAN_VID_MASK))
    994     #define vlan_tx_tag_get(__skb) ((__skb)->vlan_tci & ~VLAN_TAG_PRESENT)
    995    
    996     #if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
    997     @@ -91,7 +93,7 @@ extern struct net_device *__vlan_find_dev_deep(struct net_device *real_dev,
    998     extern struct net_device *vlan_dev_real_dev(const struct net_device *dev);
    999     extern u16 vlan_dev_vlan_id(const struct net_device *dev);
    1000    
    1001     -extern bool vlan_do_receive(struct sk_buff **skb, bool last_handler);
    1002     +extern bool vlan_do_receive(struct sk_buff **skb);
    1003     extern struct sk_buff *vlan_untag(struct sk_buff *skb);
    1004    
    1005     extern int vlan_vid_add(struct net_device *dev, unsigned short vid);
    1006     @@ -120,10 +122,8 @@ static inline u16 vlan_dev_vlan_id(const struct net_device *dev)
    1007     return 0;
    1008     }
    1009    
    1010     -static inline bool vlan_do_receive(struct sk_buff **skb, bool last_handler)
    1011     +static inline bool vlan_do_receive(struct sk_buff **skb)
    1012     {
    1013     - if (((*skb)->vlan_tci & VLAN_VID_MASK) && last_handler)
    1014     - (*skb)->pkt_type = PACKET_OTHERHOST;
    1015     return false;
    1016     }
    1017    
    1018     diff --git a/include/linux/mtd/nand.h b/include/linux/mtd/nand.h
    1019     index 1482340..2483513 100644
    1020     --- a/include/linux/mtd/nand.h
    1021     +++ b/include/linux/mtd/nand.h
    1022     @@ -215,9 +215,6 @@ typedef enum {
    1023     #define NAND_SUBPAGE_READ(chip) ((chip->ecc.mode == NAND_ECC_SOFT) \
    1024     && (chip->page_shift > 9))
    1025    
    1026     -/* Mask to zero out the chip options, which come from the id table */
    1027     -#define NAND_CHIPOPTIONS_MSK (0x0000ffff & ~NAND_NO_AUTOINCR)
    1028     -
    1029     /* Non chip related options */
    1030     /* This option skips the bbt scan during initialization. */
    1031     #define NAND_SKIP_BBTSCAN 0x00010000
    1032     diff --git a/include/linux/netlink.h b/include/linux/netlink.h
    1033     index a2092f5..b23e9cd 100644
    1034     --- a/include/linux/netlink.h
    1035     +++ b/include/linux/netlink.h
    1036     @@ -153,6 +153,7 @@ struct nlattr {
    1037    
    1038     #include <linux/capability.h>
    1039     #include <linux/skbuff.h>
    1040     +#include <linux/export.h>
    1041    
    1042     struct net;
    1043    
    1044     @@ -226,6 +227,8 @@ struct netlink_callback {
    1045     struct netlink_callback *cb);
    1046     int (*done)(struct netlink_callback *cb);
    1047     void *data;
    1048     + /* the module that dump function belong to */
    1049     + struct module *module;
    1050     u16 family;
    1051     u16 min_dump_alloc;
    1052     unsigned int prev_seq, seq;
    1053     @@ -251,14 +254,24 @@ __nlmsg_put(struct sk_buff *skb, u32 pid, u32 seq, int type, int len, int flags)
    1054    
    1055     struct netlink_dump_control {
    1056     int (*dump)(struct sk_buff *skb, struct netlink_callback *);
    1057     - int (*done)(struct netlink_callback*);
    1058     + int (*done)(struct netlink_callback *);
    1059     void *data;
    1060     + struct module *module;
    1061     u16 min_dump_alloc;
    1062     };
    1063    
    1064     -extern int netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
    1065     - const struct nlmsghdr *nlh,
    1066     - struct netlink_dump_control *control);
    1067     +extern int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
    1068     + const struct nlmsghdr *nlh,
    1069     + struct netlink_dump_control *control);
    1070     +static inline int netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
    1071     + const struct nlmsghdr *nlh,
    1072     + struct netlink_dump_control *control)
    1073     +{
    1074     + if (!control->module)
    1075     + control->module = THIS_MODULE;
    1076     +
    1077     + return __netlink_dump_start(ssk, skb, nlh, control);
    1078     +}
    1079    
    1080    
    1081     #define NL_NONROOT_RECV 0x1
    1082     diff --git a/include/linux/sunrpc/xprt.h b/include/linux/sunrpc/xprt.h
    1083     index 77d278d..005b507 100644
    1084     --- a/include/linux/sunrpc/xprt.h
    1085     +++ b/include/linux/sunrpc/xprt.h
    1086     @@ -114,6 +114,7 @@ struct rpc_xprt_ops {
    1087     void (*set_buffer_size)(struct rpc_xprt *xprt, size_t sndsize, size_t rcvsize);
    1088     int (*reserve_xprt)(struct rpc_xprt *xprt, struct rpc_task *task);
    1089     void (*release_xprt)(struct rpc_xprt *xprt, struct rpc_task *task);
    1090     + void (*alloc_slot)(struct rpc_xprt *xprt, struct rpc_task *task);
    1091     void (*rpcbind)(struct rpc_task *task);
    1092     void (*set_port)(struct rpc_xprt *xprt, unsigned short port);
    1093     void (*connect)(struct rpc_task *task);
    1094     @@ -279,6 +280,8 @@ void xprt_connect(struct rpc_task *task);
    1095     void xprt_reserve(struct rpc_task *task);
    1096     int xprt_reserve_xprt(struct rpc_xprt *xprt, struct rpc_task *task);
    1097     int xprt_reserve_xprt_cong(struct rpc_xprt *xprt, struct rpc_task *task);
    1098     +void xprt_alloc_slot(struct rpc_xprt *xprt, struct rpc_task *task);
    1099     +void xprt_lock_and_alloc_slot(struct rpc_xprt *xprt, struct rpc_task *task);
    1100     int xprt_prepare_transmit(struct rpc_task *task);
    1101     void xprt_transmit(struct rpc_task *task);
    1102     void xprt_end_transmit(struct rpc_task *task);
    1103     diff --git a/include/rdma/rdma_netlink.h b/include/rdma/rdma_netlink.h
    1104     index 3c5363a..bd3d8b2 100644
    1105     --- a/include/rdma/rdma_netlink.h
    1106     +++ b/include/rdma/rdma_netlink.h
    1107     @@ -39,6 +39,7 @@ struct rdma_cm_id_stats {
    1108    
    1109     struct ibnl_client_cbs {
    1110     int (*dump)(struct sk_buff *skb, struct netlink_callback *nlcb);
    1111     + struct module *module;
    1112     };
    1113    
    1114     int ibnl_init(void);
    1115     diff --git a/kernel/cgroup.c b/kernel/cgroup.c
    1116     index ed64cca..762f7cc7 100644
    1117     --- a/kernel/cgroup.c
    1118     +++ b/kernel/cgroup.c
    1119     @@ -1868,9 +1868,8 @@ static void cgroup_task_migrate(struct cgroup *cgrp, struct cgroup *oldcgrp,
    1120     * trading it for newcg is protected by cgroup_mutex, we're safe to drop
    1121     * it here; it will be freed under RCU.
    1122     */
    1123     - put_css_set(oldcg);
    1124     -
    1125     set_bit(CGRP_RELEASABLE, &oldcgrp->flags);
    1126     + put_css_set(oldcg);
    1127     }
    1128    
    1129     /**
    1130     @@ -4463,31 +4462,20 @@ static const struct file_operations proc_cgroupstats_operations = {
    1131     *
    1132     * A pointer to the shared css_set was automatically copied in
    1133     * fork.c by dup_task_struct(). However, we ignore that copy, since
    1134     - * it was not made under the protection of RCU, cgroup_mutex or
    1135     - * threadgroup_change_begin(), so it might no longer be a valid
    1136     - * cgroup pointer. cgroup_attach_task() might have already changed
    1137     - * current->cgroups, allowing the previously referenced cgroup
    1138     - * group to be removed and freed.
    1139     - *
    1140     - * Outside the pointer validity we also need to process the css_set
    1141     - * inheritance between threadgoup_change_begin() and
    1142     - * threadgoup_change_end(), this way there is no leak in any process
    1143     - * wide migration performed by cgroup_attach_proc() that could otherwise
    1144     - * miss a thread because it is too early or too late in the fork stage.
    1145     + * it was not made under the protection of RCU or cgroup_mutex, so
    1146     + * might no longer be a valid cgroup pointer. cgroup_attach_task() might
    1147     + * have already changed current->cgroups, allowing the previously
    1148     + * referenced cgroup group to be removed and freed.
    1149     *
    1150     * At the point that cgroup_fork() is called, 'current' is the parent
    1151     * task, and the passed argument 'child' points to the child task.
    1152     */
    1153     void cgroup_fork(struct task_struct *child)
    1154     {
    1155     - /*
    1156     - * We don't need to task_lock() current because current->cgroups
    1157     - * can't be changed concurrently here. The parent obviously hasn't
    1158     - * exited and called cgroup_exit(), and we are synchronized against
    1159     - * cgroup migration through threadgroup_change_begin().
    1160     - */
    1161     + task_lock(current);
    1162     child->cgroups = current->cgroups;
    1163     get_css_set(child->cgroups);
    1164     + task_unlock(current);
    1165     INIT_LIST_HEAD(&child->cg_list);
    1166     }
    1167    
    1168     @@ -4540,19 +4528,10 @@ void cgroup_post_fork(struct task_struct *child)
    1169     */
    1170     if (use_task_css_set_links) {
    1171     write_lock(&css_set_lock);
    1172     - if (list_empty(&child->cg_list)) {
    1173     - /*
    1174     - * It's safe to use child->cgroups without task_lock()
    1175     - * here because we are protected through
    1176     - * threadgroup_change_begin() against concurrent
    1177     - * css_set change in cgroup_task_migrate(). Also
    1178     - * the task can't exit at that point until
    1179     - * wake_up_new_task() is called, so we are protected
    1180     - * against cgroup_exit() setting child->cgroup to
    1181     - * init_css_set.
    1182     - */
    1183     + task_lock(child);
    1184     + if (list_empty(&child->cg_list))
    1185     list_add(&child->cg_list, &child->cgroups->tasks);
    1186     - }
    1187     + task_unlock(child);
    1188     write_unlock(&css_set_lock);
    1189     }
    1190     }
    1191     diff --git a/kernel/sys.c b/kernel/sys.c
    1192     index 898a84c..b0003db 100644
    1193     --- a/kernel/sys.c
    1194     +++ b/kernel/sys.c
    1195     @@ -1180,15 +1180,16 @@ DECLARE_RWSEM(uts_sem);
    1196     * Work around broken programs that cannot handle "Linux 3.0".
    1197     * Instead we map 3.x to 2.6.40+x, so e.g. 3.0 would be 2.6.40
    1198     */
    1199     -static int override_release(char __user *release, int len)
    1200     +static int override_release(char __user *release, size_t len)
    1201     {
    1202     int ret = 0;
    1203     - char buf[65];
    1204    
    1205     if (current->personality & UNAME26) {
    1206     - char *rest = UTS_RELEASE;
    1207     + const char *rest = UTS_RELEASE;
    1208     + char buf[65] = { 0 };
    1209     int ndots = 0;
    1210     unsigned v;
    1211     + size_t copy;
    1212    
    1213     while (*rest) {
    1214     if (*rest == '.' && ++ndots >= 3)
    1215     @@ -1198,8 +1199,9 @@ static int override_release(char __user *release, int len)
    1216     rest++;
    1217     }
    1218     v = ((LINUX_VERSION_CODE >> 8) & 0xff) + 40;
    1219     - snprintf(buf, len, "2.6.%u%s", v, rest);
    1220     - ret = copy_to_user(release, buf, len);
    1221     + copy = clamp_t(size_t, len, 1, sizeof(buf));
    1222     + copy = scnprintf(buf, copy, "2.6.%u%s", v, rest);
    1223     + ret = copy_to_user(release, buf, copy + 1);
    1224     }
    1225     return ret;
    1226     }
    1227     diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
    1228     index f364630..912613c 100644
    1229     --- a/net/8021q/vlan_core.c
    1230     +++ b/net/8021q/vlan_core.c
    1231     @@ -5,7 +5,7 @@
    1232     #include <linux/export.h>
    1233     #include "vlan.h"
    1234    
    1235     -bool vlan_do_receive(struct sk_buff **skbp, bool last_handler)
    1236     +bool vlan_do_receive(struct sk_buff **skbp)
    1237     {
    1238     struct sk_buff *skb = *skbp;
    1239     u16 vlan_id = skb->vlan_tci & VLAN_VID_MASK;
    1240     @@ -13,14 +13,8 @@ bool vlan_do_receive(struct sk_buff **skbp, bool last_handler)
    1241     struct vlan_pcpu_stats *rx_stats;
    1242    
    1243     vlan_dev = vlan_find_dev(skb->dev, vlan_id);
    1244     - if (!vlan_dev) {
    1245     - /* Only the last call to vlan_do_receive() should change
    1246     - * pkt_type to PACKET_OTHERHOST
    1247     - */
    1248     - if (vlan_id && last_handler)
    1249     - skb->pkt_type = PACKET_OTHERHOST;
    1250     + if (!vlan_dev)
    1251     return false;
    1252     - }
    1253    
    1254     skb = *skbp = skb_share_check(skb, GFP_ATOMIC);
    1255     if (unlikely(!skb))
    1256     diff --git a/net/core/dev.c b/net/core/dev.c
    1257     index 086bc2e..82ca51b 100644
    1258     --- a/net/core/dev.c
    1259     +++ b/net/core/dev.c
    1260     @@ -3209,18 +3209,18 @@ another_round:
    1261     ncls:
    1262     #endif
    1263    
    1264     - rx_handler = rcu_dereference(skb->dev->rx_handler);
    1265     if (vlan_tx_tag_present(skb)) {
    1266     if (pt_prev) {
    1267     ret = deliver_skb(skb, pt_prev, orig_dev);
    1268     pt_prev = NULL;
    1269     }
    1270     - if (vlan_do_receive(&skb, !rx_handler))
    1271     + if (vlan_do_receive(&skb))
    1272     goto another_round;
    1273     else if (unlikely(!skb))
    1274     goto out;
    1275     }
    1276    
    1277     + rx_handler = rcu_dereference(skb->dev->rx_handler);
    1278     if (rx_handler) {
    1279     if (pt_prev) {
    1280     ret = deliver_skb(skb, pt_prev, orig_dev);
    1281     @@ -3240,6 +3240,9 @@ ncls:
    1282     }
    1283     }
    1284    
    1285     + if (vlan_tx_nonzero_tag_present(skb))
    1286     + skb->pkt_type = PACKET_OTHERHOST;
    1287     +
    1288     /* deliver only exact match when indicated */
    1289     null_or_dev = deliver_exact ? skb->dev : NULL;
    1290    
    1291     diff --git a/net/core/neighbour.c b/net/core/neighbour.c
    1292     index 73b9035..ac88107 100644
    1293     --- a/net/core/neighbour.c
    1294     +++ b/net/core/neighbour.c
    1295     @@ -1285,8 +1285,6 @@ int neigh_resolve_output(struct neighbour *neigh, struct sk_buff *skb)
    1296     if (!dst)
    1297     goto discard;
    1298    
    1299     - __skb_pull(skb, skb_network_offset(skb));
    1300     -
    1301     if (!neigh_event_send(neigh, skb)) {
    1302     int err;
    1303     struct net_device *dev = neigh->dev;
    1304     @@ -1296,6 +1294,7 @@ int neigh_resolve_output(struct neighbour *neigh, struct sk_buff *skb)
    1305     neigh_hh_init(neigh, dst);
    1306    
    1307     do {
    1308     + __skb_pull(skb, skb_network_offset(skb));
    1309     seq = read_seqbegin(&neigh->ha_lock);
    1310     err = dev_hard_header(skb, dev, ntohs(skb->protocol),
    1311     neigh->ha, NULL, skb->len);
    1312     @@ -1326,9 +1325,8 @@ int neigh_connected_output(struct neighbour *neigh, struct sk_buff *skb)
    1313     unsigned int seq;
    1314     int err;
    1315    
    1316     - __skb_pull(skb, skb_network_offset(skb));
    1317     -
    1318     do {
    1319     + __skb_pull(skb, skb_network_offset(skb));
    1320     seq = read_seqbegin(&neigh->ha_lock);
    1321     err = dev_hard_header(skb, dev, ntohs(skb->protocol),
    1322     neigh->ha, NULL, skb->len);
    1323     diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
    1324     index 0cb86ce..8f2458d 100644
    1325     --- a/net/ipv4/tcp_ipv4.c
    1326     +++ b/net/ipv4/tcp_ipv4.c
    1327     @@ -678,10 +678,11 @@ static void tcp_v4_send_reset(struct sock *sk, struct sk_buff *skb)
    1328     arg.csumoffset = offsetof(struct tcphdr, check) / 2;
    1329     arg.flags = (sk && inet_sk(sk)->transparent) ? IP_REPLY_ARG_NOSRCCHECK : 0;
    1330     /* When socket is gone, all binding information is lost.
    1331     - * routing might fail in this case. using iif for oif to
    1332     - * make sure we can deliver it
    1333     + * routing might fail in this case. No choice here, if we choose to force
    1334     + * input interface, we will misroute in case of asymmetric route.
    1335     */
    1336     - arg.bound_dev_if = sk ? sk->sk_bound_dev_if : inet_iif(skb);
    1337     + if (sk)
    1338     + arg.bound_dev_if = sk->sk_bound_dev_if;
    1339    
    1340     net = dev_net(skb_dst(skb)->dev);
    1341     arg.tos = ip_hdr(skb)->tos;
    1342     diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
    1343     index 5ec6069..468a5ce 100644
    1344     --- a/net/ipv6/addrconf.c
    1345     +++ b/net/ipv6/addrconf.c
    1346     @@ -3095,14 +3095,15 @@ static struct inet6_ifaddr *if6_get_first(struct seq_file *seq, loff_t pos)
    1347     struct hlist_node *n;
    1348     hlist_for_each_entry_rcu_bh(ifa, n, &inet6_addr_lst[state->bucket],
    1349     addr_lst) {
    1350     + if (!net_eq(dev_net(ifa->idev->dev), net))
    1351     + continue;
    1352     /* sync with offset */
    1353     if (p < state->offset) {
    1354     p++;
    1355     continue;
    1356     }
    1357     state->offset++;
    1358     - if (net_eq(dev_net(ifa->idev->dev), net))
    1359     - return ifa;
    1360     + return ifa;
    1361     }
    1362    
    1363     /* prepare for next bucket */
    1364     @@ -3120,18 +3121,20 @@ static struct inet6_ifaddr *if6_get_next(struct seq_file *seq,
    1365     struct hlist_node *n = &ifa->addr_lst;
    1366    
    1367     hlist_for_each_entry_continue_rcu_bh(ifa, n, addr_lst) {
    1368     + if (!net_eq(dev_net(ifa->idev->dev), net))
    1369     + continue;
    1370     state->offset++;
    1371     - if (net_eq(dev_net(ifa->idev->dev), net))
    1372     - return ifa;
    1373     + return ifa;
    1374     }
    1375    
    1376     while (++state->bucket < IN6_ADDR_HSIZE) {
    1377     state->offset = 0;
    1378     hlist_for_each_entry_rcu_bh(ifa, n,
    1379     &inet6_addr_lst[state->bucket], addr_lst) {
    1380     + if (!net_eq(dev_net(ifa->idev->dev), net))
    1381     + continue;
    1382     state->offset++;
    1383     - if (net_eq(dev_net(ifa->idev->dev), net))
    1384     - return ifa;
    1385     + return ifa;
    1386     }
    1387     }
    1388    
    1389     diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
    1390     index 98256cf..8a8fa2d 100644
    1391     --- a/net/ipv6/tcp_ipv6.c
    1392     +++ b/net/ipv6/tcp_ipv6.c
    1393     @@ -896,7 +896,8 @@ static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
    1394     __tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
    1395    
    1396     fl6.flowi6_proto = IPPROTO_TCP;
    1397     - fl6.flowi6_oif = inet6_iif(skb);
    1398     + if (ipv6_addr_type(&fl6.daddr) & IPV6_ADDR_LINKLOCAL)
    1399     + fl6.flowi6_oif = inet6_iif(skb);
    1400     fl6.fl6_dport = t1->dest;
    1401     fl6.fl6_sport = t1->source;
    1402     security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
    1403     diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
    1404     index bba6ba1..edce424 100644
    1405     --- a/net/netlink/af_netlink.c
    1406     +++ b/net/netlink/af_netlink.c
    1407     @@ -156,6 +156,8 @@ static void netlink_sock_destruct(struct sock *sk)
    1408     if (nlk->cb) {
    1409     if (nlk->cb->done)
    1410     nlk->cb->done(nlk->cb);
    1411     +
    1412     + module_put(nlk->cb->module);
    1413     netlink_destroy_callback(nlk->cb);
    1414     }
    1415    
    1416     @@ -1728,6 +1730,7 @@ static int netlink_dump(struct sock *sk)
    1417     nlk->cb = NULL;
    1418     mutex_unlock(nlk->cb_mutex);
    1419    
    1420     + module_put(cb->module);
    1421     netlink_destroy_callback(cb);
    1422     return 0;
    1423    
    1424     @@ -1737,9 +1740,9 @@ errout_skb:
    1425     return err;
    1426     }
    1427    
    1428     -int netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
    1429     - const struct nlmsghdr *nlh,
    1430     - struct netlink_dump_control *control)
    1431     +int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
    1432     + const struct nlmsghdr *nlh,
    1433     + struct netlink_dump_control *control)
    1434     {
    1435     struct netlink_callback *cb;
    1436     struct sock *sk;
    1437     @@ -1754,6 +1757,7 @@ int netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
    1438     cb->done = control->done;
    1439     cb->nlh = nlh;
    1440     cb->data = control->data;
    1441     + cb->module = control->module;
    1442     cb->min_dump_alloc = control->min_dump_alloc;
    1443     atomic_inc(&skb->users);
    1444     cb->skb = skb;
    1445     @@ -1764,19 +1768,28 @@ int netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
    1446     return -ECONNREFUSED;
    1447     }
    1448     nlk = nlk_sk(sk);
    1449     - /* A dump is in progress... */
    1450     +
    1451     mutex_lock(nlk->cb_mutex);
    1452     + /* A dump is in progress... */
    1453     if (nlk->cb) {
    1454     mutex_unlock(nlk->cb_mutex);
    1455     netlink_destroy_callback(cb);
    1456     - sock_put(sk);
    1457     - return -EBUSY;
    1458     + ret = -EBUSY;
    1459     + goto out;
    1460     }
    1461     + /* add reference of module which cb->dump belongs to */
    1462     + if (!try_module_get(cb->module)) {
    1463     + mutex_unlock(nlk->cb_mutex);
    1464     + netlink_destroy_callback(cb);
    1465     + ret = -EPROTONOSUPPORT;
    1466     + goto out;
    1467     + }
    1468     +
    1469     nlk->cb = cb;
    1470     mutex_unlock(nlk->cb_mutex);
    1471    
    1472     ret = netlink_dump(sk);
    1473     -
    1474     +out:
    1475     sock_put(sk);
    1476    
    1477     if (ret)
    1478     @@ -1787,7 +1800,7 @@ int netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
    1479     */
    1480     return -EINTR;
    1481     }
    1482     -EXPORT_SYMBOL(netlink_dump_start);
    1483     +EXPORT_SYMBOL(__netlink_dump_start);
    1484    
    1485     void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err)
    1486     {
    1487     diff --git a/net/rds/send.c b/net/rds/send.c
    1488     index 96531d4..88eace5 100644
    1489     --- a/net/rds/send.c
    1490     +++ b/net/rds/send.c
    1491     @@ -1122,7 +1122,7 @@ rds_send_pong(struct rds_connection *conn, __be16 dport)
    1492     rds_stats_inc(s_send_pong);
    1493    
    1494     if (!test_bit(RDS_LL_SEND_FULL, &conn->c_flags))
    1495     - rds_send_xmit(conn);
    1496     + queue_delayed_work(rds_wq, &conn->c_send_w, 0);
    1497    
    1498     rds_message_put(rm);
    1499     return 0;
    1500     diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
    1501     index de0b0f3..76cb304 100644
    1502     --- a/net/sunrpc/cache.c
    1503     +++ b/net/sunrpc/cache.c
    1504     @@ -1406,11 +1406,11 @@ static ssize_t read_flush(struct file *file, char __user *buf,
    1505     size_t count, loff_t *ppos,
    1506     struct cache_detail *cd)
    1507     {
    1508     - char tbuf[20];
    1509     + char tbuf[22];
    1510     unsigned long p = *ppos;
    1511     size_t len;
    1512    
    1513     - sprintf(tbuf, "%lu\n", convert_to_wallclock(cd->flush_time));
    1514     + snprintf(tbuf, sizeof(tbuf), "%lu\n", convert_to_wallclock(cd->flush_time));
    1515     len = strlen(tbuf);
    1516     if (p >= len)
    1517     return 0;
    1518     diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
    1519     index da72492..176a24f 100644
    1520     --- a/net/sunrpc/xprt.c
    1521     +++ b/net/sunrpc/xprt.c
    1522     @@ -969,11 +969,11 @@ static bool xprt_dynamic_free_slot(struct rpc_xprt *xprt, struct rpc_rqst *req)
    1523     return false;
    1524     }
    1525    
    1526     -static void xprt_alloc_slot(struct rpc_task *task)
    1527     +void xprt_alloc_slot(struct rpc_xprt *xprt, struct rpc_task *task)
    1528     {
    1529     - struct rpc_xprt *xprt = task->tk_xprt;
    1530     struct rpc_rqst *req;
    1531    
    1532     + spin_lock(&xprt->reserve_lock);
    1533     if (!list_empty(&xprt->free)) {
    1534     req = list_entry(xprt->free.next, struct rpc_rqst, rq_list);
    1535     list_del(&req->rq_list);
    1536     @@ -994,12 +994,29 @@ static void xprt_alloc_slot(struct rpc_task *task)
    1537     default:
    1538     task->tk_status = -EAGAIN;
    1539     }
    1540     + spin_unlock(&xprt->reserve_lock);
    1541     return;
    1542     out_init_req:
    1543     task->tk_status = 0;
    1544     task->tk_rqstp = req;
    1545     xprt_request_init(task, xprt);
    1546     + spin_unlock(&xprt->reserve_lock);
    1547     +}
    1548     +EXPORT_SYMBOL_GPL(xprt_alloc_slot);
    1549     +
    1550     +void xprt_lock_and_alloc_slot(struct rpc_xprt *xprt, struct rpc_task *task)
    1551     +{
    1552     + /* Note: grabbing the xprt_lock_write() ensures that we throttle
    1553     + * new slot allocation if the transport is congested (i.e. when
    1554     + * reconnecting a stream transport or when out of socket write
    1555     + * buffer space).
    1556     + */
    1557     + if (xprt_lock_write(xprt, task)) {
    1558     + xprt_alloc_slot(xprt, task);
    1559     + xprt_release_write(xprt, task);
    1560     + }
    1561     }
    1562     +EXPORT_SYMBOL_GPL(xprt_lock_and_alloc_slot);
    1563    
    1564     static void xprt_free_slot(struct rpc_xprt *xprt, struct rpc_rqst *req)
    1565     {
    1566     @@ -1083,20 +1100,9 @@ void xprt_reserve(struct rpc_task *task)
    1567     if (task->tk_rqstp != NULL)
    1568     return;
    1569    
    1570     - /* Note: grabbing the xprt_lock_write() here is not strictly needed,
    1571     - * but ensures that we throttle new slot allocation if the transport
    1572     - * is congested (e.g. if reconnecting or if we're out of socket
    1573     - * write buffer space).
    1574     - */
    1575     task->tk_timeout = 0;
    1576     task->tk_status = -EAGAIN;
    1577     - if (!xprt_lock_write(xprt, task))
    1578     - return;
    1579     -
    1580     - spin_lock(&xprt->reserve_lock);
    1581     - xprt_alloc_slot(task);
    1582     - spin_unlock(&xprt->reserve_lock);
    1583     - xprt_release_write(xprt, task);
    1584     + xprt->ops->alloc_slot(xprt, task);
    1585     }
    1586    
    1587     static inline __be32 xprt_alloc_xid(struct rpc_xprt *xprt)
    1588     diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
    1589     index 06cdbff..5d9202d 100644
    1590     --- a/net/sunrpc/xprtrdma/transport.c
    1591     +++ b/net/sunrpc/xprtrdma/transport.c
    1592     @@ -713,6 +713,7 @@ static void xprt_rdma_print_stats(struct rpc_xprt *xprt, struct seq_file *seq)
    1593     static struct rpc_xprt_ops xprt_rdma_procs = {
    1594     .reserve_xprt = xprt_rdma_reserve_xprt,
    1595     .release_xprt = xprt_release_xprt_cong, /* sunrpc/xprt.c */
    1596     + .alloc_slot = xprt_alloc_slot,
    1597     .release_request = xprt_release_rqst_cong, /* ditto */
    1598     .set_retrans_timeout = xprt_set_retrans_timeout_def, /* ditto */
    1599     .rpcbind = rpcb_getport_async, /* sunrpc/rpcb_clnt.c */
    1600     diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
    1601     index 00ff343..a4a6586 100644
    1602     --- a/net/sunrpc/xprtsock.c
    1603     +++ b/net/sunrpc/xprtsock.c
    1604     @@ -2444,6 +2444,7 @@ static void bc_destroy(struct rpc_xprt *xprt)
    1605     static struct rpc_xprt_ops xs_local_ops = {
    1606     .reserve_xprt = xprt_reserve_xprt,
    1607     .release_xprt = xs_tcp_release_xprt,
    1608     + .alloc_slot = xprt_alloc_slot,
    1609     .rpcbind = xs_local_rpcbind,
    1610     .set_port = xs_local_set_port,
    1611     .connect = xs_connect,
    1612     @@ -2460,6 +2461,7 @@ static struct rpc_xprt_ops xs_udp_ops = {
    1613     .set_buffer_size = xs_udp_set_buffer_size,
    1614     .reserve_xprt = xprt_reserve_xprt_cong,
    1615     .release_xprt = xprt_release_xprt_cong,
    1616     + .alloc_slot = xprt_alloc_slot,
    1617     .rpcbind = rpcb_getport_async,
    1618     .set_port = xs_set_port,
    1619     .connect = xs_connect,
    1620     @@ -2477,6 +2479,7 @@ static struct rpc_xprt_ops xs_udp_ops = {
    1621     static struct rpc_xprt_ops xs_tcp_ops = {
    1622     .reserve_xprt = xprt_reserve_xprt,
    1623     .release_xprt = xs_tcp_release_xprt,
    1624     + .alloc_slot = xprt_lock_and_alloc_slot,
    1625     .rpcbind = rpcb_getport_async,
    1626     .set_port = xs_set_port,
    1627     .connect = xs_connect,
    1628     @@ -2496,6 +2499,7 @@ static struct rpc_xprt_ops xs_tcp_ops = {
    1629     static struct rpc_xprt_ops bc_tcp_ops = {
    1630     .reserve_xprt = xprt_reserve_xprt,
    1631     .release_xprt = xprt_release_xprt,
    1632     + .alloc_slot = xprt_alloc_slot,
    1633     .rpcbind = xs_local_rpcbind,
    1634     .buf_alloc = bc_malloc,
    1635     .buf_free = bc_free,