Magellan Linux

Contents of /trunk/kernel-alx/patches-4.4/0106-4.4.7-all-fixes.patch

Parent Directory Parent Directory | Revision Log Revision Log


Revision 2798 - (show annotations) (download)
Mon May 30 12:45:54 2016 UTC (8 years, 5 months ago) by niro
File size: 278845 byte(s)
-linux-4.4.7
1 diff --git a/MAINTAINERS b/MAINTAINERS
2 index d826f1b9eb02..4c3e1d2ac31b 100644
3 --- a/MAINTAINERS
4 +++ b/MAINTAINERS
5 @@ -230,13 +230,13 @@ F: kernel/sys_ni.c
6
7 ABIT UGURU 1,2 HARDWARE MONITOR DRIVER
8 M: Hans de Goede <hdegoede@redhat.com>
9 -L: lm-sensors@lm-sensors.org
10 +L: linux-hwmon@vger.kernel.org
11 S: Maintained
12 F: drivers/hwmon/abituguru.c
13
14 ABIT UGURU 3 HARDWARE MONITOR DRIVER
15 M: Alistair John Strachan <alistair@devzero.co.uk>
16 -L: lm-sensors@lm-sensors.org
17 +L: linux-hwmon@vger.kernel.org
18 S: Maintained
19 F: drivers/hwmon/abituguru3.c
20
21 @@ -373,14 +373,14 @@ S: Maintained
22
23 ADM1025 HARDWARE MONITOR DRIVER
24 M: Jean Delvare <jdelvare@suse.com>
25 -L: lm-sensors@lm-sensors.org
26 +L: linux-hwmon@vger.kernel.org
27 S: Maintained
28 F: Documentation/hwmon/adm1025
29 F: drivers/hwmon/adm1025.c
30
31 ADM1029 HARDWARE MONITOR DRIVER
32 M: Corentin Labbe <clabbe.montjoie@gmail.com>
33 -L: lm-sensors@lm-sensors.org
34 +L: linux-hwmon@vger.kernel.org
35 S: Maintained
36 F: drivers/hwmon/adm1029.c
37
38 @@ -425,7 +425,7 @@ F: drivers/video/backlight/adp8860_bl.c
39
40 ADS1015 HARDWARE MONITOR DRIVER
41 M: Dirk Eibach <eibach@gdsys.de>
42 -L: lm-sensors@lm-sensors.org
43 +L: linux-hwmon@vger.kernel.org
44 S: Maintained
45 F: Documentation/hwmon/ads1015
46 F: drivers/hwmon/ads1015.c
47 @@ -438,7 +438,7 @@ F: drivers/macintosh/therm_adt746x.c
48
49 ADT7475 HARDWARE MONITOR DRIVER
50 M: Jean Delvare <jdelvare@suse.com>
51 -L: lm-sensors@lm-sensors.org
52 +L: linux-hwmon@vger.kernel.org
53 S: Maintained
54 F: Documentation/hwmon/adt7475
55 F: drivers/hwmon/adt7475.c
56 @@ -615,7 +615,7 @@ F: include/linux/ccp.h
57
58 AMD FAM15H PROCESSOR POWER MONITORING DRIVER
59 M: Andreas Herrmann <herrmann.der.user@googlemail.com>
60 -L: lm-sensors@lm-sensors.org
61 +L: linux-hwmon@vger.kernel.org
62 S: Maintained
63 F: Documentation/hwmon/fam15h_power
64 F: drivers/hwmon/fam15h_power.c
65 @@ -779,7 +779,7 @@ F: drivers/input/mouse/bcm5974.c
66
67 APPLE SMC DRIVER
68 M: Henrik Rydberg <rydberg@bitmath.org>
69 -L: lm-sensors@lm-sensors.org
70 +L: linux-hwmon@vger.kernel.org
71 S: Odd fixes
72 F: drivers/hwmon/applesmc.c
73
74 @@ -1777,7 +1777,7 @@ F: include/media/as3645a.h
75
76 ASC7621 HARDWARE MONITOR DRIVER
77 M: George Joseph <george.joseph@fairview5.com>
78 -L: lm-sensors@lm-sensors.org
79 +L: linux-hwmon@vger.kernel.org
80 S: Maintained
81 F: Documentation/hwmon/asc7621
82 F: drivers/hwmon/asc7621.c
83 @@ -1864,7 +1864,7 @@ F: drivers/net/wireless/ath/carl9170/
84
85 ATK0110 HWMON DRIVER
86 M: Luca Tettamanti <kronos.it@gmail.com>
87 -L: lm-sensors@lm-sensors.org
88 +L: linux-hwmon@vger.kernel.org
89 S: Maintained
90 F: drivers/hwmon/asus_atk0110.c
91
92 @@ -2984,7 +2984,7 @@ F: mm/swap_cgroup.c
93
94 CORETEMP HARDWARE MONITORING DRIVER
95 M: Fenghua Yu <fenghua.yu@intel.com>
96 -L: lm-sensors@lm-sensors.org
97 +L: linux-hwmon@vger.kernel.org
98 S: Maintained
99 F: Documentation/hwmon/coretemp
100 F: drivers/hwmon/coretemp.c
101 @@ -3549,7 +3549,7 @@ T: git git://git.infradead.org/users/vkoul/slave-dma.git
102
103 DME1737 HARDWARE MONITOR DRIVER
104 M: Juerg Haefliger <juergh@gmail.com>
105 -L: lm-sensors@lm-sensors.org
106 +L: linux-hwmon@vger.kernel.org
107 S: Maintained
108 F: Documentation/hwmon/dme1737
109 F: drivers/hwmon/dme1737.c
110 @@ -4262,7 +4262,7 @@ F: include/video/exynos_mipi*
111
112 F71805F HARDWARE MONITORING DRIVER
113 M: Jean Delvare <jdelvare@suse.com>
114 -L: lm-sensors@lm-sensors.org
115 +L: linux-hwmon@vger.kernel.org
116 S: Maintained
117 F: Documentation/hwmon/f71805f
118 F: drivers/hwmon/f71805f.c
119 @@ -4341,7 +4341,7 @@ F: fs/*
120
121 FINTEK F75375S HARDWARE MONITOR AND FAN CONTROLLER DRIVER
122 M: Riku Voipio <riku.voipio@iki.fi>
123 -L: lm-sensors@lm-sensors.org
124 +L: linux-hwmon@vger.kernel.org
125 S: Maintained
126 F: drivers/hwmon/f75375s.c
127 F: include/linux/f75375s.h
128 @@ -4883,8 +4883,8 @@ F: drivers/media/usb/hackrf/
129 HARDWARE MONITORING
130 M: Jean Delvare <jdelvare@suse.com>
131 M: Guenter Roeck <linux@roeck-us.net>
132 -L: lm-sensors@lm-sensors.org
133 -W: http://www.lm-sensors.org/
134 +L: linux-hwmon@vger.kernel.org
135 +W: http://hwmon.wiki.kernel.org/
136 T: quilt http://jdelvare.nerim.net/devel/linux/jdelvare-hwmon/
137 T: git git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging.git
138 S: Maintained
139 @@ -5393,7 +5393,7 @@ F: drivers/usb/atm/ueagle-atm.c
140
141 INA209 HARDWARE MONITOR DRIVER
142 M: Guenter Roeck <linux@roeck-us.net>
143 -L: lm-sensors@lm-sensors.org
144 +L: linux-hwmon@vger.kernel.org
145 S: Maintained
146 F: Documentation/hwmon/ina209
147 F: Documentation/devicetree/bindings/i2c/ina209.txt
148 @@ -5401,7 +5401,7 @@ F: drivers/hwmon/ina209.c
149
150 INA2XX HARDWARE MONITOR DRIVER
151 M: Guenter Roeck <linux@roeck-us.net>
152 -L: lm-sensors@lm-sensors.org
153 +L: linux-hwmon@vger.kernel.org
154 S: Maintained
155 F: Documentation/hwmon/ina2xx
156 F: drivers/hwmon/ina2xx.c
157 @@ -5884,7 +5884,7 @@ F: drivers/isdn/hardware/eicon/
158
159 IT87 HARDWARE MONITORING DRIVER
160 M: Jean Delvare <jdelvare@suse.com>
161 -L: lm-sensors@lm-sensors.org
162 +L: linux-hwmon@vger.kernel.org
163 S: Maintained
164 F: Documentation/hwmon/it87
165 F: drivers/hwmon/it87.c
166 @@ -5920,7 +5920,7 @@ F: drivers/media/dvb-frontends/ix2505v*
167
168 JC42.4 TEMPERATURE SENSOR DRIVER
169 M: Guenter Roeck <linux@roeck-us.net>
170 -L: lm-sensors@lm-sensors.org
171 +L: linux-hwmon@vger.kernel.org
172 S: Maintained
173 F: drivers/hwmon/jc42.c
174 F: Documentation/hwmon/jc42
175 @@ -5970,14 +5970,14 @@ F: drivers/tty/serial/jsm/
176
177 K10TEMP HARDWARE MONITORING DRIVER
178 M: Clemens Ladisch <clemens@ladisch.de>
179 -L: lm-sensors@lm-sensors.org
180 +L: linux-hwmon@vger.kernel.org
181 S: Maintained
182 F: Documentation/hwmon/k10temp
183 F: drivers/hwmon/k10temp.c
184
185 K8TEMP HARDWARE MONITORING DRIVER
186 M: Rudolf Marek <r.marek@assembler.cz>
187 -L: lm-sensors@lm-sensors.org
188 +L: linux-hwmon@vger.kernel.org
189 S: Maintained
190 F: Documentation/hwmon/k8temp
191 F: drivers/hwmon/k8temp.c
192 @@ -6485,27 +6485,27 @@ F: net/llc/
193
194 LM73 HARDWARE MONITOR DRIVER
195 M: Guillaume Ligneul <guillaume.ligneul@gmail.com>
196 -L: lm-sensors@lm-sensors.org
197 +L: linux-hwmon@vger.kernel.org
198 S: Maintained
199 F: drivers/hwmon/lm73.c
200
201 LM78 HARDWARE MONITOR DRIVER
202 M: Jean Delvare <jdelvare@suse.com>
203 -L: lm-sensors@lm-sensors.org
204 +L: linux-hwmon@vger.kernel.org
205 S: Maintained
206 F: Documentation/hwmon/lm78
207 F: drivers/hwmon/lm78.c
208
209 LM83 HARDWARE MONITOR DRIVER
210 M: Jean Delvare <jdelvare@suse.com>
211 -L: lm-sensors@lm-sensors.org
212 +L: linux-hwmon@vger.kernel.org
213 S: Maintained
214 F: Documentation/hwmon/lm83
215 F: drivers/hwmon/lm83.c
216
217 LM90 HARDWARE MONITOR DRIVER
218 M: Jean Delvare <jdelvare@suse.com>
219 -L: lm-sensors@lm-sensors.org
220 +L: linux-hwmon@vger.kernel.org
221 S: Maintained
222 F: Documentation/hwmon/lm90
223 F: Documentation/devicetree/bindings/hwmon/lm90.txt
224 @@ -6513,7 +6513,7 @@ F: drivers/hwmon/lm90.c
225
226 LM95234 HARDWARE MONITOR DRIVER
227 M: Guenter Roeck <linux@roeck-us.net>
228 -L: lm-sensors@lm-sensors.org
229 +L: linux-hwmon@vger.kernel.org
230 S: Maintained
231 F: Documentation/hwmon/lm95234
232 F: drivers/hwmon/lm95234.c
233 @@ -6580,7 +6580,7 @@ F: drivers/scsi/sym53c8xx_2/
234
235 LTC4261 HARDWARE MONITOR DRIVER
236 M: Guenter Roeck <linux@roeck-us.net>
237 -L: lm-sensors@lm-sensors.org
238 +L: linux-hwmon@vger.kernel.org
239 S: Maintained
240 F: Documentation/hwmon/ltc4261
241 F: drivers/hwmon/ltc4261.c
242 @@ -6749,28 +6749,28 @@ F: include/uapi/linux/matroxfb.h
243
244 MAX16065 HARDWARE MONITOR DRIVER
245 M: Guenter Roeck <linux@roeck-us.net>
246 -L: lm-sensors@lm-sensors.org
247 +L: linux-hwmon@vger.kernel.org
248 S: Maintained
249 F: Documentation/hwmon/max16065
250 F: drivers/hwmon/max16065.c
251
252 MAX20751 HARDWARE MONITOR DRIVER
253 M: Guenter Roeck <linux@roeck-us.net>
254 -L: lm-sensors@lm-sensors.org
255 +L: linux-hwmon@vger.kernel.org
256 S: Maintained
257 F: Documentation/hwmon/max20751
258 F: drivers/hwmon/max20751.c
259
260 MAX6650 HARDWARE MONITOR AND FAN CONTROLLER DRIVER
261 M: "Hans J. Koch" <hjk@hansjkoch.de>
262 -L: lm-sensors@lm-sensors.org
263 +L: linux-hwmon@vger.kernel.org
264 S: Maintained
265 F: Documentation/hwmon/max6650
266 F: drivers/hwmon/max6650.c
267
268 MAX6697 HARDWARE MONITOR DRIVER
269 M: Guenter Roeck <linux@roeck-us.net>
270 -L: lm-sensors@lm-sensors.org
271 +L: linux-hwmon@vger.kernel.org
272 S: Maintained
273 F: Documentation/hwmon/max6697
274 F: Documentation/devicetree/bindings/i2c/max6697.txt
275 @@ -7303,7 +7303,7 @@ F: drivers/scsi/NCR_D700.*
276
277 NCT6775 HARDWARE MONITOR DRIVER
278 M: Guenter Roeck <linux@roeck-us.net>
279 -L: lm-sensors@lm-sensors.org
280 +L: linux-hwmon@vger.kernel.org
281 S: Maintained
282 F: Documentation/hwmon/nct6775
283 F: drivers/hwmon/nct6775.c
284 @@ -8064,7 +8064,7 @@ F: drivers/video/logo/logo_parisc*
285
286 PC87360 HARDWARE MONITORING DRIVER
287 M: Jim Cromie <jim.cromie@gmail.com>
288 -L: lm-sensors@lm-sensors.org
289 +L: linux-hwmon@vger.kernel.org
290 S: Maintained
291 F: Documentation/hwmon/pc87360
292 F: drivers/hwmon/pc87360.c
293 @@ -8076,7 +8076,7 @@ F: drivers/char/pc8736x_gpio.c
294
295 PC87427 HARDWARE MONITORING DRIVER
296 M: Jean Delvare <jdelvare@suse.com>
297 -L: lm-sensors@lm-sensors.org
298 +L: linux-hwmon@vger.kernel.org
299 S: Maintained
300 F: Documentation/hwmon/pc87427
301 F: drivers/hwmon/pc87427.c
302 @@ -8415,8 +8415,8 @@ F: drivers/rtc/rtc-puv3.c
303
304 PMBUS HARDWARE MONITORING DRIVERS
305 M: Guenter Roeck <linux@roeck-us.net>
306 -L: lm-sensors@lm-sensors.org
307 -W: http://www.lm-sensors.org/
308 +L: linux-hwmon@vger.kernel.org
309 +W: http://hwmon.wiki.kernel.org/
310 W: http://www.roeck-us.net/linux/drivers/
311 T: git git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging.git
312 S: Maintained
313 @@ -8610,7 +8610,7 @@ F: drivers/media/usb/pwc/*
314
315 PWM FAN DRIVER
316 M: Kamil Debski <k.debski@samsung.com>
317 -L: lm-sensors@lm-sensors.org
318 +L: linux-hwmon@vger.kernel.org
319 S: Supported
320 F: Documentation/devicetree/bindings/hwmon/pwm-fan.txt
321 F: Documentation/hwmon/pwm-fan
322 @@ -9882,28 +9882,28 @@ F: Documentation/devicetree/bindings/media/i2c/nokia,smia.txt
323
324 SMM665 HARDWARE MONITOR DRIVER
325 M: Guenter Roeck <linux@roeck-us.net>
326 -L: lm-sensors@lm-sensors.org
327 +L: linux-hwmon@vger.kernel.org
328 S: Maintained
329 F: Documentation/hwmon/smm665
330 F: drivers/hwmon/smm665.c
331
332 SMSC EMC2103 HARDWARE MONITOR DRIVER
333 M: Steve Glendinning <steve.glendinning@shawell.net>
334 -L: lm-sensors@lm-sensors.org
335 +L: linux-hwmon@vger.kernel.org
336 S: Maintained
337 F: Documentation/hwmon/emc2103
338 F: drivers/hwmon/emc2103.c
339
340 SMSC SCH5627 HARDWARE MONITOR DRIVER
341 M: Hans de Goede <hdegoede@redhat.com>
342 -L: lm-sensors@lm-sensors.org
343 +L: linux-hwmon@vger.kernel.org
344 S: Supported
345 F: Documentation/hwmon/sch5627
346 F: drivers/hwmon/sch5627.c
347
348 SMSC47B397 HARDWARE MONITOR DRIVER
349 M: Jean Delvare <jdelvare@suse.com>
350 -L: lm-sensors@lm-sensors.org
351 +L: linux-hwmon@vger.kernel.org
352 S: Maintained
353 F: Documentation/hwmon/smsc47b397
354 F: drivers/hwmon/smsc47b397.c
355 @@ -10830,7 +10830,7 @@ F: include/linux/mmc/sh_mobile_sdhi.h
356
357 TMP401 HARDWARE MONITOR DRIVER
358 M: Guenter Roeck <linux@roeck-us.net>
359 -L: lm-sensors@lm-sensors.org
360 +L: linux-hwmon@vger.kernel.org
361 S: Maintained
362 F: Documentation/hwmon/tmp401
363 F: drivers/hwmon/tmp401.c
364 @@ -11564,14 +11564,14 @@ F: Documentation/networking/vrf.txt
365
366 VT1211 HARDWARE MONITOR DRIVER
367 M: Juerg Haefliger <juergh@gmail.com>
368 -L: lm-sensors@lm-sensors.org
369 +L: linux-hwmon@vger.kernel.org
370 S: Maintained
371 F: Documentation/hwmon/vt1211
372 F: drivers/hwmon/vt1211.c
373
374 VT8231 HARDWARE MONITOR DRIVER
375 M: Roger Lucas <vt8231@hiddenengine.co.uk>
376 -L: lm-sensors@lm-sensors.org
377 +L: linux-hwmon@vger.kernel.org
378 S: Maintained
379 F: drivers/hwmon/vt8231.c
380
381 @@ -11590,21 +11590,21 @@ F: drivers/w1/
382
383 W83791D HARDWARE MONITORING DRIVER
384 M: Marc Hulsman <m.hulsman@tudelft.nl>
385 -L: lm-sensors@lm-sensors.org
386 +L: linux-hwmon@vger.kernel.org
387 S: Maintained
388 F: Documentation/hwmon/w83791d
389 F: drivers/hwmon/w83791d.c
390
391 W83793 HARDWARE MONITORING DRIVER
392 M: Rudolf Marek <r.marek@assembler.cz>
393 -L: lm-sensors@lm-sensors.org
394 +L: linux-hwmon@vger.kernel.org
395 S: Maintained
396 F: Documentation/hwmon/w83793
397 F: drivers/hwmon/w83793.c
398
399 W83795 HARDWARE MONITORING DRIVER
400 M: Jean Delvare <jdelvare@suse.com>
401 -L: lm-sensors@lm-sensors.org
402 +L: linux-hwmon@vger.kernel.org
403 S: Maintained
404 F: drivers/hwmon/w83795.c
405
406 diff --git a/Makefile b/Makefile
407 index 87d12b44ab66..5a493e785aca 100644
408 --- a/Makefile
409 +++ b/Makefile
410 @@ -1,6 +1,6 @@
411 VERSION = 4
412 PATCHLEVEL = 4
413 -SUBLEVEL = 6
414 +SUBLEVEL = 7
415 EXTRAVERSION =
416 NAME = Blurry Fish Butt
417
418 diff --git a/arch/arc/include/asm/bitops.h b/arch/arc/include/asm/bitops.h
419 index 57c1f33844d4..0352fb8d21b9 100644
420 --- a/arch/arc/include/asm/bitops.h
421 +++ b/arch/arc/include/asm/bitops.h
422 @@ -35,21 +35,6 @@ static inline void op##_bit(unsigned long nr, volatile unsigned long *m)\
423 \
424 m += nr >> 5; \
425 \
426 - /* \
427 - * ARC ISA micro-optimization: \
428 - * \
429 - * Instructions dealing with bitpos only consider lower 5 bits \
430 - * e.g (x << 33) is handled like (x << 1) by ASL instruction \
431 - * (mem pointer still needs adjustment to point to next word) \
432 - * \
433 - * Hence the masking to clamp @nr arg can be elided in general. \
434 - * \
435 - * However if @nr is a constant (above assumed in a register), \
436 - * and greater than 31, gcc can optimize away (x << 33) to 0, \
437 - * as overflow, given the 32-bit ISA. Thus masking needs to be \
438 - * done for const @nr, but no code is generated due to gcc \
439 - * const prop. \
440 - */ \
441 nr &= 0x1f; \
442 \
443 __asm__ __volatile__( \
444 diff --git a/arch/arc/include/asm/io.h b/arch/arc/include/asm/io.h
445 index 694ece8a0243..27b17adea50d 100644
446 --- a/arch/arc/include/asm/io.h
447 +++ b/arch/arc/include/asm/io.h
448 @@ -129,15 +129,23 @@ static inline void __raw_writel(u32 w, volatile void __iomem *addr)
449 #define writel(v,c) ({ __iowmb(); writel_relaxed(v,c); })
450
451 /*
452 - * Relaxed API for drivers which can handle any ordering themselves
453 + * Relaxed API for drivers which can handle barrier ordering themselves
454 + *
455 + * Also these are defined to perform little endian accesses.
456 + * To provide the typical device register semantics of fixed endian,
457 + * swap the byte order for Big Endian
458 + *
459 + * http://lkml.kernel.org/r/201603100845.30602.arnd@arndb.de
460 */
461 #define readb_relaxed(c) __raw_readb(c)
462 -#define readw_relaxed(c) __raw_readw(c)
463 -#define readl_relaxed(c) __raw_readl(c)
464 +#define readw_relaxed(c) ({ u16 __r = le16_to_cpu((__force __le16) \
465 + __raw_readw(c)); __r; })
466 +#define readl_relaxed(c) ({ u32 __r = le32_to_cpu((__force __le32) \
467 + __raw_readl(c)); __r; })
468
469 #define writeb_relaxed(v,c) __raw_writeb(v,c)
470 -#define writew_relaxed(v,c) __raw_writew(v,c)
471 -#define writel_relaxed(v,c) __raw_writel(v,c)
472 +#define writew_relaxed(v,c) __raw_writew((__force u16) cpu_to_le16(v),c)
473 +#define writel_relaxed(v,c) __raw_writel((__force u32) cpu_to_le32(v),c)
474
475 #include <asm-generic/io.h>
476
477 diff --git a/arch/arm/boot/dts/at91-sama5d3_xplained.dts b/arch/arm/boot/dts/at91-sama5d3_xplained.dts
478 index ff888d21c786..f3e2b96c06a3 100644
479 --- a/arch/arm/boot/dts/at91-sama5d3_xplained.dts
480 +++ b/arch/arm/boot/dts/at91-sama5d3_xplained.dts
481 @@ -303,6 +303,7 @@
482 regulator-name = "mmc0-card-supply";
483 regulator-min-microvolt = <3300000>;
484 regulator-max-microvolt = <3300000>;
485 + regulator-always-on;
486 };
487
488 gpio_keys {
489 diff --git a/arch/arm/boot/dts/at91-sama5d4_xplained.dts b/arch/arm/boot/dts/at91-sama5d4_xplained.dts
490 index 569026e8f96c..da84e65b56ef 100644
491 --- a/arch/arm/boot/dts/at91-sama5d4_xplained.dts
492 +++ b/arch/arm/boot/dts/at91-sama5d4_xplained.dts
493 @@ -268,5 +268,6 @@
494 regulator-min-microvolt = <3300000>;
495 regulator-max-microvolt = <3300000>;
496 vin-supply = <&vcc_3v3_reg>;
497 + regulator-always-on;
498 };
499 };
500 diff --git a/arch/arm/mach-s3c64xx/dev-audio.c b/arch/arm/mach-s3c64xx/dev-audio.c
501 index ff780a8d8366..9a42736ef4ac 100644
502 --- a/arch/arm/mach-s3c64xx/dev-audio.c
503 +++ b/arch/arm/mach-s3c64xx/dev-audio.c
504 @@ -54,12 +54,12 @@ static int s3c64xx_i2s_cfg_gpio(struct platform_device *pdev)
505
506 static struct resource s3c64xx_iis0_resource[] = {
507 [0] = DEFINE_RES_MEM(S3C64XX_PA_IIS0, SZ_256),
508 - [1] = DEFINE_RES_DMA(DMACH_I2S0_OUT),
509 - [2] = DEFINE_RES_DMA(DMACH_I2S0_IN),
510 };
511
512 -static struct s3c_audio_pdata i2sv3_pdata = {
513 +static struct s3c_audio_pdata i2s0_pdata = {
514 .cfg_gpio = s3c64xx_i2s_cfg_gpio,
515 + .dma_playback = DMACH_I2S0_OUT,
516 + .dma_capture = DMACH_I2S0_IN,
517 };
518
519 struct platform_device s3c64xx_device_iis0 = {
520 @@ -68,15 +68,19 @@ struct platform_device s3c64xx_device_iis0 = {
521 .num_resources = ARRAY_SIZE(s3c64xx_iis0_resource),
522 .resource = s3c64xx_iis0_resource,
523 .dev = {
524 - .platform_data = &i2sv3_pdata,
525 + .platform_data = &i2s0_pdata,
526 },
527 };
528 EXPORT_SYMBOL(s3c64xx_device_iis0);
529
530 static struct resource s3c64xx_iis1_resource[] = {
531 [0] = DEFINE_RES_MEM(S3C64XX_PA_IIS1, SZ_256),
532 - [1] = DEFINE_RES_DMA(DMACH_I2S1_OUT),
533 - [2] = DEFINE_RES_DMA(DMACH_I2S1_IN),
534 +};
535 +
536 +static struct s3c_audio_pdata i2s1_pdata = {
537 + .cfg_gpio = s3c64xx_i2s_cfg_gpio,
538 + .dma_playback = DMACH_I2S1_OUT,
539 + .dma_capture = DMACH_I2S1_IN,
540 };
541
542 struct platform_device s3c64xx_device_iis1 = {
543 @@ -85,19 +89,19 @@ struct platform_device s3c64xx_device_iis1 = {
544 .num_resources = ARRAY_SIZE(s3c64xx_iis1_resource),
545 .resource = s3c64xx_iis1_resource,
546 .dev = {
547 - .platform_data = &i2sv3_pdata,
548 + .platform_data = &i2s1_pdata,
549 },
550 };
551 EXPORT_SYMBOL(s3c64xx_device_iis1);
552
553 static struct resource s3c64xx_iisv4_resource[] = {
554 [0] = DEFINE_RES_MEM(S3C64XX_PA_IISV4, SZ_256),
555 - [1] = DEFINE_RES_DMA(DMACH_HSI_I2SV40_TX),
556 - [2] = DEFINE_RES_DMA(DMACH_HSI_I2SV40_RX),
557 };
558
559 static struct s3c_audio_pdata i2sv4_pdata = {
560 .cfg_gpio = s3c64xx_i2s_cfg_gpio,
561 + .dma_playback = DMACH_HSI_I2SV40_TX,
562 + .dma_capture = DMACH_HSI_I2SV40_RX,
563 .type = {
564 .i2s = {
565 .quirks = QUIRK_PRI_6CHAN,
566 @@ -142,12 +146,12 @@ static int s3c64xx_pcm_cfg_gpio(struct platform_device *pdev)
567
568 static struct resource s3c64xx_pcm0_resource[] = {
569 [0] = DEFINE_RES_MEM(S3C64XX_PA_PCM0, SZ_256),
570 - [1] = DEFINE_RES_DMA(DMACH_PCM0_TX),
571 - [2] = DEFINE_RES_DMA(DMACH_PCM0_RX),
572 };
573
574 static struct s3c_audio_pdata s3c_pcm0_pdata = {
575 .cfg_gpio = s3c64xx_pcm_cfg_gpio,
576 + .dma_capture = DMACH_PCM0_RX,
577 + .dma_playback = DMACH_PCM0_TX,
578 };
579
580 struct platform_device s3c64xx_device_pcm0 = {
581 @@ -163,12 +167,12 @@ EXPORT_SYMBOL(s3c64xx_device_pcm0);
582
583 static struct resource s3c64xx_pcm1_resource[] = {
584 [0] = DEFINE_RES_MEM(S3C64XX_PA_PCM1, SZ_256),
585 - [1] = DEFINE_RES_DMA(DMACH_PCM1_TX),
586 - [2] = DEFINE_RES_DMA(DMACH_PCM1_RX),
587 };
588
589 static struct s3c_audio_pdata s3c_pcm1_pdata = {
590 .cfg_gpio = s3c64xx_pcm_cfg_gpio,
591 + .dma_playback = DMACH_PCM1_TX,
592 + .dma_capture = DMACH_PCM1_RX,
593 };
594
595 struct platform_device s3c64xx_device_pcm1 = {
596 @@ -196,13 +200,14 @@ static int s3c64xx_ac97_cfg_gpe(struct platform_device *pdev)
597
598 static struct resource s3c64xx_ac97_resource[] = {
599 [0] = DEFINE_RES_MEM(S3C64XX_PA_AC97, SZ_256),
600 - [1] = DEFINE_RES_DMA(DMACH_AC97_PCMOUT),
601 - [2] = DEFINE_RES_DMA(DMACH_AC97_PCMIN),
602 - [3] = DEFINE_RES_DMA(DMACH_AC97_MICIN),
603 - [4] = DEFINE_RES_IRQ(IRQ_AC97),
604 + [1] = DEFINE_RES_IRQ(IRQ_AC97),
605 };
606
607 -static struct s3c_audio_pdata s3c_ac97_pdata;
608 +static struct s3c_audio_pdata s3c_ac97_pdata = {
609 + .dma_playback = DMACH_AC97_PCMOUT,
610 + .dma_capture = DMACH_AC97_PCMIN,
611 + .dma_capture_mic = DMACH_AC97_MICIN,
612 +};
613
614 static u64 s3c64xx_ac97_dmamask = DMA_BIT_MASK(32);
615
616 diff --git a/arch/arm/mach-s3c64xx/include/mach/dma.h b/arch/arm/mach-s3c64xx/include/mach/dma.h
617 index 096e14073bd9..9c739eafe95c 100644
618 --- a/arch/arm/mach-s3c64xx/include/mach/dma.h
619 +++ b/arch/arm/mach-s3c64xx/include/mach/dma.h
620 @@ -14,38 +14,38 @@
621 #define S3C64XX_DMA_CHAN(name) ((unsigned long)(name))
622
623 /* DMA0/SDMA0 */
624 -#define DMACH_UART0 S3C64XX_DMA_CHAN("uart0_tx")
625 -#define DMACH_UART0_SRC2 S3C64XX_DMA_CHAN("uart0_rx")
626 -#define DMACH_UART1 S3C64XX_DMA_CHAN("uart1_tx")
627 -#define DMACH_UART1_SRC2 S3C64XX_DMA_CHAN("uart1_rx")
628 -#define DMACH_UART2 S3C64XX_DMA_CHAN("uart2_tx")
629 -#define DMACH_UART2_SRC2 S3C64XX_DMA_CHAN("uart2_rx")
630 -#define DMACH_UART3 S3C64XX_DMA_CHAN("uart3_tx")
631 -#define DMACH_UART3_SRC2 S3C64XX_DMA_CHAN("uart3_rx")
632 -#define DMACH_PCM0_TX S3C64XX_DMA_CHAN("pcm0_tx")
633 -#define DMACH_PCM0_RX S3C64XX_DMA_CHAN("pcm0_rx")
634 -#define DMACH_I2S0_OUT S3C64XX_DMA_CHAN("i2s0_tx")
635 -#define DMACH_I2S0_IN S3C64XX_DMA_CHAN("i2s0_rx")
636 +#define DMACH_UART0 "uart0_tx"
637 +#define DMACH_UART0_SRC2 "uart0_rx"
638 +#define DMACH_UART1 "uart1_tx"
639 +#define DMACH_UART1_SRC2 "uart1_rx"
640 +#define DMACH_UART2 "uart2_tx"
641 +#define DMACH_UART2_SRC2 "uart2_rx"
642 +#define DMACH_UART3 "uart3_tx"
643 +#define DMACH_UART3_SRC2 "uart3_rx"
644 +#define DMACH_PCM0_TX "pcm0_tx"
645 +#define DMACH_PCM0_RX "pcm0_rx"
646 +#define DMACH_I2S0_OUT "i2s0_tx"
647 +#define DMACH_I2S0_IN "i2s0_rx"
648 #define DMACH_SPI0_TX S3C64XX_DMA_CHAN("spi0_tx")
649 #define DMACH_SPI0_RX S3C64XX_DMA_CHAN("spi0_rx")
650 -#define DMACH_HSI_I2SV40_TX S3C64XX_DMA_CHAN("i2s2_tx")
651 -#define DMACH_HSI_I2SV40_RX S3C64XX_DMA_CHAN("i2s2_rx")
652 +#define DMACH_HSI_I2SV40_TX "i2s2_tx"
653 +#define DMACH_HSI_I2SV40_RX "i2s2_rx"
654
655 /* DMA1/SDMA1 */
656 -#define DMACH_PCM1_TX S3C64XX_DMA_CHAN("pcm1_tx")
657 -#define DMACH_PCM1_RX S3C64XX_DMA_CHAN("pcm1_rx")
658 -#define DMACH_I2S1_OUT S3C64XX_DMA_CHAN("i2s1_tx")
659 -#define DMACH_I2S1_IN S3C64XX_DMA_CHAN("i2s1_rx")
660 +#define DMACH_PCM1_TX "pcm1_tx"
661 +#define DMACH_PCM1_RX "pcm1_rx"
662 +#define DMACH_I2S1_OUT "i2s1_tx"
663 +#define DMACH_I2S1_IN "i2s1_rx"
664 #define DMACH_SPI1_TX S3C64XX_DMA_CHAN("spi1_tx")
665 #define DMACH_SPI1_RX S3C64XX_DMA_CHAN("spi1_rx")
666 -#define DMACH_AC97_PCMOUT S3C64XX_DMA_CHAN("ac97_out")
667 -#define DMACH_AC97_PCMIN S3C64XX_DMA_CHAN("ac97_in")
668 -#define DMACH_AC97_MICIN S3C64XX_DMA_CHAN("ac97_mic")
669 -#define DMACH_PWM S3C64XX_DMA_CHAN("pwm")
670 -#define DMACH_IRDA S3C64XX_DMA_CHAN("irda")
671 -#define DMACH_EXTERNAL S3C64XX_DMA_CHAN("external")
672 -#define DMACH_SECURITY_RX S3C64XX_DMA_CHAN("sec_rx")
673 -#define DMACH_SECURITY_TX S3C64XX_DMA_CHAN("sec_tx")
674 +#define DMACH_AC97_PCMOUT "ac97_out"
675 +#define DMACH_AC97_PCMIN "ac97_in"
676 +#define DMACH_AC97_MICIN "ac97_mic"
677 +#define DMACH_PWM "pwm"
678 +#define DMACH_IRDA "irda"
679 +#define DMACH_EXTERNAL "external"
680 +#define DMACH_SECURITY_RX "sec_rx"
681 +#define DMACH_SECURITY_TX "sec_tx"
682
683 enum dma_ch {
684 DMACH_MAX = 32
685 diff --git a/arch/arm/plat-samsung/devs.c b/arch/arm/plat-samsung/devs.c
686 index 82074625de5c..e212f9d804bd 100644
687 --- a/arch/arm/plat-samsung/devs.c
688 +++ b/arch/arm/plat-samsung/devs.c
689 @@ -65,6 +65,7 @@
690 #include <linux/platform_data/usb-ohci-s3c2410.h>
691 #include <plat/usb-phy.h>
692 #include <plat/regs-spi.h>
693 +#include <linux/platform_data/asoc-s3c.h>
694 #include <linux/platform_data/spi-s3c64xx.h>
695
696 static u64 samsung_device_dma_mask = DMA_BIT_MASK(32);
697 @@ -74,9 +75,12 @@ static u64 samsung_device_dma_mask = DMA_BIT_MASK(32);
698 static struct resource s3c_ac97_resource[] = {
699 [0] = DEFINE_RES_MEM(S3C2440_PA_AC97, S3C2440_SZ_AC97),
700 [1] = DEFINE_RES_IRQ(IRQ_S3C244X_AC97),
701 - [2] = DEFINE_RES_DMA_NAMED(DMACH_PCM_OUT, "PCM out"),
702 - [3] = DEFINE_RES_DMA_NAMED(DMACH_PCM_IN, "PCM in"),
703 - [4] = DEFINE_RES_DMA_NAMED(DMACH_MIC_IN, "Mic in"),
704 +};
705 +
706 +static struct s3c_audio_pdata s3c_ac97_pdata = {
707 + .dma_playback = (void *)DMACH_PCM_OUT,
708 + .dma_capture = (void *)DMACH_PCM_IN,
709 + .dma_capture_mic = (void *)DMACH_MIC_IN,
710 };
711
712 struct platform_device s3c_device_ac97 = {
713 @@ -87,6 +91,7 @@ struct platform_device s3c_device_ac97 = {
714 .dev = {
715 .dma_mask = &samsung_device_dma_mask,
716 .coherent_dma_mask = DMA_BIT_MASK(32),
717 + .platform_data = &s3c_ac97_pdata,
718 }
719 };
720 #endif /* CONFIG_CPU_S3C2440 */
721 diff --git a/arch/ia64/include/asm/io.h b/arch/ia64/include/asm/io.h
722 index 9041bbe2b7b4..8fdb9c7eeb66 100644
723 --- a/arch/ia64/include/asm/io.h
724 +++ b/arch/ia64/include/asm/io.h
725 @@ -436,6 +436,7 @@ static inline void __iomem * ioremap_cache (unsigned long phys_addr, unsigned lo
726 return ioremap(phys_addr, size);
727 }
728 #define ioremap_cache ioremap_cache
729 +#define ioremap_uc ioremap_nocache
730
731
732 /*
733 diff --git a/arch/s390/include/asm/pci.h b/arch/s390/include/asm/pci.h
734 index c873e682b67f..2b2ced9dc00a 100644
735 --- a/arch/s390/include/asm/pci.h
736 +++ b/arch/s390/include/asm/pci.h
737 @@ -45,7 +45,7 @@ struct zpci_fmb {
738 u64 rpcit_ops;
739 u64 dma_rbytes;
740 u64 dma_wbytes;
741 -} __packed __aligned(16);
742 +} __packed __aligned(64);
743
744 enum zpci_state {
745 ZPCI_FN_STATE_RESERVED,
746 diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S
747 index 857b6526d298..424e6809ad07 100644
748 --- a/arch/s390/kernel/entry.S
749 +++ b/arch/s390/kernel/entry.S
750 @@ -1197,114 +1197,12 @@ cleanup_critical:
751 .quad .Lpsw_idle_lpsw
752
753 .Lcleanup_save_fpu_regs:
754 - TSTMSK __LC_CPU_FLAGS,_CIF_FPU
755 - bor %r14
756 - clg %r9,BASED(.Lcleanup_save_fpu_regs_done)
757 - jhe 5f
758 - clg %r9,BASED(.Lcleanup_save_fpu_regs_fp)
759 - jhe 4f
760 - clg %r9,BASED(.Lcleanup_save_fpu_regs_vx_high)
761 - jhe 3f
762 - clg %r9,BASED(.Lcleanup_save_fpu_regs_vx_low)
763 - jhe 2f
764 - clg %r9,BASED(.Lcleanup_save_fpu_fpc_end)
765 - jhe 1f
766 - lg %r2,__LC_CURRENT
767 - aghi %r2,__TASK_thread
768 -0: # Store floating-point controls
769 - stfpc __THREAD_FPU_fpc(%r2)
770 -1: # Load register save area and check if VX is active
771 - lg %r3,__THREAD_FPU_regs(%r2)
772 - TSTMSK __LC_MACHINE_FLAGS,MACHINE_FLAG_VX
773 - jz 4f # no VX -> store FP regs
774 -2: # Store vector registers (V0-V15)
775 - VSTM %v0,%v15,0,%r3 # vstm 0,15,0(3)
776 -3: # Store vector registers (V16-V31)
777 - VSTM %v16,%v31,256,%r3 # vstm 16,31,256(3)
778 - j 5f # -> done, set CIF_FPU flag
779 -4: # Store floating-point registers
780 - std 0,0(%r3)
781 - std 1,8(%r3)
782 - std 2,16(%r3)
783 - std 3,24(%r3)
784 - std 4,32(%r3)
785 - std 5,40(%r3)
786 - std 6,48(%r3)
787 - std 7,56(%r3)
788 - std 8,64(%r3)
789 - std 9,72(%r3)
790 - std 10,80(%r3)
791 - std 11,88(%r3)
792 - std 12,96(%r3)
793 - std 13,104(%r3)
794 - std 14,112(%r3)
795 - std 15,120(%r3)
796 -5: # Set CIF_FPU flag
797 - oi __LC_CPU_FLAGS+7,_CIF_FPU
798 - lg %r9,48(%r11) # return from save_fpu_regs
799 + larl %r9,save_fpu_regs
800 br %r14
801 -.Lcleanup_save_fpu_fpc_end:
802 - .quad .Lsave_fpu_regs_fpc_end
803 -.Lcleanup_save_fpu_regs_vx_low:
804 - .quad .Lsave_fpu_regs_vx_low
805 -.Lcleanup_save_fpu_regs_vx_high:
806 - .quad .Lsave_fpu_regs_vx_high
807 -.Lcleanup_save_fpu_regs_fp:
808 - .quad .Lsave_fpu_regs_fp
809 -.Lcleanup_save_fpu_regs_done:
810 - .quad .Lsave_fpu_regs_done
811
812 .Lcleanup_load_fpu_regs:
813 - TSTMSK __LC_CPU_FLAGS,_CIF_FPU
814 - bnor %r14
815 - clg %r9,BASED(.Lcleanup_load_fpu_regs_done)
816 - jhe 1f
817 - clg %r9,BASED(.Lcleanup_load_fpu_regs_fp)
818 - jhe 2f
819 - clg %r9,BASED(.Lcleanup_load_fpu_regs_vx_high)
820 - jhe 3f
821 - clg %r9,BASED(.Lcleanup_load_fpu_regs_vx)
822 - jhe 4f
823 - lg %r4,__LC_CURRENT
824 - aghi %r4,__TASK_thread
825 - lfpc __THREAD_FPU_fpc(%r4)
826 - TSTMSK __LC_MACHINE_FLAGS,MACHINE_FLAG_VX
827 - lg %r4,__THREAD_FPU_regs(%r4) # %r4 <- reg save area
828 - jz 2f # -> no VX, load FP regs
829 -4: # Load V0 ..V15 registers
830 - VLM %v0,%v15,0,%r4
831 -3: # Load V16..V31 registers
832 - VLM %v16,%v31,256,%r4
833 - j 1f
834 -2: # Load floating-point registers
835 - ld 0,0(%r4)
836 - ld 1,8(%r4)
837 - ld 2,16(%r4)
838 - ld 3,24(%r4)
839 - ld 4,32(%r4)
840 - ld 5,40(%r4)
841 - ld 6,48(%r4)
842 - ld 7,56(%r4)
843 - ld 8,64(%r4)
844 - ld 9,72(%r4)
845 - ld 10,80(%r4)
846 - ld 11,88(%r4)
847 - ld 12,96(%r4)
848 - ld 13,104(%r4)
849 - ld 14,112(%r4)
850 - ld 15,120(%r4)
851 -1: # Clear CIF_FPU bit
852 - ni __LC_CPU_FLAGS+7,255-_CIF_FPU
853 - lg %r9,48(%r11) # return from load_fpu_regs
854 + larl %r9,load_fpu_regs
855 br %r14
856 -.Lcleanup_load_fpu_regs_vx:
857 - .quad .Lload_fpu_regs_vx
858 -.Lcleanup_load_fpu_regs_vx_high:
859 - .quad .Lload_fpu_regs_vx_high
860 -.Lcleanup_load_fpu_regs_fp:
861 - .quad .Lload_fpu_regs_fp
862 -.Lcleanup_load_fpu_regs_done:
863 - .quad .Lload_fpu_regs_done
864
865 /*
866 * Integer constants
867 diff --git a/arch/s390/kernel/head64.S b/arch/s390/kernel/head64.S
868 index 58b719fa8067..1ad2407c7f75 100644
869 --- a/arch/s390/kernel/head64.S
870 +++ b/arch/s390/kernel/head64.S
871 @@ -16,7 +16,7 @@
872
873 __HEAD
874 ENTRY(startup_continue)
875 - tm __LC_STFL_FAC_LIST+6,0x80 # LPP available ?
876 + tm __LC_STFL_FAC_LIST+5,0x80 # LPP available ?
877 jz 0f
878 xc __LC_LPP+1(7,0),__LC_LPP+1 # clear lpp and current_pid
879 mvi __LC_LPP,0x80 # and set LPP_MAGIC
880 diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
881 index c837bcacf218..1f581eb61bc2 100644
882 --- a/arch/s390/kernel/setup.c
883 +++ b/arch/s390/kernel/setup.c
884 @@ -329,6 +329,7 @@ static void __init setup_lowcore(void)
885 + PAGE_SIZE - STACK_FRAME_OVERHEAD - sizeof(struct pt_regs);
886 lc->current_task = (unsigned long) init_thread_union.thread_info.task;
887 lc->thread_info = (unsigned long) &init_thread_union;
888 + lc->lpp = LPP_MAGIC;
889 lc->machine_flags = S390_lowcore.machine_flags;
890 lc->stfl_fac_list = S390_lowcore.stfl_fac_list;
891 memcpy(lc->stfle_fac_list, S390_lowcore.stfle_fac_list,
892 diff --git a/arch/s390/pci/pci.c b/arch/s390/pci/pci.c
893 index 7ef12a3ace3a..19442395f413 100644
894 --- a/arch/s390/pci/pci.c
895 +++ b/arch/s390/pci/pci.c
896 @@ -871,8 +871,11 @@ static inline int barsize(u8 size)
897
898 static int zpci_mem_init(void)
899 {
900 + BUILD_BUG_ON(!is_power_of_2(__alignof__(struct zpci_fmb)) ||
901 + __alignof__(struct zpci_fmb) < sizeof(struct zpci_fmb));
902 +
903 zdev_fmb_cache = kmem_cache_create("PCI_FMB_cache", sizeof(struct zpci_fmb),
904 - 16, 0, NULL);
905 + __alignof__(struct zpci_fmb), 0, NULL);
906 if (!zdev_fmb_cache)
907 goto error_zdev;
908
909 diff --git a/arch/sh/mm/kmap.c b/arch/sh/mm/kmap.c
910 index ec29e14ec5a8..bf25d7c79a2d 100644
911 --- a/arch/sh/mm/kmap.c
912 +++ b/arch/sh/mm/kmap.c
913 @@ -36,6 +36,7 @@ void *kmap_coherent(struct page *page, unsigned long addr)
914
915 BUG_ON(!test_bit(PG_dcache_clean, &page->flags));
916
917 + preempt_disable();
918 pagefault_disable();
919
920 idx = FIX_CMAP_END -
921 @@ -64,4 +65,5 @@ void kunmap_coherent(void *kvaddr)
922 }
923
924 pagefault_enable();
925 + preempt_enable();
926 }
927 diff --git a/arch/um/drivers/mconsole_kern.c b/arch/um/drivers/mconsole_kern.c
928 index 29880c9b324e..e22e57298522 100644
929 --- a/arch/um/drivers/mconsole_kern.c
930 +++ b/arch/um/drivers/mconsole_kern.c
931 @@ -133,7 +133,7 @@ void mconsole_proc(struct mc_request *req)
932 ptr += strlen("proc");
933 ptr = skip_spaces(ptr);
934
935 - file = file_open_root(mnt->mnt_root, mnt, ptr, O_RDONLY);
936 + file = file_open_root(mnt->mnt_root, mnt, ptr, O_RDONLY, 0);
937 if (IS_ERR(file)) {
938 mconsole_reply(req, "Failed to open file", 1, 0);
939 printk(KERN_ERR "open /proc/%s: %ld\n", ptr, PTR_ERR(file));
940 diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
941 index db3622f22b61..436639a31624 100644
942 --- a/arch/x86/Kconfig
943 +++ b/arch/x86/Kconfig
944 @@ -1126,22 +1126,23 @@ config MICROCODE
945 bool "CPU microcode loading support"
946 default y
947 depends on CPU_SUP_AMD || CPU_SUP_INTEL
948 - depends on BLK_DEV_INITRD
949 select FW_LOADER
950 ---help---
951 -
952 If you say Y here, you will be able to update the microcode on
953 - certain Intel and AMD processors. The Intel support is for the
954 - IA32 family, e.g. Pentium Pro, Pentium II, Pentium III, Pentium 4,
955 - Xeon etc. The AMD support is for families 0x10 and later. You will
956 - obviously need the actual microcode binary data itself which is not
957 - shipped with the Linux kernel.
958 -
959 - This option selects the general module only, you need to select
960 - at least one vendor specific module as well.
961 -
962 - To compile this driver as a module, choose M here: the module
963 - will be called microcode.
964 + Intel and AMD processors. The Intel support is for the IA32 family,
965 + e.g. Pentium Pro, Pentium II, Pentium III, Pentium 4, Xeon etc. The
966 + AMD support is for families 0x10 and later. You will obviously need
967 + the actual microcode binary data itself which is not shipped with
968 + the Linux kernel.
969 +
970 + The preferred method to load microcode from a detached initrd is described
971 + in Documentation/x86/early-microcode.txt. For that you need to enable
972 + CONFIG_BLK_DEV_INITRD in order for the loader to be able to scan the
973 + initrd for microcode blobs.
974 +
975 + In addition, you can build-in the microcode into the kernel. For that you
976 + need to enable FIRMWARE_IN_KERNEL and add the vendor-supplied microcode
977 + to the CONFIG_EXTRA_FIRMWARE config option.
978
979 config MICROCODE_INTEL
980 bool "Intel microcode loading support"
981 diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c
982 index 03663740c866..1a4477cedc49 100644
983 --- a/arch/x86/entry/common.c
984 +++ b/arch/x86/entry/common.c
985 @@ -268,6 +268,7 @@ static void exit_to_usermode_loop(struct pt_regs *regs, u32 cached_flags)
986 /* Called with IRQs disabled. */
987 __visible inline void prepare_exit_to_usermode(struct pt_regs *regs)
988 {
989 + struct thread_info *ti = pt_regs_to_thread_info(regs);
990 u32 cached_flags;
991
992 if (IS_ENABLED(CONFIG_PROVE_LOCKING) && WARN_ON(!irqs_disabled()))
993 @@ -275,12 +276,22 @@ __visible inline void prepare_exit_to_usermode(struct pt_regs *regs)
994
995 lockdep_sys_exit();
996
997 - cached_flags =
998 - READ_ONCE(pt_regs_to_thread_info(regs)->flags);
999 + cached_flags = READ_ONCE(ti->flags);
1000
1001 if (unlikely(cached_flags & EXIT_TO_USERMODE_LOOP_FLAGS))
1002 exit_to_usermode_loop(regs, cached_flags);
1003
1004 +#ifdef CONFIG_COMPAT
1005 + /*
1006 + * Compat syscalls set TS_COMPAT. Make sure we clear it before
1007 + * returning to user mode. We need to clear it *after* signal
1008 + * handling, because syscall restart has a fixup for compat
1009 + * syscalls. The fixup is exercised by the ptrace_syscall_32
1010 + * selftest.
1011 + */
1012 + ti->status &= ~TS_COMPAT;
1013 +#endif
1014 +
1015 user_enter();
1016 }
1017
1018 @@ -332,14 +343,6 @@ __visible inline void syscall_return_slowpath(struct pt_regs *regs)
1019 if (unlikely(cached_flags & SYSCALL_EXIT_WORK_FLAGS))
1020 syscall_slow_exit_work(regs, cached_flags);
1021
1022 -#ifdef CONFIG_COMPAT
1023 - /*
1024 - * Compat syscalls set TS_COMPAT. Make sure we clear it before
1025 - * returning to user mode.
1026 - */
1027 - ti->status &= ~TS_COMPAT;
1028 -#endif
1029 -
1030 local_irq_disable();
1031 prepare_exit_to_usermode(regs);
1032 }
1033 diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h
1034 index a30316bf801a..163769d82475 100644
1035 --- a/arch/x86/include/asm/apic.h
1036 +++ b/arch/x86/include/asm/apic.h
1037 @@ -638,8 +638,8 @@ static inline void entering_irq(void)
1038
1039 static inline void entering_ack_irq(void)
1040 {
1041 - ack_APIC_irq();
1042 entering_irq();
1043 + ack_APIC_irq();
1044 }
1045
1046 static inline void ipi_entering_ack_irq(void)
1047 diff --git a/arch/x86/include/asm/hw_irq.h b/arch/x86/include/asm/hw_irq.h
1048 index 1e3408e88604..59caa55fb9b5 100644
1049 --- a/arch/x86/include/asm/hw_irq.h
1050 +++ b/arch/x86/include/asm/hw_irq.h
1051 @@ -136,6 +136,7 @@ struct irq_alloc_info {
1052 struct irq_cfg {
1053 unsigned int dest_apicid;
1054 u8 vector;
1055 + u8 old_vector;
1056 };
1057
1058 extern struct irq_cfg *irq_cfg(unsigned int irq);
1059 diff --git a/arch/x86/include/asm/microcode.h b/arch/x86/include/asm/microcode.h
1060 index 34e62b1dcfce..712b24ed3a64 100644
1061 --- a/arch/x86/include/asm/microcode.h
1062 +++ b/arch/x86/include/asm/microcode.h
1063 @@ -2,6 +2,7 @@
1064 #define _ASM_X86_MICROCODE_H
1065
1066 #include <linux/earlycpio.h>
1067 +#include <linux/initrd.h>
1068
1069 #define native_rdmsr(msr, val1, val2) \
1070 do { \
1071 @@ -168,4 +169,29 @@ static inline void reload_early_microcode(void) { }
1072 static inline bool
1073 get_builtin_firmware(struct cpio_data *cd, const char *name) { return false; }
1074 #endif
1075 +
1076 +static inline unsigned long get_initrd_start(void)
1077 +{
1078 +#ifdef CONFIG_BLK_DEV_INITRD
1079 + return initrd_start;
1080 +#else
1081 + return 0;
1082 +#endif
1083 +}
1084 +
1085 +static inline unsigned long get_initrd_start_addr(void)
1086 +{
1087 +#ifdef CONFIG_BLK_DEV_INITRD
1088 +#ifdef CONFIG_X86_32
1089 + unsigned long *initrd_start_p = (unsigned long *)__pa_nodebug(&initrd_start);
1090 +
1091 + return (unsigned long)__pa_nodebug(*initrd_start_p);
1092 +#else
1093 + return get_initrd_start();
1094 +#endif
1095 +#else /* CONFIG_BLK_DEV_INITRD */
1096 + return 0;
1097 +#endif
1098 +}
1099 +
1100 #endif /* _ASM_X86_MICROCODE_H */
1101 diff --git a/arch/x86/include/asm/perf_event.h b/arch/x86/include/asm/perf_event.h
1102 index 7bcb861a04e5..5a2ed3ed2f26 100644
1103 --- a/arch/x86/include/asm/perf_event.h
1104 +++ b/arch/x86/include/asm/perf_event.h
1105 @@ -165,6 +165,7 @@ struct x86_pmu_capability {
1106 #define GLOBAL_STATUS_ASIF BIT_ULL(60)
1107 #define GLOBAL_STATUS_COUNTERS_FROZEN BIT_ULL(59)
1108 #define GLOBAL_STATUS_LBRS_FROZEN BIT_ULL(58)
1109 +#define GLOBAL_STATUS_TRACE_TOPAPMI BIT_ULL(55)
1110
1111 /*
1112 * IBS cpuid feature detection
1113 diff --git a/arch/x86/include/asm/xen/hypervisor.h b/arch/x86/include/asm/xen/hypervisor.h
1114 index 8b2d4bea9962..39171b3646bb 100644
1115 --- a/arch/x86/include/asm/xen/hypervisor.h
1116 +++ b/arch/x86/include/asm/xen/hypervisor.h
1117 @@ -62,4 +62,6 @@ void xen_arch_register_cpu(int num);
1118 void xen_arch_unregister_cpu(int num);
1119 #endif
1120
1121 +extern void xen_set_iopl_mask(unsigned mask);
1122 +
1123 #endif /* _ASM_X86_XEN_HYPERVISOR_H */
1124 diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c
1125 index a35f6b5473f4..7af2505f20c2 100644
1126 --- a/arch/x86/kernel/apic/vector.c
1127 +++ b/arch/x86/kernel/apic/vector.c
1128 @@ -211,6 +211,7 @@ update:
1129 */
1130 cpumask_and(d->old_domain, d->old_domain, cpu_online_mask);
1131 d->move_in_progress = !cpumask_empty(d->old_domain);
1132 + d->cfg.old_vector = d->move_in_progress ? d->cfg.vector : 0;
1133 d->cfg.vector = vector;
1134 cpumask_copy(d->domain, vector_cpumask);
1135 success:
1136 @@ -653,46 +654,97 @@ void irq_complete_move(struct irq_cfg *cfg)
1137 }
1138
1139 /*
1140 - * Called with @desc->lock held and interrupts disabled.
1141 + * Called from fixup_irqs() with @desc->lock held and interrupts disabled.
1142 */
1143 void irq_force_complete_move(struct irq_desc *desc)
1144 {
1145 struct irq_data *irqdata = irq_desc_get_irq_data(desc);
1146 struct apic_chip_data *data = apic_chip_data(irqdata);
1147 struct irq_cfg *cfg = data ? &data->cfg : NULL;
1148 + unsigned int cpu;
1149
1150 if (!cfg)
1151 return;
1152
1153 - __irq_complete_move(cfg, cfg->vector);
1154 -
1155 /*
1156 * This is tricky. If the cleanup of @data->old_domain has not been
1157 * done yet, then the following setaffinity call will fail with
1158 * -EBUSY. This can leave the interrupt in a stale state.
1159 *
1160 - * The cleanup cannot make progress because we hold @desc->lock. So in
1161 - * case @data->old_domain is not yet cleaned up, we need to drop the
1162 - * lock and acquire it again. @desc cannot go away, because the
1163 - * hotplug code holds the sparse irq lock.
1164 + * All CPUs are stuck in stop machine with interrupts disabled so
1165 + * calling __irq_complete_move() would be completely pointless.
1166 */
1167 raw_spin_lock(&vector_lock);
1168 - /* Clean out all offline cpus (including ourself) first. */
1169 + /*
1170 + * Clean out all offline cpus (including the outgoing one) from the
1171 + * old_domain mask.
1172 + */
1173 cpumask_and(data->old_domain, data->old_domain, cpu_online_mask);
1174 - while (!cpumask_empty(data->old_domain)) {
1175 +
1176 + /*
1177 + * If move_in_progress is cleared and the old_domain mask is empty,
1178 + * then there is nothing to cleanup. fixup_irqs() will take care of
1179 + * the stale vectors on the outgoing cpu.
1180 + */
1181 + if (!data->move_in_progress && cpumask_empty(data->old_domain)) {
1182 raw_spin_unlock(&vector_lock);
1183 - raw_spin_unlock(&desc->lock);
1184 - cpu_relax();
1185 - raw_spin_lock(&desc->lock);
1186 + return;
1187 + }
1188 +
1189 + /*
1190 + * 1) The interrupt is in move_in_progress state. That means that we
1191 + * have not seen an interrupt since the io_apic was reprogrammed to
1192 + * the new vector.
1193 + *
1194 + * 2) The interrupt has fired on the new vector, but the cleanup IPIs
1195 + * have not been processed yet.
1196 + */
1197 + if (data->move_in_progress) {
1198 /*
1199 - * Reevaluate apic_chip_data. It might have been cleared after
1200 - * we dropped @desc->lock.
1201 + * In theory there is a race:
1202 + *
1203 + * set_ioapic(new_vector) <-- Interrupt is raised before update
1204 + * is effective, i.e. it's raised on
1205 + * the old vector.
1206 + *
1207 + * So if the target cpu cannot handle that interrupt before
1208 + * the old vector is cleaned up, we get a spurious interrupt
1209 + * and in the worst case the ioapic irq line becomes stale.
1210 + *
1211 + * But in case of cpu hotplug this should be a non issue
1212 + * because if the affinity update happens right before all
1213 + * cpus rendevouz in stop machine, there is no way that the
1214 + * interrupt can be blocked on the target cpu because all cpus
1215 + * loops first with interrupts enabled in stop machine, so the
1216 + * old vector is not yet cleaned up when the interrupt fires.
1217 + *
1218 + * So the only way to run into this issue is if the delivery
1219 + * of the interrupt on the apic/system bus would be delayed
1220 + * beyond the point where the target cpu disables interrupts
1221 + * in stop machine. I doubt that it can happen, but at least
1222 + * there is a theroretical chance. Virtualization might be
1223 + * able to expose this, but AFAICT the IOAPIC emulation is not
1224 + * as stupid as the real hardware.
1225 + *
1226 + * Anyway, there is nothing we can do about that at this point
1227 + * w/o refactoring the whole fixup_irq() business completely.
1228 + * We print at least the irq number and the old vector number,
1229 + * so we have the necessary information when a problem in that
1230 + * area arises.
1231 */
1232 - data = apic_chip_data(irqdata);
1233 - if (!data)
1234 - return;
1235 - raw_spin_lock(&vector_lock);
1236 + pr_warn("IRQ fixup: irq %d move in progress, old vector %d\n",
1237 + irqdata->irq, cfg->old_vector);
1238 }
1239 + /*
1240 + * If old_domain is not empty, then other cpus still have the irq
1241 + * descriptor set in their vector array. Clean it up.
1242 + */
1243 + for_each_cpu(cpu, data->old_domain)
1244 + per_cpu(vector_irq, cpu)[cfg->old_vector] = VECTOR_UNUSED;
1245 +
1246 + /* Cleanup the left overs of the (half finished) move */
1247 + cpumask_clear(data->old_domain);
1248 + data->move_in_progress = 0;
1249 raw_spin_unlock(&vector_lock);
1250 }
1251 #endif
1252 diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c
1253 index ce47402eb2f9..ac8975a65280 100644
1254 --- a/arch/x86/kernel/cpu/microcode/intel.c
1255 +++ b/arch/x86/kernel/cpu/microcode/intel.c
1256 @@ -555,10 +555,14 @@ scan_microcode(struct mc_saved_data *mc_saved_data, unsigned long *initrd,
1257 cd.data = NULL;
1258 cd.size = 0;
1259
1260 - cd = find_cpio_data(p, (void *)start, size, &offset);
1261 - if (!cd.data) {
1262 + /* try built-in microcode if no initrd */
1263 + if (!size) {
1264 if (!load_builtin_intel_microcode(&cd))
1265 return UCODE_ERROR;
1266 + } else {
1267 + cd = find_cpio_data(p, (void *)start, size, &offset);
1268 + if (!cd.data)
1269 + return UCODE_ERROR;
1270 }
1271
1272 return get_matching_model_microcode(0, start, cd.data, cd.size,
1273 @@ -694,7 +698,7 @@ int __init save_microcode_in_initrd_intel(void)
1274 if (count == 0)
1275 return ret;
1276
1277 - copy_initrd_ptrs(mc_saved, mc_saved_in_initrd, initrd_start, count);
1278 + copy_initrd_ptrs(mc_saved, mc_saved_in_initrd, get_initrd_start(), count);
1279 ret = save_microcode(&mc_saved_data, mc_saved, count);
1280 if (ret)
1281 pr_err("Cannot save microcode patches from initrd.\n");
1282 @@ -732,16 +736,20 @@ void __init load_ucode_intel_bsp(void)
1283 struct boot_params *p;
1284
1285 p = (struct boot_params *)__pa_nodebug(&boot_params);
1286 - start = p->hdr.ramdisk_image;
1287 size = p->hdr.ramdisk_size;
1288
1289 - _load_ucode_intel_bsp(
1290 - (struct mc_saved_data *)__pa_nodebug(&mc_saved_data),
1291 - (unsigned long *)__pa_nodebug(&mc_saved_in_initrd),
1292 - start, size);
1293 + /*
1294 + * Set start only if we have an initrd image. We cannot use initrd_start
1295 + * because it is not set that early yet.
1296 + */
1297 + start = (size ? p->hdr.ramdisk_image : 0);
1298 +
1299 + _load_ucode_intel_bsp((struct mc_saved_data *)__pa_nodebug(&mc_saved_data),
1300 + (unsigned long *)__pa_nodebug(&mc_saved_in_initrd),
1301 + start, size);
1302 #else
1303 - start = boot_params.hdr.ramdisk_image + PAGE_OFFSET;
1304 size = boot_params.hdr.ramdisk_size;
1305 + start = (size ? boot_params.hdr.ramdisk_image + PAGE_OFFSET : 0);
1306
1307 _load_ucode_intel_bsp(&mc_saved_data, mc_saved_in_initrd, start, size);
1308 #endif
1309 @@ -752,20 +760,14 @@ void load_ucode_intel_ap(void)
1310 struct mc_saved_data *mc_saved_data_p;
1311 struct ucode_cpu_info uci;
1312 unsigned long *mc_saved_in_initrd_p;
1313 - unsigned long initrd_start_addr;
1314 enum ucode_state ret;
1315 #ifdef CONFIG_X86_32
1316 - unsigned long *initrd_start_p;
1317
1318 - mc_saved_in_initrd_p =
1319 - (unsigned long *)__pa_nodebug(mc_saved_in_initrd);
1320 + mc_saved_in_initrd_p = (unsigned long *)__pa_nodebug(mc_saved_in_initrd);
1321 mc_saved_data_p = (struct mc_saved_data *)__pa_nodebug(&mc_saved_data);
1322 - initrd_start_p = (unsigned long *)__pa_nodebug(&initrd_start);
1323 - initrd_start_addr = (unsigned long)__pa_nodebug(*initrd_start_p);
1324 #else
1325 - mc_saved_data_p = &mc_saved_data;
1326 mc_saved_in_initrd_p = mc_saved_in_initrd;
1327 - initrd_start_addr = initrd_start;
1328 + mc_saved_data_p = &mc_saved_data;
1329 #endif
1330
1331 /*
1332 @@ -777,7 +779,7 @@ void load_ucode_intel_ap(void)
1333
1334 collect_cpu_info_early(&uci);
1335 ret = load_microcode(mc_saved_data_p, mc_saved_in_initrd_p,
1336 - initrd_start_addr, &uci);
1337 + get_initrd_start_addr(), &uci);
1338
1339 if (ret != UCODE_OK)
1340 return;
1341 diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
1342 index 2bf79d7c97df..a3aeb2cc361e 100644
1343 --- a/arch/x86/kernel/cpu/perf_event.c
1344 +++ b/arch/x86/kernel/cpu/perf_event.c
1345 @@ -593,6 +593,19 @@ void x86_pmu_disable_all(void)
1346 }
1347 }
1348
1349 +/*
1350 + * There may be PMI landing after enabled=0. The PMI hitting could be before or
1351 + * after disable_all.
1352 + *
1353 + * If PMI hits before disable_all, the PMU will be disabled in the NMI handler.
1354 + * It will not be re-enabled in the NMI handler again, because enabled=0. After
1355 + * handling the NMI, disable_all will be called, which will not change the
1356 + * state either. If PMI hits after disable_all, the PMU is already disabled
1357 + * before entering NMI handler. The NMI handler will not change the state
1358 + * either.
1359 + *
1360 + * So either situation is harmless.
1361 + */
1362 static void x86_pmu_disable(struct pmu *pmu)
1363 {
1364 struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
1365 diff --git a/arch/x86/kernel/cpu/perf_event.h b/arch/x86/kernel/cpu/perf_event.h
1366 index d0e35ebb2adb..ee70445fbb1f 100644
1367 --- a/arch/x86/kernel/cpu/perf_event.h
1368 +++ b/arch/x86/kernel/cpu/perf_event.h
1369 @@ -591,6 +591,7 @@ struct x86_pmu {
1370 pebs_active :1,
1371 pebs_broken :1;
1372 int pebs_record_size;
1373 + int pebs_buffer_size;
1374 void (*drain_pebs)(struct pt_regs *regs);
1375 struct event_constraint *pebs_constraints;
1376 void (*pebs_aliases)(struct perf_event *event);
1377 @@ -907,6 +908,8 @@ void intel_pmu_lbr_init_hsw(void);
1378
1379 void intel_pmu_lbr_init_skl(void);
1380
1381 +void intel_pmu_pebs_data_source_nhm(void);
1382 +
1383 int intel_pmu_setup_lbr_filter(struct perf_event *event);
1384
1385 void intel_pt_interrupt(void);
1386 diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
1387 index e2a430021e46..078de2e86b7a 100644
1388 --- a/arch/x86/kernel/cpu/perf_event_intel.c
1389 +++ b/arch/x86/kernel/cpu/perf_event_intel.c
1390 @@ -1458,7 +1458,15 @@ static __initconst const u64 slm_hw_cache_event_ids
1391 };
1392
1393 /*
1394 - * Use from PMIs where the LBRs are already disabled.
1395 + * Used from PMIs where the LBRs are already disabled.
1396 + *
1397 + * This function could be called consecutively. It is required to remain in
1398 + * disabled state if called consecutively.
1399 + *
1400 + * During consecutive calls, the same disable value will be written to related
1401 + * registers, so the PMU state remains unchanged. hw.state in
1402 + * intel_bts_disable_local will remain PERF_HES_STOPPED too in consecutive
1403 + * calls.
1404 */
1405 static void __intel_pmu_disable_all(void)
1406 {
1407 @@ -1840,6 +1848,16 @@ again:
1408 if (__test_and_clear_bit(62, (unsigned long *)&status)) {
1409 handled++;
1410 x86_pmu.drain_pebs(regs);
1411 + /*
1412 + * There are cases where, even though, the PEBS ovfl bit is set
1413 + * in GLOBAL_OVF_STATUS, the PEBS events may also have their
1414 + * overflow bits set for their counters. We must clear them
1415 + * here because they have been processed as exact samples in
1416 + * the drain_pebs() routine. They must not be processed again
1417 + * in the for_each_bit_set() loop for regular samples below.
1418 + */
1419 + status &= ~cpuc->pebs_enabled;
1420 + status &= x86_pmu.intel_ctrl | GLOBAL_STATUS_TRACE_TOPAPMI;
1421 }
1422
1423 /*
1424 @@ -1885,7 +1903,10 @@ again:
1425 goto again;
1426
1427 done:
1428 - __intel_pmu_enable_all(0, true);
1429 + /* Only restore PMU state when it's active. See x86_pmu_disable(). */
1430 + if (cpuc->enabled)
1431 + __intel_pmu_enable_all(0, true);
1432 +
1433 /*
1434 * Only unmask the NMI after the overflow counters
1435 * have been reset. This avoids spurious NMIs on
1436 @@ -3315,6 +3336,7 @@ __init int intel_pmu_init(void)
1437 intel_perfmon_event_map[PERF_COUNT_HW_STALLED_CYCLES_BACKEND] =
1438 X86_CONFIG(.event=0xb1, .umask=0x3f, .inv=1, .cmask=1);
1439
1440 + intel_pmu_pebs_data_source_nhm();
1441 x86_add_quirk(intel_nehalem_quirk);
1442
1443 pr_cont("Nehalem events, ");
1444 @@ -3377,6 +3399,7 @@ __init int intel_pmu_init(void)
1445 intel_perfmon_event_map[PERF_COUNT_HW_STALLED_CYCLES_BACKEND] =
1446 X86_CONFIG(.event=0xb1, .umask=0x3f, .inv=1, .cmask=1);
1447
1448 + intel_pmu_pebs_data_source_nhm();
1449 pr_cont("Westmere events, ");
1450 break;
1451
1452 diff --git a/arch/x86/kernel/cpu/perf_event_intel_ds.c b/arch/x86/kernel/cpu/perf_event_intel_ds.c
1453 index 5db1c7755548..7abb2b88572e 100644
1454 --- a/arch/x86/kernel/cpu/perf_event_intel_ds.c
1455 +++ b/arch/x86/kernel/cpu/perf_event_intel_ds.c
1456 @@ -51,7 +51,8 @@ union intel_x86_pebs_dse {
1457 #define OP_LH (P(OP, LOAD) | P(LVL, HIT))
1458 #define SNOOP_NONE_MISS (P(SNOOP, NONE) | P(SNOOP, MISS))
1459
1460 -static const u64 pebs_data_source[] = {
1461 +/* Version for Sandy Bridge and later */
1462 +static u64 pebs_data_source[] = {
1463 P(OP, LOAD) | P(LVL, MISS) | P(LVL, L3) | P(SNOOP, NA),/* 0x00:ukn L3 */
1464 OP_LH | P(LVL, L1) | P(SNOOP, NONE), /* 0x01: L1 local */
1465 OP_LH | P(LVL, LFB) | P(SNOOP, NONE), /* 0x02: LFB hit */
1466 @@ -70,6 +71,14 @@ static const u64 pebs_data_source[] = {
1467 OP_LH | P(LVL, UNC) | P(SNOOP, NONE), /* 0x0f: uncached */
1468 };
1469
1470 +/* Patch up minor differences in the bits */
1471 +void __init intel_pmu_pebs_data_source_nhm(void)
1472 +{
1473 + pebs_data_source[0x05] = OP_LH | P(LVL, L3) | P(SNOOP, HIT);
1474 + pebs_data_source[0x06] = OP_LH | P(LVL, L3) | P(SNOOP, HITM);
1475 + pebs_data_source[0x07] = OP_LH | P(LVL, L3) | P(SNOOP, HITM);
1476 +}
1477 +
1478 static u64 precise_store_data(u64 status)
1479 {
1480 union intel_x86_pebs_dse dse;
1481 @@ -269,7 +278,7 @@ static int alloc_pebs_buffer(int cpu)
1482 if (!x86_pmu.pebs)
1483 return 0;
1484
1485 - buffer = kzalloc_node(PEBS_BUFFER_SIZE, GFP_KERNEL, node);
1486 + buffer = kzalloc_node(x86_pmu.pebs_buffer_size, GFP_KERNEL, node);
1487 if (unlikely(!buffer))
1488 return -ENOMEM;
1489
1490 @@ -286,7 +295,7 @@ static int alloc_pebs_buffer(int cpu)
1491 per_cpu(insn_buffer, cpu) = ibuffer;
1492 }
1493
1494 - max = PEBS_BUFFER_SIZE / x86_pmu.pebs_record_size;
1495 + max = x86_pmu.pebs_buffer_size / x86_pmu.pebs_record_size;
1496
1497 ds->pebs_buffer_base = (u64)(unsigned long)buffer;
1498 ds->pebs_index = ds->pebs_buffer_base;
1499 @@ -1296,6 +1305,7 @@ void __init intel_ds_init(void)
1500
1501 x86_pmu.bts = boot_cpu_has(X86_FEATURE_BTS);
1502 x86_pmu.pebs = boot_cpu_has(X86_FEATURE_PEBS);
1503 + x86_pmu.pebs_buffer_size = PEBS_BUFFER_SIZE;
1504 if (x86_pmu.pebs) {
1505 char pebs_type = x86_pmu.intel_cap.pebs_trap ? '+' : '-';
1506 int format = x86_pmu.intel_cap.pebs_format;
1507 @@ -1304,6 +1314,14 @@ void __init intel_ds_init(void)
1508 case 0:
1509 printk(KERN_CONT "PEBS fmt0%c, ", pebs_type);
1510 x86_pmu.pebs_record_size = sizeof(struct pebs_record_core);
1511 + /*
1512 + * Using >PAGE_SIZE buffers makes the WRMSR to
1513 + * PERF_GLOBAL_CTRL in intel_pmu_enable_all()
1514 + * mysteriously hang on Core2.
1515 + *
1516 + * As a workaround, we don't do this.
1517 + */
1518 + x86_pmu.pebs_buffer_size = PAGE_SIZE;
1519 x86_pmu.drain_pebs = intel_pmu_drain_pebs_core;
1520 break;
1521
1522 diff --git a/arch/x86/kernel/cpu/perf_event_knc.c b/arch/x86/kernel/cpu/perf_event_knc.c
1523 index 5b0c232d1ee6..b931095e86d4 100644
1524 --- a/arch/x86/kernel/cpu/perf_event_knc.c
1525 +++ b/arch/x86/kernel/cpu/perf_event_knc.c
1526 @@ -263,7 +263,9 @@ again:
1527 goto again;
1528
1529 done:
1530 - knc_pmu_enable_all(0);
1531 + /* Only restore PMU state when it's active. See x86_pmu_disable(). */
1532 + if (cpuc->enabled)
1533 + knc_pmu_enable_all(0);
1534
1535 return handled;
1536 }
1537 diff --git a/arch/x86/kernel/ioport.c b/arch/x86/kernel/ioport.c
1538 index 37dae792dbbe..589b3193f102 100644
1539 --- a/arch/x86/kernel/ioport.c
1540 +++ b/arch/x86/kernel/ioport.c
1541 @@ -96,9 +96,14 @@ asmlinkage long sys_ioperm(unsigned long from, unsigned long num, int turn_on)
1542 SYSCALL_DEFINE1(iopl, unsigned int, level)
1543 {
1544 struct pt_regs *regs = current_pt_regs();
1545 - unsigned int old = (regs->flags >> 12) & 3;
1546 struct thread_struct *t = &current->thread;
1547
1548 + /*
1549 + * Careful: the IOPL bits in regs->flags are undefined under Xen PV
1550 + * and changing them has no effect.
1551 + */
1552 + unsigned int old = t->iopl >> X86_EFLAGS_IOPL_BIT;
1553 +
1554 if (level > 3)
1555 return -EINVAL;
1556 /* Trying to gain more privileges? */
1557 @@ -106,8 +111,9 @@ SYSCALL_DEFINE1(iopl, unsigned int, level)
1558 if (!capable(CAP_SYS_RAWIO))
1559 return -EPERM;
1560 }
1561 - regs->flags = (regs->flags & ~X86_EFLAGS_IOPL) | (level << 12);
1562 - t->iopl = level << 12;
1563 + regs->flags = (regs->flags & ~X86_EFLAGS_IOPL) |
1564 + (level << X86_EFLAGS_IOPL_BIT);
1565 + t->iopl = level << X86_EFLAGS_IOPL_BIT;
1566 set_iopl_mask(t->iopl);
1567
1568 return 0;
1569 diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
1570 index e835d263a33b..4cbb60fbff3e 100644
1571 --- a/arch/x86/kernel/process_64.c
1572 +++ b/arch/x86/kernel/process_64.c
1573 @@ -48,6 +48,7 @@
1574 #include <asm/syscalls.h>
1575 #include <asm/debugreg.h>
1576 #include <asm/switch_to.h>
1577 +#include <asm/xen/hypervisor.h>
1578
1579 asmlinkage extern void ret_from_fork(void);
1580
1581 @@ -411,6 +412,17 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
1582 task_thread_info(prev_p)->flags & _TIF_WORK_CTXSW_PREV))
1583 __switch_to_xtra(prev_p, next_p, tss);
1584
1585 +#ifdef CONFIG_XEN
1586 + /*
1587 + * On Xen PV, IOPL bits in pt_regs->flags have no effect, and
1588 + * current_pt_regs()->flags may not match the current task's
1589 + * intended IOPL. We need to switch it manually.
1590 + */
1591 + if (unlikely(static_cpu_has(X86_FEATURE_XENPV) &&
1592 + prev->iopl != next->iopl))
1593 + xen_set_iopl_mask(next->iopl);
1594 +#endif
1595 +
1596 if (static_cpu_has_bug(X86_BUG_SYSRET_SS_ATTRS)) {
1597 /*
1598 * AMD CPUs have a misfeature: SYSRET sets the SS selector but
1599 diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c
1600 index b0ea42b78ccd..ab5318727579 100644
1601 --- a/arch/x86/kvm/i8254.c
1602 +++ b/arch/x86/kvm/i8254.c
1603 @@ -245,7 +245,7 @@ static void kvm_pit_ack_irq(struct kvm_irq_ack_notifier *kian)
1604 * PIC is being reset. Handle it gracefully here
1605 */
1606 atomic_inc(&ps->pending);
1607 - else if (value > 0)
1608 + else if (value > 0 && ps->reinject)
1609 /* in this case, we had multiple outstanding pit interrupts
1610 * that we needed to inject. Reinject
1611 */
1612 @@ -288,7 +288,9 @@ static void pit_do_work(struct kthread_work *work)
1613 * last one has been acked.
1614 */
1615 spin_lock(&ps->inject_lock);
1616 - if (ps->irq_ack) {
1617 + if (!ps->reinject)
1618 + inject = 1;
1619 + else if (ps->irq_ack) {
1620 ps->irq_ack = 0;
1621 inject = 1;
1622 }
1623 @@ -317,10 +319,10 @@ static enum hrtimer_restart pit_timer_fn(struct hrtimer *data)
1624 struct kvm_kpit_state *ps = container_of(data, struct kvm_kpit_state, timer);
1625 struct kvm_pit *pt = ps->kvm->arch.vpit;
1626
1627 - if (ps->reinject || !atomic_read(&ps->pending)) {
1628 + if (ps->reinject)
1629 atomic_inc(&ps->pending);
1630 - queue_kthread_work(&pt->worker, &pt->expired);
1631 - }
1632 +
1633 + queue_kthread_work(&pt->worker, &pt->expired);
1634
1635 if (ps->is_periodic) {
1636 hrtimer_add_expires_ns(&ps->timer, ps->period);
1637 diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
1638 index 0958fa2b7cb7..f34ab71dfd57 100644
1639 --- a/arch/x86/kvm/vmx.c
1640 +++ b/arch/x86/kvm/vmx.c
1641 @@ -2637,8 +2637,15 @@ static void nested_vmx_setup_ctls_msrs(struct vcpu_vmx *vmx)
1642 } else
1643 vmx->nested.nested_vmx_ept_caps = 0;
1644
1645 + /*
1646 + * Old versions of KVM use the single-context version without
1647 + * checking for support, so declare that it is supported even
1648 + * though it is treated as global context. The alternative is
1649 + * not failing the single-context invvpid, and it is worse.
1650 + */
1651 if (enable_vpid)
1652 vmx->nested.nested_vmx_vpid_caps = VMX_VPID_INVVPID_BIT |
1653 + VMX_VPID_EXTENT_SINGLE_CONTEXT_BIT |
1654 VMX_VPID_EXTENT_GLOBAL_CONTEXT_BIT;
1655 else
1656 vmx->nested.nested_vmx_vpid_caps = 0;
1657 @@ -7340,6 +7347,7 @@ static int handle_invept(struct kvm_vcpu *vcpu)
1658 if (!(types & (1UL << type))) {
1659 nested_vmx_failValid(vcpu,
1660 VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID);
1661 + skip_emulated_instruction(vcpu);
1662 return 1;
1663 }
1664
1665 @@ -7398,6 +7406,7 @@ static int handle_invvpid(struct kvm_vcpu *vcpu)
1666 if (!(types & (1UL << type))) {
1667 nested_vmx_failValid(vcpu,
1668 VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID);
1669 + skip_emulated_instruction(vcpu);
1670 return 1;
1671 }
1672
1673 @@ -7414,12 +7423,17 @@ static int handle_invvpid(struct kvm_vcpu *vcpu)
1674 }
1675
1676 switch (type) {
1677 + case VMX_VPID_EXTENT_SINGLE_CONTEXT:
1678 + /*
1679 + * Old versions of KVM use the single-context version so we
1680 + * have to support it; just treat it the same as all-context.
1681 + */
1682 case VMX_VPID_EXTENT_ALL_CONTEXT:
1683 __vmx_flush_tlb(vcpu, to_vmx(vcpu)->nested.vpid02);
1684 nested_vmx_succeed(vcpu);
1685 break;
1686 default:
1687 - /* Trap single context invalidation invvpid calls */
1688 + /* Trap individual address invalidation invvpid calls */
1689 BUG_ON(1);
1690 break;
1691 }
1692 diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
1693 index d2945024ed33..8bfc5fc6a39b 100644
1694 --- a/arch/x86/kvm/x86.c
1695 +++ b/arch/x86/kvm/x86.c
1696 @@ -2736,6 +2736,7 @@ void kvm_arch_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
1697 }
1698
1699 kvm_make_request(KVM_REQ_STEAL_UPDATE, vcpu);
1700 + vcpu->arch.switch_db_regs |= KVM_DEBUGREG_RELOAD;
1701 }
1702
1703 void kvm_arch_vcpu_put(struct kvm_vcpu *vcpu)
1704 diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
1705 index 8f4cc3dfac32..5fb6adaaa796 100644
1706 --- a/arch/x86/mm/tlb.c
1707 +++ b/arch/x86/mm/tlb.c
1708 @@ -106,8 +106,6 @@ static void flush_tlb_func(void *info)
1709
1710 if (f->flush_mm != this_cpu_read(cpu_tlbstate.active_mm))
1711 return;
1712 - if (!f->flush_end)
1713 - f->flush_end = f->flush_start + PAGE_SIZE;
1714
1715 count_vm_tlb_event(NR_TLB_REMOTE_FLUSH_RECEIVED);
1716 if (this_cpu_read(cpu_tlbstate.state) == TLBSTATE_OK) {
1717 @@ -135,12 +133,20 @@ void native_flush_tlb_others(const struct cpumask *cpumask,
1718 unsigned long end)
1719 {
1720 struct flush_tlb_info info;
1721 +
1722 + if (end == 0)
1723 + end = start + PAGE_SIZE;
1724 info.flush_mm = mm;
1725 info.flush_start = start;
1726 info.flush_end = end;
1727
1728 count_vm_tlb_event(NR_TLB_REMOTE_FLUSH);
1729 - trace_tlb_flush(TLB_REMOTE_SEND_IPI, end - start);
1730 + if (end == TLB_FLUSH_ALL)
1731 + trace_tlb_flush(TLB_REMOTE_SEND_IPI, TLB_FLUSH_ALL);
1732 + else
1733 + trace_tlb_flush(TLB_REMOTE_SEND_IPI,
1734 + (end - start) >> PAGE_SHIFT);
1735 +
1736 if (is_uv_system()) {
1737 unsigned int cpu;
1738
1739 diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c
1740 index e58565556703..0ae7e9fa348d 100644
1741 --- a/arch/x86/pci/fixup.c
1742 +++ b/arch/x86/pci/fixup.c
1743 @@ -540,3 +540,10 @@ static void twinhead_reserve_killing_zone(struct pci_dev *dev)
1744 }
1745 }
1746 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x27B9, twinhead_reserve_killing_zone);
1747 +
1748 +static void pci_bdwep_bar(struct pci_dev *dev)
1749 +{
1750 + dev->non_compliant_bars = 1;
1751 +}
1752 +DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6fa0, pci_bdwep_bar);
1753 +DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6fc0, pci_bdwep_bar);
1754 diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
1755 index b7de78bdc09c..beab8c706ac9 100644
1756 --- a/arch/x86/xen/enlighten.c
1757 +++ b/arch/x86/xen/enlighten.c
1758 @@ -961,7 +961,7 @@ static void xen_load_sp0(struct tss_struct *tss,
1759 tss->x86_tss.sp0 = thread->sp0;
1760 }
1761
1762 -static void xen_set_iopl_mask(unsigned mask)
1763 +void xen_set_iopl_mask(unsigned mask)
1764 {
1765 struct physdev_set_iopl set_iopl;
1766
1767 diff --git a/arch/xtensa/kernel/head.S b/arch/xtensa/kernel/head.S
1768 index 9ed55649ac8e..05e1df943856 100644
1769 --- a/arch/xtensa/kernel/head.S
1770 +++ b/arch/xtensa/kernel/head.S
1771 @@ -128,7 +128,7 @@ ENTRY(_startup)
1772 wsr a0, icountlevel
1773
1774 .set _index, 0
1775 - .rept XCHAL_NUM_DBREAK - 1
1776 + .rept XCHAL_NUM_DBREAK
1777 wsr a0, SREG_DBREAKC + _index
1778 .set _index, _index + 1
1779 .endr
1780 diff --git a/arch/xtensa/mm/cache.c b/arch/xtensa/mm/cache.c
1781 index d75aa1476da7..1a804a2f9a5b 100644
1782 --- a/arch/xtensa/mm/cache.c
1783 +++ b/arch/xtensa/mm/cache.c
1784 @@ -97,11 +97,11 @@ void clear_user_highpage(struct page *page, unsigned long vaddr)
1785 unsigned long paddr;
1786 void *kvaddr = coherent_kvaddr(page, TLBTEMP_BASE_1, vaddr, &paddr);
1787
1788 - pagefault_disable();
1789 + preempt_disable();
1790 kmap_invalidate_coherent(page, vaddr);
1791 set_bit(PG_arch_1, &page->flags);
1792 clear_page_alias(kvaddr, paddr);
1793 - pagefault_enable();
1794 + preempt_enable();
1795 }
1796
1797 void copy_user_highpage(struct page *dst, struct page *src,
1798 @@ -113,11 +113,11 @@ void copy_user_highpage(struct page *dst, struct page *src,
1799 void *src_vaddr = coherent_kvaddr(src, TLBTEMP_BASE_2, vaddr,
1800 &src_paddr);
1801
1802 - pagefault_disable();
1803 + preempt_disable();
1804 kmap_invalidate_coherent(dst, vaddr);
1805 set_bit(PG_arch_1, &dst->flags);
1806 copy_page_alias(dst_vaddr, src_vaddr, dst_paddr, src_paddr);
1807 - pagefault_enable();
1808 + preempt_enable();
1809 }
1810
1811 #endif /* DCACHE_WAY_SIZE > PAGE_SIZE */
1812 diff --git a/arch/xtensa/platforms/iss/console.c b/arch/xtensa/platforms/iss/console.c
1813 index 70cb408bc20d..92d785fefb6d 100644
1814 --- a/arch/xtensa/platforms/iss/console.c
1815 +++ b/arch/xtensa/platforms/iss/console.c
1816 @@ -100,21 +100,23 @@ static void rs_poll(unsigned long priv)
1817 {
1818 struct tty_port *port = (struct tty_port *)priv;
1819 int i = 0;
1820 + int rd = 1;
1821 unsigned char c;
1822
1823 spin_lock(&timer_lock);
1824
1825 while (simc_poll(0)) {
1826 - simc_read(0, &c, 1);
1827 + rd = simc_read(0, &c, 1);
1828 + if (rd <= 0)
1829 + break;
1830 tty_insert_flip_char(port, c, TTY_NORMAL);
1831 i++;
1832 }
1833
1834 if (i)
1835 tty_flip_buffer_push(port);
1836 -
1837 -
1838 - mod_timer(&serial_timer, jiffies + SERIAL_TIMER_VALUE);
1839 + if (rd)
1840 + mod_timer(&serial_timer, jiffies + SERIAL_TIMER_VALUE);
1841 spin_unlock(&timer_lock);
1842 }
1843
1844 diff --git a/block/blk-core.c b/block/blk-core.c
1845 index 33e2f62d5062..f8e64cac981a 100644
1846 --- a/block/blk-core.c
1847 +++ b/block/blk-core.c
1848 @@ -2189,7 +2189,7 @@ int blk_insert_cloned_request(struct request_queue *q, struct request *rq)
1849 if (q->mq_ops) {
1850 if (blk_queue_io_stat(q))
1851 blk_account_io_start(rq, true);
1852 - blk_mq_insert_request(rq, false, true, true);
1853 + blk_mq_insert_request(rq, false, true, false);
1854 return 0;
1855 }
1856
1857 diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c
1858 index 021d39c0ba75..13c4e5a5fe8c 100644
1859 --- a/crypto/asymmetric_keys/x509_cert_parser.c
1860 +++ b/crypto/asymmetric_keys/x509_cert_parser.c
1861 @@ -494,7 +494,7 @@ int x509_decode_time(time64_t *_t, size_t hdrlen,
1862 unsigned char tag,
1863 const unsigned char *value, size_t vlen)
1864 {
1865 - static const unsigned char month_lengths[] = { 31, 29, 31, 30, 31, 30,
1866 + static const unsigned char month_lengths[] = { 31, 28, 31, 30, 31, 30,
1867 31, 31, 30, 31, 30, 31 };
1868 const unsigned char *p = value;
1869 unsigned year, mon, day, hour, min, sec, mon_len;
1870 @@ -540,9 +540,9 @@ int x509_decode_time(time64_t *_t, size_t hdrlen,
1871 if (year % 4 == 0) {
1872 mon_len = 29;
1873 if (year % 100 == 0) {
1874 - year /= 100;
1875 - if (year % 4 != 0)
1876 - mon_len = 28;
1877 + mon_len = 28;
1878 + if (year % 400 == 0)
1879 + mon_len = 29;
1880 }
1881 }
1882 }
1883 diff --git a/crypto/keywrap.c b/crypto/keywrap.c
1884 index b1d106ce55f3..72014f963ba7 100644
1885 --- a/crypto/keywrap.c
1886 +++ b/crypto/keywrap.c
1887 @@ -212,7 +212,7 @@ static int crypto_kw_decrypt(struct blkcipher_desc *desc,
1888 SEMIBSIZE))
1889 ret = -EBADMSG;
1890
1891 - memzero_explicit(&block, sizeof(struct crypto_kw_block));
1892 + memzero_explicit(block, sizeof(struct crypto_kw_block));
1893
1894 return ret;
1895 }
1896 @@ -297,7 +297,7 @@ static int crypto_kw_encrypt(struct blkcipher_desc *desc,
1897 /* establish the IV for the caller to pick up */
1898 memcpy(desc->info, block->A, SEMIBSIZE);
1899
1900 - memzero_explicit(&block, sizeof(struct crypto_kw_block));
1901 + memzero_explicit(block, sizeof(struct crypto_kw_block));
1902
1903 return 0;
1904 }
1905 diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
1906 index cdc5c2599beb..627f8fbb5e9a 100644
1907 --- a/drivers/acpi/resource.c
1908 +++ b/drivers/acpi/resource.c
1909 @@ -26,8 +26,20 @@
1910
1911 #ifdef CONFIG_X86
1912 #define valid_IRQ(i) (((i) != 0) && ((i) != 2))
1913 +static inline bool acpi_iospace_resource_valid(struct resource *res)
1914 +{
1915 + /* On X86 IO space is limited to the [0 - 64K] IO port range */
1916 + return res->end < 0x10003;
1917 +}
1918 #else
1919 #define valid_IRQ(i) (true)
1920 +/*
1921 + * ACPI IO descriptors on arches other than X86 contain MMIO CPU physical
1922 + * addresses mapping IO space in CPU physical address space, IO space
1923 + * resources can be placed anywhere in the 64-bit physical address space.
1924 + */
1925 +static inline bool
1926 +acpi_iospace_resource_valid(struct resource *res) { return true; }
1927 #endif
1928
1929 static bool acpi_dev_resource_len_valid(u64 start, u64 end, u64 len, bool io)
1930 @@ -126,7 +138,7 @@ static void acpi_dev_ioresource_flags(struct resource *res, u64 len,
1931 if (!acpi_dev_resource_len_valid(res->start, res->end, len, true))
1932 res->flags |= IORESOURCE_DISABLED | IORESOURCE_UNSET;
1933
1934 - if (res->end >= 0x10003)
1935 + if (!acpi_iospace_resource_valid(res))
1936 res->flags |= IORESOURCE_DISABLED | IORESOURCE_UNSET;
1937
1938 if (io_decode == ACPI_DECODE_16)
1939 diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
1940 index 0d94621dc856..e3322adaaae0 100644
1941 --- a/drivers/acpi/sleep.c
1942 +++ b/drivers/acpi/sleep.c
1943 @@ -714,6 +714,7 @@ static int acpi_hibernation_enter(void)
1944
1945 static void acpi_hibernation_leave(void)
1946 {
1947 + pm_set_resume_via_firmware();
1948 /*
1949 * If ACPI is not enabled by the BIOS and the boot kernel, we need to
1950 * enable it here.
1951 diff --git a/drivers/block/brd.c b/drivers/block/brd.c
1952 index a5880f4ab40e..1914c63ca8b1 100644
1953 --- a/drivers/block/brd.c
1954 +++ b/drivers/block/brd.c
1955 @@ -338,7 +338,7 @@ static blk_qc_t brd_make_request(struct request_queue *q, struct bio *bio)
1956
1957 if (unlikely(bio->bi_rw & REQ_DISCARD)) {
1958 if (sector & ((PAGE_SIZE >> SECTOR_SHIFT) - 1) ||
1959 - bio->bi_iter.bi_size & PAGE_MASK)
1960 + bio->bi_iter.bi_size & ~PAGE_MASK)
1961 goto io_error;
1962 discard_from_brd(brd, sector, bio->bi_iter.bi_size);
1963 goto out;
1964 diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
1965 index 3457ac8c03e2..55d3d1da72de 100644
1966 --- a/drivers/block/mtip32xx/mtip32xx.c
1967 +++ b/drivers/block/mtip32xx/mtip32xx.c
1968 @@ -173,7 +173,13 @@ static struct mtip_cmd *mtip_get_int_command(struct driver_data *dd)
1969 {
1970 struct request *rq;
1971
1972 + if (mtip_check_surprise_removal(dd->pdev))
1973 + return NULL;
1974 +
1975 rq = blk_mq_alloc_request(dd->queue, 0, __GFP_RECLAIM, true);
1976 + if (IS_ERR(rq))
1977 + return NULL;
1978 +
1979 return blk_mq_rq_to_pdu(rq);
1980 }
1981
1982 @@ -233,15 +239,9 @@ static void mtip_async_complete(struct mtip_port *port,
1983 "Command tag %d failed due to TFE\n", tag);
1984 }
1985
1986 - /* Unmap the DMA scatter list entries */
1987 - dma_unmap_sg(&dd->pdev->dev, cmd->sg, cmd->scatter_ents, cmd->direction);
1988 -
1989 rq = mtip_rq_from_tag(dd, tag);
1990
1991 - if (unlikely(cmd->unaligned))
1992 - up(&port->cmd_slot_unal);
1993 -
1994 - blk_mq_end_request(rq, status ? -EIO : 0);
1995 + blk_mq_complete_request(rq, status);
1996 }
1997
1998 /*
1999 @@ -581,6 +581,8 @@ static void mtip_completion(struct mtip_port *port,
2000 dev_warn(&port->dd->pdev->dev,
2001 "Internal command %d completed with TFE\n", tag);
2002
2003 + command->comp_func = NULL;
2004 + command->comp_data = NULL;
2005 complete(waiting);
2006 }
2007
2008 @@ -618,8 +620,6 @@ static void mtip_handle_tfe(struct driver_data *dd)
2009
2010 port = dd->port;
2011
2012 - set_bit(MTIP_PF_EH_ACTIVE_BIT, &port->flags);
2013 -
2014 if (test_bit(MTIP_PF_IC_ACTIVE_BIT, &port->flags)) {
2015 cmd = mtip_cmd_from_tag(dd, MTIP_TAG_INTERNAL);
2016 dbg_printk(MTIP_DRV_NAME " TFE for the internal command\n");
2017 @@ -628,7 +628,7 @@ static void mtip_handle_tfe(struct driver_data *dd)
2018 cmd->comp_func(port, MTIP_TAG_INTERNAL,
2019 cmd, PORT_IRQ_TF_ERR);
2020 }
2021 - goto handle_tfe_exit;
2022 + return;
2023 }
2024
2025 /* clear the tag accumulator */
2026 @@ -701,7 +701,7 @@ static void mtip_handle_tfe(struct driver_data *dd)
2027 fail_reason = "thermal shutdown";
2028 }
2029 if (buf[288] == 0xBF) {
2030 - set_bit(MTIP_DDF_SEC_LOCK_BIT, &dd->dd_flag);
2031 + set_bit(MTIP_DDF_REBUILD_FAILED_BIT, &dd->dd_flag);
2032 dev_info(&dd->pdev->dev,
2033 "Drive indicates rebuild has failed. Secure erase required.\n");
2034 fail_all_ncq_cmds = 1;
2035 @@ -771,11 +771,6 @@ static void mtip_handle_tfe(struct driver_data *dd)
2036 }
2037 }
2038 print_tags(dd, "reissued (TFE)", tagaccum, cmd_cnt);
2039 -
2040 -handle_tfe_exit:
2041 - /* clear eh_active */
2042 - clear_bit(MTIP_PF_EH_ACTIVE_BIT, &port->flags);
2043 - wake_up_interruptible(&port->svc_wait);
2044 }
2045
2046 /*
2047 @@ -1007,6 +1002,7 @@ static bool mtip_pause_ncq(struct mtip_port *port,
2048 (fis->features == 0x27 || fis->features == 0x72 ||
2049 fis->features == 0x62 || fis->features == 0x26))) {
2050 clear_bit(MTIP_DDF_SEC_LOCK_BIT, &port->dd->dd_flag);
2051 + clear_bit(MTIP_DDF_REBUILD_FAILED_BIT, &port->dd->dd_flag);
2052 /* Com reset after secure erase or lowlevel format */
2053 mtip_restart_port(port);
2054 clear_bit(MTIP_PF_SE_ACTIVE_BIT, &port->flags);
2055 @@ -1021,12 +1017,14 @@ static bool mtip_pause_ncq(struct mtip_port *port,
2056 *
2057 * @port Pointer to port data structure
2058 * @timeout Max duration to wait (ms)
2059 + * @atomic gfp_t flag to indicate blockable context or not
2060 *
2061 * return value
2062 * 0 Success
2063 * -EBUSY Commands still active
2064 */
2065 -static int mtip_quiesce_io(struct mtip_port *port, unsigned long timeout)
2066 +static int mtip_quiesce_io(struct mtip_port *port, unsigned long timeout,
2067 + gfp_t atomic)
2068 {
2069 unsigned long to;
2070 unsigned int n;
2071 @@ -1037,16 +1035,21 @@ static int mtip_quiesce_io(struct mtip_port *port, unsigned long timeout)
2072 to = jiffies + msecs_to_jiffies(timeout);
2073 do {
2074 if (test_bit(MTIP_PF_SVC_THD_ACTIVE_BIT, &port->flags) &&
2075 - test_bit(MTIP_PF_ISSUE_CMDS_BIT, &port->flags)) {
2076 + test_bit(MTIP_PF_ISSUE_CMDS_BIT, &port->flags) &&
2077 + atomic == GFP_KERNEL) {
2078 msleep(20);
2079 continue; /* svc thd is actively issuing commands */
2080 }
2081
2082 - msleep(100);
2083 + if (atomic == GFP_KERNEL)
2084 + msleep(100);
2085 + else {
2086 + cpu_relax();
2087 + udelay(100);
2088 + }
2089 +
2090 if (mtip_check_surprise_removal(port->dd->pdev))
2091 goto err_fault;
2092 - if (test_bit(MTIP_DDF_REMOVE_PENDING_BIT, &port->dd->dd_flag))
2093 - goto err_fault;
2094
2095 /*
2096 * Ignore s_active bit 0 of array element 0.
2097 @@ -1099,6 +1102,7 @@ static int mtip_exec_internal_command(struct mtip_port *port,
2098 struct mtip_cmd *int_cmd;
2099 struct driver_data *dd = port->dd;
2100 int rv = 0;
2101 + unsigned long start;
2102
2103 /* Make sure the buffer is 8 byte aligned. This is asic specific. */
2104 if (buffer & 0x00000007) {
2105 @@ -1107,6 +1111,10 @@ static int mtip_exec_internal_command(struct mtip_port *port,
2106 }
2107
2108 int_cmd = mtip_get_int_command(dd);
2109 + if (!int_cmd) {
2110 + dbg_printk(MTIP_DRV_NAME "Unable to allocate tag for PIO cmd\n");
2111 + return -EFAULT;
2112 + }
2113
2114 set_bit(MTIP_PF_IC_ACTIVE_BIT, &port->flags);
2115
2116 @@ -1119,7 +1127,7 @@ static int mtip_exec_internal_command(struct mtip_port *port,
2117 if (fis->command != ATA_CMD_STANDBYNOW1) {
2118 /* wait for io to complete if non atomic */
2119 if (mtip_quiesce_io(port,
2120 - MTIP_QUIESCE_IO_TIMEOUT_MS) < 0) {
2121 + MTIP_QUIESCE_IO_TIMEOUT_MS, atomic) < 0) {
2122 dev_warn(&dd->pdev->dev,
2123 "Failed to quiesce IO\n");
2124 mtip_put_int_command(dd, int_cmd);
2125 @@ -1162,6 +1170,8 @@ static int mtip_exec_internal_command(struct mtip_port *port,
2126 /* Populate the command header */
2127 int_cmd->command_header->byte_count = 0;
2128
2129 + start = jiffies;
2130 +
2131 /* Issue the command to the hardware */
2132 mtip_issue_non_ncq_command(port, MTIP_TAG_INTERNAL);
2133
2134 @@ -1170,10 +1180,12 @@ static int mtip_exec_internal_command(struct mtip_port *port,
2135 if ((rv = wait_for_completion_interruptible_timeout(
2136 &wait,
2137 msecs_to_jiffies(timeout))) <= 0) {
2138 +
2139 if (rv == -ERESTARTSYS) { /* interrupted */
2140 dev_err(&dd->pdev->dev,
2141 - "Internal command [%02X] was interrupted after %lu ms\n",
2142 - fis->command, timeout);
2143 + "Internal command [%02X] was interrupted after %u ms\n",
2144 + fis->command,
2145 + jiffies_to_msecs(jiffies - start));
2146 rv = -EINTR;
2147 goto exec_ic_exit;
2148 } else if (rv == 0) /* timeout */
2149 @@ -2897,6 +2909,42 @@ static int mtip_ftl_rebuild_poll(struct driver_data *dd)
2150 return -EFAULT;
2151 }
2152
2153 +static void mtip_softirq_done_fn(struct request *rq)
2154 +{
2155 + struct mtip_cmd *cmd = blk_mq_rq_to_pdu(rq);
2156 + struct driver_data *dd = rq->q->queuedata;
2157 +
2158 + /* Unmap the DMA scatter list entries */
2159 + dma_unmap_sg(&dd->pdev->dev, cmd->sg, cmd->scatter_ents,
2160 + cmd->direction);
2161 +
2162 + if (unlikely(cmd->unaligned))
2163 + up(&dd->port->cmd_slot_unal);
2164 +
2165 + blk_mq_end_request(rq, rq->errors);
2166 +}
2167 +
2168 +static void mtip_abort_cmd(struct request *req, void *data,
2169 + bool reserved)
2170 +{
2171 + struct driver_data *dd = data;
2172 +
2173 + dbg_printk(MTIP_DRV_NAME " Aborting request, tag = %d\n", req->tag);
2174 +
2175 + clear_bit(req->tag, dd->port->cmds_to_issue);
2176 + req->errors = -EIO;
2177 + mtip_softirq_done_fn(req);
2178 +}
2179 +
2180 +static void mtip_queue_cmd(struct request *req, void *data,
2181 + bool reserved)
2182 +{
2183 + struct driver_data *dd = data;
2184 +
2185 + set_bit(req->tag, dd->port->cmds_to_issue);
2186 + blk_abort_request(req);
2187 +}
2188 +
2189 /*
2190 * service thread to issue queued commands
2191 *
2192 @@ -2909,7 +2957,7 @@ static int mtip_ftl_rebuild_poll(struct driver_data *dd)
2193 static int mtip_service_thread(void *data)
2194 {
2195 struct driver_data *dd = (struct driver_data *)data;
2196 - unsigned long slot, slot_start, slot_wrap;
2197 + unsigned long slot, slot_start, slot_wrap, to;
2198 unsigned int num_cmd_slots = dd->slot_groups * 32;
2199 struct mtip_port *port = dd->port;
2200
2201 @@ -2924,9 +2972,7 @@ static int mtip_service_thread(void *data)
2202 * is in progress nor error handling is active
2203 */
2204 wait_event_interruptible(port->svc_wait, (port->flags) &&
2205 - !(port->flags & MTIP_PF_PAUSE_IO));
2206 -
2207 - set_bit(MTIP_PF_SVC_THD_ACTIVE_BIT, &port->flags);
2208 + (port->flags & MTIP_PF_SVC_THD_WORK));
2209
2210 if (kthread_should_stop() ||
2211 test_bit(MTIP_PF_SVC_THD_STOP_BIT, &port->flags))
2212 @@ -2936,6 +2982,8 @@ static int mtip_service_thread(void *data)
2213 &dd->dd_flag)))
2214 goto st_out;
2215
2216 + set_bit(MTIP_PF_SVC_THD_ACTIVE_BIT, &port->flags);
2217 +
2218 restart_eh:
2219 /* Demux bits: start with error handling */
2220 if (test_bit(MTIP_PF_EH_ACTIVE_BIT, &port->flags)) {
2221 @@ -2946,6 +2994,32 @@ restart_eh:
2222 if (test_bit(MTIP_PF_EH_ACTIVE_BIT, &port->flags))
2223 goto restart_eh;
2224
2225 + if (test_bit(MTIP_PF_TO_ACTIVE_BIT, &port->flags)) {
2226 + to = jiffies + msecs_to_jiffies(5000);
2227 +
2228 + do {
2229 + mdelay(100);
2230 + } while (atomic_read(&dd->irq_workers_active) != 0 &&
2231 + time_before(jiffies, to));
2232 +
2233 + if (atomic_read(&dd->irq_workers_active) != 0)
2234 + dev_warn(&dd->pdev->dev,
2235 + "Completion workers still active!");
2236 +
2237 + spin_lock(dd->queue->queue_lock);
2238 + blk_mq_all_tag_busy_iter(*dd->tags.tags,
2239 + mtip_queue_cmd, dd);
2240 + spin_unlock(dd->queue->queue_lock);
2241 +
2242 + set_bit(MTIP_PF_ISSUE_CMDS_BIT, &dd->port->flags);
2243 +
2244 + if (mtip_device_reset(dd))
2245 + blk_mq_all_tag_busy_iter(*dd->tags.tags,
2246 + mtip_abort_cmd, dd);
2247 +
2248 + clear_bit(MTIP_PF_TO_ACTIVE_BIT, &dd->port->flags);
2249 + }
2250 +
2251 if (test_bit(MTIP_PF_ISSUE_CMDS_BIT, &port->flags)) {
2252 slot = 1;
2253 /* used to restrict the loop to one iteration */
2254 @@ -2978,10 +3052,8 @@ restart_eh:
2255 }
2256
2257 if (test_bit(MTIP_PF_REBUILD_BIT, &port->flags)) {
2258 - if (mtip_ftl_rebuild_poll(dd) < 0)
2259 - set_bit(MTIP_DDF_REBUILD_FAILED_BIT,
2260 - &dd->dd_flag);
2261 - clear_bit(MTIP_PF_REBUILD_BIT, &port->flags);
2262 + if (mtip_ftl_rebuild_poll(dd) == 0)
2263 + clear_bit(MTIP_PF_REBUILD_BIT, &port->flags);
2264 }
2265 }
2266
2267 @@ -3096,7 +3168,7 @@ static int mtip_hw_get_identify(struct driver_data *dd)
2268 if (buf[288] == 0xBF) {
2269 dev_info(&dd->pdev->dev,
2270 "Drive indicates rebuild has failed.\n");
2271 - /* TODO */
2272 + set_bit(MTIP_DDF_REBUILD_FAILED_BIT, &dd->dd_flag);
2273 }
2274 }
2275
2276 @@ -3270,20 +3342,25 @@ out1:
2277 return rv;
2278 }
2279
2280 -static void mtip_standby_drive(struct driver_data *dd)
2281 +static int mtip_standby_drive(struct driver_data *dd)
2282 {
2283 - if (dd->sr)
2284 - return;
2285 + int rv = 0;
2286
2287 + if (dd->sr || !dd->port)
2288 + return -ENODEV;
2289 /*
2290 * Send standby immediate (E0h) to the drive so that it
2291 * saves its state.
2292 */
2293 if (!test_bit(MTIP_PF_REBUILD_BIT, &dd->port->flags) &&
2294 - !test_bit(MTIP_DDF_SEC_LOCK_BIT, &dd->dd_flag))
2295 - if (mtip_standby_immediate(dd->port))
2296 + !test_bit(MTIP_DDF_REBUILD_FAILED_BIT, &dd->dd_flag) &&
2297 + !test_bit(MTIP_DDF_SEC_LOCK_BIT, &dd->dd_flag)) {
2298 + rv = mtip_standby_immediate(dd->port);
2299 + if (rv)
2300 dev_warn(&dd->pdev->dev,
2301 "STANDBY IMMEDIATE failed\n");
2302 + }
2303 + return rv;
2304 }
2305
2306 /*
2307 @@ -3296,10 +3373,6 @@ static void mtip_standby_drive(struct driver_data *dd)
2308 */
2309 static int mtip_hw_exit(struct driver_data *dd)
2310 {
2311 - /*
2312 - * Send standby immediate (E0h) to the drive so that it
2313 - * saves its state.
2314 - */
2315 if (!dd->sr) {
2316 /* de-initialize the port. */
2317 mtip_deinit_port(dd->port);
2318 @@ -3341,8 +3414,7 @@ static int mtip_hw_shutdown(struct driver_data *dd)
2319 * Send standby immediate (E0h) to the drive so that it
2320 * saves its state.
2321 */
2322 - if (!dd->sr && dd->port)
2323 - mtip_standby_immediate(dd->port);
2324 + mtip_standby_drive(dd);
2325
2326 return 0;
2327 }
2328 @@ -3365,7 +3437,7 @@ static int mtip_hw_suspend(struct driver_data *dd)
2329 * Send standby immediate (E0h) to the drive
2330 * so that it saves its state.
2331 */
2332 - if (mtip_standby_immediate(dd->port) != 0) {
2333 + if (mtip_standby_drive(dd) != 0) {
2334 dev_err(&dd->pdev->dev,
2335 "Failed standby-immediate command\n");
2336 return -EFAULT;
2337 @@ -3603,6 +3675,28 @@ static int mtip_block_getgeo(struct block_device *dev,
2338 return 0;
2339 }
2340
2341 +static int mtip_block_open(struct block_device *dev, fmode_t mode)
2342 +{
2343 + struct driver_data *dd;
2344 +
2345 + if (dev && dev->bd_disk) {
2346 + dd = (struct driver_data *) dev->bd_disk->private_data;
2347 +
2348 + if (dd) {
2349 + if (test_bit(MTIP_DDF_REMOVAL_BIT,
2350 + &dd->dd_flag)) {
2351 + return -ENODEV;
2352 + }
2353 + return 0;
2354 + }
2355 + }
2356 + return -ENODEV;
2357 +}
2358 +
2359 +void mtip_block_release(struct gendisk *disk, fmode_t mode)
2360 +{
2361 +}
2362 +
2363 /*
2364 * Block device operation function.
2365 *
2366 @@ -3610,6 +3704,8 @@ static int mtip_block_getgeo(struct block_device *dev,
2367 * layer.
2368 */
2369 static const struct block_device_operations mtip_block_ops = {
2370 + .open = mtip_block_open,
2371 + .release = mtip_block_release,
2372 .ioctl = mtip_block_ioctl,
2373 #ifdef CONFIG_COMPAT
2374 .compat_ioctl = mtip_block_compat_ioctl,
2375 @@ -3671,10 +3767,9 @@ static int mtip_submit_request(struct blk_mq_hw_ctx *hctx, struct request *rq)
2376 rq_data_dir(rq))) {
2377 return -ENODATA;
2378 }
2379 - if (unlikely(test_bit(MTIP_DDF_SEC_LOCK_BIT, &dd->dd_flag)))
2380 + if (unlikely(test_bit(MTIP_DDF_SEC_LOCK_BIT, &dd->dd_flag) ||
2381 + test_bit(MTIP_DDF_REBUILD_FAILED_BIT, &dd->dd_flag)))
2382 return -ENODATA;
2383 - if (test_bit(MTIP_DDF_REBUILD_FAILED_BIT, &dd->dd_flag))
2384 - return -ENXIO;
2385 }
2386
2387 if (rq->cmd_flags & REQ_DISCARD) {
2388 @@ -3786,11 +3881,33 @@ static int mtip_init_cmd(void *data, struct request *rq, unsigned int hctx_idx,
2389 return 0;
2390 }
2391
2392 +static enum blk_eh_timer_return mtip_cmd_timeout(struct request *req,
2393 + bool reserved)
2394 +{
2395 + struct driver_data *dd = req->q->queuedata;
2396 + int ret = BLK_EH_RESET_TIMER;
2397 +
2398 + if (reserved)
2399 + goto exit_handler;
2400 +
2401 + if (test_bit(req->tag, dd->port->cmds_to_issue))
2402 + goto exit_handler;
2403 +
2404 + if (test_and_set_bit(MTIP_PF_TO_ACTIVE_BIT, &dd->port->flags))
2405 + goto exit_handler;
2406 +
2407 + wake_up_interruptible(&dd->port->svc_wait);
2408 +exit_handler:
2409 + return ret;
2410 +}
2411 +
2412 static struct blk_mq_ops mtip_mq_ops = {
2413 .queue_rq = mtip_queue_rq,
2414 .map_queue = blk_mq_map_queue,
2415 .init_request = mtip_init_cmd,
2416 .exit_request = mtip_free_cmd,
2417 + .complete = mtip_softirq_done_fn,
2418 + .timeout = mtip_cmd_timeout,
2419 };
2420
2421 /*
2422 @@ -3857,7 +3974,6 @@ static int mtip_block_initialize(struct driver_data *dd)
2423
2424 mtip_hw_debugfs_init(dd);
2425
2426 -skip_create_disk:
2427 memset(&dd->tags, 0, sizeof(dd->tags));
2428 dd->tags.ops = &mtip_mq_ops;
2429 dd->tags.nr_hw_queues = 1;
2430 @@ -3867,12 +3983,13 @@ skip_create_disk:
2431 dd->tags.numa_node = dd->numa_node;
2432 dd->tags.flags = BLK_MQ_F_SHOULD_MERGE;
2433 dd->tags.driver_data = dd;
2434 + dd->tags.timeout = MTIP_NCQ_CMD_TIMEOUT_MS;
2435
2436 rv = blk_mq_alloc_tag_set(&dd->tags);
2437 if (rv) {
2438 dev_err(&dd->pdev->dev,
2439 "Unable to allocate request queue\n");
2440 - goto block_queue_alloc_init_error;
2441 + goto block_queue_alloc_tag_error;
2442 }
2443
2444 /* Allocate the request queue. */
2445 @@ -3887,6 +4004,7 @@ skip_create_disk:
2446 dd->disk->queue = dd->queue;
2447 dd->queue->queuedata = dd;
2448
2449 +skip_create_disk:
2450 /* Initialize the protocol layer. */
2451 wait_for_rebuild = mtip_hw_get_identify(dd);
2452 if (wait_for_rebuild < 0) {
2453 @@ -3983,8 +4101,9 @@ kthread_run_error:
2454 read_capacity_error:
2455 init_hw_cmds_error:
2456 blk_cleanup_queue(dd->queue);
2457 - blk_mq_free_tag_set(&dd->tags);
2458 block_queue_alloc_init_error:
2459 + blk_mq_free_tag_set(&dd->tags);
2460 +block_queue_alloc_tag_error:
2461 mtip_hw_debugfs_exit(dd);
2462 disk_index_error:
2463 spin_lock(&rssd_index_lock);
2464 @@ -4001,6 +4120,22 @@ protocol_init_error:
2465 return rv;
2466 }
2467
2468 +static void mtip_no_dev_cleanup(struct request *rq, void *data, bool reserv)
2469 +{
2470 + struct driver_data *dd = (struct driver_data *)data;
2471 + struct mtip_cmd *cmd;
2472 +
2473 + if (likely(!reserv))
2474 + blk_mq_complete_request(rq, -ENODEV);
2475 + else if (test_bit(MTIP_PF_IC_ACTIVE_BIT, &dd->port->flags)) {
2476 +
2477 + cmd = mtip_cmd_from_tag(dd, MTIP_TAG_INTERNAL);
2478 + if (cmd->comp_func)
2479 + cmd->comp_func(dd->port, MTIP_TAG_INTERNAL,
2480 + cmd, -ENODEV);
2481 + }
2482 +}
2483 +
2484 /*
2485 * Block layer deinitialization function.
2486 *
2487 @@ -4032,12 +4167,23 @@ static int mtip_block_remove(struct driver_data *dd)
2488 }
2489 }
2490
2491 - if (!dd->sr)
2492 - mtip_standby_drive(dd);
2493 + if (!dd->sr) {
2494 + /*
2495 + * Explicitly wait here for IOs to quiesce,
2496 + * as mtip_standby_drive usually won't wait for IOs.
2497 + */
2498 + if (!mtip_quiesce_io(dd->port, MTIP_QUIESCE_IO_TIMEOUT_MS,
2499 + GFP_KERNEL))
2500 + mtip_standby_drive(dd);
2501 + }
2502 else
2503 dev_info(&dd->pdev->dev, "device %s surprise removal\n",
2504 dd->disk->disk_name);
2505
2506 + blk_mq_freeze_queue_start(dd->queue);
2507 + blk_mq_stop_hw_queues(dd->queue);
2508 + blk_mq_all_tag_busy_iter(dd->tags.tags[0], mtip_no_dev_cleanup, dd);
2509 +
2510 /*
2511 * Delete our gendisk structure. This also removes the device
2512 * from /dev
2513 @@ -4047,7 +4193,8 @@ static int mtip_block_remove(struct driver_data *dd)
2514 dd->bdev = NULL;
2515 }
2516 if (dd->disk) {
2517 - del_gendisk(dd->disk);
2518 + if (test_bit(MTIP_DDF_INIT_DONE_BIT, &dd->dd_flag))
2519 + del_gendisk(dd->disk);
2520 if (dd->disk->queue) {
2521 blk_cleanup_queue(dd->queue);
2522 blk_mq_free_tag_set(&dd->tags);
2523 @@ -4088,7 +4235,8 @@ static int mtip_block_shutdown(struct driver_data *dd)
2524 dev_info(&dd->pdev->dev,
2525 "Shutting down %s ...\n", dd->disk->disk_name);
2526
2527 - del_gendisk(dd->disk);
2528 + if (test_bit(MTIP_DDF_INIT_DONE_BIT, &dd->dd_flag))
2529 + del_gendisk(dd->disk);
2530 if (dd->disk->queue) {
2531 blk_cleanup_queue(dd->queue);
2532 blk_mq_free_tag_set(&dd->tags);
2533 @@ -4433,7 +4581,7 @@ static void mtip_pci_remove(struct pci_dev *pdev)
2534 struct driver_data *dd = pci_get_drvdata(pdev);
2535 unsigned long flags, to;
2536
2537 - set_bit(MTIP_DDF_REMOVE_PENDING_BIT, &dd->dd_flag);
2538 + set_bit(MTIP_DDF_REMOVAL_BIT, &dd->dd_flag);
2539
2540 spin_lock_irqsave(&dev_lock, flags);
2541 list_del_init(&dd->online_list);
2542 @@ -4450,12 +4598,17 @@ static void mtip_pci_remove(struct pci_dev *pdev)
2543 } while (atomic_read(&dd->irq_workers_active) != 0 &&
2544 time_before(jiffies, to));
2545
2546 + if (!dd->sr)
2547 + fsync_bdev(dd->bdev);
2548 +
2549 if (atomic_read(&dd->irq_workers_active) != 0) {
2550 dev_warn(&dd->pdev->dev,
2551 "Completion workers still active!\n");
2552 }
2553
2554 - blk_mq_stop_hw_queues(dd->queue);
2555 + blk_set_queue_dying(dd->queue);
2556 + set_bit(MTIP_DDF_REMOVE_PENDING_BIT, &dd->dd_flag);
2557 +
2558 /* Clean up the block layer. */
2559 mtip_block_remove(dd);
2560
2561 diff --git a/drivers/block/mtip32xx/mtip32xx.h b/drivers/block/mtip32xx/mtip32xx.h
2562 index 3274784008eb..7617888f7944 100644
2563 --- a/drivers/block/mtip32xx/mtip32xx.h
2564 +++ b/drivers/block/mtip32xx/mtip32xx.h
2565 @@ -134,16 +134,24 @@ enum {
2566 MTIP_PF_EH_ACTIVE_BIT = 1, /* error handling */
2567 MTIP_PF_SE_ACTIVE_BIT = 2, /* secure erase */
2568 MTIP_PF_DM_ACTIVE_BIT = 3, /* download microcde */
2569 + MTIP_PF_TO_ACTIVE_BIT = 9, /* timeout handling */
2570 MTIP_PF_PAUSE_IO = ((1 << MTIP_PF_IC_ACTIVE_BIT) |
2571 (1 << MTIP_PF_EH_ACTIVE_BIT) |
2572 (1 << MTIP_PF_SE_ACTIVE_BIT) |
2573 - (1 << MTIP_PF_DM_ACTIVE_BIT)),
2574 + (1 << MTIP_PF_DM_ACTIVE_BIT) |
2575 + (1 << MTIP_PF_TO_ACTIVE_BIT)),
2576
2577 MTIP_PF_SVC_THD_ACTIVE_BIT = 4,
2578 MTIP_PF_ISSUE_CMDS_BIT = 5,
2579 MTIP_PF_REBUILD_BIT = 6,
2580 MTIP_PF_SVC_THD_STOP_BIT = 8,
2581
2582 + MTIP_PF_SVC_THD_WORK = ((1 << MTIP_PF_EH_ACTIVE_BIT) |
2583 + (1 << MTIP_PF_ISSUE_CMDS_BIT) |
2584 + (1 << MTIP_PF_REBUILD_BIT) |
2585 + (1 << MTIP_PF_SVC_THD_STOP_BIT) |
2586 + (1 << MTIP_PF_TO_ACTIVE_BIT)),
2587 +
2588 /* below are bit numbers in 'dd_flag' defined in driver_data */
2589 MTIP_DDF_SEC_LOCK_BIT = 0,
2590 MTIP_DDF_REMOVE_PENDING_BIT = 1,
2591 @@ -153,6 +161,7 @@ enum {
2592 MTIP_DDF_RESUME_BIT = 6,
2593 MTIP_DDF_INIT_DONE_BIT = 7,
2594 MTIP_DDF_REBUILD_FAILED_BIT = 8,
2595 + MTIP_DDF_REMOVAL_BIT = 9,
2596
2597 MTIP_DDF_STOP_IO = ((1 << MTIP_DDF_REMOVE_PENDING_BIT) |
2598 (1 << MTIP_DDF_SEC_LOCK_BIT) |
2599 diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
2600 index fa893c3ec408..0beaa52df66b 100644
2601 --- a/drivers/bluetooth/ath3k.c
2602 +++ b/drivers/bluetooth/ath3k.c
2603 @@ -82,6 +82,7 @@ static const struct usb_device_id ath3k_table[] = {
2604 { USB_DEVICE(0x0489, 0xe05f) },
2605 { USB_DEVICE(0x0489, 0xe076) },
2606 { USB_DEVICE(0x0489, 0xe078) },
2607 + { USB_DEVICE(0x0489, 0xe095) },
2608 { USB_DEVICE(0x04c5, 0x1330) },
2609 { USB_DEVICE(0x04CA, 0x3004) },
2610 { USB_DEVICE(0x04CA, 0x3005) },
2611 @@ -92,6 +93,7 @@ static const struct usb_device_id ath3k_table[] = {
2612 { USB_DEVICE(0x04CA, 0x300d) },
2613 { USB_DEVICE(0x04CA, 0x300f) },
2614 { USB_DEVICE(0x04CA, 0x3010) },
2615 + { USB_DEVICE(0x04CA, 0x3014) },
2616 { USB_DEVICE(0x0930, 0x0219) },
2617 { USB_DEVICE(0x0930, 0x021c) },
2618 { USB_DEVICE(0x0930, 0x0220) },
2619 @@ -113,10 +115,12 @@ static const struct usb_device_id ath3k_table[] = {
2620 { USB_DEVICE(0x13d3, 0x3362) },
2621 { USB_DEVICE(0x13d3, 0x3375) },
2622 { USB_DEVICE(0x13d3, 0x3393) },
2623 + { USB_DEVICE(0x13d3, 0x3395) },
2624 { USB_DEVICE(0x13d3, 0x3402) },
2625 { USB_DEVICE(0x13d3, 0x3408) },
2626 { USB_DEVICE(0x13d3, 0x3423) },
2627 { USB_DEVICE(0x13d3, 0x3432) },
2628 + { USB_DEVICE(0x13d3, 0x3472) },
2629 { USB_DEVICE(0x13d3, 0x3474) },
2630
2631 /* Atheros AR5BBU12 with sflash firmware */
2632 @@ -144,6 +148,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = {
2633 { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
2634 { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 },
2635 { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 },
2636 + { USB_DEVICE(0x0489, 0xe095), .driver_info = BTUSB_ATH3012 },
2637 { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
2638 { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
2639 { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
2640 @@ -154,6 +159,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = {
2641 { USB_DEVICE(0x04ca, 0x300d), .driver_info = BTUSB_ATH3012 },
2642 { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
2643 { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
2644 + { USB_DEVICE(0x04ca, 0x3014), .driver_info = BTUSB_ATH3012 },
2645 { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
2646 { USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 },
2647 { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
2648 @@ -175,10 +181,12 @@ static const struct usb_device_id ath3k_blist_tbl[] = {
2649 { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
2650 { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
2651 { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
2652 + { USB_DEVICE(0x13d3, 0x3395), .driver_info = BTUSB_ATH3012 },
2653 { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
2654 { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
2655 { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
2656 { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
2657 + { USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 },
2658 { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },
2659
2660 /* Atheros AR5BBU22 with sflash firmware */
2661 diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
2662 index 968897108c76..79107597a594 100644
2663 --- a/drivers/bluetooth/btusb.c
2664 +++ b/drivers/bluetooth/btusb.c
2665 @@ -196,6 +196,7 @@ static const struct usb_device_id blacklist_table[] = {
2666 { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
2667 { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 },
2668 { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 },
2669 + { USB_DEVICE(0x0489, 0xe095), .driver_info = BTUSB_ATH3012 },
2670 { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
2671 { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
2672 { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
2673 @@ -206,6 +207,7 @@ static const struct usb_device_id blacklist_table[] = {
2674 { USB_DEVICE(0x04ca, 0x300d), .driver_info = BTUSB_ATH3012 },
2675 { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
2676 { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
2677 + { USB_DEVICE(0x04ca, 0x3014), .driver_info = BTUSB_ATH3012 },
2678 { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
2679 { USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 },
2680 { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
2681 @@ -227,10 +229,12 @@ static const struct usb_device_id blacklist_table[] = {
2682 { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
2683 { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
2684 { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
2685 + { USB_DEVICE(0x13d3, 0x3395), .driver_info = BTUSB_ATH3012 },
2686 { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
2687 { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
2688 { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
2689 { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
2690 + { USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 },
2691 { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },
2692
2693 /* Atheros AR5BBU12 with sflash firmware */
2694 diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
2695 index 45cc39aabeee..252142524ff2 100644
2696 --- a/drivers/char/tpm/tpm-chip.c
2697 +++ b/drivers/char/tpm/tpm-chip.c
2698 @@ -136,11 +136,13 @@ struct tpm_chip *tpmm_chip_alloc(struct device *dev,
2699 chip->cdev.owner = chip->pdev->driver->owner;
2700 chip->cdev.kobj.parent = &chip->dev.kobj;
2701
2702 + devm_add_action(dev, (void (*)(void *)) put_device, &chip->dev);
2703 +
2704 return chip;
2705 }
2706 EXPORT_SYMBOL_GPL(tpmm_chip_alloc);
2707
2708 -static int tpm_dev_add_device(struct tpm_chip *chip)
2709 +static int tpm_add_char_device(struct tpm_chip *chip)
2710 {
2711 int rc;
2712
2713 @@ -151,7 +153,6 @@ static int tpm_dev_add_device(struct tpm_chip *chip)
2714 chip->devname, MAJOR(chip->dev.devt),
2715 MINOR(chip->dev.devt), rc);
2716
2717 - device_unregister(&chip->dev);
2718 return rc;
2719 }
2720
2721 @@ -162,16 +163,17 @@ static int tpm_dev_add_device(struct tpm_chip *chip)
2722 chip->devname, MAJOR(chip->dev.devt),
2723 MINOR(chip->dev.devt), rc);
2724
2725 + cdev_del(&chip->cdev);
2726 return rc;
2727 }
2728
2729 return rc;
2730 }
2731
2732 -static void tpm_dev_del_device(struct tpm_chip *chip)
2733 +static void tpm_del_char_device(struct tpm_chip *chip)
2734 {
2735 cdev_del(&chip->cdev);
2736 - device_unregister(&chip->dev);
2737 + device_del(&chip->dev);
2738 }
2739
2740 static int tpm1_chip_register(struct tpm_chip *chip)
2741 @@ -222,7 +224,7 @@ int tpm_chip_register(struct tpm_chip *chip)
2742
2743 tpm_add_ppi(chip);
2744
2745 - rc = tpm_dev_add_device(chip);
2746 + rc = tpm_add_char_device(chip);
2747 if (rc)
2748 goto out_err;
2749
2750 @@ -274,6 +276,6 @@ void tpm_chip_unregister(struct tpm_chip *chip)
2751 sysfs_remove_link(&chip->pdev->kobj, "ppi");
2752
2753 tpm1_chip_unregister(chip);
2754 - tpm_dev_del_device(chip);
2755 + tpm_del_char_device(chip);
2756 }
2757 EXPORT_SYMBOL_GPL(tpm_chip_unregister);
2758 diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c
2759 index 4bb9727c1047..61e64293b765 100644
2760 --- a/drivers/char/tpm/tpm_crb.c
2761 +++ b/drivers/char/tpm/tpm_crb.c
2762 @@ -310,11 +310,11 @@ static int crb_acpi_remove(struct acpi_device *device)
2763 struct device *dev = &device->dev;
2764 struct tpm_chip *chip = dev_get_drvdata(dev);
2765
2766 - tpm_chip_unregister(chip);
2767 -
2768 if (chip->flags & TPM_CHIP_FLAG_TPM2)
2769 tpm2_shutdown(chip, TPM2_SU_CLEAR);
2770
2771 + tpm_chip_unregister(chip);
2772 +
2773 return 0;
2774 }
2775
2776 diff --git a/drivers/char/tpm/tpm_eventlog.c b/drivers/char/tpm/tpm_eventlog.c
2777 index bd72fb04225e..4e6940acf639 100644
2778 --- a/drivers/char/tpm/tpm_eventlog.c
2779 +++ b/drivers/char/tpm/tpm_eventlog.c
2780 @@ -232,7 +232,7 @@ static int tpm_binary_bios_measurements_show(struct seq_file *m, void *v)
2781 {
2782 struct tcpa_event *event = v;
2783 struct tcpa_event temp_event;
2784 - char *tempPtr;
2785 + char *temp_ptr;
2786 int i;
2787
2788 memcpy(&temp_event, event, sizeof(struct tcpa_event));
2789 @@ -242,10 +242,16 @@ static int tpm_binary_bios_measurements_show(struct seq_file *m, void *v)
2790 temp_event.event_type = do_endian_conversion(event->event_type);
2791 temp_event.event_size = do_endian_conversion(event->event_size);
2792
2793 - tempPtr = (char *)&temp_event;
2794 + temp_ptr = (char *) &temp_event;
2795
2796 - for (i = 0; i < sizeof(struct tcpa_event) + temp_event.event_size; i++)
2797 - seq_putc(m, tempPtr[i]);
2798 + for (i = 0; i < (sizeof(struct tcpa_event) - 1) ; i++)
2799 + seq_putc(m, temp_ptr[i]);
2800 +
2801 + temp_ptr = (char *) v;
2802 +
2803 + for (i = (sizeof(struct tcpa_event) - 1);
2804 + i < (sizeof(struct tcpa_event) + temp_event.event_size); i++)
2805 + seq_putc(m, temp_ptr[i]);
2806
2807 return 0;
2808
2809 diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
2810 index 39bf5820297e..4f9830c1b121 100644
2811 --- a/drivers/clk/bcm/clk-bcm2835.c
2812 +++ b/drivers/clk/bcm/clk-bcm2835.c
2813 @@ -1097,13 +1097,15 @@ static int bcm2835_pll_divider_set_rate(struct clk_hw *hw,
2814 struct bcm2835_pll_divider *divider = bcm2835_pll_divider_from_hw(hw);
2815 struct bcm2835_cprman *cprman = divider->cprman;
2816 const struct bcm2835_pll_divider_data *data = divider->data;
2817 - u32 cm;
2818 - int ret;
2819 + u32 cm, div, max_div = 1 << A2W_PLL_DIV_BITS;
2820
2821 - ret = clk_divider_ops.set_rate(hw, rate, parent_rate);
2822 - if (ret)
2823 - return ret;
2824 + div = DIV_ROUND_UP_ULL(parent_rate, rate);
2825 +
2826 + div = min(div, max_div);
2827 + if (div == max_div)
2828 + div = 0;
2829
2830 + cprman_write(cprman, data->a2w_reg, div);
2831 cm = cprman_read(cprman, data->cm_reg);
2832 cprman_write(cprman, data->cm_reg, cm | data->load_mask);
2833 cprman_write(cprman, data->cm_reg, cm & ~data->load_mask);
2834 diff --git a/drivers/clk/rockchip/clk-rk3188.c b/drivers/clk/rockchip/clk-rk3188.c
2835 index abb47608713b..fe728f8dcbe4 100644
2836 --- a/drivers/clk/rockchip/clk-rk3188.c
2837 +++ b/drivers/clk/rockchip/clk-rk3188.c
2838 @@ -718,6 +718,7 @@ static const char *const rk3188_critical_clocks[] __initconst = {
2839 "hclk_peri",
2840 "pclk_cpu",
2841 "pclk_peri",
2842 + "hclk_cpubus"
2843 };
2844
2845 static void __init rk3188_common_clk_init(struct device_node *np)
2846 diff --git a/drivers/clk/rockchip/clk-rk3368.c b/drivers/clk/rockchip/clk-rk3368.c
2847 index 7e6b783e6eee..1b148694b633 100644
2848 --- a/drivers/clk/rockchip/clk-rk3368.c
2849 +++ b/drivers/clk/rockchip/clk-rk3368.c
2850 @@ -165,7 +165,7 @@ static const struct rockchip_cpuclk_reg_data rk3368_cpuclkb_data = {
2851 .core_reg = RK3368_CLKSEL_CON(0),
2852 .div_core_shift = 0,
2853 .div_core_mask = 0x1f,
2854 - .mux_core_shift = 15,
2855 + .mux_core_shift = 7,
2856 };
2857
2858 static const struct rockchip_cpuclk_reg_data rk3368_cpuclkl_data = {
2859 @@ -218,29 +218,29 @@ static const struct rockchip_cpuclk_reg_data rk3368_cpuclkl_data = {
2860 }
2861
2862 static struct rockchip_cpuclk_rate_table rk3368_cpuclkb_rates[] __initdata = {
2863 - RK3368_CPUCLKB_RATE(1512000000, 2, 6, 6),
2864 - RK3368_CPUCLKB_RATE(1488000000, 2, 5, 5),
2865 - RK3368_CPUCLKB_RATE(1416000000, 2, 5, 5),
2866 - RK3368_CPUCLKB_RATE(1200000000, 2, 4, 4),
2867 - RK3368_CPUCLKB_RATE(1008000000, 2, 4, 4),
2868 - RK3368_CPUCLKB_RATE( 816000000, 2, 3, 3),
2869 - RK3368_CPUCLKB_RATE( 696000000, 2, 3, 3),
2870 - RK3368_CPUCLKB_RATE( 600000000, 2, 2, 2),
2871 - RK3368_CPUCLKB_RATE( 408000000, 2, 2, 2),
2872 - RK3368_CPUCLKB_RATE( 312000000, 2, 2, 2),
2873 + RK3368_CPUCLKB_RATE(1512000000, 1, 5, 5),
2874 + RK3368_CPUCLKB_RATE(1488000000, 1, 4, 4),
2875 + RK3368_CPUCLKB_RATE(1416000000, 1, 4, 4),
2876 + RK3368_CPUCLKB_RATE(1200000000, 1, 3, 3),
2877 + RK3368_CPUCLKB_RATE(1008000000, 1, 3, 3),
2878 + RK3368_CPUCLKB_RATE( 816000000, 1, 2, 2),
2879 + RK3368_CPUCLKB_RATE( 696000000, 1, 2, 2),
2880 + RK3368_CPUCLKB_RATE( 600000000, 1, 1, 1),
2881 + RK3368_CPUCLKB_RATE( 408000000, 1, 1, 1),
2882 + RK3368_CPUCLKB_RATE( 312000000, 1, 1, 1),
2883 };
2884
2885 static struct rockchip_cpuclk_rate_table rk3368_cpuclkl_rates[] __initdata = {
2886 - RK3368_CPUCLKL_RATE(1512000000, 2, 7, 7),
2887 - RK3368_CPUCLKL_RATE(1488000000, 2, 6, 6),
2888 - RK3368_CPUCLKL_RATE(1416000000, 2, 6, 6),
2889 - RK3368_CPUCLKL_RATE(1200000000, 2, 5, 5),
2890 - RK3368_CPUCLKL_RATE(1008000000, 2, 5, 5),
2891 - RK3368_CPUCLKL_RATE( 816000000, 2, 4, 4),
2892 - RK3368_CPUCLKL_RATE( 696000000, 2, 3, 3),
2893 - RK3368_CPUCLKL_RATE( 600000000, 2, 3, 3),
2894 - RK3368_CPUCLKL_RATE( 408000000, 2, 2, 2),
2895 - RK3368_CPUCLKL_RATE( 312000000, 2, 2, 2),
2896 + RK3368_CPUCLKL_RATE(1512000000, 1, 6, 6),
2897 + RK3368_CPUCLKL_RATE(1488000000, 1, 5, 5),
2898 + RK3368_CPUCLKL_RATE(1416000000, 1, 5, 5),
2899 + RK3368_CPUCLKL_RATE(1200000000, 1, 4, 4),
2900 + RK3368_CPUCLKL_RATE(1008000000, 1, 4, 4),
2901 + RK3368_CPUCLKL_RATE( 816000000, 1, 3, 3),
2902 + RK3368_CPUCLKL_RATE( 696000000, 1, 2, 2),
2903 + RK3368_CPUCLKL_RATE( 600000000, 1, 2, 2),
2904 + RK3368_CPUCLKL_RATE( 408000000, 1, 1, 1),
2905 + RK3368_CPUCLKL_RATE( 312000000, 1, 1, 1),
2906 };
2907
2908 static struct rockchip_clk_branch rk3368_clk_branches[] __initdata = {
2909 @@ -384,10 +384,10 @@ static struct rockchip_clk_branch rk3368_clk_branches[] __initdata = {
2910 * Clock-Architecture Diagram 3
2911 */
2912
2913 - COMPOSITE(0, "aclk_vepu", mux_pll_src_cpll_gpll_usb_p, 0,
2914 + COMPOSITE(0, "aclk_vepu", mux_pll_src_cpll_gpll_npll_usb_p, 0,
2915 RK3368_CLKSEL_CON(15), 6, 2, MFLAGS, 0, 5, DFLAGS,
2916 RK3368_CLKGATE_CON(4), 6, GFLAGS),
2917 - COMPOSITE(0, "aclk_vdpu", mux_pll_src_cpll_gpll_usb_p, 0,
2918 + COMPOSITE(0, "aclk_vdpu", mux_pll_src_cpll_gpll_npll_usb_p, 0,
2919 RK3368_CLKSEL_CON(15), 14, 2, MFLAGS, 8, 5, DFLAGS,
2920 RK3368_CLKGATE_CON(4), 7, GFLAGS),
2921
2922 @@ -442,7 +442,7 @@ static struct rockchip_clk_branch rk3368_clk_branches[] __initdata = {
2923 GATE(SCLK_HDMI_HDCP, "sclk_hdmi_hdcp", "xin24m", 0,
2924 RK3368_CLKGATE_CON(4), 13, GFLAGS),
2925 GATE(SCLK_HDMI_CEC, "sclk_hdmi_cec", "xin32k", 0,
2926 - RK3368_CLKGATE_CON(5), 12, GFLAGS),
2927 + RK3368_CLKGATE_CON(4), 12, GFLAGS),
2928
2929 COMPOSITE_NODIV(0, "vip_src", mux_pll_src_cpll_gpll_p, 0,
2930 RK3368_CLKSEL_CON(21), 15, 1, MFLAGS,
2931 diff --git a/drivers/crypto/atmel-aes.c b/drivers/crypto/atmel-aes.c
2932 index fb16d812c8f5..1dffb13e5c2f 100644
2933 --- a/drivers/crypto/atmel-aes.c
2934 +++ b/drivers/crypto/atmel-aes.c
2935 @@ -1396,9 +1396,9 @@ static int atmel_aes_probe(struct platform_device *pdev)
2936 }
2937
2938 aes_dd->io_base = devm_ioremap_resource(&pdev->dev, aes_res);
2939 - if (!aes_dd->io_base) {
2940 + if (IS_ERR(aes_dd->io_base)) {
2941 dev_err(dev, "can't ioremap\n");
2942 - err = -ENOMEM;
2943 + err = PTR_ERR(aes_dd->io_base);
2944 goto res_err;
2945 }
2946
2947 diff --git a/drivers/crypto/atmel-sha.c b/drivers/crypto/atmel-sha.c
2948 index 3178f84d2757..0dadb6332f0e 100644
2949 --- a/drivers/crypto/atmel-sha.c
2950 +++ b/drivers/crypto/atmel-sha.c
2951 @@ -1405,9 +1405,9 @@ static int atmel_sha_probe(struct platform_device *pdev)
2952 }
2953
2954 sha_dd->io_base = devm_ioremap_resource(&pdev->dev, sha_res);
2955 - if (!sha_dd->io_base) {
2956 + if (IS_ERR(sha_dd->io_base)) {
2957 dev_err(dev, "can't ioremap\n");
2958 - err = -ENOMEM;
2959 + err = PTR_ERR(sha_dd->io_base);
2960 goto res_err;
2961 }
2962
2963 diff --git a/drivers/crypto/atmel-tdes.c b/drivers/crypto/atmel-tdes.c
2964 index 2c7a628d0375..bf467d7be35c 100644
2965 --- a/drivers/crypto/atmel-tdes.c
2966 +++ b/drivers/crypto/atmel-tdes.c
2967 @@ -1417,9 +1417,9 @@ static int atmel_tdes_probe(struct platform_device *pdev)
2968 }
2969
2970 tdes_dd->io_base = devm_ioremap_resource(&pdev->dev, tdes_res);
2971 - if (!tdes_dd->io_base) {
2972 + if (IS_ERR(tdes_dd->io_base)) {
2973 dev_err(dev, "can't ioremap\n");
2974 - err = -ENOMEM;
2975 + err = PTR_ERR(tdes_dd->io_base);
2976 goto res_err;
2977 }
2978
2979 diff --git a/drivers/crypto/ccp/ccp-crypto-aes-cmac.c b/drivers/crypto/ccp/ccp-crypto-aes-cmac.c
2980 index d89f20c04266..3d9acc53d247 100644
2981 --- a/drivers/crypto/ccp/ccp-crypto-aes-cmac.c
2982 +++ b/drivers/crypto/ccp/ccp-crypto-aes-cmac.c
2983 @@ -220,6 +220,39 @@ static int ccp_aes_cmac_digest(struct ahash_request *req)
2984 return ccp_aes_cmac_finup(req);
2985 }
2986
2987 +static int ccp_aes_cmac_export(struct ahash_request *req, void *out)
2988 +{
2989 + struct ccp_aes_cmac_req_ctx *rctx = ahash_request_ctx(req);
2990 + struct ccp_aes_cmac_exp_ctx state;
2991 +
2992 + state.null_msg = rctx->null_msg;
2993 + memcpy(state.iv, rctx->iv, sizeof(state.iv));
2994 + state.buf_count = rctx->buf_count;
2995 + memcpy(state.buf, rctx->buf, sizeof(state.buf));
2996 +
2997 + /* 'out' may not be aligned so memcpy from local variable */
2998 + memcpy(out, &state, sizeof(state));
2999 +
3000 + return 0;
3001 +}
3002 +
3003 +static int ccp_aes_cmac_import(struct ahash_request *req, const void *in)
3004 +{
3005 + struct ccp_aes_cmac_req_ctx *rctx = ahash_request_ctx(req);
3006 + struct ccp_aes_cmac_exp_ctx state;
3007 +
3008 + /* 'in' may not be aligned so memcpy to local variable */
3009 + memcpy(&state, in, sizeof(state));
3010 +
3011 + memset(rctx, 0, sizeof(*rctx));
3012 + rctx->null_msg = state.null_msg;
3013 + memcpy(rctx->iv, state.iv, sizeof(rctx->iv));
3014 + rctx->buf_count = state.buf_count;
3015 + memcpy(rctx->buf, state.buf, sizeof(rctx->buf));
3016 +
3017 + return 0;
3018 +}
3019 +
3020 static int ccp_aes_cmac_setkey(struct crypto_ahash *tfm, const u8 *key,
3021 unsigned int key_len)
3022 {
3023 @@ -352,10 +385,13 @@ int ccp_register_aes_cmac_algs(struct list_head *head)
3024 alg->final = ccp_aes_cmac_final;
3025 alg->finup = ccp_aes_cmac_finup;
3026 alg->digest = ccp_aes_cmac_digest;
3027 + alg->export = ccp_aes_cmac_export;
3028 + alg->import = ccp_aes_cmac_import;
3029 alg->setkey = ccp_aes_cmac_setkey;
3030
3031 halg = &alg->halg;
3032 halg->digestsize = AES_BLOCK_SIZE;
3033 + halg->statesize = sizeof(struct ccp_aes_cmac_exp_ctx);
3034
3035 base = &halg->base;
3036 snprintf(base->cra_name, CRYPTO_MAX_ALG_NAME, "cmac(aes)");
3037 diff --git a/drivers/crypto/ccp/ccp-crypto-sha.c b/drivers/crypto/ccp/ccp-crypto-sha.c
3038 index d14b3f28e010..8ef06fad8b14 100644
3039 --- a/drivers/crypto/ccp/ccp-crypto-sha.c
3040 +++ b/drivers/crypto/ccp/ccp-crypto-sha.c
3041 @@ -207,6 +207,43 @@ static int ccp_sha_digest(struct ahash_request *req)
3042 return ccp_sha_finup(req);
3043 }
3044
3045 +static int ccp_sha_export(struct ahash_request *req, void *out)
3046 +{
3047 + struct ccp_sha_req_ctx *rctx = ahash_request_ctx(req);
3048 + struct ccp_sha_exp_ctx state;
3049 +
3050 + state.type = rctx->type;
3051 + state.msg_bits = rctx->msg_bits;
3052 + state.first = rctx->first;
3053 + memcpy(state.ctx, rctx->ctx, sizeof(state.ctx));
3054 + state.buf_count = rctx->buf_count;
3055 + memcpy(state.buf, rctx->buf, sizeof(state.buf));
3056 +
3057 + /* 'out' may not be aligned so memcpy from local variable */
3058 + memcpy(out, &state, sizeof(state));
3059 +
3060 + return 0;
3061 +}
3062 +
3063 +static int ccp_sha_import(struct ahash_request *req, const void *in)
3064 +{
3065 + struct ccp_sha_req_ctx *rctx = ahash_request_ctx(req);
3066 + struct ccp_sha_exp_ctx state;
3067 +
3068 + /* 'in' may not be aligned so memcpy to local variable */
3069 + memcpy(&state, in, sizeof(state));
3070 +
3071 + memset(rctx, 0, sizeof(*rctx));
3072 + rctx->type = state.type;
3073 + rctx->msg_bits = state.msg_bits;
3074 + rctx->first = state.first;
3075 + memcpy(rctx->ctx, state.ctx, sizeof(rctx->ctx));
3076 + rctx->buf_count = state.buf_count;
3077 + memcpy(rctx->buf, state.buf, sizeof(rctx->buf));
3078 +
3079 + return 0;
3080 +}
3081 +
3082 static int ccp_sha_setkey(struct crypto_ahash *tfm, const u8 *key,
3083 unsigned int key_len)
3084 {
3085 @@ -403,9 +440,12 @@ static int ccp_register_sha_alg(struct list_head *head,
3086 alg->final = ccp_sha_final;
3087 alg->finup = ccp_sha_finup;
3088 alg->digest = ccp_sha_digest;
3089 + alg->export = ccp_sha_export;
3090 + alg->import = ccp_sha_import;
3091
3092 halg = &alg->halg;
3093 halg->digestsize = def->digest_size;
3094 + halg->statesize = sizeof(struct ccp_sha_exp_ctx);
3095
3096 base = &halg->base;
3097 snprintf(base->cra_name, CRYPTO_MAX_ALG_NAME, "%s", def->name);
3098 diff --git a/drivers/crypto/ccp/ccp-crypto.h b/drivers/crypto/ccp/ccp-crypto.h
3099 index 76a96f0f44c6..a326ec20bfa8 100644
3100 --- a/drivers/crypto/ccp/ccp-crypto.h
3101 +++ b/drivers/crypto/ccp/ccp-crypto.h
3102 @@ -129,6 +129,15 @@ struct ccp_aes_cmac_req_ctx {
3103 struct ccp_cmd cmd;
3104 };
3105
3106 +struct ccp_aes_cmac_exp_ctx {
3107 + unsigned int null_msg;
3108 +
3109 + u8 iv[AES_BLOCK_SIZE];
3110 +
3111 + unsigned int buf_count;
3112 + u8 buf[AES_BLOCK_SIZE];
3113 +};
3114 +
3115 /***** SHA related defines *****/
3116 #define MAX_SHA_CONTEXT_SIZE SHA256_DIGEST_SIZE
3117 #define MAX_SHA_BLOCK_SIZE SHA256_BLOCK_SIZE
3118 @@ -171,6 +180,19 @@ struct ccp_sha_req_ctx {
3119 struct ccp_cmd cmd;
3120 };
3121
3122 +struct ccp_sha_exp_ctx {
3123 + enum ccp_sha_type type;
3124 +
3125 + u64 msg_bits;
3126 +
3127 + unsigned int first;
3128 +
3129 + u8 ctx[MAX_SHA_CONTEXT_SIZE];
3130 +
3131 + unsigned int buf_count;
3132 + u8 buf[MAX_SHA_BLOCK_SIZE];
3133 +};
3134 +
3135 /***** Common Context Structure *****/
3136 struct ccp_ctx {
3137 int (*complete)(struct crypto_async_request *req, int ret);
3138 diff --git a/drivers/crypto/marvell/cesa.c b/drivers/crypto/marvell/cesa.c
3139 index c0656e7f37b5..80239ae69527 100644
3140 --- a/drivers/crypto/marvell/cesa.c
3141 +++ b/drivers/crypto/marvell/cesa.c
3142 @@ -420,7 +420,7 @@ static int mv_cesa_probe(struct platform_device *pdev)
3143 res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "regs");
3144 cesa->regs = devm_ioremap_resource(dev, res);
3145 if (IS_ERR(cesa->regs))
3146 - return -ENOMEM;
3147 + return PTR_ERR(cesa->regs);
3148
3149 ret = mv_cesa_dev_dma_init(cesa);
3150 if (ret)
3151 diff --git a/drivers/crypto/ux500/cryp/cryp_core.c b/drivers/crypto/ux500/cryp/cryp_core.c
3152 index 4c243c1ffc7f..790f7cadc1ed 100644
3153 --- a/drivers/crypto/ux500/cryp/cryp_core.c
3154 +++ b/drivers/crypto/ux500/cryp/cryp_core.c
3155 @@ -1440,9 +1440,9 @@ static int ux500_cryp_probe(struct platform_device *pdev)
3156
3157 device_data->phybase = res->start;
3158 device_data->base = devm_ioremap_resource(dev, res);
3159 - if (!device_data->base) {
3160 + if (IS_ERR(device_data->base)) {
3161 dev_err(dev, "[%s]: ioremap failed!", __func__);
3162 - ret = -ENOMEM;
3163 + ret = PTR_ERR(device_data->base);
3164 goto out;
3165 }
3166
3167 diff --git a/drivers/crypto/ux500/hash/hash_core.c b/drivers/crypto/ux500/hash/hash_core.c
3168 index f47d112041b2..66b1c3313e2e 100644
3169 --- a/drivers/crypto/ux500/hash/hash_core.c
3170 +++ b/drivers/crypto/ux500/hash/hash_core.c
3171 @@ -1675,9 +1675,9 @@ static int ux500_hash_probe(struct platform_device *pdev)
3172
3173 device_data->phybase = res->start;
3174 device_data->base = devm_ioremap_resource(dev, res);
3175 - if (!device_data->base) {
3176 + if (IS_ERR(device_data->base)) {
3177 dev_err(dev, "%s: ioremap() failed!\n", __func__);
3178 - ret = -ENOMEM;
3179 + ret = PTR_ERR(device_data->base);
3180 goto out;
3181 }
3182 spin_lock_init(&device_data->ctx_lock);
3183 diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
3184 index 9eee13ef83a5..d87a47547ba5 100644
3185 --- a/drivers/edac/amd64_edac.c
3186 +++ b/drivers/edac/amd64_edac.c
3187 @@ -1452,7 +1452,7 @@ static u64 f1x_get_norm_dct_addr(struct amd64_pvt *pvt, u8 range,
3188 u64 chan_off;
3189 u64 dram_base = get_dram_base(pvt, range);
3190 u64 hole_off = f10_dhar_offset(pvt);
3191 - u64 dct_sel_base_off = (pvt->dct_sel_hi & 0xFFFFFC00) << 16;
3192 + u64 dct_sel_base_off = (u64)(pvt->dct_sel_hi & 0xFFFFFC00) << 16;
3193
3194 if (hi_rng) {
3195 /*
3196 diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
3197 index 429309c62699..cbee3179ec08 100644
3198 --- a/drivers/edac/sb_edac.c
3199 +++ b/drivers/edac/sb_edac.c
3200 @@ -1117,8 +1117,8 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
3201 edac_dbg(0, "TAD#%d: up to %u.%03u GB (0x%016Lx), socket interleave %d, memory interleave %d, TGT: %d, %d, %d, %d, reg=0x%08x\n",
3202 n_tads, gb, (mb*1000)/1024,
3203 ((u64)tmp_mb) << 20L,
3204 - (u32)TAD_SOCK(reg),
3205 - (u32)TAD_CH(reg),
3206 + (u32)(1 << TAD_SOCK(reg)),
3207 + (u32)TAD_CH(reg) + 1,
3208 (u32)TAD_TGT0(reg),
3209 (u32)TAD_TGT1(reg),
3210 (u32)TAD_TGT2(reg),
3211 @@ -1396,7 +1396,7 @@ static int get_memory_error_data(struct mem_ctl_info *mci,
3212 }
3213
3214 ch_way = TAD_CH(reg) + 1;
3215 - sck_way = TAD_SOCK(reg) + 1;
3216 + sck_way = 1 << TAD_SOCK(reg);
3217
3218 if (ch_way == 3)
3219 idx = addr >> 6;
3220 @@ -1453,7 +1453,7 @@ static int get_memory_error_data(struct mem_ctl_info *mci,
3221 n_tads,
3222 addr,
3223 limit,
3224 - (u32)TAD_SOCK(reg),
3225 + sck_way,
3226 ch_way,
3227 offset,
3228 idx,
3229 @@ -1468,18 +1468,12 @@ static int get_memory_error_data(struct mem_ctl_info *mci,
3230 offset, addr);
3231 return -EINVAL;
3232 }
3233 - addr -= offset;
3234 - /* Store the low bits [0:6] of the addr */
3235 - ch_addr = addr & 0x7f;
3236 - /* Remove socket wayness and remove 6 bits */
3237 - addr >>= 6;
3238 - addr = div_u64(addr, sck_xch);
3239 -#if 0
3240 - /* Divide by channel way */
3241 - addr = addr / ch_way;
3242 -#endif
3243 - /* Recover the last 6 bits */
3244 - ch_addr |= addr << 6;
3245 +
3246 + ch_addr = addr - offset;
3247 + ch_addr >>= (6 + shiftup);
3248 + ch_addr /= ch_way * sck_way;
3249 + ch_addr <<= (6 + shiftup);
3250 + ch_addr |= addr & ((1 << (6 + shiftup)) - 1);
3251
3252 /*
3253 * Step 3) Decode rank
3254 diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
3255 index 5a8fbadbd27b..8ac49812a716 100644
3256 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
3257 +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
3258 @@ -63,6 +63,10 @@ bool amdgpu_has_atpx(void) {
3259 return amdgpu_atpx_priv.atpx_detected;
3260 }
3261
3262 +bool amdgpu_has_atpx_dgpu_power_cntl(void) {
3263 + return amdgpu_atpx_priv.atpx.functions.power_cntl;
3264 +}
3265 +
3266 /**
3267 * amdgpu_atpx_call - call an ATPX method
3268 *
3269 @@ -142,10 +146,6 @@ static void amdgpu_atpx_parse_functions(struct amdgpu_atpx_functions *f, u32 mas
3270 */
3271 static int amdgpu_atpx_validate(struct amdgpu_atpx *atpx)
3272 {
3273 - /* make sure required functions are enabled */
3274 - /* dGPU power control is required */
3275 - atpx->functions.power_cntl = true;
3276 -
3277 if (atpx->functions.px_params) {
3278 union acpi_object *info;
3279 struct atpx_px_params output;
3280 diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
3281 index c961fe093e12..9d88023df836 100644
3282 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
3283 +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
3284 @@ -61,6 +61,12 @@ static const char *amdgpu_asic_name[] = {
3285 "LAST",
3286 };
3287
3288 +#if defined(CONFIG_VGA_SWITCHEROO)
3289 +bool amdgpu_has_atpx_dgpu_power_cntl(void);
3290 +#else
3291 +static inline bool amdgpu_has_atpx_dgpu_power_cntl(void) { return false; }
3292 +#endif
3293 +
3294 bool amdgpu_device_is_px(struct drm_device *dev)
3295 {
3296 struct amdgpu_device *adev = dev->dev_private;
3297 @@ -1469,7 +1475,7 @@ int amdgpu_device_init(struct amdgpu_device *adev,
3298
3299 if (amdgpu_runtime_pm == 1)
3300 runtime = true;
3301 - if (amdgpu_device_is_px(ddev))
3302 + if (amdgpu_device_is_px(ddev) && amdgpu_has_atpx_dgpu_power_cntl())
3303 runtime = true;
3304 vga_switcheroo_register_client(adev->pdev, &amdgpu_switcheroo_ops, runtime);
3305 if (runtime)
3306 diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c b/drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c
3307 index 2cf50180cc51..b1c7a9b3631b 100644
3308 --- a/drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c
3309 +++ b/drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c
3310 @@ -32,8 +32,8 @@
3311 #include "oss/oss_2_4_d.h"
3312 #include "oss/oss_2_4_sh_mask.h"
3313
3314 -#include "gmc/gmc_8_1_d.h"
3315 -#include "gmc/gmc_8_1_sh_mask.h"
3316 +#include "gmc/gmc_7_1_d.h"
3317 +#include "gmc/gmc_7_1_sh_mask.h"
3318
3319 #include "gca/gfx_8_0_d.h"
3320 #include "gca/gfx_8_0_enum.h"
3321 diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
3322 index bb292143997e..adf74f4366bb 100644
3323 --- a/drivers/gpu/drm/radeon/atombios_encoders.c
3324 +++ b/drivers/gpu/drm/radeon/atombios_encoders.c
3325 @@ -892,8 +892,6 @@ atombios_dig_encoder_setup2(struct drm_encoder *encoder, int action, int panel_m
3326 else
3327 args.v1.ucLaneNum = 4;
3328
3329 - if (ENCODER_MODE_IS_DP(args.v1.ucEncoderMode) && (dp_clock == 270000))
3330 - args.v1.ucConfig |= ATOM_ENCODER_CONFIG_DPLINKRATE_2_70GHZ;
3331 switch (radeon_encoder->encoder_id) {
3332 case ENCODER_OBJECT_ID_INTERNAL_UNIPHY:
3333 args.v1.ucConfig = ATOM_ENCODER_CONFIG_V2_TRANSMITTER1;
3334 @@ -910,6 +908,10 @@ atombios_dig_encoder_setup2(struct drm_encoder *encoder, int action, int panel_m
3335 args.v1.ucConfig |= ATOM_ENCODER_CONFIG_LINKB;
3336 else
3337 args.v1.ucConfig |= ATOM_ENCODER_CONFIG_LINKA;
3338 +
3339 + if (ENCODER_MODE_IS_DP(args.v1.ucEncoderMode) && (dp_clock == 270000))
3340 + args.v1.ucConfig |= ATOM_ENCODER_CONFIG_DPLINKRATE_2_70GHZ;
3341 +
3342 break;
3343 case 2:
3344 case 3:
3345 diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
3346 index c4b4f298a283..9bc408c9f9f6 100644
3347 --- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c
3348 +++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
3349 @@ -62,6 +62,10 @@ bool radeon_has_atpx(void) {
3350 return radeon_atpx_priv.atpx_detected;
3351 }
3352
3353 +bool radeon_has_atpx_dgpu_power_cntl(void) {
3354 + return radeon_atpx_priv.atpx.functions.power_cntl;
3355 +}
3356 +
3357 /**
3358 * radeon_atpx_call - call an ATPX method
3359 *
3360 @@ -141,10 +145,6 @@ static void radeon_atpx_parse_functions(struct radeon_atpx_functions *f, u32 mas
3361 */
3362 static int radeon_atpx_validate(struct radeon_atpx *atpx)
3363 {
3364 - /* make sure required functions are enabled */
3365 - /* dGPU power control is required */
3366 - atpx->functions.power_cntl = true;
3367 -
3368 if (atpx->functions.px_params) {
3369 union acpi_object *info;
3370 struct atpx_px_params output;
3371 diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
3372 index c566993a2ec3..f78f111e68de 100644
3373 --- a/drivers/gpu/drm/radeon/radeon_device.c
3374 +++ b/drivers/gpu/drm/radeon/radeon_device.c
3375 @@ -103,6 +103,12 @@ static const char radeon_family_name[][16] = {
3376 "LAST",
3377 };
3378
3379 +#if defined(CONFIG_VGA_SWITCHEROO)
3380 +bool radeon_has_atpx_dgpu_power_cntl(void);
3381 +#else
3382 +static inline bool radeon_has_atpx_dgpu_power_cntl(void) { return false; }
3383 +#endif
3384 +
3385 #define RADEON_PX_QUIRK_DISABLE_PX (1 << 0)
3386 #define RADEON_PX_QUIRK_LONG_WAKEUP (1 << 1)
3387
3388 @@ -1433,7 +1439,7 @@ int radeon_device_init(struct radeon_device *rdev,
3389 * ignore it */
3390 vga_client_register(rdev->pdev, rdev, NULL, radeon_vga_set_decode);
3391
3392 - if (rdev->flags & RADEON_IS_PX)
3393 + if ((rdev->flags & RADEON_IS_PX) && radeon_has_atpx_dgpu_power_cntl())
3394 runtime = true;
3395 vga_switcheroo_register_client(rdev->pdev, &radeon_switcheroo_ops, runtime);
3396 if (runtime)
3397 diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
3398 index c6f7a694f67a..ec791e169f8f 100644
3399 --- a/drivers/hid/hid-core.c
3400 +++ b/drivers/hid/hid-core.c
3401 @@ -1897,6 +1897,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
3402 { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_ELITE_KBD) },
3403 { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_CORDLESS_DESKTOP_LX500) },
3404 { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_EXTREME_3D) },
3405 + { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_DUAL_ACTION) },
3406 { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_WHEEL) },
3407 { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_RUMBLEPAD_CORD) },
3408 { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_RUMBLEPAD) },
3409 @@ -2615,9 +2616,10 @@ int hid_add_device(struct hid_device *hdev)
3410 /*
3411 * Scan generic devices for group information
3412 */
3413 - if (hid_ignore_special_drivers ||
3414 - (!hdev->group &&
3415 - !hid_match_id(hdev, hid_have_special_driver))) {
3416 + if (hid_ignore_special_drivers) {
3417 + hdev->group = HID_GROUP_GENERIC;
3418 + } else if (!hdev->group &&
3419 + !hid_match_id(hdev, hid_have_special_driver)) {
3420 ret = hid_scan_report(hdev);
3421 if (ret)
3422 hid_warn(hdev, "bad device descriptor (%d)\n", ret);
3423 diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
3424 index 2b8ff18d3713..c5ec4f915594 100644
3425 --- a/drivers/hid/hid-multitouch.c
3426 +++ b/drivers/hid/hid-multitouch.c
3427 @@ -396,6 +396,11 @@ static void mt_feature_mapping(struct hid_device *hdev,
3428 td->is_buttonpad = true;
3429
3430 break;
3431 + case 0xff0000c5:
3432 + /* Retrieve the Win8 blob once to enable some devices */
3433 + if (usage->usage_index == 0)
3434 + mt_get_feature(hdev, field->report);
3435 + break;
3436 }
3437 }
3438
3439 diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
3440 index 10bd8e6e4c9c..0b80633bae91 100644
3441 --- a/drivers/hid/i2c-hid/i2c-hid.c
3442 +++ b/drivers/hid/i2c-hid/i2c-hid.c
3443 @@ -282,17 +282,21 @@ static int i2c_hid_set_or_send_report(struct i2c_client *client, u8 reportType,
3444 u16 dataRegister = le16_to_cpu(ihid->hdesc.wDataRegister);
3445 u16 outputRegister = le16_to_cpu(ihid->hdesc.wOutputRegister);
3446 u16 maxOutputLength = le16_to_cpu(ihid->hdesc.wMaxOutputLength);
3447 + u16 size;
3448 + int args_len;
3449 + int index = 0;
3450 +
3451 + i2c_hid_dbg(ihid, "%s\n", __func__);
3452 +
3453 + if (data_len > ihid->bufsize)
3454 + return -EINVAL;
3455
3456 - /* hid_hw_* already checked that data_len < HID_MAX_BUFFER_SIZE */
3457 - u16 size = 2 /* size */ +
3458 + size = 2 /* size */ +
3459 (reportID ? 1 : 0) /* reportID */ +
3460 data_len /* buf */;
3461 - int args_len = (reportID >= 0x0F ? 1 : 0) /* optional third byte */ +
3462 + args_len = (reportID >= 0x0F ? 1 : 0) /* optional third byte */ +
3463 2 /* dataRegister */ +
3464 size /* args */;
3465 - int index = 0;
3466 -
3467 - i2c_hid_dbg(ihid, "%s\n", __func__);
3468
3469 if (!use_data && maxOutputLength == 0)
3470 return -ENOSYS;
3471 diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
3472 index cd4510a63375..146eed70bdf4 100644
3473 --- a/drivers/idle/intel_idle.c
3474 +++ b/drivers/idle/intel_idle.c
3475 @@ -65,7 +65,7 @@
3476 #include <asm/mwait.h>
3477 #include <asm/msr.h>
3478
3479 -#define INTEL_IDLE_VERSION "0.4"
3480 +#define INTEL_IDLE_VERSION "0.4.1"
3481 #define PREFIX "intel_idle: "
3482
3483 static struct cpuidle_driver intel_idle_driver = {
3484 @@ -994,36 +994,92 @@ static void intel_idle_cpuidle_devices_uninit(void)
3485 }
3486
3487 /*
3488 - * intel_idle_state_table_update()
3489 - *
3490 - * Update the default state_table for this CPU-id
3491 + * ivt_idle_state_table_update(void)
3492 *
3493 - * Currently used to access tuned IVT multi-socket targets
3494 + * Tune IVT multi-socket targets
3495 * Assumption: num_sockets == (max_package_num + 1)
3496 */
3497 -void intel_idle_state_table_update(void)
3498 +static void ivt_idle_state_table_update(void)
3499 {
3500 /* IVT uses a different table for 1-2, 3-4, and > 4 sockets */
3501 - if (boot_cpu_data.x86_model == 0x3e) { /* IVT */
3502 - int cpu, package_num, num_sockets = 1;
3503 -
3504 - for_each_online_cpu(cpu) {
3505 - package_num = topology_physical_package_id(cpu);
3506 - if (package_num + 1 > num_sockets) {
3507 - num_sockets = package_num + 1;
3508 -
3509 - if (num_sockets > 4) {
3510 - cpuidle_state_table = ivt_cstates_8s;
3511 - return;
3512 - }
3513 + int cpu, package_num, num_sockets = 1;
3514 +
3515 + for_each_online_cpu(cpu) {
3516 + package_num = topology_physical_package_id(cpu);
3517 + if (package_num + 1 > num_sockets) {
3518 + num_sockets = package_num + 1;
3519 +
3520 + if (num_sockets > 4) {
3521 + cpuidle_state_table = ivt_cstates_8s;
3522 + return;
3523 }
3524 }
3525 + }
3526 +
3527 + if (num_sockets > 2)
3528 + cpuidle_state_table = ivt_cstates_4s;
3529 +
3530 + /* else, 1 and 2 socket systems use default ivt_cstates */
3531 +}
3532 +/*
3533 + * sklh_idle_state_table_update(void)
3534 + *
3535 + * On SKL-H (model 0x5e) disable C8 and C9 if:
3536 + * C10 is enabled and SGX disabled
3537 + */
3538 +static void sklh_idle_state_table_update(void)
3539 +{
3540 + unsigned long long msr;
3541 + unsigned int eax, ebx, ecx, edx;
3542 +
3543 +
3544 + /* if PC10 disabled via cmdline intel_idle.max_cstate=7 or shallower */
3545 + if (max_cstate <= 7)
3546 + return;
3547 +
3548 + /* if PC10 not present in CPUID.MWAIT.EDX */
3549 + if ((mwait_substates & (0xF << 28)) == 0)
3550 + return;
3551 +
3552 + rdmsrl(MSR_NHM_SNB_PKG_CST_CFG_CTL, msr);
3553 +
3554 + /* PC10 is not enabled in PKG C-state limit */
3555 + if ((msr & 0xF) != 8)
3556 + return;
3557 +
3558 + ecx = 0;
3559 + cpuid(7, &eax, &ebx, &ecx, &edx);
3560 +
3561 + /* if SGX is present */
3562 + if (ebx & (1 << 2)) {
3563
3564 - if (num_sockets > 2)
3565 - cpuidle_state_table = ivt_cstates_4s;
3566 - /* else, 1 and 2 socket systems use default ivt_cstates */
3567 + rdmsrl(MSR_IA32_FEATURE_CONTROL, msr);
3568 +
3569 + /* if SGX is enabled */
3570 + if (msr & (1 << 18))
3571 + return;
3572 + }
3573 +
3574 + skl_cstates[5].disabled = 1; /* C8-SKL */
3575 + skl_cstates[6].disabled = 1; /* C9-SKL */
3576 +}
3577 +/*
3578 + * intel_idle_state_table_update()
3579 + *
3580 + * Update the default state_table for this CPU-id
3581 + */
3582 +
3583 +static void intel_idle_state_table_update(void)
3584 +{
3585 + switch (boot_cpu_data.x86_model) {
3586 +
3587 + case 0x3e: /* IVT */
3588 + ivt_idle_state_table_update();
3589 + break;
3590 + case 0x5e: /* SKL-H */
3591 + sklh_idle_state_table_update();
3592 + break;
3593 }
3594 - return;
3595 }
3596
3597 /*
3598 @@ -1063,6 +1119,14 @@ static int __init intel_idle_cpuidle_driver_init(void)
3599 if (num_substates == 0)
3600 continue;
3601
3602 + /* if state marked as disabled, skip it */
3603 + if (cpuidle_state_table[cstate].disabled != 0) {
3604 + pr_debug(PREFIX "state %s is disabled",
3605 + cpuidle_state_table[cstate].name);
3606 + continue;
3607 + }
3608 +
3609 +
3610 if (((mwait_cstate + 1) > 2) &&
3611 !boot_cpu_has(X86_FEATURE_NONSTOP_TSC))
3612 mark_tsc_unstable("TSC halts in idle"
3613 diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
3614 index f357ca67a41c..87799de90a1d 100644
3615 --- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
3616 +++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
3617 @@ -456,7 +456,10 @@ out_locked:
3618 return status;
3619 }
3620
3621 -static void ipoib_mcast_join(struct net_device *dev, struct ipoib_mcast *mcast)
3622 +/*
3623 + * Caller must hold 'priv->lock'
3624 + */
3625 +static int ipoib_mcast_join(struct net_device *dev, struct ipoib_mcast *mcast)
3626 {
3627 struct ipoib_dev_priv *priv = netdev_priv(dev);
3628 struct ib_sa_multicast *multicast;
3629 @@ -466,6 +469,10 @@ static void ipoib_mcast_join(struct net_device *dev, struct ipoib_mcast *mcast)
3630 ib_sa_comp_mask comp_mask;
3631 int ret = 0;
3632
3633 + if (!priv->broadcast ||
3634 + !test_bit(IPOIB_FLAG_OPER_UP, &priv->flags))
3635 + return -EINVAL;
3636 +
3637 ipoib_dbg_mcast(priv, "joining MGID %pI6\n", mcast->mcmember.mgid.raw);
3638
3639 rec.mgid = mcast->mcmember.mgid;
3640 @@ -525,20 +532,23 @@ static void ipoib_mcast_join(struct net_device *dev, struct ipoib_mcast *mcast)
3641 rec.join_state = 4;
3642 #endif
3643 }
3644 + spin_unlock_irq(&priv->lock);
3645
3646 multicast = ib_sa_join_multicast(&ipoib_sa_client, priv->ca, priv->port,
3647 &rec, comp_mask, GFP_KERNEL,
3648 ipoib_mcast_join_complete, mcast);
3649 + spin_lock_irq(&priv->lock);
3650 if (IS_ERR(multicast)) {
3651 ret = PTR_ERR(multicast);
3652 ipoib_warn(priv, "ib_sa_join_multicast failed, status %d\n", ret);
3653 - spin_lock_irq(&priv->lock);
3654 /* Requeue this join task with a backoff delay */
3655 __ipoib_mcast_schedule_join_thread(priv, mcast, 1);
3656 clear_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags);
3657 spin_unlock_irq(&priv->lock);
3658 complete(&mcast->done);
3659 + spin_lock_irq(&priv->lock);
3660 }
3661 + return 0;
3662 }
3663
3664 void ipoib_mcast_join_task(struct work_struct *work)
3665 @@ -620,9 +630,10 @@ void ipoib_mcast_join_task(struct work_struct *work)
3666 /* Found the next unjoined group */
3667 init_completion(&mcast->done);
3668 set_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags);
3669 - spin_unlock_irq(&priv->lock);
3670 - ipoib_mcast_join(dev, mcast);
3671 - spin_lock_irq(&priv->lock);
3672 + if (ipoib_mcast_join(dev, mcast)) {
3673 + spin_unlock_irq(&priv->lock);
3674 + return;
3675 + }
3676 } else if (!delay_until ||
3677 time_before(mcast->delay_until, delay_until))
3678 delay_until = mcast->delay_until;
3679 @@ -641,10 +652,9 @@ out:
3680 if (mcast) {
3681 init_completion(&mcast->done);
3682 set_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags);
3683 + ipoib_mcast_join(dev, mcast);
3684 }
3685 spin_unlock_irq(&priv->lock);
3686 - if (mcast)
3687 - ipoib_mcast_join(dev, mcast);
3688 }
3689
3690 int ipoib_mcast_start_thread(struct net_device *dev)
3691 diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
3692 index 8a51c3b5d657..b0edb66a291b 100644
3693 --- a/drivers/infiniband/ulp/isert/ib_isert.c
3694 +++ b/drivers/infiniband/ulp/isert/ib_isert.c
3695 @@ -66,6 +66,7 @@ isert_rdma_accept(struct isert_conn *isert_conn);
3696 struct rdma_cm_id *isert_setup_id(struct isert_np *isert_np);
3697
3698 static void isert_release_work(struct work_struct *work);
3699 +static void isert_wait4flush(struct isert_conn *isert_conn);
3700
3701 static inline bool
3702 isert_prot_cmd(struct isert_conn *conn, struct se_cmd *cmd)
3703 @@ -815,12 +816,31 @@ isert_put_conn(struct isert_conn *isert_conn)
3704 kref_put(&isert_conn->kref, isert_release_kref);
3705 }
3706
3707 +static void
3708 +isert_handle_unbound_conn(struct isert_conn *isert_conn)
3709 +{
3710 + struct isert_np *isert_np = isert_conn->cm_id->context;
3711 +
3712 + mutex_lock(&isert_np->mutex);
3713 + if (!list_empty(&isert_conn->node)) {
3714 + /*
3715 + * This means iscsi doesn't know this connection
3716 + * so schedule a cleanup ourselves
3717 + */
3718 + list_del_init(&isert_conn->node);
3719 + isert_put_conn(isert_conn);
3720 + complete(&isert_conn->wait);
3721 + queue_work(isert_release_wq, &isert_conn->release_work);
3722 + }
3723 + mutex_unlock(&isert_np->mutex);
3724 +}
3725 +
3726 /**
3727 * isert_conn_terminate() - Initiate connection termination
3728 * @isert_conn: isert connection struct
3729 *
3730 * Notes:
3731 - * In case the connection state is FULL_FEATURE, move state
3732 + * In case the connection state is BOUND, move state
3733 * to TEMINATING and start teardown sequence (rdma_disconnect).
3734 * In case the connection state is UP, complete flush as well.
3735 *
3736 @@ -832,23 +852,19 @@ isert_conn_terminate(struct isert_conn *isert_conn)
3737 {
3738 int err;
3739
3740 - switch (isert_conn->state) {
3741 - case ISER_CONN_TERMINATING:
3742 - break;
3743 - case ISER_CONN_UP:
3744 - case ISER_CONN_FULL_FEATURE: /* FALLTHRU */
3745 - isert_info("Terminating conn %p state %d\n",
3746 - isert_conn, isert_conn->state);
3747 - isert_conn->state = ISER_CONN_TERMINATING;
3748 - err = rdma_disconnect(isert_conn->cm_id);
3749 - if (err)
3750 - isert_warn("Failed rdma_disconnect isert_conn %p\n",
3751 - isert_conn);
3752 - break;
3753 - default:
3754 - isert_warn("conn %p teminating in state %d\n",
3755 - isert_conn, isert_conn->state);
3756 - }
3757 + if (isert_conn->state >= ISER_CONN_TERMINATING)
3758 + return;
3759 +
3760 + isert_info("Terminating conn %p state %d\n",
3761 + isert_conn, isert_conn->state);
3762 + isert_conn->state = ISER_CONN_TERMINATING;
3763 + err = rdma_disconnect(isert_conn->cm_id);
3764 + if (err)
3765 + isert_warn("Failed rdma_disconnect isert_conn %p\n",
3766 + isert_conn);
3767 +
3768 + isert_info("conn %p completing wait\n", isert_conn);
3769 + complete(&isert_conn->wait);
3770 }
3771
3772 static int
3773 @@ -882,35 +898,27 @@ static int
3774 isert_disconnected_handler(struct rdma_cm_id *cma_id,
3775 enum rdma_cm_event_type event)
3776 {
3777 - struct isert_np *isert_np = cma_id->context;
3778 - struct isert_conn *isert_conn;
3779 - bool terminating = false;
3780 -
3781 - if (isert_np->cm_id == cma_id)
3782 - return isert_np_cma_handler(cma_id->context, event);
3783 -
3784 - isert_conn = cma_id->qp->qp_context;
3785 + struct isert_conn *isert_conn = cma_id->qp->qp_context;
3786
3787 mutex_lock(&isert_conn->mutex);
3788 - terminating = (isert_conn->state == ISER_CONN_TERMINATING);
3789 - isert_conn_terminate(isert_conn);
3790 - mutex_unlock(&isert_conn->mutex);
3791 -
3792 - isert_info("conn %p completing wait\n", isert_conn);
3793 - complete(&isert_conn->wait);
3794 -
3795 - if (terminating)
3796 - goto out;
3797 -
3798 - mutex_lock(&isert_np->mutex);
3799 - if (!list_empty(&isert_conn->node)) {
3800 - list_del_init(&isert_conn->node);
3801 - isert_put_conn(isert_conn);
3802 - queue_work(isert_release_wq, &isert_conn->release_work);
3803 + switch (isert_conn->state) {
3804 + case ISER_CONN_TERMINATING:
3805 + break;
3806 + case ISER_CONN_UP:
3807 + isert_conn_terminate(isert_conn);
3808 + isert_wait4flush(isert_conn);
3809 + isert_handle_unbound_conn(isert_conn);
3810 + break;
3811 + case ISER_CONN_BOUND:
3812 + case ISER_CONN_FULL_FEATURE: /* FALLTHRU */
3813 + iscsit_cause_connection_reinstatement(isert_conn->conn, 0);
3814 + break;
3815 + default:
3816 + isert_warn("conn %p teminating in state %d\n",
3817 + isert_conn, isert_conn->state);
3818 }
3819 - mutex_unlock(&isert_np->mutex);
3820 + mutex_unlock(&isert_conn->mutex);
3821
3822 -out:
3823 return 0;
3824 }
3825
3826 @@ -929,12 +937,16 @@ isert_connect_error(struct rdma_cm_id *cma_id)
3827 static int
3828 isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
3829 {
3830 + struct isert_np *isert_np = cma_id->context;
3831 int ret = 0;
3832
3833 isert_info("%s (%d): status %d id %p np %p\n",
3834 rdma_event_msg(event->event), event->event,
3835 event->status, cma_id, cma_id->context);
3836
3837 + if (isert_np->cm_id == cma_id)
3838 + return isert_np_cma_handler(cma_id->context, event->event);
3839 +
3840 switch (event->event) {
3841 case RDMA_CM_EVENT_CONNECT_REQUEST:
3842 ret = isert_connect_request(cma_id, event);
3843 @@ -980,13 +992,10 @@ isert_post_recvm(struct isert_conn *isert_conn, u32 count)
3844 rx_wr--;
3845 rx_wr->next = NULL; /* mark end of work requests list */
3846
3847 - isert_conn->post_recv_buf_count += count;
3848 ret = ib_post_recv(isert_conn->qp, isert_conn->rx_wr,
3849 &rx_wr_failed);
3850 - if (ret) {
3851 + if (ret)
3852 isert_err("ib_post_recv() failed with ret: %d\n", ret);
3853 - isert_conn->post_recv_buf_count -= count;
3854 - }
3855
3856 return ret;
3857 }
3858 @@ -1002,12 +1011,9 @@ isert_post_recv(struct isert_conn *isert_conn, struct iser_rx_desc *rx_desc)
3859 rx_wr.num_sge = 1;
3860 rx_wr.next = NULL;
3861
3862 - isert_conn->post_recv_buf_count++;
3863 ret = ib_post_recv(isert_conn->qp, &rx_wr, &rx_wr_failed);
3864 - if (ret) {
3865 + if (ret)
3866 isert_err("ib_post_recv() failed with ret: %d\n", ret);
3867 - isert_conn->post_recv_buf_count--;
3868 - }
3869
3870 return ret;
3871 }
3872 @@ -1120,12 +1126,9 @@ isert_rdma_post_recvl(struct isert_conn *isert_conn)
3873 rx_wr.sg_list = &sge;
3874 rx_wr.num_sge = 1;
3875
3876 - isert_conn->post_recv_buf_count++;
3877 ret = ib_post_recv(isert_conn->qp, &rx_wr, &rx_wr_fail);
3878 - if (ret) {
3879 + if (ret)
3880 isert_err("ib_post_recv() failed: %d\n", ret);
3881 - isert_conn->post_recv_buf_count--;
3882 - }
3883
3884 return ret;
3885 }
3886 @@ -1620,7 +1623,6 @@ isert_rcv_completion(struct iser_rx_desc *desc,
3887 ib_dma_sync_single_for_device(ib_dev, rx_dma, rx_buflen,
3888 DMA_FROM_DEVICE);
3889
3890 - isert_conn->post_recv_buf_count--;
3891 }
3892
3893 static int
3894 @@ -2035,7 +2037,8 @@ is_isert_tx_desc(struct isert_conn *isert_conn, void *wr_id)
3895 void *start = isert_conn->rx_descs;
3896 int len = ISERT_QP_MAX_RECV_DTOS * sizeof(*isert_conn->rx_descs);
3897
3898 - if (wr_id >= start && wr_id < start + len)
3899 + if ((wr_id >= start && wr_id < start + len) ||
3900 + (wr_id == isert_conn->login_req_buf))
3901 return false;
3902
3903 return true;
3904 @@ -2059,10 +2062,6 @@ isert_cq_comp_err(struct isert_conn *isert_conn, struct ib_wc *wc)
3905 isert_unmap_tx_desc(desc, ib_dev);
3906 else
3907 isert_completion_put(desc, isert_cmd, ib_dev, true);
3908 - } else {
3909 - isert_conn->post_recv_buf_count--;
3910 - if (!isert_conn->post_recv_buf_count)
3911 - iscsit_cause_connection_reinstatement(isert_conn->conn, 0);
3912 }
3913 }
3914
3915 @@ -3193,6 +3192,7 @@ accept_wait:
3916
3917 conn->context = isert_conn;
3918 isert_conn->conn = conn;
3919 + isert_conn->state = ISER_CONN_BOUND;
3920
3921 isert_set_conn_info(np, conn, isert_conn);
3922
3923 diff --git a/drivers/infiniband/ulp/isert/ib_isert.h b/drivers/infiniband/ulp/isert/ib_isert.h
3924 index 3d7fbc47c343..1874d21daee0 100644
3925 --- a/drivers/infiniband/ulp/isert/ib_isert.h
3926 +++ b/drivers/infiniband/ulp/isert/ib_isert.h
3927 @@ -50,6 +50,7 @@ enum iser_ib_op_code {
3928 enum iser_conn_state {
3929 ISER_CONN_INIT,
3930 ISER_CONN_UP,
3931 + ISER_CONN_BOUND,
3932 ISER_CONN_FULL_FEATURE,
3933 ISER_CONN_TERMINATING,
3934 ISER_CONN_DOWN,
3935 @@ -144,7 +145,6 @@ struct isert_device;
3936
3937 struct isert_conn {
3938 enum iser_conn_state state;
3939 - int post_recv_buf_count;
3940 u32 responder_resources;
3941 u32 initiator_depth;
3942 bool pi_support;
3943 diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
3944 index 2e2fe818ca9f..eaabf3125846 100644
3945 --- a/drivers/infiniband/ulp/srpt/ib_srpt.c
3946 +++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
3947 @@ -1737,47 +1737,6 @@ send_sense:
3948 return -1;
3949 }
3950
3951 -/**
3952 - * srpt_rx_mgmt_fn_tag() - Process a task management function by tag.
3953 - * @ch: RDMA channel of the task management request.
3954 - * @fn: Task management function to perform.
3955 - * @req_tag: Tag of the SRP task management request.
3956 - * @mgmt_ioctx: I/O context of the task management request.
3957 - *
3958 - * Returns zero if the target core will process the task management
3959 - * request asynchronously.
3960 - *
3961 - * Note: It is assumed that the initiator serializes tag-based task management
3962 - * requests.
3963 - */
3964 -static int srpt_rx_mgmt_fn_tag(struct srpt_send_ioctx *ioctx, u64 tag)
3965 -{
3966 - struct srpt_device *sdev;
3967 - struct srpt_rdma_ch *ch;
3968 - struct srpt_send_ioctx *target;
3969 - int ret, i;
3970 -
3971 - ret = -EINVAL;
3972 - ch = ioctx->ch;
3973 - BUG_ON(!ch);
3974 - BUG_ON(!ch->sport);
3975 - sdev = ch->sport->sdev;
3976 - BUG_ON(!sdev);
3977 - spin_lock_irq(&sdev->spinlock);
3978 - for (i = 0; i < ch->rq_size; ++i) {
3979 - target = ch->ioctx_ring[i];
3980 - if (target->cmd.se_lun == ioctx->cmd.se_lun &&
3981 - target->cmd.tag == tag &&
3982 - srpt_get_cmd_state(target) != SRPT_STATE_DONE) {
3983 - ret = 0;
3984 - /* now let the target core abort &target->cmd; */
3985 - break;
3986 - }
3987 - }
3988 - spin_unlock_irq(&sdev->spinlock);
3989 - return ret;
3990 -}
3991 -
3992 static int srp_tmr_to_tcm(int fn)
3993 {
3994 switch (fn) {
3995 @@ -1812,7 +1771,6 @@ static void srpt_handle_tsk_mgmt(struct srpt_rdma_ch *ch,
3996 struct se_cmd *cmd;
3997 struct se_session *sess = ch->sess;
3998 uint64_t unpacked_lun;
3999 - uint32_t tag = 0;
4000 int tcm_tmr;
4001 int rc;
4002
4003 @@ -1828,25 +1786,10 @@ static void srpt_handle_tsk_mgmt(struct srpt_rdma_ch *ch,
4004 srpt_set_cmd_state(send_ioctx, SRPT_STATE_MGMT);
4005 send_ioctx->cmd.tag = srp_tsk->tag;
4006 tcm_tmr = srp_tmr_to_tcm(srp_tsk->tsk_mgmt_func);
4007 - if (tcm_tmr < 0) {
4008 - send_ioctx->cmd.se_tmr_req->response =
4009 - TMR_TASK_MGMT_FUNCTION_NOT_SUPPORTED;
4010 - goto fail;
4011 - }
4012 unpacked_lun = srpt_unpack_lun((uint8_t *)&srp_tsk->lun,
4013 sizeof(srp_tsk->lun));
4014 -
4015 - if (srp_tsk->tsk_mgmt_func == SRP_TSK_ABORT_TASK) {
4016 - rc = srpt_rx_mgmt_fn_tag(send_ioctx, srp_tsk->task_tag);
4017 - if (rc < 0) {
4018 - send_ioctx->cmd.se_tmr_req->response =
4019 - TMR_TASK_DOES_NOT_EXIST;
4020 - goto fail;
4021 - }
4022 - tag = srp_tsk->task_tag;
4023 - }
4024 rc = target_submit_tmr(&send_ioctx->cmd, sess, NULL, unpacked_lun,
4025 - srp_tsk, tcm_tmr, GFP_KERNEL, tag,
4026 + srp_tsk, tcm_tmr, GFP_KERNEL, srp_tsk->task_tag,
4027 TARGET_SCF_ACK_KREF);
4028 if (rc != 0) {
4029 send_ioctx->cmd.se_tmr_req->response = TMR_FUNCTION_REJECTED;
4030 diff --git a/drivers/input/misc/ati_remote2.c b/drivers/input/misc/ati_remote2.c
4031 index cfd58e87da26..1c5914cae853 100644
4032 --- a/drivers/input/misc/ati_remote2.c
4033 +++ b/drivers/input/misc/ati_remote2.c
4034 @@ -817,26 +817,49 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d
4035
4036 ar2->udev = udev;
4037
4038 + /* Sanity check, first interface must have an endpoint */
4039 + if (alt->desc.bNumEndpoints < 1 || !alt->endpoint) {
4040 + dev_err(&interface->dev,
4041 + "%s(): interface 0 must have an endpoint\n", __func__);
4042 + r = -ENODEV;
4043 + goto fail1;
4044 + }
4045 ar2->intf[0] = interface;
4046 ar2->ep[0] = &alt->endpoint[0].desc;
4047
4048 + /* Sanity check, the device must have two interfaces */
4049 ar2->intf[1] = usb_ifnum_to_if(udev, 1);
4050 + if ((udev->actconfig->desc.bNumInterfaces < 2) || !ar2->intf[1]) {
4051 + dev_err(&interface->dev, "%s(): need 2 interfaces, found %d\n",
4052 + __func__, udev->actconfig->desc.bNumInterfaces);
4053 + r = -ENODEV;
4054 + goto fail1;
4055 + }
4056 +
4057 r = usb_driver_claim_interface(&ati_remote2_driver, ar2->intf[1], ar2);
4058 if (r)
4059 goto fail1;
4060 +
4061 + /* Sanity check, second interface must have an endpoint */
4062 alt = ar2->intf[1]->cur_altsetting;
4063 + if (alt->desc.bNumEndpoints < 1 || !alt->endpoint) {
4064 + dev_err(&interface->dev,
4065 + "%s(): interface 1 must have an endpoint\n", __func__);
4066 + r = -ENODEV;
4067 + goto fail2;
4068 + }
4069 ar2->ep[1] = &alt->endpoint[0].desc;
4070
4071 r = ati_remote2_urb_init(ar2);
4072 if (r)
4073 - goto fail2;
4074 + goto fail3;
4075
4076 ar2->channel_mask = channel_mask;
4077 ar2->mode_mask = mode_mask;
4078
4079 r = ati_remote2_setup(ar2, ar2->channel_mask);
4080 if (r)
4081 - goto fail2;
4082 + goto fail3;
4083
4084 usb_make_path(udev, ar2->phys, sizeof(ar2->phys));
4085 strlcat(ar2->phys, "/input0", sizeof(ar2->phys));
4086 @@ -845,11 +868,11 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d
4087
4088 r = sysfs_create_group(&udev->dev.kobj, &ati_remote2_attr_group);
4089 if (r)
4090 - goto fail2;
4091 + goto fail3;
4092
4093 r = ati_remote2_input_init(ar2);
4094 if (r)
4095 - goto fail3;
4096 + goto fail4;
4097
4098 usb_set_intfdata(interface, ar2);
4099
4100 @@ -857,10 +880,11 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d
4101
4102 return 0;
4103
4104 - fail3:
4105 + fail4:
4106 sysfs_remove_group(&udev->dev.kobj, &ati_remote2_attr_group);
4107 - fail2:
4108 + fail3:
4109 ati_remote2_urb_cleanup(ar2);
4110 + fail2:
4111 usb_driver_release_interface(&ati_remote2_driver, ar2->intf[1]);
4112 fail1:
4113 kfree(ar2);
4114 diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c
4115 index ac1fa5f44580..9c0ea36913b4 100644
4116 --- a/drivers/input/misc/ims-pcu.c
4117 +++ b/drivers/input/misc/ims-pcu.c
4118 @@ -1663,6 +1663,8 @@ static int ims_pcu_parse_cdc_data(struct usb_interface *intf, struct ims_pcu *pc
4119
4120 pcu->ctrl_intf = usb_ifnum_to_if(pcu->udev,
4121 union_desc->bMasterInterface0);
4122 + if (!pcu->ctrl_intf)
4123 + return -EINVAL;
4124
4125 alt = pcu->ctrl_intf->cur_altsetting;
4126 pcu->ep_ctrl = &alt->endpoint[0].desc;
4127 @@ -1670,6 +1672,8 @@ static int ims_pcu_parse_cdc_data(struct usb_interface *intf, struct ims_pcu *pc
4128
4129 pcu->data_intf = usb_ifnum_to_if(pcu->udev,
4130 union_desc->bSlaveInterface0);
4131 + if (!pcu->data_intf)
4132 + return -EINVAL;
4133
4134 alt = pcu->data_intf->cur_altsetting;
4135 if (alt->desc.bNumEndpoints != 2) {
4136 diff --git a/drivers/input/misc/powermate.c b/drivers/input/misc/powermate.c
4137 index 63b539d3daba..84909a12ff36 100644
4138 --- a/drivers/input/misc/powermate.c
4139 +++ b/drivers/input/misc/powermate.c
4140 @@ -307,6 +307,9 @@ static int powermate_probe(struct usb_interface *intf, const struct usb_device_i
4141 int error = -ENOMEM;
4142
4143 interface = intf->cur_altsetting;
4144 + if (interface->desc.bNumEndpoints < 1)
4145 + return -EINVAL;
4146 +
4147 endpoint = &interface->endpoint[0].desc;
4148 if (!usb_endpoint_is_int_in(endpoint))
4149 return -EIO;
4150 diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
4151 index 6025eb430c0a..a41d8328c064 100644
4152 --- a/drivers/input/mouse/synaptics.c
4153 +++ b/drivers/input/mouse/synaptics.c
4154 @@ -862,8 +862,9 @@ static void synaptics_report_ext_buttons(struct psmouse *psmouse,
4155 if (!SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap))
4156 return;
4157
4158 - /* Bug in FW 8.1, buttons are reported only when ExtBit is 1 */
4159 - if (SYN_ID_FULL(priv->identity) == 0x801 &&
4160 + /* Bug in FW 8.1 & 8.2, buttons are reported only when ExtBit is 1 */
4161 + if ((SYN_ID_FULL(priv->identity) == 0x801 ||
4162 + SYN_ID_FULL(priv->identity) == 0x802) &&
4163 !((psmouse->packet[0] ^ psmouse->packet[3]) & 0x02))
4164 return;
4165
4166 diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
4167 index 8d0ead98eb6e..a296425a7270 100644
4168 --- a/drivers/md/bcache/super.c
4169 +++ b/drivers/md/bcache/super.c
4170 @@ -1015,8 +1015,12 @@ int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c)
4171 */
4172 atomic_set(&dc->count, 1);
4173
4174 - if (bch_cached_dev_writeback_start(dc))
4175 + /* Block writeback thread, but spawn it */
4176 + down_write(&dc->writeback_lock);
4177 + if (bch_cached_dev_writeback_start(dc)) {
4178 + up_write(&dc->writeback_lock);
4179 return -ENOMEM;
4180 + }
4181
4182 if (BDEV_STATE(&dc->sb) == BDEV_STATE_DIRTY) {
4183 bch_sectors_dirty_init(dc);
4184 @@ -1028,6 +1032,9 @@ int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c)
4185 bch_cached_dev_run(dc);
4186 bcache_device_link(&dc->disk, c, "bdev");
4187
4188 + /* Allow the writeback thread to proceed */
4189 + up_write(&dc->writeback_lock);
4190 +
4191 pr_info("Caching %s as %s on set %pU",
4192 bdevname(dc->bdev, buf), dc->disk.disk->disk_name,
4193 dc->disk.c->sb.set_uuid);
4194 @@ -1366,6 +1373,9 @@ static void cache_set_flush(struct closure *cl)
4195 struct btree *b;
4196 unsigned i;
4197
4198 + if (!c)
4199 + closure_return(cl);
4200 +
4201 bch_cache_accounting_destroy(&c->accounting);
4202
4203 kobject_put(&c->internal);
4204 @@ -1828,11 +1838,12 @@ static int cache_alloc(struct cache_sb *sb, struct cache *ca)
4205 return 0;
4206 }
4207
4208 -static void register_cache(struct cache_sb *sb, struct page *sb_page,
4209 +static int register_cache(struct cache_sb *sb, struct page *sb_page,
4210 struct block_device *bdev, struct cache *ca)
4211 {
4212 char name[BDEVNAME_SIZE];
4213 - const char *err = "cannot allocate memory";
4214 + const char *err = NULL;
4215 + int ret = 0;
4216
4217 memcpy(&ca->sb, sb, sizeof(struct cache_sb));
4218 ca->bdev = bdev;
4219 @@ -1847,27 +1858,35 @@ static void register_cache(struct cache_sb *sb, struct page *sb_page,
4220 if (blk_queue_discard(bdev_get_queue(ca->bdev)))
4221 ca->discard = CACHE_DISCARD(&ca->sb);
4222
4223 - if (cache_alloc(sb, ca) != 0)
4224 + ret = cache_alloc(sb, ca);
4225 + if (ret != 0)
4226 goto err;
4227
4228 - err = "error creating kobject";
4229 - if (kobject_add(&ca->kobj, &part_to_dev(bdev->bd_part)->kobj, "bcache"))
4230 - goto err;
4231 + if (kobject_add(&ca->kobj, &part_to_dev(bdev->bd_part)->kobj, "bcache")) {
4232 + err = "error calling kobject_add";
4233 + ret = -ENOMEM;
4234 + goto out;
4235 + }
4236
4237 mutex_lock(&bch_register_lock);
4238 err = register_cache_set(ca);
4239 mutex_unlock(&bch_register_lock);
4240
4241 - if (err)
4242 - goto err;
4243 + if (err) {
4244 + ret = -ENODEV;
4245 + goto out;
4246 + }
4247
4248 pr_info("registered cache device %s", bdevname(bdev, name));
4249 +
4250 out:
4251 kobject_put(&ca->kobj);
4252 - return;
4253 +
4254 err:
4255 - pr_notice("error opening %s: %s", bdevname(bdev, name), err);
4256 - goto out;
4257 + if (err)
4258 + pr_notice("error opening %s: %s", bdevname(bdev, name), err);
4259 +
4260 + return ret;
4261 }
4262
4263 /* Global interfaces/init */
4264 @@ -1965,7 +1984,8 @@ static ssize_t register_bcache(struct kobject *k, struct kobj_attribute *attr,
4265 if (!ca)
4266 goto err_close;
4267
4268 - register_cache(sb, sb_page, bdev, ca);
4269 + if (register_cache(sb, sb_page, bdev, ca) != 0)
4270 + goto err_close;
4271 }
4272 out:
4273 if (sb_page)
4274 diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c
4275 index f6543f3a970f..27f2ef300f8b 100644
4276 --- a/drivers/md/dm-cache-metadata.c
4277 +++ b/drivers/md/dm-cache-metadata.c
4278 @@ -867,19 +867,40 @@ static int blocks_are_unmapped_or_clean(struct dm_cache_metadata *cmd,
4279 return 0;
4280 }
4281
4282 -#define WRITE_LOCK(cmd) \
4283 - if (cmd->fail_io || dm_bm_is_read_only(cmd->bm)) \
4284 +#define WRITE_LOCK(cmd) \
4285 + down_write(&cmd->root_lock); \
4286 + if (cmd->fail_io || dm_bm_is_read_only(cmd->bm)) { \
4287 + up_write(&cmd->root_lock); \
4288 return -EINVAL; \
4289 - down_write(&cmd->root_lock)
4290 + }
4291
4292 #define WRITE_LOCK_VOID(cmd) \
4293 - if (cmd->fail_io || dm_bm_is_read_only(cmd->bm)) \
4294 + down_write(&cmd->root_lock); \
4295 + if (cmd->fail_io || dm_bm_is_read_only(cmd->bm)) { \
4296 + up_write(&cmd->root_lock); \
4297 return; \
4298 - down_write(&cmd->root_lock)
4299 + }
4300
4301 #define WRITE_UNLOCK(cmd) \
4302 up_write(&cmd->root_lock)
4303
4304 +#define READ_LOCK(cmd) \
4305 + down_read(&cmd->root_lock); \
4306 + if (cmd->fail_io || dm_bm_is_read_only(cmd->bm)) { \
4307 + up_read(&cmd->root_lock); \
4308 + return -EINVAL; \
4309 + }
4310 +
4311 +#define READ_LOCK_VOID(cmd) \
4312 + down_read(&cmd->root_lock); \
4313 + if (cmd->fail_io || dm_bm_is_read_only(cmd->bm)) { \
4314 + up_read(&cmd->root_lock); \
4315 + return; \
4316 + }
4317 +
4318 +#define READ_UNLOCK(cmd) \
4319 + up_read(&cmd->root_lock)
4320 +
4321 int dm_cache_resize(struct dm_cache_metadata *cmd, dm_cblock_t new_cache_size)
4322 {
4323 int r;
4324 @@ -1015,22 +1036,20 @@ int dm_cache_load_discards(struct dm_cache_metadata *cmd,
4325 {
4326 int r;
4327
4328 - down_read(&cmd->root_lock);
4329 + READ_LOCK(cmd);
4330 r = __load_discards(cmd, fn, context);
4331 - up_read(&cmd->root_lock);
4332 + READ_UNLOCK(cmd);
4333
4334 return r;
4335 }
4336
4337 -dm_cblock_t dm_cache_size(struct dm_cache_metadata *cmd)
4338 +int dm_cache_size(struct dm_cache_metadata *cmd, dm_cblock_t *result)
4339 {
4340 - dm_cblock_t r;
4341 + READ_LOCK(cmd);
4342 + *result = cmd->cache_blocks;
4343 + READ_UNLOCK(cmd);
4344
4345 - down_read(&cmd->root_lock);
4346 - r = cmd->cache_blocks;
4347 - up_read(&cmd->root_lock);
4348 -
4349 - return r;
4350 + return 0;
4351 }
4352
4353 static int __remove(struct dm_cache_metadata *cmd, dm_cblock_t cblock)
4354 @@ -1188,9 +1207,9 @@ int dm_cache_load_mappings(struct dm_cache_metadata *cmd,
4355 {
4356 int r;
4357
4358 - down_read(&cmd->root_lock);
4359 + READ_LOCK(cmd);
4360 r = __load_mappings(cmd, policy, fn, context);
4361 - up_read(&cmd->root_lock);
4362 + READ_UNLOCK(cmd);
4363
4364 return r;
4365 }
4366 @@ -1215,18 +1234,18 @@ static int __dump_mappings(struct dm_cache_metadata *cmd)
4367
4368 void dm_cache_dump(struct dm_cache_metadata *cmd)
4369 {
4370 - down_read(&cmd->root_lock);
4371 + READ_LOCK_VOID(cmd);
4372 __dump_mappings(cmd);
4373 - up_read(&cmd->root_lock);
4374 + READ_UNLOCK(cmd);
4375 }
4376
4377 int dm_cache_changed_this_transaction(struct dm_cache_metadata *cmd)
4378 {
4379 int r;
4380
4381 - down_read(&cmd->root_lock);
4382 + READ_LOCK(cmd);
4383 r = cmd->changed;
4384 - up_read(&cmd->root_lock);
4385 + READ_UNLOCK(cmd);
4386
4387 return r;
4388 }
4389 @@ -1276,9 +1295,9 @@ int dm_cache_set_dirty(struct dm_cache_metadata *cmd,
4390 void dm_cache_metadata_get_stats(struct dm_cache_metadata *cmd,
4391 struct dm_cache_statistics *stats)
4392 {
4393 - down_read(&cmd->root_lock);
4394 + READ_LOCK_VOID(cmd);
4395 *stats = cmd->stats;
4396 - up_read(&cmd->root_lock);
4397 + READ_UNLOCK(cmd);
4398 }
4399
4400 void dm_cache_metadata_set_stats(struct dm_cache_metadata *cmd,
4401 @@ -1312,9 +1331,9 @@ int dm_cache_get_free_metadata_block_count(struct dm_cache_metadata *cmd,
4402 {
4403 int r = -EINVAL;
4404
4405 - down_read(&cmd->root_lock);
4406 + READ_LOCK(cmd);
4407 r = dm_sm_get_nr_free(cmd->metadata_sm, result);
4408 - up_read(&cmd->root_lock);
4409 + READ_UNLOCK(cmd);
4410
4411 return r;
4412 }
4413 @@ -1324,9 +1343,9 @@ int dm_cache_get_metadata_dev_size(struct dm_cache_metadata *cmd,
4414 {
4415 int r = -EINVAL;
4416
4417 - down_read(&cmd->root_lock);
4418 + READ_LOCK(cmd);
4419 r = dm_sm_get_nr_blocks(cmd->metadata_sm, result);
4420 - up_read(&cmd->root_lock);
4421 + READ_UNLOCK(cmd);
4422
4423 return r;
4424 }
4425 @@ -1417,7 +1436,13 @@ int dm_cache_write_hints(struct dm_cache_metadata *cmd, struct dm_cache_policy *
4426
4427 int dm_cache_metadata_all_clean(struct dm_cache_metadata *cmd, bool *result)
4428 {
4429 - return blocks_are_unmapped_or_clean(cmd, 0, cmd->cache_blocks, result);
4430 + int r;
4431 +
4432 + READ_LOCK(cmd);
4433 + r = blocks_are_unmapped_or_clean(cmd, 0, cmd->cache_blocks, result);
4434 + READ_UNLOCK(cmd);
4435 +
4436 + return r;
4437 }
4438
4439 void dm_cache_metadata_set_read_only(struct dm_cache_metadata *cmd)
4440 @@ -1440,10 +1465,7 @@ int dm_cache_metadata_set_needs_check(struct dm_cache_metadata *cmd)
4441 struct dm_block *sblock;
4442 struct cache_disk_superblock *disk_super;
4443
4444 - /*
4445 - * We ignore fail_io for this function.
4446 - */
4447 - down_write(&cmd->root_lock);
4448 + WRITE_LOCK(cmd);
4449 set_bit(NEEDS_CHECK, &cmd->flags);
4450
4451 r = superblock_lock(cmd, &sblock);
4452 @@ -1458,19 +1480,17 @@ int dm_cache_metadata_set_needs_check(struct dm_cache_metadata *cmd)
4453 dm_bm_unlock(sblock);
4454
4455 out:
4456 - up_write(&cmd->root_lock);
4457 + WRITE_UNLOCK(cmd);
4458 return r;
4459 }
4460
4461 -bool dm_cache_metadata_needs_check(struct dm_cache_metadata *cmd)
4462 +int dm_cache_metadata_needs_check(struct dm_cache_metadata *cmd, bool *result)
4463 {
4464 - bool needs_check;
4465 + READ_LOCK(cmd);
4466 + *result = !!test_bit(NEEDS_CHECK, &cmd->flags);
4467 + READ_UNLOCK(cmd);
4468
4469 - down_read(&cmd->root_lock);
4470 - needs_check = !!test_bit(NEEDS_CHECK, &cmd->flags);
4471 - up_read(&cmd->root_lock);
4472 -
4473 - return needs_check;
4474 + return 0;
4475 }
4476
4477 int dm_cache_metadata_abort(struct dm_cache_metadata *cmd)
4478 diff --git a/drivers/md/dm-cache-metadata.h b/drivers/md/dm-cache-metadata.h
4479 index 2ffee21f318d..8528744195e5 100644
4480 --- a/drivers/md/dm-cache-metadata.h
4481 +++ b/drivers/md/dm-cache-metadata.h
4482 @@ -66,7 +66,7 @@ void dm_cache_metadata_close(struct dm_cache_metadata *cmd);
4483 * origin blocks to map to.
4484 */
4485 int dm_cache_resize(struct dm_cache_metadata *cmd, dm_cblock_t new_cache_size);
4486 -dm_cblock_t dm_cache_size(struct dm_cache_metadata *cmd);
4487 +int dm_cache_size(struct dm_cache_metadata *cmd, dm_cblock_t *result);
4488
4489 int dm_cache_discard_bitset_resize(struct dm_cache_metadata *cmd,
4490 sector_t discard_block_size,
4491 @@ -137,7 +137,7 @@ int dm_cache_write_hints(struct dm_cache_metadata *cmd, struct dm_cache_policy *
4492 */
4493 int dm_cache_metadata_all_clean(struct dm_cache_metadata *cmd, bool *result);
4494
4495 -bool dm_cache_metadata_needs_check(struct dm_cache_metadata *cmd);
4496 +int dm_cache_metadata_needs_check(struct dm_cache_metadata *cmd, bool *result);
4497 int dm_cache_metadata_set_needs_check(struct dm_cache_metadata *cmd);
4498 void dm_cache_metadata_set_read_only(struct dm_cache_metadata *cmd);
4499 void dm_cache_metadata_set_read_write(struct dm_cache_metadata *cmd);
4500 diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
4501 index 2fd4c8296144..515f83e7d9ab 100644
4502 --- a/drivers/md/dm-cache-target.c
4503 +++ b/drivers/md/dm-cache-target.c
4504 @@ -987,9 +987,14 @@ static void notify_mode_switch(struct cache *cache, enum cache_metadata_mode mod
4505
4506 static void set_cache_mode(struct cache *cache, enum cache_metadata_mode new_mode)
4507 {
4508 - bool needs_check = dm_cache_metadata_needs_check(cache->cmd);
4509 + bool needs_check;
4510 enum cache_metadata_mode old_mode = get_cache_mode(cache);
4511
4512 + if (dm_cache_metadata_needs_check(cache->cmd, &needs_check)) {
4513 + DMERR("unable to read needs_check flag, setting failure mode");
4514 + new_mode = CM_FAIL;
4515 + }
4516 +
4517 if (new_mode == CM_WRITE && needs_check) {
4518 DMERR("%s: unable to switch cache to write mode until repaired.",
4519 cache_device_name(cache));
4520 @@ -3513,6 +3518,7 @@ static void cache_status(struct dm_target *ti, status_type_t type,
4521 char buf[BDEVNAME_SIZE];
4522 struct cache *cache = ti->private;
4523 dm_cblock_t residency;
4524 + bool needs_check;
4525
4526 switch (type) {
4527 case STATUSTYPE_INFO:
4528 @@ -3586,7 +3592,9 @@ static void cache_status(struct dm_target *ti, status_type_t type,
4529 else
4530 DMEMIT("rw ");
4531
4532 - if (dm_cache_metadata_needs_check(cache->cmd))
4533 + r = dm_cache_metadata_needs_check(cache->cmd, &needs_check);
4534 +
4535 + if (r || needs_check)
4536 DMEMIT("needs_check ");
4537 else
4538 DMEMIT("- ");
4539 diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
4540 index 61f184ad081c..e108deebbaaa 100644
4541 --- a/drivers/md/dm-snap.c
4542 +++ b/drivers/md/dm-snap.c
4543 @@ -1106,6 +1106,7 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv)
4544 int i;
4545 int r = -EINVAL;
4546 char *origin_path, *cow_path;
4547 + dev_t origin_dev, cow_dev;
4548 unsigned args_used, num_flush_bios = 1;
4549 fmode_t origin_mode = FMODE_READ;
4550
4551 @@ -1136,11 +1137,19 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv)
4552 ti->error = "Cannot get origin device";
4553 goto bad_origin;
4554 }
4555 + origin_dev = s->origin->bdev->bd_dev;
4556
4557 cow_path = argv[0];
4558 argv++;
4559 argc--;
4560
4561 + cow_dev = dm_get_dev_t(cow_path);
4562 + if (cow_dev && cow_dev == origin_dev) {
4563 + ti->error = "COW device cannot be the same as origin device";
4564 + r = -EINVAL;
4565 + goto bad_cow;
4566 + }
4567 +
4568 r = dm_get_device(ti, cow_path, dm_table_get_mode(ti->table), &s->cow);
4569 if (r) {
4570 ti->error = "Cannot get COW device";
4571 diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
4572 index 061152a43730..cb5d0daf53bb 100644
4573 --- a/drivers/md/dm-table.c
4574 +++ b/drivers/md/dm-table.c
4575 @@ -365,6 +365,26 @@ static int upgrade_mode(struct dm_dev_internal *dd, fmode_t new_mode,
4576 }
4577
4578 /*
4579 + * Convert the path to a device
4580 + */
4581 +dev_t dm_get_dev_t(const char *path)
4582 +{
4583 + dev_t uninitialized_var(dev);
4584 + struct block_device *bdev;
4585 +
4586 + bdev = lookup_bdev(path);
4587 + if (IS_ERR(bdev))
4588 + dev = name_to_dev_t(path);
4589 + else {
4590 + dev = bdev->bd_dev;
4591 + bdput(bdev);
4592 + }
4593 +
4594 + return dev;
4595 +}
4596 +EXPORT_SYMBOL_GPL(dm_get_dev_t);
4597 +
4598 +/*
4599 * Add a device to the list, or just increment the usage count if
4600 * it's already present.
4601 */
4602 @@ -372,23 +392,15 @@ int dm_get_device(struct dm_target *ti, const char *path, fmode_t mode,
4603 struct dm_dev **result)
4604 {
4605 int r;
4606 - dev_t uninitialized_var(dev);
4607 + dev_t dev;
4608 struct dm_dev_internal *dd;
4609 struct dm_table *t = ti->table;
4610 - struct block_device *bdev;
4611
4612 BUG_ON(!t);
4613
4614 - /* convert the path to a device */
4615 - bdev = lookup_bdev(path);
4616 - if (IS_ERR(bdev)) {
4617 - dev = name_to_dev_t(path);
4618 - if (!dev)
4619 - return -ENODEV;
4620 - } else {
4621 - dev = bdev->bd_dev;
4622 - bdput(bdev);
4623 - }
4624 + dev = dm_get_dev_t(path);
4625 + if (!dev)
4626 + return -ENODEV;
4627
4628 dd = find_device(&t->devices, dev);
4629 if (!dd) {
4630 diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
4631 index c219a053c7f6..911ada643364 100644
4632 --- a/drivers/md/dm-thin-metadata.c
4633 +++ b/drivers/md/dm-thin-metadata.c
4634 @@ -1943,5 +1943,8 @@ bool dm_pool_metadata_needs_check(struct dm_pool_metadata *pmd)
4635
4636 void dm_pool_issue_prefetches(struct dm_pool_metadata *pmd)
4637 {
4638 - dm_tm_issue_prefetches(pmd->tm);
4639 + down_read(&pmd->root_lock);
4640 + if (!pmd->fail_io)
4641 + dm_tm_issue_prefetches(pmd->tm);
4642 + up_read(&pmd->root_lock);
4643 }
4644 diff --git a/drivers/md/dm.c b/drivers/md/dm.c
4645 index dd834927bc66..c338aebb4ccd 100644
4646 --- a/drivers/md/dm.c
4647 +++ b/drivers/md/dm.c
4648 @@ -1109,12 +1109,8 @@ static void rq_completed(struct mapped_device *md, int rw, bool run_queue)
4649 * back into ->request_fn() could deadlock attempting to grab the
4650 * queue lock again.
4651 */
4652 - if (run_queue) {
4653 - if (md->queue->mq_ops)
4654 - blk_mq_run_hw_queues(md->queue, true);
4655 - else
4656 - blk_run_queue_async(md->queue);
4657 - }
4658 + if (!md->queue->mq_ops && run_queue)
4659 + blk_run_queue_async(md->queue);
4660
4661 /*
4662 * dm_put() must be at the end of this function. See the comment above
4663 @@ -1214,9 +1210,9 @@ static void dm_requeue_original_request(struct mapped_device *md,
4664 {
4665 int rw = rq_data_dir(rq);
4666
4667 + rq_end_stats(md, rq);
4668 dm_unprep_request(rq);
4669
4670 - rq_end_stats(md, rq);
4671 if (!rq->q->mq_ops)
4672 old_requeue_request(rq);
4673 else {
4674 @@ -1336,7 +1332,10 @@ static void dm_complete_request(struct request *rq, int error)
4675 struct dm_rq_target_io *tio = tio_from_request(rq);
4676
4677 tio->error = error;
4678 - blk_complete_request(rq);
4679 + if (!rq->q->mq_ops)
4680 + blk_complete_request(rq);
4681 + else
4682 + blk_mq_complete_request(rq, error);
4683 }
4684
4685 /*
4686 diff --git a/drivers/md/multipath.c b/drivers/md/multipath.c
4687 index 0a72ab6e6c20..dd483bb2e111 100644
4688 --- a/drivers/md/multipath.c
4689 +++ b/drivers/md/multipath.c
4690 @@ -129,7 +129,9 @@ static void multipath_make_request(struct mddev *mddev, struct bio * bio)
4691 }
4692 multipath = conf->multipaths + mp_bh->path;
4693
4694 - mp_bh->bio = *bio;
4695 + bio_init(&mp_bh->bio);
4696 + __bio_clone_fast(&mp_bh->bio, bio);
4697 +
4698 mp_bh->bio.bi_iter.bi_sector += multipath->rdev->data_offset;
4699 mp_bh->bio.bi_bdev = multipath->rdev->bdev;
4700 mp_bh->bio.bi_rw |= REQ_FAILFAST_TRANSPORT;
4701 diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
4702 index c4b913409226..515554c7365b 100644
4703 --- a/drivers/md/raid1.c
4704 +++ b/drivers/md/raid1.c
4705 @@ -2274,6 +2274,7 @@ static void handle_write_finished(struct r1conf *conf, struct r1bio *r1_bio)
4706 if (fail) {
4707 spin_lock_irq(&conf->device_lock);
4708 list_add(&r1_bio->retry_list, &conf->bio_end_io_list);
4709 + conf->nr_queued++;
4710 spin_unlock_irq(&conf->device_lock);
4711 md_wakeup_thread(conf->mddev->thread);
4712 } else {
4713 @@ -2391,8 +2392,10 @@ static void raid1d(struct md_thread *thread)
4714 LIST_HEAD(tmp);
4715 spin_lock_irqsave(&conf->device_lock, flags);
4716 if (!test_bit(MD_CHANGE_PENDING, &mddev->flags)) {
4717 - list_add(&tmp, &conf->bio_end_io_list);
4718 - list_del_init(&conf->bio_end_io_list);
4719 + while (!list_empty(&conf->bio_end_io_list)) {
4720 + list_move(conf->bio_end_io_list.prev, &tmp);
4721 + conf->nr_queued--;
4722 + }
4723 }
4724 spin_unlock_irqrestore(&conf->device_lock, flags);
4725 while (!list_empty(&tmp)) {
4726 diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
4727 index ce959b4ae4df..ebb0dd612ebd 100644
4728 --- a/drivers/md/raid10.c
4729 +++ b/drivers/md/raid10.c
4730 @@ -2664,6 +2664,7 @@ static void handle_write_completed(struct r10conf *conf, struct r10bio *r10_bio)
4731 if (fail) {
4732 spin_lock_irq(&conf->device_lock);
4733 list_add(&r10_bio->retry_list, &conf->bio_end_io_list);
4734 + conf->nr_queued++;
4735 spin_unlock_irq(&conf->device_lock);
4736 md_wakeup_thread(conf->mddev->thread);
4737 } else {
4738 @@ -2691,8 +2692,10 @@ static void raid10d(struct md_thread *thread)
4739 LIST_HEAD(tmp);
4740 spin_lock_irqsave(&conf->device_lock, flags);
4741 if (!test_bit(MD_CHANGE_PENDING, &mddev->flags)) {
4742 - list_add(&tmp, &conf->bio_end_io_list);
4743 - list_del_init(&conf->bio_end_io_list);
4744 + while (!list_empty(&conf->bio_end_io_list)) {
4745 + list_move(conf->bio_end_io_list.prev, &tmp);
4746 + conf->nr_queued--;
4747 + }
4748 }
4749 spin_unlock_irqrestore(&conf->device_lock, flags);
4750 while (!list_empty(&tmp)) {
4751 diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
4752 index 704ef7fcfbf8..10ce885445f6 100644
4753 --- a/drivers/md/raid5.c
4754 +++ b/drivers/md/raid5.c
4755 @@ -340,8 +340,7 @@ static void release_inactive_stripe_list(struct r5conf *conf,
4756 int hash)
4757 {
4758 int size;
4759 - unsigned long do_wakeup = 0;
4760 - int i = 0;
4761 + bool do_wakeup = false;
4762 unsigned long flags;
4763
4764 if (hash == NR_STRIPE_HASH_LOCKS) {
4765 @@ -362,19 +361,15 @@ static void release_inactive_stripe_list(struct r5conf *conf,
4766 !list_empty(list))
4767 atomic_dec(&conf->empty_inactive_list_nr);
4768 list_splice_tail_init(list, conf->inactive_list + hash);
4769 - do_wakeup |= 1 << hash;
4770 + do_wakeup = true;
4771 spin_unlock_irqrestore(conf->hash_locks + hash, flags);
4772 }
4773 size--;
4774 hash--;
4775 }
4776
4777 - for (i = 0; i < NR_STRIPE_HASH_LOCKS; i++) {
4778 - if (do_wakeup & (1 << i))
4779 - wake_up(&conf->wait_for_stripe[i]);
4780 - }
4781 -
4782 if (do_wakeup) {
4783 + wake_up(&conf->wait_for_stripe);
4784 if (atomic_read(&conf->active_stripes) == 0)
4785 wake_up(&conf->wait_for_quiescent);
4786 if (conf->retry_read_aligned)
4787 @@ -687,15 +682,14 @@ raid5_get_active_stripe(struct r5conf *conf, sector_t sector,
4788 if (!sh) {
4789 set_bit(R5_INACTIVE_BLOCKED,
4790 &conf->cache_state);
4791 - wait_event_exclusive_cmd(
4792 - conf->wait_for_stripe[hash],
4793 + wait_event_lock_irq(
4794 + conf->wait_for_stripe,
4795 !list_empty(conf->inactive_list + hash) &&
4796 (atomic_read(&conf->active_stripes)
4797 < (conf->max_nr_stripes * 3 / 4)
4798 || !test_bit(R5_INACTIVE_BLOCKED,
4799 &conf->cache_state)),
4800 - spin_unlock_irq(conf->hash_locks + hash),
4801 - spin_lock_irq(conf->hash_locks + hash));
4802 + *(conf->hash_locks + hash));
4803 clear_bit(R5_INACTIVE_BLOCKED,
4804 &conf->cache_state);
4805 } else {
4806 @@ -720,9 +714,6 @@ raid5_get_active_stripe(struct r5conf *conf, sector_t sector,
4807 }
4808 } while (sh == NULL);
4809
4810 - if (!list_empty(conf->inactive_list + hash))
4811 - wake_up(&conf->wait_for_stripe[hash]);
4812 -
4813 spin_unlock_irq(conf->hash_locks + hash);
4814 return sh;
4815 }
4816 @@ -2091,6 +2082,14 @@ static int resize_chunks(struct r5conf *conf, int new_disks, int new_sectors)
4817 unsigned long cpu;
4818 int err = 0;
4819
4820 + /*
4821 + * Never shrink. And mddev_suspend() could deadlock if this is called
4822 + * from raid5d. In that case, scribble_disks and scribble_sectors
4823 + * should equal to new_disks and new_sectors
4824 + */
4825 + if (conf->scribble_disks >= new_disks &&
4826 + conf->scribble_sectors >= new_sectors)
4827 + return 0;
4828 mddev_suspend(conf->mddev);
4829 get_online_cpus();
4830 for_each_present_cpu(cpu) {
4831 @@ -2112,6 +2111,10 @@ static int resize_chunks(struct r5conf *conf, int new_disks, int new_sectors)
4832 }
4833 put_online_cpus();
4834 mddev_resume(conf->mddev);
4835 + if (!err) {
4836 + conf->scribble_disks = new_disks;
4837 + conf->scribble_sectors = new_sectors;
4838 + }
4839 return err;
4840 }
4841
4842 @@ -2192,7 +2195,7 @@ static int resize_stripes(struct r5conf *conf, int newsize)
4843 cnt = 0;
4844 list_for_each_entry(nsh, &newstripes, lru) {
4845 lock_device_hash_lock(conf, hash);
4846 - wait_event_exclusive_cmd(conf->wait_for_stripe[hash],
4847 + wait_event_cmd(conf->wait_for_stripe,
4848 !list_empty(conf->inactive_list + hash),
4849 unlock_device_hash_lock(conf, hash),
4850 lock_device_hash_lock(conf, hash));
4851 @@ -4238,7 +4241,6 @@ static void break_stripe_batch_list(struct stripe_head *head_sh,
4852 WARN_ON_ONCE(sh->state & ((1 << STRIPE_ACTIVE) |
4853 (1 << STRIPE_SYNCING) |
4854 (1 << STRIPE_REPLACED) |
4855 - (1 << STRIPE_PREREAD_ACTIVE) |
4856 (1 << STRIPE_DELAYED) |
4857 (1 << STRIPE_BIT_DELAY) |
4858 (1 << STRIPE_FULL_WRITE) |
4859 @@ -4253,6 +4255,7 @@ static void break_stripe_batch_list(struct stripe_head *head_sh,
4860 (1 << STRIPE_REPLACED)));
4861
4862 set_mask_bits(&sh->state, ~(STRIPE_EXPAND_SYNC_FLAGS |
4863 + (1 << STRIPE_PREREAD_ACTIVE) |
4864 (1 << STRIPE_DEGRADED)),
4865 head_sh->state & (1 << STRIPE_INSYNC));
4866
4867 @@ -6414,6 +6417,12 @@ static int raid5_alloc_percpu(struct r5conf *conf)
4868 }
4869 put_online_cpus();
4870
4871 + if (!err) {
4872 + conf->scribble_disks = max(conf->raid_disks,
4873 + conf->previous_raid_disks);
4874 + conf->scribble_sectors = max(conf->chunk_sectors,
4875 + conf->prev_chunk_sectors);
4876 + }
4877 return err;
4878 }
4879
4880 @@ -6504,9 +6513,7 @@ static struct r5conf *setup_conf(struct mddev *mddev)
4881 seqcount_init(&conf->gen_lock);
4882 mutex_init(&conf->cache_size_mutex);
4883 init_waitqueue_head(&conf->wait_for_quiescent);
4884 - for (i = 0; i < NR_STRIPE_HASH_LOCKS; i++) {
4885 - init_waitqueue_head(&conf->wait_for_stripe[i]);
4886 - }
4887 + init_waitqueue_head(&conf->wait_for_stripe);
4888 init_waitqueue_head(&conf->wait_for_overlap);
4889 INIT_LIST_HEAD(&conf->handle_list);
4890 INIT_LIST_HEAD(&conf->hold_list);
4891 @@ -7015,8 +7022,8 @@ static int run(struct mddev *mddev)
4892 }
4893
4894 if (discard_supported &&
4895 - mddev->queue->limits.max_discard_sectors >= stripe &&
4896 - mddev->queue->limits.discard_granularity >= stripe)
4897 + mddev->queue->limits.max_discard_sectors >= (stripe >> 9) &&
4898 + mddev->queue->limits.discard_granularity >= stripe)
4899 queue_flag_set_unlocked(QUEUE_FLAG_DISCARD,
4900 mddev->queue);
4901 else
4902 diff --git a/drivers/md/raid5.h b/drivers/md/raid5.h
4903 index a415e1cd39b8..517d4b68a1be 100644
4904 --- a/drivers/md/raid5.h
4905 +++ b/drivers/md/raid5.h
4906 @@ -510,6 +510,8 @@ struct r5conf {
4907 * conversions
4908 */
4909 } __percpu *percpu;
4910 + int scribble_disks;
4911 + int scribble_sectors;
4912 #ifdef CONFIG_HOTPLUG_CPU
4913 struct notifier_block cpu_notify;
4914 #endif
4915 @@ -522,7 +524,7 @@ struct r5conf {
4916 atomic_t empty_inactive_list_nr;
4917 struct llist_head released_stripes;
4918 wait_queue_head_t wait_for_quiescent;
4919 - wait_queue_head_t wait_for_stripe[NR_STRIPE_HASH_LOCKS];
4920 + wait_queue_head_t wait_for_stripe;
4921 wait_queue_head_t wait_for_overlap;
4922 unsigned long cache_state;
4923 #define R5_INACTIVE_BLOCKED 1 /* release of inactive stripes blocked,
4924 diff --git a/drivers/media/i2c/adv7511.c b/drivers/media/i2c/adv7511.c
4925 index e4900df1140b..c24839cfcc35 100644
4926 --- a/drivers/media/i2c/adv7511.c
4927 +++ b/drivers/media/i2c/adv7511.c
4928 @@ -1161,12 +1161,23 @@ static void adv7511_dbg_dump_edid(int lvl, int debug, struct v4l2_subdev *sd, in
4929 }
4930 }
4931
4932 +static void adv7511_notify_no_edid(struct v4l2_subdev *sd)
4933 +{
4934 + struct adv7511_state *state = get_adv7511_state(sd);
4935 + struct adv7511_edid_detect ed;
4936 +
4937 + /* We failed to read the EDID, so send an event for this. */
4938 + ed.present = false;
4939 + ed.segment = adv7511_rd(sd, 0xc4);
4940 + v4l2_subdev_notify(sd, ADV7511_EDID_DETECT, (void *)&ed);
4941 + v4l2_ctrl_s_ctrl(state->have_edid0_ctrl, 0x0);
4942 +}
4943 +
4944 static void adv7511_edid_handler(struct work_struct *work)
4945 {
4946 struct delayed_work *dwork = to_delayed_work(work);
4947 struct adv7511_state *state = container_of(dwork, struct adv7511_state, edid_handler);
4948 struct v4l2_subdev *sd = &state->sd;
4949 - struct adv7511_edid_detect ed;
4950
4951 v4l2_dbg(1, debug, sd, "%s:\n", __func__);
4952
4953 @@ -1191,9 +1202,7 @@ static void adv7511_edid_handler(struct work_struct *work)
4954 }
4955
4956 /* We failed to read the EDID, so send an event for this. */
4957 - ed.present = false;
4958 - ed.segment = adv7511_rd(sd, 0xc4);
4959 - v4l2_subdev_notify(sd, ADV7511_EDID_DETECT, (void *)&ed);
4960 + adv7511_notify_no_edid(sd);
4961 v4l2_dbg(1, debug, sd, "%s: no edid found\n", __func__);
4962 }
4963
4964 @@ -1264,7 +1273,6 @@ static void adv7511_check_monitor_present_status(struct v4l2_subdev *sd)
4965 /* update read only ctrls */
4966 v4l2_ctrl_s_ctrl(state->hotplug_ctrl, adv7511_have_hotplug(sd) ? 0x1 : 0x0);
4967 v4l2_ctrl_s_ctrl(state->rx_sense_ctrl, adv7511_have_rx_sense(sd) ? 0x1 : 0x0);
4968 - v4l2_ctrl_s_ctrl(state->have_edid0_ctrl, state->edid.segments ? 0x1 : 0x0);
4969
4970 if ((status & MASK_ADV7511_HPD_DETECT) && ((status & MASK_ADV7511_MSEN_DETECT) || state->edid.segments)) {
4971 v4l2_dbg(1, debug, sd, "%s: hotplug and (rx-sense or edid)\n", __func__);
4972 @@ -1294,6 +1302,7 @@ static void adv7511_check_monitor_present_status(struct v4l2_subdev *sd)
4973 }
4974 adv7511_s_power(sd, false);
4975 memset(&state->edid, 0, sizeof(struct adv7511_state_edid));
4976 + adv7511_notify_no_edid(sd);
4977 }
4978 }
4979
4980 @@ -1370,6 +1379,7 @@ static bool adv7511_check_edid_status(struct v4l2_subdev *sd)
4981 }
4982 /* one more segment read ok */
4983 state->edid.segments = segment + 1;
4984 + v4l2_ctrl_s_ctrl(state->have_edid0_ctrl, 0x1);
4985 if (((state->edid.data[0x7e] >> 1) + 1) > state->edid.segments) {
4986 /* Request next EDID segment */
4987 v4l2_dbg(1, debug, sd, "%s: request segment %d\n", __func__, state->edid.segments);
4988 @@ -1389,7 +1399,6 @@ static bool adv7511_check_edid_status(struct v4l2_subdev *sd)
4989 ed.present = true;
4990 ed.segment = 0;
4991 state->edid_detect_counter++;
4992 - v4l2_ctrl_s_ctrl(state->have_edid0_ctrl, state->edid.segments ? 0x1 : 0x0);
4993 v4l2_subdev_notify(sd, ADV7511_EDID_DETECT, (void *)&ed);
4994 return ed.present;
4995 }
4996 diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c
4997 index 15a4ebc2844d..51dbef2f9a48 100644
4998 --- a/drivers/media/pci/bt8xx/bttv-driver.c
4999 +++ b/drivers/media/pci/bt8xx/bttv-driver.c
5000 @@ -2334,6 +2334,19 @@ static int bttv_g_fmt_vid_overlay(struct file *file, void *priv,
5001 return 0;
5002 }
5003
5004 +static void bttv_get_width_mask_vid_cap(const struct bttv_format *fmt,
5005 + unsigned int *width_mask,
5006 + unsigned int *width_bias)
5007 +{
5008 + if (fmt->flags & FORMAT_FLAGS_PLANAR) {
5009 + *width_mask = ~15; /* width must be a multiple of 16 pixels */
5010 + *width_bias = 8; /* nearest */
5011 + } else {
5012 + *width_mask = ~3; /* width must be a multiple of 4 pixels */
5013 + *width_bias = 2; /* nearest */
5014 + }
5015 +}
5016 +
5017 static int bttv_try_fmt_vid_cap(struct file *file, void *priv,
5018 struct v4l2_format *f)
5019 {
5020 @@ -2343,6 +2356,7 @@ static int bttv_try_fmt_vid_cap(struct file *file, void *priv,
5021 enum v4l2_field field;
5022 __s32 width, height;
5023 __s32 height2;
5024 + unsigned int width_mask, width_bias;
5025 int rc;
5026
5027 fmt = format_by_fourcc(f->fmt.pix.pixelformat);
5028 @@ -2375,9 +2389,9 @@ static int bttv_try_fmt_vid_cap(struct file *file, void *priv,
5029 width = f->fmt.pix.width;
5030 height = f->fmt.pix.height;
5031
5032 + bttv_get_width_mask_vid_cap(fmt, &width_mask, &width_bias);
5033 rc = limit_scaled_size_lock(fh, &width, &height, field,
5034 - /* width_mask: 4 pixels */ ~3,
5035 - /* width_bias: nearest */ 2,
5036 + width_mask, width_bias,
5037 /* adjust_size */ 1,
5038 /* adjust_crop */ 0);
5039 if (0 != rc)
5040 @@ -2410,6 +2424,7 @@ static int bttv_s_fmt_vid_cap(struct file *file, void *priv,
5041 struct bttv_fh *fh = priv;
5042 struct bttv *btv = fh->btv;
5043 __s32 width, height;
5044 + unsigned int width_mask, width_bias;
5045 enum v4l2_field field;
5046
5047 retval = bttv_switch_type(fh, f->type);
5048 @@ -2424,9 +2439,10 @@ static int bttv_s_fmt_vid_cap(struct file *file, void *priv,
5049 height = f->fmt.pix.height;
5050 field = f->fmt.pix.field;
5051
5052 + fmt = format_by_fourcc(f->fmt.pix.pixelformat);
5053 + bttv_get_width_mask_vid_cap(fmt, &width_mask, &width_bias);
5054 retval = limit_scaled_size_lock(fh, &width, &height, f->fmt.pix.field,
5055 - /* width_mask: 4 pixels */ ~3,
5056 - /* width_bias: nearest */ 2,
5057 + width_mask, width_bias,
5058 /* adjust_size */ 1,
5059 /* adjust_crop */ 1);
5060 if (0 != retval)
5061 @@ -2434,8 +2450,6 @@ static int bttv_s_fmt_vid_cap(struct file *file, void *priv,
5062
5063 f->fmt.pix.field = field;
5064
5065 - fmt = format_by_fourcc(f->fmt.pix.pixelformat);
5066 -
5067 /* update our state informations */
5068 fh->fmt = fmt;
5069 fh->cap.field = f->fmt.pix.field;
5070 diff --git a/drivers/media/pci/saa7134/saa7134-video.c b/drivers/media/pci/saa7134/saa7134-video.c
5071 index 518086c7aed5..15e56c07b217 100644
5072 --- a/drivers/media/pci/saa7134/saa7134-video.c
5073 +++ b/drivers/media/pci/saa7134/saa7134-video.c
5074 @@ -1219,10 +1219,13 @@ static int saa7134_g_fmt_vid_cap(struct file *file, void *priv,
5075 f->fmt.pix.height = dev->height;
5076 f->fmt.pix.field = dev->field;
5077 f->fmt.pix.pixelformat = dev->fmt->fourcc;
5078 - f->fmt.pix.bytesperline =
5079 - (f->fmt.pix.width * dev->fmt->depth) >> 3;
5080 + if (dev->fmt->planar)
5081 + f->fmt.pix.bytesperline = f->fmt.pix.width;
5082 + else
5083 + f->fmt.pix.bytesperline =
5084 + (f->fmt.pix.width * dev->fmt->depth) / 8;
5085 f->fmt.pix.sizeimage =
5086 - f->fmt.pix.height * f->fmt.pix.bytesperline;
5087 + (f->fmt.pix.height * f->fmt.pix.width * dev->fmt->depth) / 8;
5088 f->fmt.pix.colorspace = V4L2_COLORSPACE_SMPTE170M;
5089 return 0;
5090 }
5091 @@ -1298,10 +1301,13 @@ static int saa7134_try_fmt_vid_cap(struct file *file, void *priv,
5092 if (f->fmt.pix.height > maxh)
5093 f->fmt.pix.height = maxh;
5094 f->fmt.pix.width &= ~0x03;
5095 - f->fmt.pix.bytesperline =
5096 - (f->fmt.pix.width * fmt->depth) >> 3;
5097 + if (fmt->planar)
5098 + f->fmt.pix.bytesperline = f->fmt.pix.width;
5099 + else
5100 + f->fmt.pix.bytesperline =
5101 + (f->fmt.pix.width * fmt->depth) / 8;
5102 f->fmt.pix.sizeimage =
5103 - f->fmt.pix.height * f->fmt.pix.bytesperline;
5104 + (f->fmt.pix.height * f->fmt.pix.width * fmt->depth) / 8;
5105 f->fmt.pix.colorspace = V4L2_COLORSPACE_SMPTE170M;
5106
5107 return 0;
5108 diff --git a/drivers/media/platform/coda/coda-bit.c b/drivers/media/platform/coda/coda-bit.c
5109 index 654e964f84a2..d76511c1c1e3 100644
5110 --- a/drivers/media/platform/coda/coda-bit.c
5111 +++ b/drivers/media/platform/coda/coda-bit.c
5112 @@ -1342,7 +1342,7 @@ static void coda_finish_encode(struct coda_ctx *ctx)
5113
5114 /* Calculate bytesused field */
5115 if (dst_buf->sequence == 0) {
5116 - vb2_set_plane_payload(&dst_buf->vb2_buf, 0,
5117 + vb2_set_plane_payload(&dst_buf->vb2_buf, 0, wr_ptr - start_ptr +
5118 ctx->vpu_header_size[0] +
5119 ctx->vpu_header_size[1] +
5120 ctx->vpu_header_size[2]);
5121 diff --git a/drivers/media/usb/pwc/pwc-if.c b/drivers/media/usb/pwc/pwc-if.c
5122 index b79c36fd8cd2..58f23bcfe94e 100644
5123 --- a/drivers/media/usb/pwc/pwc-if.c
5124 +++ b/drivers/media/usb/pwc/pwc-if.c
5125 @@ -91,6 +91,7 @@ static const struct usb_device_id pwc_device_table [] = {
5126 { USB_DEVICE(0x0471, 0x0312) },
5127 { USB_DEVICE(0x0471, 0x0313) }, /* the 'new' 720K */
5128 { USB_DEVICE(0x0471, 0x0329) }, /* Philips SPC 900NC PC Camera */
5129 + { USB_DEVICE(0x0471, 0x032C) }, /* Philips SPC 880NC PC Camera */
5130 { USB_DEVICE(0x069A, 0x0001) }, /* Askey */
5131 { USB_DEVICE(0x046D, 0x08B0) }, /* Logitech QuickCam Pro 3000 */
5132 { USB_DEVICE(0x046D, 0x08B1) }, /* Logitech QuickCam Notebook Pro */
5133 @@ -811,6 +812,11 @@ static int usb_pwc_probe(struct usb_interface *intf, const struct usb_device_id
5134 name = "Philips SPC 900NC webcam";
5135 type_id = 740;
5136 break;
5137 + case 0x032C:
5138 + PWC_INFO("Philips SPC 880NC USB webcam detected.\n");
5139 + name = "Philips SPC 880NC webcam";
5140 + type_id = 740;
5141 + break;
5142 default:
5143 return -ENODEV;
5144 break;
5145 diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
5146 index 327e83ac2469..f38c076752ce 100644
5147 --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
5148 +++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
5149 @@ -415,7 +415,8 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
5150 get_user(kp->index, &up->index) ||
5151 get_user(kp->type, &up->type) ||
5152 get_user(kp->flags, &up->flags) ||
5153 - get_user(kp->memory, &up->memory))
5154 + get_user(kp->memory, &up->memory) ||
5155 + get_user(kp->length, &up->length))
5156 return -EFAULT;
5157
5158 if (V4L2_TYPE_IS_OUTPUT(kp->type))
5159 @@ -427,9 +428,6 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
5160 return -EFAULT;
5161
5162 if (V4L2_TYPE_IS_MULTIPLANAR(kp->type)) {
5163 - if (get_user(kp->length, &up->length))
5164 - return -EFAULT;
5165 -
5166 num_planes = kp->length;
5167 if (num_planes == 0) {
5168 kp->m.planes = NULL;
5169 @@ -462,16 +460,14 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
5170 } else {
5171 switch (kp->memory) {
5172 case V4L2_MEMORY_MMAP:
5173 - if (get_user(kp->length, &up->length) ||
5174 - get_user(kp->m.offset, &up->m.offset))
5175 + if (get_user(kp->m.offset, &up->m.offset))
5176 return -EFAULT;
5177 break;
5178 case V4L2_MEMORY_USERPTR:
5179 {
5180 compat_long_t tmp;
5181
5182 - if (get_user(kp->length, &up->length) ||
5183 - get_user(tmp, &up->m.userptr))
5184 + if (get_user(tmp, &up->m.userptr))
5185 return -EFAULT;
5186
5187 kp->m.userptr = (unsigned long)compat_ptr(tmp);
5188 @@ -513,7 +509,8 @@ static int put_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
5189 copy_to_user(&up->timecode, &kp->timecode, sizeof(struct v4l2_timecode)) ||
5190 put_user(kp->sequence, &up->sequence) ||
5191 put_user(kp->reserved2, &up->reserved2) ||
5192 - put_user(kp->reserved, &up->reserved))
5193 + put_user(kp->reserved, &up->reserved) ||
5194 + put_user(kp->length, &up->length))
5195 return -EFAULT;
5196
5197 if (V4L2_TYPE_IS_MULTIPLANAR(kp->type)) {
5198 @@ -536,13 +533,11 @@ static int put_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
5199 } else {
5200 switch (kp->memory) {
5201 case V4L2_MEMORY_MMAP:
5202 - if (put_user(kp->length, &up->length) ||
5203 - put_user(kp->m.offset, &up->m.offset))
5204 + if (put_user(kp->m.offset, &up->m.offset))
5205 return -EFAULT;
5206 break;
5207 case V4L2_MEMORY_USERPTR:
5208 - if (put_user(kp->length, &up->length) ||
5209 - put_user(kp->m.userptr, &up->m.userptr))
5210 + if (put_user(kp->m.userptr, &up->m.userptr))
5211 return -EFAULT;
5212 break;
5213 case V4L2_MEMORY_OVERLAY:
5214 diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c
5215 index 0b05aa938799..1a173d0af694 100644
5216 --- a/drivers/misc/mei/bus.c
5217 +++ b/drivers/misc/mei/bus.c
5218 @@ -53,6 +53,11 @@ ssize_t __mei_cl_send(struct mei_cl *cl, u8 *buf, size_t length,
5219 bus = cl->dev;
5220
5221 mutex_lock(&bus->device_lock);
5222 + if (bus->dev_state != MEI_DEV_ENABLED) {
5223 + rets = -ENODEV;
5224 + goto out;
5225 + }
5226 +
5227 if (!mei_cl_is_connected(cl)) {
5228 rets = -ENODEV;
5229 goto out;
5230 @@ -109,6 +114,10 @@ ssize_t __mei_cl_recv(struct mei_cl *cl, u8 *buf, size_t length)
5231 bus = cl->dev;
5232
5233 mutex_lock(&bus->device_lock);
5234 + if (bus->dev_state != MEI_DEV_ENABLED) {
5235 + rets = -ENODEV;
5236 + goto out;
5237 + }
5238
5239 cb = mei_cl_read_cb(cl, NULL);
5240 if (cb)
5241 diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
5242 index d8486168415a..553113eb1bdb 100644
5243 --- a/drivers/mmc/card/block.c
5244 +++ b/drivers/mmc/card/block.c
5245 @@ -596,6 +596,14 @@ static int mmc_blk_ioctl_cmd(struct block_device *bdev,
5246 struct mmc_card *card;
5247 int err = 0, ioc_err = 0;
5248
5249 + /*
5250 + * The caller must have CAP_SYS_RAWIO, and must be calling this on the
5251 + * whole block device, not on a partition. This prevents overspray
5252 + * between sibling partitions.
5253 + */
5254 + if ((!capable(CAP_SYS_RAWIO)) || (bdev != bdev->bd_contains))
5255 + return -EPERM;
5256 +
5257 idata = mmc_blk_ioctl_copy_from_user(ic_ptr);
5258 if (IS_ERR(idata))
5259 return PTR_ERR(idata);
5260 @@ -638,6 +646,14 @@ static int mmc_blk_ioctl_multi_cmd(struct block_device *bdev,
5261 int i, err = 0, ioc_err = 0;
5262 __u64 num_of_cmds;
5263
5264 + /*
5265 + * The caller must have CAP_SYS_RAWIO, and must be calling this on the
5266 + * whole block device, not on a partition. This prevents overspray
5267 + * between sibling partitions.
5268 + */
5269 + if ((!capable(CAP_SYS_RAWIO)) || (bdev != bdev->bd_contains))
5270 + return -EPERM;
5271 +
5272 if (copy_from_user(&num_of_cmds, &user->num_of_cmds,
5273 sizeof(num_of_cmds)))
5274 return -EFAULT;
5275 @@ -693,14 +709,6 @@ cmd_err:
5276 static int mmc_blk_ioctl(struct block_device *bdev, fmode_t mode,
5277 unsigned int cmd, unsigned long arg)
5278 {
5279 - /*
5280 - * The caller must have CAP_SYS_RAWIO, and must be calling this on the
5281 - * whole block device, not on a partition. This prevents overspray
5282 - * between sibling partitions.
5283 - */
5284 - if ((!capable(CAP_SYS_RAWIO)) || (bdev != bdev->bd_contains))
5285 - return -EPERM;
5286 -
5287 switch (cmd) {
5288 case MMC_IOC_CMD:
5289 return mmc_blk_ioctl_cmd(bdev,
5290 diff --git a/drivers/mmc/host/mmc_spi.c b/drivers/mmc/host/mmc_spi.c
5291 index 1c1b45ef3faf..aad3243a48fc 100644
5292 --- a/drivers/mmc/host/mmc_spi.c
5293 +++ b/drivers/mmc/host/mmc_spi.c
5294 @@ -1436,6 +1436,12 @@ static int mmc_spi_probe(struct spi_device *spi)
5295 host->pdata->cd_debounce);
5296 if (status != 0)
5297 goto fail_add_host;
5298 +
5299 + /* The platform has a CD GPIO signal that may support
5300 + * interrupts, so let mmc_gpiod_request_cd_irq() decide
5301 + * if polling is needed or not.
5302 + */
5303 + mmc->caps &= ~MMC_CAP_NEEDS_POLL;
5304 mmc_gpiod_request_cd_irq(mmc);
5305 }
5306
5307 diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
5308 index 8814eb6b83bf..1a802af827ed 100644
5309 --- a/drivers/mmc/host/sdhci.c
5310 +++ b/drivers/mmc/host/sdhci.c
5311 @@ -666,9 +666,20 @@ static u8 sdhci_calc_timeout(struct sdhci_host *host, struct mmc_command *cmd)
5312 if (!data)
5313 target_timeout = cmd->busy_timeout * 1000;
5314 else {
5315 - target_timeout = data->timeout_ns / 1000;
5316 - if (host->clock)
5317 - target_timeout += data->timeout_clks / host->clock;
5318 + target_timeout = DIV_ROUND_UP(data->timeout_ns, 1000);
5319 + if (host->clock && data->timeout_clks) {
5320 + unsigned long long val;
5321 +
5322 + /*
5323 + * data->timeout_clks is in units of clock cycles.
5324 + * host->clock is in Hz. target_timeout is in us.
5325 + * Hence, us = 1000000 * cycles / Hz. Round up.
5326 + */
5327 + val = 1000000 * data->timeout_clks;
5328 + if (do_div(val, host->clock))
5329 + target_timeout++;
5330 + target_timeout += val;
5331 + }
5332 }
5333
5334 /*
5335 @@ -3095,14 +3106,14 @@ int sdhci_add_host(struct sdhci_host *host)
5336 if (caps[0] & SDHCI_TIMEOUT_CLK_UNIT)
5337 host->timeout_clk *= 1000;
5338
5339 + if (override_timeout_clk)
5340 + host->timeout_clk = override_timeout_clk;
5341 +
5342 mmc->max_busy_timeout = host->ops->get_max_timeout_count ?
5343 host->ops->get_max_timeout_count(host) : 1 << 27;
5344 mmc->max_busy_timeout /= host->timeout_clk;
5345 }
5346
5347 - if (override_timeout_clk)
5348 - host->timeout_clk = override_timeout_clk;
5349 -
5350 mmc->caps |= MMC_CAP_SDIO_IRQ | MMC_CAP_ERASE | MMC_CAP_CMD23;
5351 mmc->caps2 |= MMC_CAP2_SDIO_IRQ_NOTHREAD;
5352
5353 diff --git a/drivers/mmc/host/sh_mmcif.c b/drivers/mmc/host/sh_mmcif.c
5354 index ad9ffea7d659..6234eab38ff3 100644
5355 --- a/drivers/mmc/host/sh_mmcif.c
5356 +++ b/drivers/mmc/host/sh_mmcif.c
5357 @@ -397,38 +397,26 @@ static void sh_mmcif_start_dma_tx(struct sh_mmcif_host *host)
5358 }
5359
5360 static struct dma_chan *
5361 -sh_mmcif_request_dma_one(struct sh_mmcif_host *host,
5362 - struct sh_mmcif_plat_data *pdata,
5363 - enum dma_transfer_direction direction)
5364 +sh_mmcif_request_dma_pdata(struct sh_mmcif_host *host, uintptr_t slave_id)
5365 {
5366 - struct dma_slave_config cfg = { 0, };
5367 - struct dma_chan *chan;
5368 - void *slave_data = NULL;
5369 - struct resource *res;
5370 - struct device *dev = sh_mmcif_host_to_dev(host);
5371 dma_cap_mask_t mask;
5372 - int ret;
5373
5374 dma_cap_zero(mask);
5375 dma_cap_set(DMA_SLAVE, mask);
5376 + if (slave_id <= 0)
5377 + return NULL;
5378
5379 - if (pdata)
5380 - slave_data = direction == DMA_MEM_TO_DEV ?
5381 - (void *)pdata->slave_id_tx :
5382 - (void *)pdata->slave_id_rx;
5383 -
5384 - chan = dma_request_slave_channel_compat(mask, shdma_chan_filter,
5385 - slave_data, dev,
5386 - direction == DMA_MEM_TO_DEV ? "tx" : "rx");
5387 -
5388 - dev_dbg(dev, "%s: %s: got channel %p\n", __func__,
5389 - direction == DMA_MEM_TO_DEV ? "TX" : "RX", chan);
5390 + return dma_request_channel(mask, shdma_chan_filter, (void *)slave_id);
5391 +}
5392
5393 - if (!chan)
5394 - return NULL;
5395 +static int sh_mmcif_dma_slave_config(struct sh_mmcif_host *host,
5396 + struct dma_chan *chan,
5397 + enum dma_transfer_direction direction)
5398 +{
5399 + struct resource *res;
5400 + struct dma_slave_config cfg = { 0, };
5401
5402 res = platform_get_resource(host->pd, IORESOURCE_MEM, 0);
5403 -
5404 cfg.direction = direction;
5405
5406 if (direction == DMA_DEV_TO_MEM) {
5407 @@ -439,38 +427,42 @@ sh_mmcif_request_dma_one(struct sh_mmcif_host *host,
5408 cfg.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
5409 }
5410
5411 - ret = dmaengine_slave_config(chan, &cfg);
5412 - if (ret < 0) {
5413 - dma_release_channel(chan);
5414 - return NULL;
5415 - }
5416 -
5417 - return chan;
5418 + return dmaengine_slave_config(chan, &cfg);
5419 }
5420
5421 -static void sh_mmcif_request_dma(struct sh_mmcif_host *host,
5422 - struct sh_mmcif_plat_data *pdata)
5423 +static void sh_mmcif_request_dma(struct sh_mmcif_host *host)
5424 {
5425 struct device *dev = sh_mmcif_host_to_dev(host);
5426 host->dma_active = false;
5427
5428 - if (pdata) {
5429 - if (pdata->slave_id_tx <= 0 || pdata->slave_id_rx <= 0)
5430 - return;
5431 - } else if (!dev->of_node) {
5432 - return;
5433 + /* We can only either use DMA for both Tx and Rx or not use it at all */
5434 + if (IS_ENABLED(CONFIG_SUPERH) && dev->platform_data) {
5435 + struct sh_mmcif_plat_data *pdata = dev->platform_data;
5436 +
5437 + host->chan_tx = sh_mmcif_request_dma_pdata(host,
5438 + pdata->slave_id_tx);
5439 + host->chan_rx = sh_mmcif_request_dma_pdata(host,
5440 + pdata->slave_id_rx);
5441 + } else {
5442 + host->chan_tx = dma_request_slave_channel(dev, "tx");
5443 + host->chan_rx = dma_request_slave_channel(dev, "rx");
5444 }
5445 + dev_dbg(dev, "%s: got channel TX %p RX %p\n", __func__, host->chan_tx,
5446 + host->chan_rx);
5447
5448 - /* We can only either use DMA for both Tx and Rx or not use it at all */
5449 - host->chan_tx = sh_mmcif_request_dma_one(host, pdata, DMA_MEM_TO_DEV);
5450 - if (!host->chan_tx)
5451 - return;
5452 + if (!host->chan_tx || !host->chan_rx ||
5453 + sh_mmcif_dma_slave_config(host, host->chan_tx, DMA_MEM_TO_DEV) ||
5454 + sh_mmcif_dma_slave_config(host, host->chan_rx, DMA_DEV_TO_MEM))
5455 + goto error;
5456
5457 - host->chan_rx = sh_mmcif_request_dma_one(host, pdata, DMA_DEV_TO_MEM);
5458 - if (!host->chan_rx) {
5459 + return;
5460 +
5461 +error:
5462 + if (host->chan_tx)
5463 dma_release_channel(host->chan_tx);
5464 - host->chan_tx = NULL;
5465 - }
5466 + if (host->chan_rx)
5467 + dma_release_channel(host->chan_rx);
5468 + host->chan_tx = host->chan_rx = NULL;
5469 }
5470
5471 static void sh_mmcif_release_dma(struct sh_mmcif_host *host)
5472 @@ -1102,7 +1094,7 @@ static void sh_mmcif_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
5473 if (ios->power_mode == MMC_POWER_UP) {
5474 if (!host->card_present) {
5475 /* See if we also get DMA */
5476 - sh_mmcif_request_dma(host, dev->platform_data);
5477 + sh_mmcif_request_dma(host);
5478 host->card_present = true;
5479 }
5480 sh_mmcif_set_power(host, ios);
5481 diff --git a/drivers/mtd/onenand/onenand_base.c b/drivers/mtd/onenand/onenand_base.c
5482 index 43b3392ffee7..652d01832873 100644
5483 --- a/drivers/mtd/onenand/onenand_base.c
5484 +++ b/drivers/mtd/onenand/onenand_base.c
5485 @@ -2599,6 +2599,7 @@ static int onenand_default_block_markbad(struct mtd_info *mtd, loff_t ofs)
5486 */
5487 static int onenand_block_markbad(struct mtd_info *mtd, loff_t ofs)
5488 {
5489 + struct onenand_chip *this = mtd->priv;
5490 int ret;
5491
5492 ret = onenand_block_isbad(mtd, ofs);
5493 @@ -2610,7 +2611,7 @@ static int onenand_block_markbad(struct mtd_info *mtd, loff_t ofs)
5494 }
5495
5496 onenand_get_device(mtd, FL_WRITING);
5497 - ret = mtd_block_markbad(mtd, ofs);
5498 + ret = this->block_markbad(mtd, ofs);
5499 onenand_release_device(mtd);
5500 return ret;
5501 }
5502 diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
5503 index ed622fa29dfa..a4ac6fedac75 100644
5504 --- a/drivers/net/ethernet/marvell/mvneta.c
5505 +++ b/drivers/net/ethernet/marvell/mvneta.c
5506 @@ -3404,7 +3404,7 @@ static int mvneta_probe(struct platform_device *pdev)
5507 dev->features = NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_TSO;
5508 dev->hw_features |= dev->features;
5509 dev->vlan_features |= dev->features;
5510 - dev->priv_flags |= IFF_UNICAST_FLT;
5511 + dev->priv_flags |= IFF_UNICAST_FLT | IFF_LIVE_ADDR_CHANGE;
5512 dev->gso_max_segs = MVNETA_MAX_TSO_SEGS;
5513
5514 err = register_netdev(dev);
5515 diff --git a/drivers/net/irda/irtty-sir.c b/drivers/net/irda/irtty-sir.c
5516 index 696852eb23c3..7a3f990c1935 100644
5517 --- a/drivers/net/irda/irtty-sir.c
5518 +++ b/drivers/net/irda/irtty-sir.c
5519 @@ -430,16 +430,6 @@ static int irtty_open(struct tty_struct *tty)
5520
5521 /* Module stuff handled via irda_ldisc.owner - Jean II */
5522
5523 - /* First make sure we're not already connected. */
5524 - if (tty->disc_data != NULL) {
5525 - priv = tty->disc_data;
5526 - if (priv && priv->magic == IRTTY_MAGIC) {
5527 - ret = -EEXIST;
5528 - goto out;
5529 - }
5530 - tty->disc_data = NULL; /* ### */
5531 - }
5532 -
5533 /* stop the underlying driver */
5534 irtty_stop_receiver(tty, TRUE);
5535 if (tty->ops->stop)
5536 diff --git a/drivers/net/rionet.c b/drivers/net/rionet.c
5537 index 01f08a7751f7..e7034c55e796 100644
5538 --- a/drivers/net/rionet.c
5539 +++ b/drivers/net/rionet.c
5540 @@ -280,7 +280,7 @@ static void rionet_outb_msg_event(struct rio_mport *mport, void *dev_id, int mbo
5541 struct net_device *ndev = dev_id;
5542 struct rionet_private *rnet = netdev_priv(ndev);
5543
5544 - spin_lock(&rnet->lock);
5545 + spin_lock(&rnet->tx_lock);
5546
5547 if (netif_msg_intr(rnet))
5548 printk(KERN_INFO
5549 @@ -299,7 +299,7 @@ static void rionet_outb_msg_event(struct rio_mport *mport, void *dev_id, int mbo
5550 if (rnet->tx_cnt < RIONET_TX_RING_SIZE)
5551 netif_wake_queue(ndev);
5552
5553 - spin_unlock(&rnet->lock);
5554 + spin_unlock(&rnet->tx_lock);
5555 }
5556
5557 static int rionet_open(struct net_device *ndev)
5558 diff --git a/drivers/net/wireless/iwlwifi/mvm/fw.c b/drivers/net/wireless/iwlwifi/mvm/fw.c
5559 index d906fa13ba97..610c442c7ab2 100644
5560 --- a/drivers/net/wireless/iwlwifi/mvm/fw.c
5561 +++ b/drivers/net/wireless/iwlwifi/mvm/fw.c
5562 @@ -106,7 +106,7 @@ static int iwl_send_tx_ant_cfg(struct iwl_mvm *mvm, u8 valid_tx_ant)
5563 sizeof(tx_ant_cmd), &tx_ant_cmd);
5564 }
5565
5566 -static void iwl_free_fw_paging(struct iwl_mvm *mvm)
5567 +void iwl_free_fw_paging(struct iwl_mvm *mvm)
5568 {
5569 int i;
5570
5571 @@ -126,6 +126,8 @@ static void iwl_free_fw_paging(struct iwl_mvm *mvm)
5572 get_order(mvm->fw_paging_db[i].fw_paging_size));
5573 }
5574 kfree(mvm->trans->paging_download_buf);
5575 + mvm->trans->paging_download_buf = NULL;
5576 +
5577 memset(mvm->fw_paging_db, 0, sizeof(mvm->fw_paging_db));
5578 }
5579
5580 diff --git a/drivers/net/wireless/iwlwifi/mvm/mvm.h b/drivers/net/wireless/iwlwifi/mvm/mvm.h
5581 index 4bde2d027dcd..244e26c26821 100644
5582 --- a/drivers/net/wireless/iwlwifi/mvm/mvm.h
5583 +++ b/drivers/net/wireless/iwlwifi/mvm/mvm.h
5584 @@ -1190,6 +1190,9 @@ void iwl_mvm_rx_umac_scan_complete_notif(struct iwl_mvm *mvm,
5585 void iwl_mvm_rx_umac_scan_iter_complete_notif(struct iwl_mvm *mvm,
5586 struct iwl_rx_cmd_buffer *rxb);
5587
5588 +/* Paging */
5589 +void iwl_free_fw_paging(struct iwl_mvm *mvm);
5590 +
5591 /* MVM debugfs */
5592 #ifdef CONFIG_IWLWIFI_DEBUGFS
5593 int iwl_mvm_dbgfs_register(struct iwl_mvm *mvm, struct dentry *dbgfs_dir);
5594 diff --git a/drivers/net/wireless/iwlwifi/mvm/ops.c b/drivers/net/wireless/iwlwifi/mvm/ops.c
5595 index 13c97f665ba8..c3adf2bcdc85 100644
5596 --- a/drivers/net/wireless/iwlwifi/mvm/ops.c
5597 +++ b/drivers/net/wireless/iwlwifi/mvm/ops.c
5598 @@ -645,6 +645,8 @@ static void iwl_op_mode_mvm_stop(struct iwl_op_mode *op_mode)
5599 for (i = 0; i < NVM_MAX_NUM_SECTIONS; i++)
5600 kfree(mvm->nvm_sections[i].data);
5601
5602 + iwl_free_fw_paging(mvm);
5603 +
5604 iwl_mvm_tof_clean(mvm);
5605
5606 ieee80211_free_hw(mvm->hw);
5607 diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
5608 index 7e2c43f701bc..496b9b662dc6 100644
5609 --- a/drivers/nvdimm/bus.c
5610 +++ b/drivers/nvdimm/bus.c
5611 @@ -513,10 +513,10 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
5612
5613 /* fail write commands (when read-only) */
5614 if (read_only)
5615 - switch (ioctl_cmd) {
5616 - case ND_IOCTL_VENDOR:
5617 - case ND_IOCTL_SET_CONFIG_DATA:
5618 - case ND_IOCTL_ARS_START:
5619 + switch (cmd) {
5620 + case ND_CMD_VENDOR:
5621 + case ND_CMD_SET_CONFIG_DATA:
5622 + case ND_CMD_ARS_START:
5623 dev_dbg(&nvdimm_bus->dev, "'%s' command while read-only.\n",
5624 nvdimm ? nvdimm_cmd_name(cmd)
5625 : nvdimm_bus_cmd_name(cmd));
5626 diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c
5627 index 1a3556a9e9ea..ed01c0172e4a 100644
5628 --- a/drivers/of/of_reserved_mem.c
5629 +++ b/drivers/of/of_reserved_mem.c
5630 @@ -32,11 +32,13 @@ int __init __weak early_init_dt_alloc_reserved_memory_arch(phys_addr_t size,
5631 phys_addr_t align, phys_addr_t start, phys_addr_t end, bool nomap,
5632 phys_addr_t *res_base)
5633 {
5634 + phys_addr_t base;
5635 /*
5636 * We use __memblock_alloc_base() because memblock_alloc_base()
5637 * panic()s on allocation failure.
5638 */
5639 - phys_addr_t base = __memblock_alloc_base(size, align, end);
5640 + end = !end ? MEMBLOCK_ALLOC_ANYWHERE : end;
5641 + base = __memblock_alloc_base(size, align, end);
5642 if (!base)
5643 return -ENOMEM;
5644
5645 diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
5646 index edb1984201e9..7aafb5fb9336 100644
5647 --- a/drivers/pci/probe.c
5648 +++ b/drivers/pci/probe.c
5649 @@ -179,6 +179,9 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
5650 u16 orig_cmd;
5651 struct pci_bus_region region, inverted_region;
5652
5653 + if (dev->non_compliant_bars)
5654 + return 0;
5655 +
5656 mask = type ? PCI_ROM_ADDRESS_MASK : ~0;
5657
5658 /* No printks while decoding is disabled! */
5659 @@ -1174,6 +1177,7 @@ void pci_msi_setup_pci_dev(struct pci_dev *dev)
5660 int pci_setup_device(struct pci_dev *dev)
5661 {
5662 u32 class;
5663 + u16 cmd;
5664 u8 hdr_type;
5665 int pos = 0;
5666 struct pci_bus_region region;
5667 @@ -1219,6 +1223,16 @@ int pci_setup_device(struct pci_dev *dev)
5668 /* device class may be changed after fixup */
5669 class = dev->class >> 8;
5670
5671 + if (dev->non_compliant_bars) {
5672 + pci_read_config_word(dev, PCI_COMMAND, &cmd);
5673 + if (cmd & (PCI_COMMAND_IO | PCI_COMMAND_MEMORY)) {
5674 + dev_info(&dev->dev, "device has non-compliant BARs; disabling IO/MEM decoding\n");
5675 + cmd &= ~PCI_COMMAND_IO;
5676 + cmd &= ~PCI_COMMAND_MEMORY;
5677 + pci_write_config_word(dev, PCI_COMMAND, cmd);
5678 + }
5679 + }
5680 +
5681 switch (dev->hdr_type) { /* header type */
5682 case PCI_HEADER_TYPE_NORMAL: /* standard header */
5683 if (class == PCI_CLASS_BRIDGE_PCI)
5684 diff --git a/drivers/pinctrl/bcm/pinctrl-bcm2835.c b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
5685 index 2e6ca69635aa..17dd8fe12b54 100644
5686 --- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c
5687 +++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
5688 @@ -779,7 +779,7 @@ static int bcm2835_pctl_dt_node_to_map(struct pinctrl_dev *pctldev,
5689 }
5690 if (num_pulls) {
5691 err = of_property_read_u32_index(np, "brcm,pull",
5692 - (num_funcs > 1) ? i : 0, &pull);
5693 + (num_pulls > 1) ? i : 0, &pull);
5694 if (err)
5695 goto out;
5696 err = bcm2835_pctl_dt_node_to_map_pull(pc, np, pin,
5697 diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c
5698 index d78ee151c9e4..be3bc2f4edd4 100644
5699 --- a/drivers/platform/x86/ideapad-laptop.c
5700 +++ b/drivers/platform/x86/ideapad-laptop.c
5701 @@ -865,6 +865,20 @@ static const struct dmi_system_id no_hw_rfkill_list[] = {
5702 },
5703 },
5704 {
5705 + .ident = "Lenovo ideapad Y700-15ISK",
5706 + .matches = {
5707 + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
5708 + DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo ideapad Y700-15ISK"),
5709 + },
5710 + },
5711 + {
5712 + .ident = "Lenovo ideapad Y700 Touch-15ISK",
5713 + .matches = {
5714 + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
5715 + DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo ideapad Y700 Touch-15ISK"),
5716 + },
5717 + },
5718 + {
5719 .ident = "Lenovo ideapad Y700-17ISK",
5720 .matches = {
5721 DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
5722 diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
5723 index 73b7683355cd..7b94b8ee087c 100644
5724 --- a/drivers/regulator/core.c
5725 +++ b/drivers/regulator/core.c
5726 @@ -132,24 +132,24 @@ static bool have_full_constraints(void)
5727 return has_full_constraints || of_have_populated_dt();
5728 }
5729
5730 +static inline struct regulator_dev *rdev_get_supply(struct regulator_dev *rdev)
5731 +{
5732 + if (rdev && rdev->supply)
5733 + return rdev->supply->rdev;
5734 +
5735 + return NULL;
5736 +}
5737 +
5738 /**
5739 * regulator_lock_supply - lock a regulator and its supplies
5740 * @rdev: regulator source
5741 */
5742 static void regulator_lock_supply(struct regulator_dev *rdev)
5743 {
5744 - struct regulator *supply;
5745 - int i = 0;
5746 -
5747 - while (1) {
5748 - mutex_lock_nested(&rdev->mutex, i++);
5749 - supply = rdev->supply;
5750 -
5751 - if (!rdev->supply)
5752 - return;
5753 + int i;
5754
5755 - rdev = supply->rdev;
5756 - }
5757 + for (i = 0; rdev->supply; rdev = rdev_get_supply(rdev), i++)
5758 + mutex_lock_nested(&rdev->mutex, i);
5759 }
5760
5761 /**
5762 diff --git a/drivers/scsi/aacraid/aacraid.h b/drivers/scsi/aacraid/aacraid.h
5763 index 074878b55a0b..d044f3f273be 100644
5764 --- a/drivers/scsi/aacraid/aacraid.h
5765 +++ b/drivers/scsi/aacraid/aacraid.h
5766 @@ -944,6 +944,7 @@ struct fib {
5767 */
5768 struct list_head fiblink;
5769 void *data;
5770 + u32 vector_no;
5771 struct hw_fib *hw_fib_va; /* Actual shared object */
5772 dma_addr_t hw_fib_pa; /* physical address of hw_fib*/
5773 };
5774 @@ -2113,6 +2114,7 @@ static inline unsigned int cap_to_cyls(sector_t capacity, unsigned divisor)
5775 int aac_acquire_irq(struct aac_dev *dev);
5776 void aac_free_irq(struct aac_dev *dev);
5777 const char *aac_driverinfo(struct Scsi_Host *);
5778 +void aac_fib_vector_assign(struct aac_dev *dev);
5779 struct fib *aac_fib_alloc(struct aac_dev *dev);
5780 int aac_fib_setup(struct aac_dev *dev);
5781 void aac_fib_map_free(struct aac_dev *dev);
5782 diff --git a/drivers/scsi/aacraid/commsup.c b/drivers/scsi/aacraid/commsup.c
5783 index a1f90fe849c9..4cbf54928640 100644
5784 --- a/drivers/scsi/aacraid/commsup.c
5785 +++ b/drivers/scsi/aacraid/commsup.c
5786 @@ -83,13 +83,38 @@ static int fib_map_alloc(struct aac_dev *dev)
5787
5788 void aac_fib_map_free(struct aac_dev *dev)
5789 {
5790 - pci_free_consistent(dev->pdev,
5791 - dev->max_fib_size * (dev->scsi_host_ptr->can_queue + AAC_NUM_MGT_FIB),
5792 - dev->hw_fib_va, dev->hw_fib_pa);
5793 + if (dev->hw_fib_va && dev->max_fib_size) {
5794 + pci_free_consistent(dev->pdev,
5795 + (dev->max_fib_size *
5796 + (dev->scsi_host_ptr->can_queue + AAC_NUM_MGT_FIB)),
5797 + dev->hw_fib_va, dev->hw_fib_pa);
5798 + }
5799 dev->hw_fib_va = NULL;
5800 dev->hw_fib_pa = 0;
5801 }
5802
5803 +void aac_fib_vector_assign(struct aac_dev *dev)
5804 +{
5805 + u32 i = 0;
5806 + u32 vector = 1;
5807 + struct fib *fibptr = NULL;
5808 +
5809 + for (i = 0, fibptr = &dev->fibs[i];
5810 + i < (dev->scsi_host_ptr->can_queue + AAC_NUM_MGT_FIB);
5811 + i++, fibptr++) {
5812 + if ((dev->max_msix == 1) ||
5813 + (i > ((dev->scsi_host_ptr->can_queue + AAC_NUM_MGT_FIB - 1)
5814 + - dev->vector_cap))) {
5815 + fibptr->vector_no = 0;
5816 + } else {
5817 + fibptr->vector_no = vector;
5818 + vector++;
5819 + if (vector == dev->max_msix)
5820 + vector = 1;
5821 + }
5822 + }
5823 +}
5824 +
5825 /**
5826 * aac_fib_setup - setup the fibs
5827 * @dev: Adapter to set up
5828 @@ -151,6 +176,12 @@ int aac_fib_setup(struct aac_dev * dev)
5829 hw_fib_pa = hw_fib_pa +
5830 dev->max_fib_size + sizeof(struct aac_fib_xporthdr);
5831 }
5832 +
5833 + /*
5834 + *Assign vector numbers to fibs
5835 + */
5836 + aac_fib_vector_assign(dev);
5837 +
5838 /*
5839 * Add the fib chain to the free list
5840 */
5841 diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
5842 index 3b6e5c67e853..aa6eccb8940b 100644
5843 --- a/drivers/scsi/aacraid/linit.c
5844 +++ b/drivers/scsi/aacraid/linit.c
5845 @@ -1404,8 +1404,18 @@ static int aac_acquire_resources(struct aac_dev *dev)
5846
5847 aac_adapter_enable_int(dev);
5848
5849 - if (!dev->sync_mode)
5850 + /*max msix may change after EEH
5851 + * Re-assign vectors to fibs
5852 + */
5853 + aac_fib_vector_assign(dev);
5854 +
5855 + if (!dev->sync_mode) {
5856 + /* After EEH recovery or suspend resume, max_msix count
5857 + * may change, therfore updating in init as well.
5858 + */
5859 aac_adapter_start(dev);
5860 + dev->init->Sa_MSIXVectors = cpu_to_le32(dev->max_msix);
5861 + }
5862 return 0;
5863
5864 error_iounmap:
5865 diff --git a/drivers/scsi/aacraid/src.c b/drivers/scsi/aacraid/src.c
5866 index 2aa34ea8ceb1..bc0203f3d243 100644
5867 --- a/drivers/scsi/aacraid/src.c
5868 +++ b/drivers/scsi/aacraid/src.c
5869 @@ -156,8 +156,8 @@ static irqreturn_t aac_src_intr_message(int irq, void *dev_id)
5870 break;
5871 if (dev->msi_enabled && dev->max_msix > 1)
5872 atomic_dec(&dev->rrq_outstanding[vector_no]);
5873 - aac_intr_normal(dev, handle-1, 0, isFastResponse, NULL);
5874 dev->host_rrq[index++] = 0;
5875 + aac_intr_normal(dev, handle-1, 0, isFastResponse, NULL);
5876 if (index == (vector_no + 1) * dev->vector_cap)
5877 index = vector_no * dev->vector_cap;
5878 dev->host_rrq_idx[vector_no] = index;
5879 @@ -452,36 +452,20 @@ static int aac_src_deliver_message(struct fib *fib)
5880 #endif
5881
5882 u16 hdr_size = le16_to_cpu(fib->hw_fib_va->header.Size);
5883 + u16 vector_no;
5884
5885 atomic_inc(&q->numpending);
5886
5887 if (dev->msi_enabled && fib->hw_fib_va->header.Command != AifRequest &&
5888 dev->max_msix > 1) {
5889 - u_int16_t vector_no, first_choice = 0xffff;
5890 -
5891 - vector_no = dev->fibs_pushed_no % dev->max_msix;
5892 - do {
5893 - vector_no += 1;
5894 - if (vector_no == dev->max_msix)
5895 - vector_no = 1;
5896 - if (atomic_read(&dev->rrq_outstanding[vector_no]) <
5897 - dev->vector_cap)
5898 - break;
5899 - if (0xffff == first_choice)
5900 - first_choice = vector_no;
5901 - else if (vector_no == first_choice)
5902 - break;
5903 - } while (1);
5904 - if (vector_no == first_choice)
5905 - vector_no = 0;
5906 - atomic_inc(&dev->rrq_outstanding[vector_no]);
5907 - if (dev->fibs_pushed_no == 0xffffffff)
5908 - dev->fibs_pushed_no = 0;
5909 - else
5910 - dev->fibs_pushed_no++;
5911 + vector_no = fib->vector_no;
5912 fib->hw_fib_va->header.Handle += (vector_no << 16);
5913 + } else {
5914 + vector_no = 0;
5915 }
5916
5917 + atomic_inc(&dev->rrq_outstanding[vector_no]);
5918 +
5919 if (dev->comm_interface == AAC_COMM_MESSAGE_TYPE2) {
5920 /* Calculate the amount to the fibsize bits */
5921 fibsize = (hdr_size + 127) / 128 - 1;
5922 diff --git a/drivers/scsi/aic7xxx/aic7xxx_osm.c b/drivers/scsi/aic7xxx/aic7xxx_osm.c
5923 index b846a4683562..fc6a83188c1e 100644
5924 --- a/drivers/scsi/aic7xxx/aic7xxx_osm.c
5925 +++ b/drivers/scsi/aic7xxx/aic7xxx_osm.c
5926 @@ -1336,6 +1336,7 @@ ahc_platform_set_tags(struct ahc_softc *ahc, struct scsi_device *sdev,
5927 case AHC_DEV_Q_TAGGED:
5928 scsi_change_queue_depth(sdev,
5929 dev->openings + dev->active);
5930 + break;
5931 default:
5932 /*
5933 * We allow the OS to queue 2 untagged transactions to
5934 diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
5935 index fe0c5143f8e6..758f76e88704 100644
5936 --- a/drivers/scsi/be2iscsi/be_main.c
5937 +++ b/drivers/scsi/be2iscsi/be_main.c
5938 @@ -4470,6 +4470,7 @@ put_shost:
5939 scsi_host_put(phba->shost);
5940 free_kset:
5941 iscsi_boot_destroy_kset(phba->boot_kset);
5942 + phba->boot_kset = NULL;
5943 return -ENOMEM;
5944 }
5945
5946 diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
5947 index 536cd5a80422..43ac62623bf2 100644
5948 --- a/drivers/scsi/ipr.c
5949 +++ b/drivers/scsi/ipr.c
5950 @@ -4003,13 +4003,17 @@ static ssize_t ipr_store_update_fw(struct device *dev,
5951 struct ipr_sglist *sglist;
5952 char fname[100];
5953 char *src;
5954 - int len, result, dnld_size;
5955 + char *endline;
5956 + int result, dnld_size;
5957
5958 if (!capable(CAP_SYS_ADMIN))
5959 return -EACCES;
5960
5961 - len = snprintf(fname, 99, "%s", buf);
5962 - fname[len-1] = '\0';
5963 + snprintf(fname, sizeof(fname), "%s", buf);
5964 +
5965 + endline = strchr(fname, '\n');
5966 + if (endline)
5967 + *endline = '\0';
5968
5969 if (request_firmware(&fw_entry, fname, &ioa_cfg->pdev->dev)) {
5970 dev_err(&ioa_cfg->pdev->dev, "Firmware file %s not found\n", fname);
5971 diff --git a/drivers/scsi/scsi_common.c b/drivers/scsi/scsi_common.c
5972 index c126966130ab..ce79de822e46 100644
5973 --- a/drivers/scsi/scsi_common.c
5974 +++ b/drivers/scsi/scsi_common.c
5975 @@ -278,8 +278,16 @@ int scsi_set_sense_information(u8 *buf, int buf_len, u64 info)
5976 ucp[3] = 0;
5977 put_unaligned_be64(info, &ucp[4]);
5978 } else if ((buf[0] & 0x7f) == 0x70) {
5979 - buf[0] |= 0x80;
5980 - put_unaligned_be64(info, &buf[3]);
5981 + /*
5982 + * Only set the 'VALID' bit if we can represent the value
5983 + * correctly; otherwise just fill out the lower bytes and
5984 + * clear the 'VALID' flag.
5985 + */
5986 + if (info <= 0xffffffffUL)
5987 + buf[0] |= 0x80;
5988 + else
5989 + buf[0] &= 0x7f;
5990 + put_unaligned_be32((u32)info, &buf[3]);
5991 }
5992
5993 return 0;
5994 diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
5995 index bb669d32ccd0..cc84ea7d09cc 100644
5996 --- a/drivers/scsi/sd.c
5997 +++ b/drivers/scsi/sd.c
5998 @@ -648,7 +648,7 @@ static void sd_config_discard(struct scsi_disk *sdkp, unsigned int mode)
5999 */
6000 if (sdkp->lbprz) {
6001 q->limits.discard_alignment = 0;
6002 - q->limits.discard_granularity = 1;
6003 + q->limits.discard_granularity = logical_block_size;
6004 } else {
6005 q->limits.discard_alignment = sdkp->unmap_alignment *
6006 logical_block_size;
6007 diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
6008 index 5e820674432c..ae7d9bdf409c 100644
6009 --- a/drivers/scsi/sg.c
6010 +++ b/drivers/scsi/sg.c
6011 @@ -652,7 +652,8 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos)
6012 else
6013 hp->dxfer_direction = (mxsize > 0) ? SG_DXFER_FROM_DEV : SG_DXFER_NONE;
6014 hp->dxfer_len = mxsize;
6015 - if (hp->dxfer_direction == SG_DXFER_TO_DEV)
6016 + if ((hp->dxfer_direction == SG_DXFER_TO_DEV) ||
6017 + (hp->dxfer_direction == SG_DXFER_TO_FROM_DEV))
6018 hp->dxferp = (char __user *)buf + cmd_size;
6019 else
6020 hp->dxferp = NULL;
6021 diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
6022 index 3fba42ad9fb8..0f636cc4c809 100644
6023 --- a/drivers/scsi/storvsc_drv.c
6024 +++ b/drivers/scsi/storvsc_drv.c
6025 @@ -889,8 +889,9 @@ static void storvsc_handle_error(struct vmscsi_request *vm_srb,
6026 do_work = true;
6027 process_err_fn = storvsc_remove_lun;
6028 break;
6029 - case (SRB_STATUS_ABORTED | SRB_STATUS_AUTOSENSE_VALID):
6030 - if ((asc == 0x2a) && (ascq == 0x9)) {
6031 + case SRB_STATUS_ABORTED:
6032 + if (vm_srb->srb_status & SRB_STATUS_AUTOSENSE_VALID &&
6033 + (asc == 0x2a) && (ascq == 0x9)) {
6034 do_work = true;
6035 process_err_fn = storvsc_device_scan;
6036 /*
6037 diff --git a/drivers/staging/android/ion/ion_test.c b/drivers/staging/android/ion/ion_test.c
6038 index b8dcf5a26cc4..58d46893e5ff 100644
6039 --- a/drivers/staging/android/ion/ion_test.c
6040 +++ b/drivers/staging/android/ion/ion_test.c
6041 @@ -285,8 +285,8 @@ static int __init ion_test_init(void)
6042 {
6043 ion_test_pdev = platform_device_register_simple("ion-test",
6044 -1, NULL, 0);
6045 - if (!ion_test_pdev)
6046 - return -ENODEV;
6047 + if (IS_ERR(ion_test_pdev))
6048 + return PTR_ERR(ion_test_pdev);
6049
6050 return platform_driver_probe(&ion_test_platform_driver, ion_test_probe);
6051 }
6052 diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c
6053 index 6cc304a4c59b..27fbf1a81097 100644
6054 --- a/drivers/staging/comedi/drivers/ni_mio_common.c
6055 +++ b/drivers/staging/comedi/drivers/ni_mio_common.c
6056 @@ -246,24 +246,24 @@ static void ni_writel(struct comedi_device *dev, uint32_t data, int reg)
6057 {
6058 if (dev->mmio)
6059 writel(data, dev->mmio + reg);
6060 -
6061 - outl(data, dev->iobase + reg);
6062 + else
6063 + outl(data, dev->iobase + reg);
6064 }
6065
6066 static void ni_writew(struct comedi_device *dev, uint16_t data, int reg)
6067 {
6068 if (dev->mmio)
6069 writew(data, dev->mmio + reg);
6070 -
6071 - outw(data, dev->iobase + reg);
6072 + else
6073 + outw(data, dev->iobase + reg);
6074 }
6075
6076 static void ni_writeb(struct comedi_device *dev, uint8_t data, int reg)
6077 {
6078 if (dev->mmio)
6079 writeb(data, dev->mmio + reg);
6080 -
6081 - outb(data, dev->iobase + reg);
6082 + else
6083 + outb(data, dev->iobase + reg);
6084 }
6085
6086 static uint32_t ni_readl(struct comedi_device *dev, int reg)
6087 diff --git a/drivers/staging/comedi/drivers/ni_tiocmd.c b/drivers/staging/comedi/drivers/ni_tiocmd.c
6088 index 437f723bb34d..823e47910004 100644
6089 --- a/drivers/staging/comedi/drivers/ni_tiocmd.c
6090 +++ b/drivers/staging/comedi/drivers/ni_tiocmd.c
6091 @@ -92,7 +92,7 @@ static int ni_tio_input_inttrig(struct comedi_device *dev,
6092 unsigned long flags;
6093 int ret = 0;
6094
6095 - if (trig_num != cmd->start_src)
6096 + if (trig_num != cmd->start_arg)
6097 return -EINVAL;
6098
6099 spin_lock_irqsave(&counter->lock, flags);
6100 diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
6101 index 94f4ffac723f..d151bc3d6971 100644
6102 --- a/drivers/target/target_core_transport.c
6103 +++ b/drivers/target/target_core_transport.c
6104 @@ -2618,8 +2618,6 @@ void target_wait_for_sess_cmds(struct se_session *se_sess)
6105
6106 list_for_each_entry_safe(se_cmd, tmp_cmd,
6107 &se_sess->sess_wait_list, se_cmd_list) {
6108 - list_del_init(&se_cmd->se_cmd_list);
6109 -
6110 pr_debug("Waiting for se_cmd: %p t_state: %d, fabric state:"
6111 " %d\n", se_cmd, se_cmd->t_state,
6112 se_cmd->se_tfo->get_cmd_state(se_cmd));
6113 diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
6114 index ba08b5521382..3d5f8f432b5b 100644
6115 --- a/drivers/thermal/thermal_core.c
6116 +++ b/drivers/thermal/thermal_core.c
6117 @@ -454,6 +454,10 @@ static void handle_thermal_trip(struct thermal_zone_device *tz, int trip)
6118 {
6119 enum thermal_trip_type type;
6120
6121 + /* Ignore disabled trip points */
6122 + if (test_bit(trip, &tz->trips_disabled))
6123 + return;
6124 +
6125 tz->ops->get_trip_type(tz, trip, &type);
6126
6127 if (type == THERMAL_TRIP_CRITICAL || type == THERMAL_TRIP_HOT)
6128 @@ -1796,6 +1800,7 @@ struct thermal_zone_device *thermal_zone_device_register(const char *type,
6129 {
6130 struct thermal_zone_device *tz;
6131 enum thermal_trip_type trip_type;
6132 + int trip_temp;
6133 int result;
6134 int count;
6135 int passive = 0;
6136 @@ -1867,9 +1872,15 @@ struct thermal_zone_device *thermal_zone_device_register(const char *type,
6137 goto unregister;
6138
6139 for (count = 0; count < trips; count++) {
6140 - tz->ops->get_trip_type(tz, count, &trip_type);
6141 + if (tz->ops->get_trip_type(tz, count, &trip_type))
6142 + set_bit(count, &tz->trips_disabled);
6143 if (trip_type == THERMAL_TRIP_PASSIVE)
6144 passive = 1;
6145 + if (tz->ops->get_trip_temp(tz, count, &trip_temp))
6146 + set_bit(count, &tz->trips_disabled);
6147 + /* Check for bogus trip points */
6148 + if (trip_temp == 0)
6149 + set_bit(count, &tz->trips_disabled);
6150 }
6151
6152 if (!passive) {
6153 diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
6154 index 52d82d2ac726..56ccbcefdd85 100644
6155 --- a/drivers/tty/serial/8250/8250_port.c
6156 +++ b/drivers/tty/serial/8250/8250_port.c
6157 @@ -713,22 +713,16 @@ static int size_fifo(struct uart_8250_port *up)
6158 */
6159 static unsigned int autoconfig_read_divisor_id(struct uart_8250_port *p)
6160 {
6161 - unsigned char old_dll, old_dlm, old_lcr;
6162 - unsigned int id;
6163 + unsigned char old_lcr;
6164 + unsigned int id, old_dl;
6165
6166 old_lcr = serial_in(p, UART_LCR);
6167 serial_out(p, UART_LCR, UART_LCR_CONF_MODE_A);
6168 + old_dl = serial_dl_read(p);
6169 + serial_dl_write(p, 0);
6170 + id = serial_dl_read(p);
6171 + serial_dl_write(p, old_dl);
6172
6173 - old_dll = serial_in(p, UART_DLL);
6174 - old_dlm = serial_in(p, UART_DLM);
6175 -
6176 - serial_out(p, UART_DLL, 0);
6177 - serial_out(p, UART_DLM, 0);
6178 -
6179 - id = serial_in(p, UART_DLL) | serial_in(p, UART_DLM) << 8;
6180 -
6181 - serial_out(p, UART_DLL, old_dll);
6182 - serial_out(p, UART_DLM, old_dlm);
6183 serial_out(p, UART_LCR, old_lcr);
6184
6185 return id;
6186 diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
6187 index fa4e23930614..d37fdcc3143c 100644
6188 --- a/drivers/usb/class/cdc-acm.c
6189 +++ b/drivers/usb/class/cdc-acm.c
6190 @@ -1114,6 +1114,9 @@ static int acm_probe(struct usb_interface *intf,
6191 if (quirks == NO_UNION_NORMAL) {
6192 data_interface = usb_ifnum_to_if(usb_dev, 1);
6193 control_interface = usb_ifnum_to_if(usb_dev, 0);
6194 + /* we would crash */
6195 + if (!data_interface || !control_interface)
6196 + return -ENODEV;
6197 goto skip_normal_probe;
6198 }
6199
6200 diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
6201 index 56593a9a8726..2057d91d8336 100644
6202 --- a/drivers/usb/core/driver.c
6203 +++ b/drivers/usb/core/driver.c
6204 @@ -502,11 +502,15 @@ static int usb_unbind_interface(struct device *dev)
6205 int usb_driver_claim_interface(struct usb_driver *driver,
6206 struct usb_interface *iface, void *priv)
6207 {
6208 - struct device *dev = &iface->dev;
6209 + struct device *dev;
6210 struct usb_device *udev;
6211 int retval = 0;
6212 int lpm_disable_error;
6213
6214 + if (!iface)
6215 + return -ENODEV;
6216 +
6217 + dev = &iface->dev;
6218 if (dev->driver)
6219 return -EBUSY;
6220
6221 diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
6222 index 1560f3f3e756..2a274884c7ea 100644
6223 --- a/drivers/usb/core/hub.c
6224 +++ b/drivers/usb/core/hub.c
6225 @@ -4277,7 +4277,7 @@ hub_port_init(struct usb_hub *hub, struct usb_device *udev, int port1,
6226 {
6227 struct usb_device *hdev = hub->hdev;
6228 struct usb_hcd *hcd = bus_to_hcd(hdev->bus);
6229 - int i, j, retval;
6230 + int retries, operations, retval, i;
6231 unsigned delay = HUB_SHORT_RESET_TIME;
6232 enum usb_device_speed oldspeed = udev->speed;
6233 const char *speed;
6234 @@ -4379,7 +4379,7 @@ hub_port_init(struct usb_hub *hub, struct usb_device *udev, int port1,
6235 * first 8 bytes of the device descriptor to get the ep0 maxpacket
6236 * value.
6237 */
6238 - for (i = 0; i < GET_DESCRIPTOR_TRIES; (++i, msleep(100))) {
6239 + for (retries = 0; retries < GET_DESCRIPTOR_TRIES; (++retries, msleep(100))) {
6240 bool did_new_scheme = false;
6241
6242 if (use_new_scheme(udev, retry_counter)) {
6243 @@ -4406,7 +4406,7 @@ hub_port_init(struct usb_hub *hub, struct usb_device *udev, int port1,
6244 * 255 is for WUSB devices, we actually need to use
6245 * 512 (WUSB1.0[4.8.1]).
6246 */
6247 - for (j = 0; j < 3; ++j) {
6248 + for (operations = 0; operations < 3; ++operations) {
6249 buf->bMaxPacketSize0 = 0;
6250 r = usb_control_msg(udev, usb_rcvaddr0pipe(),
6251 USB_REQ_GET_DESCRIPTOR, USB_DIR_IN,
6252 @@ -4426,7 +4426,13 @@ hub_port_init(struct usb_hub *hub, struct usb_device *udev, int port1,
6253 r = -EPROTO;
6254 break;
6255 }
6256 - if (r == 0)
6257 + /*
6258 + * Some devices time out if they are powered on
6259 + * when already connected. They need a second
6260 + * reset. But only on the first attempt,
6261 + * lest we get into a time out/reset loop
6262 + */
6263 + if (r == 0 || (r == -ETIMEDOUT && retries == 0))
6264 break;
6265 }
6266 udev->descriptor.bMaxPacketSize0 =
6267 @@ -4458,7 +4464,7 @@ hub_port_init(struct usb_hub *hub, struct usb_device *udev, int port1,
6268 * authorization will assign the final address.
6269 */
6270 if (udev->wusb == 0) {
6271 - for (j = 0; j < SET_ADDRESS_TRIES; ++j) {
6272 + for (operations = 0; operations < SET_ADDRESS_TRIES; ++operations) {
6273 retval = hub_set_address(udev, devnum);
6274 if (retval >= 0)
6275 break;
6276 diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c
6277 index c6bfd13f6c92..1950e87b4219 100644
6278 --- a/drivers/usb/misc/iowarrior.c
6279 +++ b/drivers/usb/misc/iowarrior.c
6280 @@ -787,6 +787,12 @@ static int iowarrior_probe(struct usb_interface *interface,
6281 iface_desc = interface->cur_altsetting;
6282 dev->product_id = le16_to_cpu(udev->descriptor.idProduct);
6283
6284 + if (iface_desc->desc.bNumEndpoints < 1) {
6285 + dev_err(&interface->dev, "Invalid number of endpoints\n");
6286 + retval = -EINVAL;
6287 + goto error;
6288 + }
6289 +
6290 /* set up the endpoint information */
6291 for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
6292 endpoint = &iface_desc->endpoint[i].desc;
6293 diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
6294 index 7a76fe4c2f9e..bdc0f2f24f19 100644
6295 --- a/drivers/usb/serial/cp210x.c
6296 +++ b/drivers/usb/serial/cp210x.c
6297 @@ -164,6 +164,7 @@ static const struct usb_device_id id_table[] = {
6298 { USB_DEVICE(0x18EF, 0xE025) }, /* ELV Marble Sound Board 1 */
6299 { USB_DEVICE(0x1901, 0x0190) }, /* GE B850 CP2105 Recorder interface */
6300 { USB_DEVICE(0x1901, 0x0193) }, /* GE B650 CP2104 PMC interface */
6301 + { USB_DEVICE(0x1901, 0x0194) }, /* GE Healthcare Remote Alarm Box */
6302 { USB_DEVICE(0x19CF, 0x3000) }, /* Parrot NMEA GPS Flight Recorder */
6303 { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */
6304 { USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */
6305 diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c
6306 index 01bf53392819..244acb1299a9 100644
6307 --- a/drivers/usb/serial/cypress_m8.c
6308 +++ b/drivers/usb/serial/cypress_m8.c
6309 @@ -447,6 +447,11 @@ static int cypress_generic_port_probe(struct usb_serial_port *port)
6310 struct usb_serial *serial = port->serial;
6311 struct cypress_private *priv;
6312
6313 + if (!port->interrupt_out_urb || !port->interrupt_in_urb) {
6314 + dev_err(&port->dev, "required endpoint is missing\n");
6315 + return -ENODEV;
6316 + }
6317 +
6318 priv = kzalloc(sizeof(struct cypress_private), GFP_KERNEL);
6319 if (!priv)
6320 return -ENOMEM;
6321 @@ -606,12 +611,6 @@ static int cypress_open(struct tty_struct *tty, struct usb_serial_port *port)
6322 cypress_set_termios(tty, port, &priv->tmp_termios);
6323
6324 /* setup the port and start reading from the device */
6325 - if (!port->interrupt_in_urb) {
6326 - dev_err(&port->dev, "%s - interrupt_in_urb is empty!\n",
6327 - __func__);
6328 - return -1;
6329 - }
6330 -
6331 usb_fill_int_urb(port->interrupt_in_urb, serial->dev,
6332 usb_rcvintpipe(serial->dev, port->interrupt_in_endpointAddress),
6333 port->interrupt_in_urb->transfer_buffer,
6334 diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c
6335 index 12b0e67473ba..3df7b7ec178e 100644
6336 --- a/drivers/usb/serial/digi_acceleport.c
6337 +++ b/drivers/usb/serial/digi_acceleport.c
6338 @@ -1251,8 +1251,27 @@ static int digi_port_init(struct usb_serial_port *port, unsigned port_num)
6339
6340 static int digi_startup(struct usb_serial *serial)
6341 {
6342 + struct device *dev = &serial->interface->dev;
6343 struct digi_serial *serial_priv;
6344 int ret;
6345 + int i;
6346 +
6347 + /* check whether the device has the expected number of endpoints */
6348 + if (serial->num_port_pointers < serial->type->num_ports + 1) {
6349 + dev_err(dev, "OOB endpoints missing\n");
6350 + return -ENODEV;
6351 + }
6352 +
6353 + for (i = 0; i < serial->type->num_ports + 1 ; i++) {
6354 + if (!serial->port[i]->read_urb) {
6355 + dev_err(dev, "bulk-in endpoint missing\n");
6356 + return -ENODEV;
6357 + }
6358 + if (!serial->port[i]->write_urb) {
6359 + dev_err(dev, "bulk-out endpoint missing\n");
6360 + return -ENODEV;
6361 + }
6362 + }
6363
6364 serial_priv = kzalloc(sizeof(*serial_priv), GFP_KERNEL);
6365 if (!serial_priv)
6366 diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
6367 index 8c660ae401d8..b61f12160d37 100644
6368 --- a/drivers/usb/serial/ftdi_sio.c
6369 +++ b/drivers/usb/serial/ftdi_sio.c
6370 @@ -1004,6 +1004,10 @@ static const struct usb_device_id id_table_combined[] = {
6371 { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_DISPLAY_PID) },
6372 { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_LITE_PID) },
6373 { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_ANALOG_PID) },
6374 + /* ICP DAS I-756xU devices */
6375 + { USB_DEVICE(ICPDAS_VID, ICPDAS_I7560U_PID) },
6376 + { USB_DEVICE(ICPDAS_VID, ICPDAS_I7561U_PID) },
6377 + { USB_DEVICE(ICPDAS_VID, ICPDAS_I7563U_PID) },
6378 { } /* Terminating entry */
6379 };
6380
6381 diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
6382 index a84df2513994..c5d6c1e73e8e 100644
6383 --- a/drivers/usb/serial/ftdi_sio_ids.h
6384 +++ b/drivers/usb/serial/ftdi_sio_ids.h
6385 @@ -872,6 +872,14 @@
6386 #define NOVITUS_BONO_E_PID 0x6010
6387
6388 /*
6389 + * ICPDAS I-756*U devices
6390 + */
6391 +#define ICPDAS_VID 0x1b5c
6392 +#define ICPDAS_I7560U_PID 0x0103
6393 +#define ICPDAS_I7561U_PID 0x0104
6394 +#define ICPDAS_I7563U_PID 0x0105
6395 +
6396 +/*
6397 * RT Systems programming cables for various ham radios
6398 */
6399 #define RTSYSTEMS_VID 0x2100 /* Vendor ID */
6400 diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c
6401 index fd707d6a10e2..89726f702202 100644
6402 --- a/drivers/usb/serial/mct_u232.c
6403 +++ b/drivers/usb/serial/mct_u232.c
6404 @@ -376,14 +376,21 @@ static void mct_u232_msr_to_state(struct usb_serial_port *port,
6405
6406 static int mct_u232_port_probe(struct usb_serial_port *port)
6407 {
6408 + struct usb_serial *serial = port->serial;
6409 struct mct_u232_private *priv;
6410
6411 + /* check first to simplify error handling */
6412 + if (!serial->port[1] || !serial->port[1]->interrupt_in_urb) {
6413 + dev_err(&port->dev, "expected endpoint missing\n");
6414 + return -ENODEV;
6415 + }
6416 +
6417 priv = kzalloc(sizeof(*priv), GFP_KERNEL);
6418 if (!priv)
6419 return -ENOMEM;
6420
6421 /* Use second interrupt-in endpoint for reading. */
6422 - priv->read_urb = port->serial->port[1]->interrupt_in_urb;
6423 + priv->read_urb = serial->port[1]->interrupt_in_urb;
6424 priv->read_urb->context = port;
6425
6426 spin_lock_init(&priv->lock);
6427 diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
6428 index 348e19834b83..c6f497f16526 100644
6429 --- a/drivers/usb/serial/option.c
6430 +++ b/drivers/usb/serial/option.c
6431 @@ -1818,6 +1818,8 @@ static const struct usb_device_id option_ids[] = {
6432 { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d02, 0xff, 0x00, 0x00) },
6433 { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x02, 0x01) },
6434 { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) },
6435 + { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e19, 0xff), /* D-Link DWM-221 B1 */
6436 + .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
6437 { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
6438 { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
6439 { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */
6440 diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
6441 index 5c66d3f7a6d0..ce0cd6e20d4f 100644
6442 --- a/drivers/usb/storage/uas.c
6443 +++ b/drivers/usb/storage/uas.c
6444 @@ -812,7 +812,7 @@ static struct scsi_host_template uas_host_template = {
6445 .slave_configure = uas_slave_configure,
6446 .eh_abort_handler = uas_eh_abort_handler,
6447 .eh_bus_reset_handler = uas_eh_bus_reset_handler,
6448 - .can_queue = 65536, /* Is there a limit on the _host_ ? */
6449 + .can_queue = MAX_CMNDS,
6450 .this_id = -1,
6451 .sg_tablesize = SG_NONE,
6452 .skip_settle_delay = 1,
6453 diff --git a/drivers/watchdog/rc32434_wdt.c b/drivers/watchdog/rc32434_wdt.c
6454 index 71e78ef4b736..3a75f3b53452 100644
6455 --- a/drivers/watchdog/rc32434_wdt.c
6456 +++ b/drivers/watchdog/rc32434_wdt.c
6457 @@ -237,7 +237,7 @@ static long rc32434_wdt_ioctl(struct file *file, unsigned int cmd,
6458 return -EINVAL;
6459 /* Fall through */
6460 case WDIOC_GETTIMEOUT:
6461 - return copy_to_user(argp, &timeout, sizeof(int));
6462 + return copy_to_user(argp, &timeout, sizeof(int)) ? -EFAULT : 0;
6463 default:
6464 return -ENOTTY;
6465 }
6466 diff --git a/fs/coredump.c b/fs/coredump.c
6467 index 1777331eee76..dfc87c5f5a54 100644
6468 --- a/fs/coredump.c
6469 +++ b/fs/coredump.c
6470 @@ -32,6 +32,9 @@
6471 #include <linux/pipe_fs_i.h>
6472 #include <linux/oom.h>
6473 #include <linux/compat.h>
6474 +#include <linux/sched.h>
6475 +#include <linux/fs.h>
6476 +#include <linux/path.h>
6477
6478 #include <asm/uaccess.h>
6479 #include <asm/mmu_context.h>
6480 @@ -627,6 +630,8 @@ void do_coredump(const siginfo_t *siginfo)
6481 }
6482 } else {
6483 struct inode *inode;
6484 + int open_flags = O_CREAT | O_RDWR | O_NOFOLLOW |
6485 + O_LARGEFILE | O_EXCL;
6486
6487 if (cprm.limit < binfmt->min_coredump)
6488 goto fail_unlock;
6489 @@ -665,10 +670,27 @@ void do_coredump(const siginfo_t *siginfo)
6490 * what matters is that at least one of the two processes
6491 * writes its coredump successfully, not which one.
6492 */
6493 - cprm.file = filp_open(cn.corename,
6494 - O_CREAT | 2 | O_NOFOLLOW |
6495 - O_LARGEFILE | O_EXCL,
6496 - 0600);
6497 + if (need_suid_safe) {
6498 + /*
6499 + * Using user namespaces, normal user tasks can change
6500 + * their current->fs->root to point to arbitrary
6501 + * directories. Since the intention of the "only dump
6502 + * with a fully qualified path" rule is to control where
6503 + * coredumps may be placed using root privileges,
6504 + * current->fs->root must not be used. Instead, use the
6505 + * root directory of init_task.
6506 + */
6507 + struct path root;
6508 +
6509 + task_lock(&init_task);
6510 + get_fs_root(init_task.fs, &root);
6511 + task_unlock(&init_task);
6512 + cprm.file = file_open_root(root.dentry, root.mnt,
6513 + cn.corename, open_flags, 0600);
6514 + path_put(&root);
6515 + } else {
6516 + cprm.file = filp_open(cn.corename, open_flags, 0600);
6517 + }
6518 if (IS_ERR(cprm.file))
6519 goto fail_unlock;
6520
6521 diff --git a/fs/fhandle.c b/fs/fhandle.c
6522 index d59712dfa3e7..ca3c3dd01789 100644
6523 --- a/fs/fhandle.c
6524 +++ b/fs/fhandle.c
6525 @@ -228,7 +228,7 @@ long do_handle_open(int mountdirfd,
6526 path_put(&path);
6527 return fd;
6528 }
6529 - file = file_open_root(path.dentry, path.mnt, "", open_flag);
6530 + file = file_open_root(path.dentry, path.mnt, "", open_flag, 0);
6531 if (IS_ERR(file)) {
6532 put_unused_fd(fd);
6533 retval = PTR_ERR(file);
6534 diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
6535 index 7a8ea1351584..60d6fc2e0e4b 100644
6536 --- a/fs/fs-writeback.c
6537 +++ b/fs/fs-writeback.c
6538 @@ -281,13 +281,15 @@ locked_inode_to_wb_and_lock_list(struct inode *inode)
6539 wb_get(wb);
6540 spin_unlock(&inode->i_lock);
6541 spin_lock(&wb->list_lock);
6542 - wb_put(wb); /* not gonna deref it anymore */
6543
6544 /* i_wb may have changed inbetween, can't use inode_to_wb() */
6545 - if (likely(wb == inode->i_wb))
6546 - return wb; /* @inode already has ref */
6547 + if (likely(wb == inode->i_wb)) {
6548 + wb_put(wb); /* @inode already has ref */
6549 + return wb;
6550 + }
6551
6552 spin_unlock(&wb->list_lock);
6553 + wb_put(wb);
6554 cpu_relax();
6555 spin_lock(&inode->i_lock);
6556 }
6557 @@ -1339,10 +1341,10 @@ __writeback_single_inode(struct inode *inode, struct writeback_control *wbc)
6558 * we go e.g. from filesystem. Flusher thread uses __writeback_single_inode()
6559 * and does more profound writeback list handling in writeback_sb_inodes().
6560 */
6561 -static int
6562 -writeback_single_inode(struct inode *inode, struct bdi_writeback *wb,
6563 - struct writeback_control *wbc)
6564 +static int writeback_single_inode(struct inode *inode,
6565 + struct writeback_control *wbc)
6566 {
6567 + struct bdi_writeback *wb;
6568 int ret = 0;
6569
6570 spin_lock(&inode->i_lock);
6571 @@ -1380,7 +1382,8 @@ writeback_single_inode(struct inode *inode, struct bdi_writeback *wb,
6572 ret = __writeback_single_inode(inode, wbc);
6573
6574 wbc_detach_inode(wbc);
6575 - spin_lock(&wb->list_lock);
6576 +
6577 + wb = inode_to_wb_and_lock_list(inode);
6578 spin_lock(&inode->i_lock);
6579 /*
6580 * If inode is clean, remove it from writeback lists. Otherwise don't
6581 @@ -1455,6 +1458,7 @@ static long writeback_sb_inodes(struct super_block *sb,
6582
6583 while (!list_empty(&wb->b_io)) {
6584 struct inode *inode = wb_inode(wb->b_io.prev);
6585 + struct bdi_writeback *tmp_wb;
6586
6587 if (inode->i_sb != sb) {
6588 if (work->sb) {
6589 @@ -1545,15 +1549,23 @@ static long writeback_sb_inodes(struct super_block *sb,
6590 cond_resched();
6591 }
6592
6593 -
6594 - spin_lock(&wb->list_lock);
6595 + /*
6596 + * Requeue @inode if still dirty. Be careful as @inode may
6597 + * have been switched to another wb in the meantime.
6598 + */
6599 + tmp_wb = inode_to_wb_and_lock_list(inode);
6600 spin_lock(&inode->i_lock);
6601 if (!(inode->i_state & I_DIRTY_ALL))
6602 wrote++;
6603 - requeue_inode(inode, wb, &wbc);
6604 + requeue_inode(inode, tmp_wb, &wbc);
6605 inode_sync_complete(inode);
6606 spin_unlock(&inode->i_lock);
6607
6608 + if (unlikely(tmp_wb != wb)) {
6609 + spin_unlock(&tmp_wb->list_lock);
6610 + spin_lock(&wb->list_lock);
6611 + }
6612 +
6613 /*
6614 * bail out to wb_writeback() often enough to check
6615 * background threshold and other termination conditions.
6616 @@ -2340,7 +2352,6 @@ EXPORT_SYMBOL(sync_inodes_sb);
6617 */
6618 int write_inode_now(struct inode *inode, int sync)
6619 {
6620 - struct bdi_writeback *wb = &inode_to_bdi(inode)->wb;
6621 struct writeback_control wbc = {
6622 .nr_to_write = LONG_MAX,
6623 .sync_mode = sync ? WB_SYNC_ALL : WB_SYNC_NONE,
6624 @@ -2352,7 +2363,7 @@ int write_inode_now(struct inode *inode, int sync)
6625 wbc.nr_to_write = 0;
6626
6627 might_sleep();
6628 - return writeback_single_inode(inode, wb, &wbc);
6629 + return writeback_single_inode(inode, &wbc);
6630 }
6631 EXPORT_SYMBOL(write_inode_now);
6632
6633 @@ -2369,7 +2380,7 @@ EXPORT_SYMBOL(write_inode_now);
6634 */
6635 int sync_inode(struct inode *inode, struct writeback_control *wbc)
6636 {
6637 - return writeback_single_inode(inode, &inode_to_bdi(inode)->wb, wbc);
6638 + return writeback_single_inode(inode, wbc);
6639 }
6640 EXPORT_SYMBOL(sync_inode);
6641
6642 diff --git a/fs/fuse/cuse.c b/fs/fuse/cuse.c
6643 index 8e3ee1936c7e..c5b6b7165489 100644
6644 --- a/fs/fuse/cuse.c
6645 +++ b/fs/fuse/cuse.c
6646 @@ -90,7 +90,7 @@ static struct list_head *cuse_conntbl_head(dev_t devt)
6647
6648 static ssize_t cuse_read_iter(struct kiocb *kiocb, struct iov_iter *to)
6649 {
6650 - struct fuse_io_priv io = { .async = 0, .file = kiocb->ki_filp };
6651 + struct fuse_io_priv io = FUSE_IO_PRIV_SYNC(kiocb->ki_filp);
6652 loff_t pos = 0;
6653
6654 return fuse_direct_io(&io, to, &pos, FUSE_DIO_CUSE);
6655 @@ -98,7 +98,7 @@ static ssize_t cuse_read_iter(struct kiocb *kiocb, struct iov_iter *to)
6656
6657 static ssize_t cuse_write_iter(struct kiocb *kiocb, struct iov_iter *from)
6658 {
6659 - struct fuse_io_priv io = { .async = 0, .file = kiocb->ki_filp };
6660 + struct fuse_io_priv io = FUSE_IO_PRIV_SYNC(kiocb->ki_filp);
6661 loff_t pos = 0;
6662 /*
6663 * No locking or generic_write_checks(), the server is
6664 diff --git a/fs/fuse/file.c b/fs/fuse/file.c
6665 index 570ca4053c80..c2e340d6ec6e 100644
6666 --- a/fs/fuse/file.c
6667 +++ b/fs/fuse/file.c
6668 @@ -528,6 +528,11 @@ static void fuse_release_user_pages(struct fuse_req *req, int write)
6669 }
6670 }
6671
6672 +static void fuse_io_release(struct kref *kref)
6673 +{
6674 + kfree(container_of(kref, struct fuse_io_priv, refcnt));
6675 +}
6676 +
6677 static ssize_t fuse_get_res_by_io(struct fuse_io_priv *io)
6678 {
6679 if (io->err)
6680 @@ -585,8 +590,9 @@ static void fuse_aio_complete(struct fuse_io_priv *io, int err, ssize_t pos)
6681 }
6682
6683 io->iocb->ki_complete(io->iocb, res, 0);
6684 - kfree(io);
6685 }
6686 +
6687 + kref_put(&io->refcnt, fuse_io_release);
6688 }
6689
6690 static void fuse_aio_complete_req(struct fuse_conn *fc, struct fuse_req *req)
6691 @@ -613,6 +619,7 @@ static size_t fuse_async_req_send(struct fuse_conn *fc, struct fuse_req *req,
6692 size_t num_bytes, struct fuse_io_priv *io)
6693 {
6694 spin_lock(&io->lock);
6695 + kref_get(&io->refcnt);
6696 io->size += num_bytes;
6697 io->reqs++;
6698 spin_unlock(&io->lock);
6699 @@ -691,7 +698,7 @@ static void fuse_short_read(struct fuse_req *req, struct inode *inode,
6700
6701 static int fuse_do_readpage(struct file *file, struct page *page)
6702 {
6703 - struct fuse_io_priv io = { .async = 0, .file = file };
6704 + struct fuse_io_priv io = FUSE_IO_PRIV_SYNC(file);
6705 struct inode *inode = page->mapping->host;
6706 struct fuse_conn *fc = get_fuse_conn(inode);
6707 struct fuse_req *req;
6708 @@ -984,7 +991,7 @@ static size_t fuse_send_write_pages(struct fuse_req *req, struct file *file,
6709 size_t res;
6710 unsigned offset;
6711 unsigned i;
6712 - struct fuse_io_priv io = { .async = 0, .file = file };
6713 + struct fuse_io_priv io = FUSE_IO_PRIV_SYNC(file);
6714
6715 for (i = 0; i < req->num_pages; i++)
6716 fuse_wait_on_page_writeback(inode, req->pages[i]->index);
6717 @@ -1398,7 +1405,7 @@ static ssize_t __fuse_direct_read(struct fuse_io_priv *io,
6718
6719 static ssize_t fuse_direct_read_iter(struct kiocb *iocb, struct iov_iter *to)
6720 {
6721 - struct fuse_io_priv io = { .async = 0, .file = iocb->ki_filp };
6722 + struct fuse_io_priv io = FUSE_IO_PRIV_SYNC(iocb->ki_filp);
6723 return __fuse_direct_read(&io, to, &iocb->ki_pos);
6724 }
6725
6726 @@ -1406,7 +1413,7 @@ static ssize_t fuse_direct_write_iter(struct kiocb *iocb, struct iov_iter *from)
6727 {
6728 struct file *file = iocb->ki_filp;
6729 struct inode *inode = file_inode(file);
6730 - struct fuse_io_priv io = { .async = 0, .file = file };
6731 + struct fuse_io_priv io = FUSE_IO_PRIV_SYNC(file);
6732 ssize_t res;
6733
6734 if (is_bad_inode(inode))
6735 @@ -2786,6 +2793,7 @@ fuse_direct_IO(struct kiocb *iocb, struct iov_iter *iter, loff_t offset)
6736 loff_t i_size;
6737 size_t count = iov_iter_count(iter);
6738 struct fuse_io_priv *io;
6739 + bool is_sync = is_sync_kiocb(iocb);
6740
6741 pos = offset;
6742 inode = file->f_mapping->host;
6743 @@ -2806,6 +2814,7 @@ fuse_direct_IO(struct kiocb *iocb, struct iov_iter *iter, loff_t offset)
6744 if (!io)
6745 return -ENOMEM;
6746 spin_lock_init(&io->lock);
6747 + kref_init(&io->refcnt);
6748 io->reqs = 1;
6749 io->bytes = -1;
6750 io->size = 0;
6751 @@ -2825,12 +2834,18 @@ fuse_direct_IO(struct kiocb *iocb, struct iov_iter *iter, loff_t offset)
6752 * to wait on real async I/O requests, so we must submit this request
6753 * synchronously.
6754 */
6755 - if (!is_sync_kiocb(iocb) && (offset + count > i_size) &&
6756 + if (!is_sync && (offset + count > i_size) &&
6757 iov_iter_rw(iter) == WRITE)
6758 io->async = false;
6759
6760 - if (io->async && is_sync_kiocb(iocb))
6761 + if (io->async && is_sync) {
6762 + /*
6763 + * Additional reference to keep io around after
6764 + * calling fuse_aio_complete()
6765 + */
6766 + kref_get(&io->refcnt);
6767 io->done = &wait;
6768 + }
6769
6770 if (iov_iter_rw(iter) == WRITE) {
6771 ret = fuse_direct_io(io, iter, &pos, FUSE_DIO_WRITE);
6772 @@ -2843,14 +2858,14 @@ fuse_direct_IO(struct kiocb *iocb, struct iov_iter *iter, loff_t offset)
6773 fuse_aio_complete(io, ret < 0 ? ret : 0, -1);
6774
6775 /* we have a non-extending, async request, so return */
6776 - if (!is_sync_kiocb(iocb))
6777 + if (!is_sync)
6778 return -EIOCBQUEUED;
6779
6780 wait_for_completion(&wait);
6781 ret = fuse_get_res_by_io(io);
6782 }
6783
6784 - kfree(io);
6785 + kref_put(&io->refcnt, fuse_io_release);
6786
6787 if (iov_iter_rw(iter) == WRITE) {
6788 if (ret > 0)
6789 diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
6790 index 405113101db8..604cd42dafef 100644
6791 --- a/fs/fuse/fuse_i.h
6792 +++ b/fs/fuse/fuse_i.h
6793 @@ -22,6 +22,7 @@
6794 #include <linux/rbtree.h>
6795 #include <linux/poll.h>
6796 #include <linux/workqueue.h>
6797 +#include <linux/kref.h>
6798
6799 /** Max number of pages that can be used in a single read request */
6800 #define FUSE_MAX_PAGES_PER_REQ 32
6801 @@ -243,6 +244,7 @@ struct fuse_args {
6802
6803 /** The request IO state (for asynchronous processing) */
6804 struct fuse_io_priv {
6805 + struct kref refcnt;
6806 int async;
6807 spinlock_t lock;
6808 unsigned reqs;
6809 @@ -256,6 +258,13 @@ struct fuse_io_priv {
6810 struct completion *done;
6811 };
6812
6813 +#define FUSE_IO_PRIV_SYNC(f) \
6814 +{ \
6815 + .refcnt = { ATOMIC_INIT(1) }, \
6816 + .async = 0, \
6817 + .file = f, \
6818 +}
6819 +
6820 /**
6821 * Request flags
6822 *
6823 diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
6824 index 81e622681c82..624a57a9c4aa 100644
6825 --- a/fs/jbd2/journal.c
6826 +++ b/fs/jbd2/journal.c
6827 @@ -1408,11 +1408,12 @@ out:
6828 /**
6829 * jbd2_mark_journal_empty() - Mark on disk journal as empty.
6830 * @journal: The journal to update.
6831 + * @write_op: With which operation should we write the journal sb
6832 *
6833 * Update a journal's dynamic superblock fields to show that journal is empty.
6834 * Write updated superblock to disk waiting for IO to complete.
6835 */
6836 -static void jbd2_mark_journal_empty(journal_t *journal)
6837 +static void jbd2_mark_journal_empty(journal_t *journal, int write_op)
6838 {
6839 journal_superblock_t *sb = journal->j_superblock;
6840
6841 @@ -1430,7 +1431,7 @@ static void jbd2_mark_journal_empty(journal_t *journal)
6842 sb->s_start = cpu_to_be32(0);
6843 read_unlock(&journal->j_state_lock);
6844
6845 - jbd2_write_superblock(journal, WRITE_FUA);
6846 + jbd2_write_superblock(journal, write_op);
6847
6848 /* Log is no longer empty */
6849 write_lock(&journal->j_state_lock);
6850 @@ -1716,7 +1717,13 @@ int jbd2_journal_destroy(journal_t *journal)
6851 if (journal->j_sb_buffer) {
6852 if (!is_journal_aborted(journal)) {
6853 mutex_lock(&journal->j_checkpoint_mutex);
6854 - jbd2_mark_journal_empty(journal);
6855 +
6856 + write_lock(&journal->j_state_lock);
6857 + journal->j_tail_sequence =
6858 + ++journal->j_transaction_sequence;
6859 + write_unlock(&journal->j_state_lock);
6860 +
6861 + jbd2_mark_journal_empty(journal, WRITE_FLUSH_FUA);
6862 mutex_unlock(&journal->j_checkpoint_mutex);
6863 } else
6864 err = -EIO;
6865 @@ -1975,7 +1982,7 @@ int jbd2_journal_flush(journal_t *journal)
6866 * the magic code for a fully-recovered superblock. Any future
6867 * commits of data to the journal will restore the current
6868 * s_start value. */
6869 - jbd2_mark_journal_empty(journal);
6870 + jbd2_mark_journal_empty(journal, WRITE_FUA);
6871 mutex_unlock(&journal->j_checkpoint_mutex);
6872 write_lock(&journal->j_state_lock);
6873 J_ASSERT(!journal->j_running_transaction);
6874 @@ -2021,7 +2028,7 @@ int jbd2_journal_wipe(journal_t *journal, int write)
6875 if (write) {
6876 /* Lock to make assertions happy... */
6877 mutex_lock(&journal->j_checkpoint_mutex);
6878 - jbd2_mark_journal_empty(journal);
6879 + jbd2_mark_journal_empty(journal, WRITE_FUA);
6880 mutex_unlock(&journal->j_checkpoint_mutex);
6881 }
6882
6883 diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
6884 index a9f096c7e99f..7d5351cd67fb 100644
6885 --- a/fs/nfsd/nfs4proc.c
6886 +++ b/fs/nfsd/nfs4proc.c
6887 @@ -877,6 +877,7 @@ nfsd4_secinfo(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
6888 &exp, &dentry);
6889 if (err)
6890 return err;
6891 + fh_unlock(&cstate->current_fh);
6892 if (d_really_is_negative(dentry)) {
6893 exp_put(exp);
6894 err = nfserr_noent;
6895 diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
6896 index 51c9e9ca39a4..12935209deca 100644
6897 --- a/fs/nfsd/nfs4xdr.c
6898 +++ b/fs/nfsd/nfs4xdr.c
6899 @@ -1072,8 +1072,9 @@ nfsd4_decode_rename(struct nfsd4_compoundargs *argp, struct nfsd4_rename *rename
6900
6901 READ_BUF(4);
6902 rename->rn_snamelen = be32_to_cpup(p++);
6903 - READ_BUF(rename->rn_snamelen + 4);
6904 + READ_BUF(rename->rn_snamelen);
6905 SAVEMEM(rename->rn_sname, rename->rn_snamelen);
6906 + READ_BUF(4);
6907 rename->rn_tnamelen = be32_to_cpup(p++);
6908 READ_BUF(rename->rn_tnamelen);
6909 SAVEMEM(rename->rn_tname, rename->rn_tnamelen);
6910 @@ -1155,13 +1156,14 @@ nfsd4_decode_setclientid(struct nfsd4_compoundargs *argp, struct nfsd4_setclient
6911 READ_BUF(8);
6912 setclientid->se_callback_prog = be32_to_cpup(p++);
6913 setclientid->se_callback_netid_len = be32_to_cpup(p++);
6914 -
6915 - READ_BUF(setclientid->se_callback_netid_len + 4);
6916 + READ_BUF(setclientid->se_callback_netid_len);
6917 SAVEMEM(setclientid->se_callback_netid_val, setclientid->se_callback_netid_len);
6918 + READ_BUF(4);
6919 setclientid->se_callback_addr_len = be32_to_cpup(p++);
6920
6921 - READ_BUF(setclientid->se_callback_addr_len + 4);
6922 + READ_BUF(setclientid->se_callback_addr_len);
6923 SAVEMEM(setclientid->se_callback_addr_val, setclientid->se_callback_addr_len);
6924 + READ_BUF(4);
6925 setclientid->se_callback_ident = be32_to_cpup(p++);
6926
6927 DECODE_TAIL;
6928 @@ -1815,8 +1817,9 @@ nfsd4_decode_compound(struct nfsd4_compoundargs *argp)
6929
6930 READ_BUF(4);
6931 argp->taglen = be32_to_cpup(p++);
6932 - READ_BUF(argp->taglen + 8);
6933 + READ_BUF(argp->taglen);
6934 SAVEMEM(argp->tag, argp->taglen);
6935 + READ_BUF(8);
6936 argp->minorversion = be32_to_cpup(p++);
6937 argp->opcnt = be32_to_cpup(p++);
6938 max_reply += 4 + (XDR_QUADLEN(argp->taglen) << 2);
6939 diff --git a/fs/ocfs2/dlm/dlmconvert.c b/fs/ocfs2/dlm/dlmconvert.c
6940 index e36d63ff1783..f90931335c6b 100644
6941 --- a/fs/ocfs2/dlm/dlmconvert.c
6942 +++ b/fs/ocfs2/dlm/dlmconvert.c
6943 @@ -262,6 +262,7 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm,
6944 struct dlm_lock *lock, int flags, int type)
6945 {
6946 enum dlm_status status;
6947 + u8 old_owner = res->owner;
6948
6949 mlog(0, "type=%d, convert_type=%d, busy=%d\n", lock->ml.type,
6950 lock->ml.convert_type, res->state & DLM_LOCK_RES_IN_PROGRESS);
6951 @@ -287,6 +288,19 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm,
6952 status = DLM_DENIED;
6953 goto bail;
6954 }
6955 +
6956 + if (lock->ml.type == type && lock->ml.convert_type == LKM_IVMODE) {
6957 + mlog(0, "last convert request returned DLM_RECOVERING, but "
6958 + "owner has already queued and sent ast to me. res %.*s, "
6959 + "(cookie=%u:%llu, type=%d, conv=%d)\n",
6960 + res->lockname.len, res->lockname.name,
6961 + dlm_get_lock_cookie_node(be64_to_cpu(lock->ml.cookie)),
6962 + dlm_get_lock_cookie_seq(be64_to_cpu(lock->ml.cookie)),
6963 + lock->ml.type, lock->ml.convert_type);
6964 + status = DLM_NORMAL;
6965 + goto bail;
6966 + }
6967 +
6968 res->state |= DLM_LOCK_RES_IN_PROGRESS;
6969 /* move lock to local convert queue */
6970 /* do not alter lock refcount. switching lists. */
6971 @@ -316,11 +330,19 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm,
6972 spin_lock(&res->spinlock);
6973 res->state &= ~DLM_LOCK_RES_IN_PROGRESS;
6974 lock->convert_pending = 0;
6975 - /* if it failed, move it back to granted queue */
6976 + /* if it failed, move it back to granted queue.
6977 + * if master returns DLM_NORMAL and then down before sending ast,
6978 + * it may have already been moved to granted queue, reset to
6979 + * DLM_RECOVERING and retry convert */
6980 if (status != DLM_NORMAL) {
6981 if (status != DLM_NOTQUEUED)
6982 dlm_error(status);
6983 dlm_revert_pending_convert(res, lock);
6984 + } else if ((res->state & DLM_LOCK_RES_RECOVERING) ||
6985 + (old_owner != res->owner)) {
6986 + mlog(0, "res %.*s is in recovering or has been recovered.\n",
6987 + res->lockname.len, res->lockname.name);
6988 + status = DLM_RECOVERING;
6989 }
6990 bail:
6991 spin_unlock(&res->spinlock);
6992 diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
6993 index 42f0cae93a0a..4a338803e7e9 100644
6994 --- a/fs/ocfs2/dlm/dlmrecovery.c
6995 +++ b/fs/ocfs2/dlm/dlmrecovery.c
6996 @@ -2064,7 +2064,6 @@ void dlm_move_lockres_to_recovery_list(struct dlm_ctxt *dlm,
6997 dlm_lock_get(lock);
6998 if (lock->convert_pending) {
6999 /* move converting lock back to granted */
7000 - BUG_ON(i != DLM_CONVERTING_LIST);
7001 mlog(0, "node died with convert pending "
7002 "on %.*s. move back to granted list.\n",
7003 res->lockname.len, res->lockname.name);
7004 diff --git a/fs/open.c b/fs/open.c
7005 index b6f1e96a7c0b..6a24f988d253 100644
7006 --- a/fs/open.c
7007 +++ b/fs/open.c
7008 @@ -995,14 +995,12 @@ struct file *filp_open(const char *filename, int flags, umode_t mode)
7009 EXPORT_SYMBOL(filp_open);
7010
7011 struct file *file_open_root(struct dentry *dentry, struct vfsmount *mnt,
7012 - const char *filename, int flags)
7013 + const char *filename, int flags, umode_t mode)
7014 {
7015 struct open_flags op;
7016 - int err = build_open_flags(flags, 0, &op);
7017 + int err = build_open_flags(flags, mode, &op);
7018 if (err)
7019 return ERR_PTR(err);
7020 - if (flags & O_CREAT)
7021 - return ERR_PTR(-EINVAL);
7022 return do_file_open_root(dentry, mnt, filename, &op);
7023 }
7024 EXPORT_SYMBOL(file_open_root);
7025 diff --git a/fs/proc_namespace.c b/fs/proc_namespace.c
7026 index 8ebd9a334085..87645955990d 100644
7027 --- a/fs/proc_namespace.c
7028 +++ b/fs/proc_namespace.c
7029 @@ -197,6 +197,8 @@ static int show_vfsstat(struct seq_file *m, struct vfsmount *mnt)
7030 if (sb->s_op->show_devname) {
7031 seq_puts(m, "device ");
7032 err = sb->s_op->show_devname(m, mnt_path.dentry);
7033 + if (err)
7034 + goto out;
7035 } else {
7036 if (r->mnt_devname) {
7037 seq_puts(m, "device ");
7038 diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
7039 index ef0d64b2a6d9..353ff31dcee1 100644
7040 --- a/fs/quota/dquot.c
7041 +++ b/fs/quota/dquot.c
7042 @@ -1398,7 +1398,7 @@ static int dquot_active(const struct inode *inode)
7043 static int __dquot_initialize(struct inode *inode, int type)
7044 {
7045 int cnt, init_needed = 0;
7046 - struct dquot **dquots, *got[MAXQUOTAS];
7047 + struct dquot **dquots, *got[MAXQUOTAS] = {};
7048 struct super_block *sb = inode->i_sb;
7049 qsize_t rsv;
7050 int ret = 0;
7051 @@ -1415,7 +1415,6 @@ static int __dquot_initialize(struct inode *inode, int type)
7052 int rc;
7053 struct dquot *dquot;
7054
7055 - got[cnt] = NULL;
7056 if (type != -1 && cnt != type)
7057 continue;
7058 /*
7059 diff --git a/fs/splice.c b/fs/splice.c
7060 index 4cf700d50b40..0f77e9682857 100644
7061 --- a/fs/splice.c
7062 +++ b/fs/splice.c
7063 @@ -185,6 +185,9 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe,
7064 unsigned int spd_pages = spd->nr_pages;
7065 int ret, do_wakeup, page_nr;
7066
7067 + if (!spd_pages)
7068 + return 0;
7069 +
7070 ret = 0;
7071 do_wakeup = 0;
7072 page_nr = 0;
7073 diff --git a/fs/xfs/xfs_attr_list.c b/fs/xfs/xfs_attr_list.c
7074 index 0ef7c2ed3f8a..4fa14820e2e2 100644
7075 --- a/fs/xfs/xfs_attr_list.c
7076 +++ b/fs/xfs/xfs_attr_list.c
7077 @@ -202,8 +202,10 @@ xfs_attr_shortform_list(xfs_attr_list_context_t *context)
7078 sbp->namelen,
7079 sbp->valuelen,
7080 &sbp->name[sbp->namelen]);
7081 - if (error)
7082 + if (error) {
7083 + kmem_free(sbuf);
7084 return error;
7085 + }
7086 if (context->seen_enough)
7087 break;
7088 cursor->offset++;
7089 @@ -454,14 +456,13 @@ xfs_attr3_leaf_list_int(
7090 args.rmtblkcnt = xfs_attr3_rmt_blocks(
7091 args.dp->i_mount, valuelen);
7092 retval = xfs_attr_rmtval_get(&args);
7093 - if (retval)
7094 - return retval;
7095 - retval = context->put_listent(context,
7096 - entry->flags,
7097 - name_rmt->name,
7098 - (int)name_rmt->namelen,
7099 - valuelen,
7100 - args.value);
7101 + if (!retval)
7102 + retval = context->put_listent(context,
7103 + entry->flags,
7104 + name_rmt->name,
7105 + (int)name_rmt->namelen,
7106 + valuelen,
7107 + args.value);
7108 kmem_free(args.value);
7109 } else {
7110 retval = context->put_listent(context,
7111 diff --git a/include/asm-generic/bitops/lock.h b/include/asm-generic/bitops/lock.h
7112 index c30266e94806..8ef0ccbf8167 100644
7113 --- a/include/asm-generic/bitops/lock.h
7114 +++ b/include/asm-generic/bitops/lock.h
7115 @@ -29,16 +29,16 @@ do { \
7116 * @nr: the bit to set
7117 * @addr: the address to start counting from
7118 *
7119 - * This operation is like clear_bit_unlock, however it is not atomic.
7120 - * It does provide release barrier semantics so it can be used to unlock
7121 - * a bit lock, however it would only be used if no other CPU can modify
7122 - * any bits in the memory until the lock is released (a good example is
7123 - * if the bit lock itself protects access to the other bits in the word).
7124 + * A weaker form of clear_bit_unlock() as used by __bit_lock_unlock(). If all
7125 + * the bits in the word are protected by this lock some archs can use weaker
7126 + * ops to safely unlock.
7127 + *
7128 + * See for example x86's implementation.
7129 */
7130 #define __clear_bit_unlock(nr, addr) \
7131 do { \
7132 - smp_mb(); \
7133 - __clear_bit(nr, addr); \
7134 + smp_mb__before_atomic(); \
7135 + clear_bit(nr, addr); \
7136 } while (0)
7137
7138 #endif /* _ASM_GENERIC_BITOPS_LOCK_H_ */
7139 diff --git a/include/linux/cgroup-defs.h b/include/linux/cgroup-defs.h
7140 index 8e30faeab183..a7c7f74808a4 100644
7141 --- a/include/linux/cgroup-defs.h
7142 +++ b/include/linux/cgroup-defs.h
7143 @@ -216,6 +216,9 @@ struct css_set {
7144 /* all css_task_iters currently walking this cset */
7145 struct list_head task_iters;
7146
7147 + /* dead and being drained, ignore for migration */
7148 + bool dead;
7149 +
7150 /* For RCU-protected deletion */
7151 struct rcu_head rcu_head;
7152 };
7153 diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h
7154 index ec1c61c87d89..899ab9f8549e 100644
7155 --- a/include/linux/device-mapper.h
7156 +++ b/include/linux/device-mapper.h
7157 @@ -124,6 +124,8 @@ struct dm_dev {
7158 char name[16];
7159 };
7160
7161 +dev_t dm_get_dev_t(const char *path);
7162 +
7163 /*
7164 * Constructors should call these functions to ensure destination devices
7165 * are opened/closed correctly.
7166 diff --git a/include/linux/fs.h b/include/linux/fs.h
7167 index 3aa514254161..22c5a0cf16e3 100644
7168 --- a/include/linux/fs.h
7169 +++ b/include/linux/fs.h
7170 @@ -2217,7 +2217,7 @@ extern long do_sys_open(int dfd, const char __user *filename, int flags,
7171 extern struct file *file_open_name(struct filename *, int, umode_t);
7172 extern struct file *filp_open(const char *, int, umode_t);
7173 extern struct file *file_open_root(struct dentry *, struct vfsmount *,
7174 - const char *, int);
7175 + const char *, int, umode_t);
7176 extern struct file * dentry_open(const struct path *, int, const struct cred *);
7177 extern int filp_close(struct file *, fl_owner_t id);
7178
7179 diff --git a/include/linux/kernel.h b/include/linux/kernel.h
7180 index 350dfb08aee3..924853d33a13 100644
7181 --- a/include/linux/kernel.h
7182 +++ b/include/linux/kernel.h
7183 @@ -607,7 +607,7 @@ do { \
7184
7185 #define do_trace_printk(fmt, args...) \
7186 do { \
7187 - static const char *trace_printk_fmt \
7188 + static const char *trace_printk_fmt __used \
7189 __attribute__((section("__trace_printk_fmt"))) = \
7190 __builtin_constant_p(fmt) ? fmt : NULL; \
7191 \
7192 @@ -651,7 +651,7 @@ int __trace_printk(unsigned long ip, const char *fmt, ...);
7193 */
7194
7195 #define trace_puts(str) ({ \
7196 - static const char *trace_printk_fmt \
7197 + static const char *trace_printk_fmt __used \
7198 __attribute__((section("__trace_printk_fmt"))) = \
7199 __builtin_constant_p(str) ? str : NULL; \
7200 \
7201 @@ -673,7 +673,7 @@ extern void trace_dump_stack(int skip);
7202 #define ftrace_vprintk(fmt, vargs) \
7203 do { \
7204 if (__builtin_constant_p(fmt)) { \
7205 - static const char *trace_printk_fmt \
7206 + static const char *trace_printk_fmt __used \
7207 __attribute__((section("__trace_printk_fmt"))) = \
7208 __builtin_constant_p(fmt) ? fmt : NULL; \
7209 \
7210 diff --git a/include/linux/pci.h b/include/linux/pci.h
7211 index 6ae25aae88fd..4e554bfff129 100644
7212 --- a/include/linux/pci.h
7213 +++ b/include/linux/pci.h
7214 @@ -359,6 +359,7 @@ struct pci_dev {
7215 unsigned int io_window_1k:1; /* Intel P2P bridge 1K I/O windows */
7216 unsigned int irq_managed:1;
7217 unsigned int has_secondary_link:1;
7218 + unsigned int non_compliant_bars:1; /* broken BARs; ignore them */
7219 pci_dev_flags_t dev_flags;
7220 atomic_t enable_cnt; /* pci_enable_device has been called */
7221
7222 diff --git a/include/linux/platform_data/asoc-s3c.h b/include/linux/platform_data/asoc-s3c.h
7223 index 5e0bc779e6c5..33f88b4479e4 100644
7224 --- a/include/linux/platform_data/asoc-s3c.h
7225 +++ b/include/linux/platform_data/asoc-s3c.h
7226 @@ -39,6 +39,10 @@ struct samsung_i2s {
7227 */
7228 struct s3c_audio_pdata {
7229 int (*cfg_gpio)(struct platform_device *);
7230 + void *dma_playback;
7231 + void *dma_capture;
7232 + void *dma_play_sec;
7233 + void *dma_capture_mic;
7234 union {
7235 struct samsung_i2s i2s;
7236 } type;
7237 diff --git a/include/linux/thermal.h b/include/linux/thermal.h
7238 index e13a1ace50e9..4a849f19e6c9 100644
7239 --- a/include/linux/thermal.h
7240 +++ b/include/linux/thermal.h
7241 @@ -156,6 +156,7 @@ struct thermal_attr {
7242 * @trip_hyst_attrs: attributes for trip points for sysfs: trip hysteresis
7243 * @devdata: private pointer for device private data
7244 * @trips: number of trip points the thermal zone supports
7245 + * @trips_disabled; bitmap for disabled trips
7246 * @passive_delay: number of milliseconds to wait between polls when
7247 * performing passive cooling.
7248 * @polling_delay: number of milliseconds to wait between polls when
7249 @@ -191,6 +192,7 @@ struct thermal_zone_device {
7250 struct thermal_attr *trip_hyst_attrs;
7251 void *devdata;
7252 int trips;
7253 + unsigned long trips_disabled; /* bitmap for disabled trips */
7254 int passive_delay;
7255 int polling_delay;
7256 int temperature;
7257 diff --git a/include/linux/tty.h b/include/linux/tty.h
7258 index 6b6e811f4575..3bf03b6b52e9 100644
7259 --- a/include/linux/tty.h
7260 +++ b/include/linux/tty.h
7261 @@ -594,7 +594,7 @@ static inline int tty_ldisc_receive_buf(struct tty_ldisc *ld, unsigned char *p,
7262 count = ld->ops->receive_buf2(ld->tty, p, f, count);
7263 else {
7264 count = min_t(int, count, ld->tty->receive_room);
7265 - if (count)
7266 + if (count && ld->ops->receive_buf)
7267 ld->ops->receive_buf(ld->tty, p, f, count);
7268 }
7269 return count;
7270 diff --git a/kernel/cgroup.c b/kernel/cgroup.c
7271 index fb1ecfd2decd..dc94f8beb097 100644
7272 --- a/kernel/cgroup.c
7273 +++ b/kernel/cgroup.c
7274 @@ -2498,6 +2498,14 @@ static void cgroup_migrate_add_src(struct css_set *src_cset,
7275 lockdep_assert_held(&cgroup_mutex);
7276 lockdep_assert_held(&css_set_lock);
7277
7278 + /*
7279 + * If ->dead, @src_set is associated with one or more dead cgroups
7280 + * and doesn't contain any migratable tasks. Ignore it early so
7281 + * that the rest of migration path doesn't get confused by it.
7282 + */
7283 + if (src_cset->dead)
7284 + return;
7285 +
7286 src_cgrp = cset_cgroup_from_root(src_cset, dst_cgrp->root);
7287
7288 if (!list_empty(&src_cset->mg_preload_node))
7289 @@ -5131,6 +5139,7 @@ static int cgroup_destroy_locked(struct cgroup *cgrp)
7290 __releases(&cgroup_mutex) __acquires(&cgroup_mutex)
7291 {
7292 struct cgroup_subsys_state *css;
7293 + struct cgrp_cset_link *link;
7294 int ssid;
7295
7296 lockdep_assert_held(&cgroup_mutex);
7297 @@ -5151,11 +5160,18 @@ static int cgroup_destroy_locked(struct cgroup *cgrp)
7298 return -EBUSY;
7299
7300 /*
7301 - * Mark @cgrp dead. This prevents further task migration and child
7302 - * creation by disabling cgroup_lock_live_group().
7303 + * Mark @cgrp and the associated csets dead. The former prevents
7304 + * further task migration and child creation by disabling
7305 + * cgroup_lock_live_group(). The latter makes the csets ignored by
7306 + * the migration path.
7307 */
7308 cgrp->self.flags &= ~CSS_ONLINE;
7309
7310 + spin_lock_bh(&css_set_lock);
7311 + list_for_each_entry(link, &cgrp->cset_links, cset_link)
7312 + link->cset->dead = true;
7313 + spin_unlock_bh(&css_set_lock);
7314 +
7315 /* initiate massacre of all css's */
7316 for_each_css(css, ssid, cgrp)
7317 kill_css(css);
7318 diff --git a/kernel/events/core.c b/kernel/events/core.c
7319 index 1087bbeb152b..faf2067fc8e2 100644
7320 --- a/kernel/events/core.c
7321 +++ b/kernel/events/core.c
7322 @@ -7979,6 +7979,9 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
7323 }
7324 }
7325
7326 + /* symmetric to unaccount_event() in _free_event() */
7327 + account_event(event);
7328 +
7329 return event;
7330
7331 err_per_task:
7332 @@ -8342,8 +8345,6 @@ SYSCALL_DEFINE5(perf_event_open,
7333 }
7334 }
7335
7336 - account_event(event);
7337 -
7338 /*
7339 * Special case software events and allow them to be part of
7340 * any hardware group.
7341 @@ -8626,8 +8627,6 @@ perf_event_create_kernel_counter(struct perf_event_attr *attr, int cpu,
7342 /* Mark owner so we could distinguish it from user events. */
7343 event->owner = EVENT_OWNER_KERNEL;
7344
7345 - account_event(event);
7346 -
7347 ctx = find_get_context(event->pmu, task, event);
7348 if (IS_ERR(ctx)) {
7349 err = PTR_ERR(ctx);
7350 diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
7351 index b7342a24f559..b7dd5718836e 100644
7352 --- a/kernel/power/hibernate.c
7353 +++ b/kernel/power/hibernate.c
7354 @@ -339,6 +339,7 @@ int hibernation_snapshot(int platform_mode)
7355 pm_message_t msg;
7356 int error;
7357
7358 + pm_suspend_clear_flags();
7359 error = platform_begin(platform_mode);
7360 if (error)
7361 goto Close;
7362 diff --git a/kernel/sched/core.c b/kernel/sched/core.c
7363 index eb70592f03f6..70e5e09341f1 100644
7364 --- a/kernel/sched/core.c
7365 +++ b/kernel/sched/core.c
7366 @@ -5525,6 +5525,7 @@ migration_call(struct notifier_block *nfb, unsigned long action, void *hcpu)
7367
7368 case CPU_UP_PREPARE:
7369 rq->calc_load_update = calc_load_update;
7370 + account_reset_rq(rq);
7371 break;
7372
7373 case CPU_ONLINE:
7374 diff --git a/kernel/sched/cputime.c b/kernel/sched/cputime.c
7375 index 05de80b48586..f74ea89e77a8 100644
7376 --- a/kernel/sched/cputime.c
7377 +++ b/kernel/sched/cputime.c
7378 @@ -259,21 +259,21 @@ static __always_inline bool steal_account_process_tick(void)
7379 #ifdef CONFIG_PARAVIRT
7380 if (static_key_false(&paravirt_steal_enabled)) {
7381 u64 steal;
7382 - cputime_t steal_ct;
7383 + unsigned long steal_jiffies;
7384
7385 steal = paravirt_steal_clock(smp_processor_id());
7386 steal -= this_rq()->prev_steal_time;
7387
7388 /*
7389 - * cputime_t may be less precise than nsecs (eg: if it's
7390 - * based on jiffies). Lets cast the result to cputime
7391 + * steal is in nsecs but our caller is expecting steal
7392 + * time in jiffies. Lets cast the result to jiffies
7393 * granularity and account the rest on the next rounds.
7394 */
7395 - steal_ct = nsecs_to_cputime(steal);
7396 - this_rq()->prev_steal_time += cputime_to_nsecs(steal_ct);
7397 + steal_jiffies = nsecs_to_jiffies(steal);
7398 + this_rq()->prev_steal_time += jiffies_to_nsecs(steal_jiffies);
7399
7400 - account_steal_time(steal_ct);
7401 - return steal_ct;
7402 + account_steal_time(jiffies_to_cputime(steal_jiffies));
7403 + return steal_jiffies;
7404 }
7405 #endif
7406 return false;
7407 diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
7408 index b242775bf670..0517abd7dd73 100644
7409 --- a/kernel/sched/sched.h
7410 +++ b/kernel/sched/sched.h
7411 @@ -1770,3 +1770,16 @@ static inline u64 irq_time_read(int cpu)
7412 }
7413 #endif /* CONFIG_64BIT */
7414 #endif /* CONFIG_IRQ_TIME_ACCOUNTING */
7415 +
7416 +static inline void account_reset_rq(struct rq *rq)
7417 +{
7418 +#ifdef CONFIG_IRQ_TIME_ACCOUNTING
7419 + rq->prev_irq_time = 0;
7420 +#endif
7421 +#ifdef CONFIG_PARAVIRT
7422 + rq->prev_steal_time = 0;
7423 +#endif
7424 +#ifdef CONFIG_PARAVIRT_TIME_ACCOUNTING
7425 + rq->prev_steal_time_rq = 0;
7426 +#endif
7427 +}
7428 diff --git a/kernel/sysctl_binary.c b/kernel/sysctl_binary.c
7429 index 7e7746a42a62..10a1d7dc9313 100644
7430 --- a/kernel/sysctl_binary.c
7431 +++ b/kernel/sysctl_binary.c
7432 @@ -1321,7 +1321,7 @@ static ssize_t binary_sysctl(const int *name, int nlen,
7433 }
7434
7435 mnt = task_active_pid_ns(current)->proc_mnt;
7436 - file = file_open_root(mnt->mnt_root, mnt, pathname, flags);
7437 + file = file_open_root(mnt->mnt_root, mnt, pathname, flags, 0);
7438 result = PTR_ERR(file);
7439 if (IS_ERR(file))
7440 goto out_putname;
7441 diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
7442 index d9293402ee68..8305cbb2d5a2 100644
7443 --- a/kernel/trace/trace.c
7444 +++ b/kernel/trace/trace.c
7445 @@ -4949,7 +4949,10 @@ static ssize_t tracing_splice_read_pipe(struct file *filp,
7446
7447 spd.nr_pages = i;
7448
7449 - ret = splice_to_pipe(pipe, &spd);
7450 + if (i)
7451 + ret = splice_to_pipe(pipe, &spd);
7452 + else
7453 + ret = 0;
7454 out:
7455 splice_shrink_spd(&spd);
7456 return ret;
7457 diff --git a/kernel/trace/trace_irqsoff.c b/kernel/trace/trace_irqsoff.c
7458 index e4e56589ec1d..be3222b7d72e 100644
7459 --- a/kernel/trace/trace_irqsoff.c
7460 +++ b/kernel/trace/trace_irqsoff.c
7461 @@ -109,8 +109,12 @@ static int func_prolog_dec(struct trace_array *tr,
7462 return 0;
7463
7464 local_save_flags(*flags);
7465 - /* slight chance to get a false positive on tracing_cpu */
7466 - if (!irqs_disabled_flags(*flags))
7467 + /*
7468 + * Slight chance to get a false positive on tracing_cpu,
7469 + * although I'm starting to think there isn't a chance.
7470 + * Leave this for now just to be paranoid.
7471 + */
7472 + if (!irqs_disabled_flags(*flags) && !preempt_count())
7473 return 0;
7474
7475 *data = per_cpu_ptr(tr->trace_buffer.data, cpu);
7476 diff --git a/kernel/trace/trace_printk.c b/kernel/trace/trace_printk.c
7477 index 060df67dbdd1..f96f0383f6c6 100644
7478 --- a/kernel/trace/trace_printk.c
7479 +++ b/kernel/trace/trace_printk.c
7480 @@ -296,6 +296,9 @@ static int t_show(struct seq_file *m, void *v)
7481 const char *str = *fmt;
7482 int i;
7483
7484 + if (!*fmt)
7485 + return 0;
7486 +
7487 seq_printf(m, "0x%lx : \"", *(unsigned long *)fmt);
7488
7489 /*
7490 diff --git a/kernel/watchdog.c b/kernel/watchdog.c
7491 index 18f34cf75f74..198137b1cadc 100644
7492 --- a/kernel/watchdog.c
7493 +++ b/kernel/watchdog.c
7494 @@ -907,6 +907,9 @@ static int proc_watchdog_common(int which, struct ctl_table *table, int write,
7495 * both lockup detectors are disabled if proc_watchdog_update()
7496 * returns an error.
7497 */
7498 + if (old == new)
7499 + goto out;
7500 +
7501 err = proc_watchdog_update();
7502 }
7503 out:
7504 @@ -951,7 +954,7 @@ int proc_soft_watchdog(struct ctl_table *table, int write,
7505 int proc_watchdog_thresh(struct ctl_table *table, int write,
7506 void __user *buffer, size_t *lenp, loff_t *ppos)
7507 {
7508 - int err, old;
7509 + int err, old, new;
7510
7511 get_online_cpus();
7512 mutex_lock(&watchdog_proc_mutex);
7513 @@ -971,6 +974,10 @@ int proc_watchdog_thresh(struct ctl_table *table, int write,
7514 /*
7515 * Update the sample period. Restore on failure.
7516 */
7517 + new = ACCESS_ONCE(watchdog_thresh);
7518 + if (old == new)
7519 + goto out;
7520 +
7521 set_sample_period();
7522 err = proc_watchdog_update();
7523 if (err) {
7524 diff --git a/mm/memcontrol.c b/mm/memcontrol.c
7525 index ee6acd279953..fc0bcc41d57f 100644
7526 --- a/mm/memcontrol.c
7527 +++ b/mm/memcontrol.c
7528 @@ -1332,7 +1332,7 @@ static unsigned long mem_cgroup_get_limit(struct mem_cgroup *memcg)
7529 return limit;
7530 }
7531
7532 -static void mem_cgroup_out_of_memory(struct mem_cgroup *memcg, gfp_t gfp_mask,
7533 +static bool mem_cgroup_out_of_memory(struct mem_cgroup *memcg, gfp_t gfp_mask,
7534 int order)
7535 {
7536 struct oom_control oc = {
7537 @@ -1410,6 +1410,7 @@ static void mem_cgroup_out_of_memory(struct mem_cgroup *memcg, gfp_t gfp_mask,
7538 }
7539 unlock:
7540 mutex_unlock(&oom_lock);
7541 + return chosen;
7542 }
7543
7544 #if MAX_NUMNODES > 1
7545 @@ -5121,6 +5122,7 @@ static ssize_t memory_high_write(struct kernfs_open_file *of,
7546 char *buf, size_t nbytes, loff_t off)
7547 {
7548 struct mem_cgroup *memcg = mem_cgroup_from_css(of_css(of));
7549 + unsigned long nr_pages;
7550 unsigned long high;
7551 int err;
7552
7553 @@ -5131,6 +5133,11 @@ static ssize_t memory_high_write(struct kernfs_open_file *of,
7554
7555 memcg->high = high;
7556
7557 + nr_pages = page_counter_read(&memcg->memory);
7558 + if (nr_pages > high)
7559 + try_to_free_mem_cgroup_pages(memcg, nr_pages - high,
7560 + GFP_KERNEL, true);
7561 +
7562 memcg_wb_domain_size_changed(memcg);
7563 return nbytes;
7564 }
7565 @@ -5152,6 +5159,8 @@ static ssize_t memory_max_write(struct kernfs_open_file *of,
7566 char *buf, size_t nbytes, loff_t off)
7567 {
7568 struct mem_cgroup *memcg = mem_cgroup_from_css(of_css(of));
7569 + unsigned int nr_reclaims = MEM_CGROUP_RECLAIM_RETRIES;
7570 + bool drained = false;
7571 unsigned long max;
7572 int err;
7573
7574 @@ -5160,9 +5169,36 @@ static ssize_t memory_max_write(struct kernfs_open_file *of,
7575 if (err)
7576 return err;
7577
7578 - err = mem_cgroup_resize_limit(memcg, max);
7579 - if (err)
7580 - return err;
7581 + xchg(&memcg->memory.limit, max);
7582 +
7583 + for (;;) {
7584 + unsigned long nr_pages = page_counter_read(&memcg->memory);
7585 +
7586 + if (nr_pages <= max)
7587 + break;
7588 +
7589 + if (signal_pending(current)) {
7590 + err = -EINTR;
7591 + break;
7592 + }
7593 +
7594 + if (!drained) {
7595 + drain_all_stock(memcg);
7596 + drained = true;
7597 + continue;
7598 + }
7599 +
7600 + if (nr_reclaims) {
7601 + if (!try_to_free_mem_cgroup_pages(memcg, nr_pages - max,
7602 + GFP_KERNEL, true))
7603 + nr_reclaims--;
7604 + continue;
7605 + }
7606 +
7607 + mem_cgroup_events(memcg, MEMCG_OOM, 1);
7608 + if (!mem_cgroup_out_of_memory(memcg, GFP_KERNEL, 0))
7609 + break;
7610 + }
7611
7612 memcg_wb_domain_size_changed(memcg);
7613 return nbytes;
7614 diff --git a/mm/page_alloc.c b/mm/page_alloc.c
7615 index 9d666df5ef95..c69531afbd8f 100644
7616 --- a/mm/page_alloc.c
7617 +++ b/mm/page_alloc.c
7618 @@ -662,34 +662,28 @@ static inline void __free_one_page(struct page *page,
7619 unsigned long combined_idx;
7620 unsigned long uninitialized_var(buddy_idx);
7621 struct page *buddy;
7622 - unsigned int max_order = MAX_ORDER;
7623 + unsigned int max_order;
7624 +
7625 + max_order = min_t(unsigned int, MAX_ORDER, pageblock_order + 1);
7626
7627 VM_BUG_ON(!zone_is_initialized(zone));
7628 VM_BUG_ON_PAGE(page->flags & PAGE_FLAGS_CHECK_AT_PREP, page);
7629
7630 VM_BUG_ON(migratetype == -1);
7631 - if (is_migrate_isolate(migratetype)) {
7632 - /*
7633 - * We restrict max order of merging to prevent merge
7634 - * between freepages on isolate pageblock and normal
7635 - * pageblock. Without this, pageblock isolation
7636 - * could cause incorrect freepage accounting.
7637 - */
7638 - max_order = min_t(unsigned int, MAX_ORDER, pageblock_order + 1);
7639 - } else {
7640 + if (likely(!is_migrate_isolate(migratetype)))
7641 __mod_zone_freepage_state(zone, 1 << order, migratetype);
7642 - }
7643
7644 - page_idx = pfn & ((1 << max_order) - 1);
7645 + page_idx = pfn & ((1 << MAX_ORDER) - 1);
7646
7647 VM_BUG_ON_PAGE(page_idx & ((1 << order) - 1), page);
7648 VM_BUG_ON_PAGE(bad_range(zone, page), page);
7649
7650 +continue_merging:
7651 while (order < max_order - 1) {
7652 buddy_idx = __find_buddy_index(page_idx, order);
7653 buddy = page + (buddy_idx - page_idx);
7654 if (!page_is_buddy(page, buddy, order))
7655 - break;
7656 + goto done_merging;
7657 /*
7658 * Our buddy is free or it is CONFIG_DEBUG_PAGEALLOC guard page,
7659 * merge with it and move up one order.
7660 @@ -706,6 +700,32 @@ static inline void __free_one_page(struct page *page,
7661 page_idx = combined_idx;
7662 order++;
7663 }
7664 + if (max_order < MAX_ORDER) {
7665 + /* If we are here, it means order is >= pageblock_order.
7666 + * We want to prevent merge between freepages on isolate
7667 + * pageblock and normal pageblock. Without this, pageblock
7668 + * isolation could cause incorrect freepage or CMA accounting.
7669 + *
7670 + * We don't want to hit this code for the more frequent
7671 + * low-order merging.
7672 + */
7673 + if (unlikely(has_isolate_pageblock(zone))) {
7674 + int buddy_mt;
7675 +
7676 + buddy_idx = __find_buddy_index(page_idx, order);
7677 + buddy = page + (buddy_idx - page_idx);
7678 + buddy_mt = get_pageblock_migratetype(buddy);
7679 +
7680 + if (migratetype != buddy_mt
7681 + && (is_migrate_isolate(migratetype) ||
7682 + is_migrate_isolate(buddy_mt)))
7683 + goto done_merging;
7684 + }
7685 + max_order++;
7686 + goto continue_merging;
7687 + }
7688 +
7689 +done_merging:
7690 set_page_order(page, order);
7691
7692 /*
7693 diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
7694 index 7f22119276f3..b1b0a1c0bd8d 100644
7695 --- a/net/bluetooth/mgmt.c
7696 +++ b/net/bluetooth/mgmt.c
7697 @@ -7155,6 +7155,10 @@ static int add_advertising(struct sock *sk, struct hci_dev *hdev,
7698 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7699 status);
7700
7701 + if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
7702 + return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7703 + MGMT_STATUS_INVALID_PARAMS);
7704 +
7705 flags = __le32_to_cpu(cp->flags);
7706 timeout = __le16_to_cpu(cp->timeout);
7707 duration = __le16_to_cpu(cp->duration);
7708 diff --git a/scripts/coccinelle/iterators/use_after_iter.cocci b/scripts/coccinelle/iterators/use_after_iter.cocci
7709 index f085f5968c52..ce8cc9c006e5 100644
7710 --- a/scripts/coccinelle/iterators/use_after_iter.cocci
7711 +++ b/scripts/coccinelle/iterators/use_after_iter.cocci
7712 @@ -123,7 +123,7 @@ list_remove_head(x,c,...)
7713 |
7714 sizeof(<+...c...+>)
7715 |
7716 -&c->member
7717 + &c->member
7718 |
7719 c = E
7720 |
7721 diff --git a/scripts/kconfig/Makefile b/scripts/kconfig/Makefile
7722 index d79cba4ce3eb..ebced77deb9c 100644
7723 --- a/scripts/kconfig/Makefile
7724 +++ b/scripts/kconfig/Makefile
7725 @@ -96,13 +96,15 @@ savedefconfig: $(obj)/conf
7726 defconfig: $(obj)/conf
7727 ifeq ($(KBUILD_DEFCONFIG),)
7728 $< $(silent) --defconfig $(Kconfig)
7729 -else ifneq ($(wildcard $(srctree)/arch/$(SRCARCH)/configs/$(KBUILD_DEFCONFIG)),)
7730 +else
7731 +ifneq ($(wildcard $(srctree)/arch/$(SRCARCH)/configs/$(KBUILD_DEFCONFIG)),)
7732 @$(kecho) "*** Default configuration is based on '$(KBUILD_DEFCONFIG)'"
7733 $(Q)$< $(silent) --defconfig=arch/$(SRCARCH)/configs/$(KBUILD_DEFCONFIG) $(Kconfig)
7734 else
7735 @$(kecho) "*** Default configuration is based on target '$(KBUILD_DEFCONFIG)'"
7736 $(Q)$(MAKE) -f $(srctree)/Makefile $(KBUILD_DEFCONFIG)
7737 endif
7738 +endif
7739
7740 %_defconfig: $(obj)/conf
7741 $(Q)$< $(silent) --defconfig=arch/$(SRCARCH)/configs/$@ $(Kconfig)
7742 diff --git a/scripts/package/mkspec b/scripts/package/mkspec
7743 index 71004daefe31..fe44d68e9344 100755
7744 --- a/scripts/package/mkspec
7745 +++ b/scripts/package/mkspec
7746 @@ -131,11 +131,11 @@ echo 'rm -rf $RPM_BUILD_ROOT'
7747 echo ""
7748 echo "%post"
7749 echo "if [ -x /sbin/installkernel -a -r /boot/vmlinuz-$KERNELRELEASE -a -r /boot/System.map-$KERNELRELEASE ]; then"
7750 -echo "cp /boot/vmlinuz-$KERNELRELEASE /boot/vmlinuz-$KERNELRELEASE-rpm"
7751 -echo "cp /boot/System.map-$KERNELRELEASE /boot/System.map-$KERNELRELEASE-rpm"
7752 +echo "cp /boot/vmlinuz-$KERNELRELEASE /boot/.vmlinuz-$KERNELRELEASE-rpm"
7753 +echo "cp /boot/System.map-$KERNELRELEASE /boot/.System.map-$KERNELRELEASE-rpm"
7754 echo "rm -f /boot/vmlinuz-$KERNELRELEASE /boot/System.map-$KERNELRELEASE"
7755 -echo "/sbin/installkernel $KERNELRELEASE /boot/vmlinuz-$KERNELRELEASE-rpm /boot/System.map-$KERNELRELEASE-rpm"
7756 -echo "rm -f /boot/vmlinuz-$KERNELRELEASE-rpm /boot/System.map-$KERNELRELEASE-rpm"
7757 +echo "/sbin/installkernel $KERNELRELEASE /boot/.vmlinuz-$KERNELRELEASE-rpm /boot/.System.map-$KERNELRELEASE-rpm"
7758 +echo "rm -f /boot/.vmlinuz-$KERNELRELEASE-rpm /boot/.System.map-$KERNELRELEASE-rpm"
7759 echo "fi"
7760 echo ""
7761 echo "%files"
7762 diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
7763 index 6b5a811e01a5..3a9b66c6e09c 100644
7764 --- a/sound/core/pcm_lib.c
7765 +++ b/sound/core/pcm_lib.c
7766 @@ -322,7 +322,7 @@ static int snd_pcm_update_hw_ptr0(struct snd_pcm_substream *substream,
7767 char name[16];
7768 snd_pcm_debug_name(substream, name, sizeof(name));
7769 pcm_err(substream->pcm,
7770 - "BUG: %s, pos = %ld, buffer size = %ld, period size = %ld\n",
7771 + "invalid position: %s, pos = %ld, buffer size = %ld, period size = %ld\n",
7772 name, pos, runtime->buffer_size,
7773 runtime->period_size);
7774 }
7775 diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
7776 index c1c855a6c0af..a47e8ae0eb30 100644
7777 --- a/sound/pci/hda/patch_cirrus.c
7778 +++ b/sound/pci/hda/patch_cirrus.c
7779 @@ -174,8 +174,12 @@ static void cs_automute(struct hda_codec *codec)
7780 snd_hda_gen_update_outputs(codec);
7781
7782 if (spec->gpio_eapd_hp || spec->gpio_eapd_speaker) {
7783 - spec->gpio_data = spec->gen.hp_jack_present ?
7784 - spec->gpio_eapd_hp : spec->gpio_eapd_speaker;
7785 + if (spec->gen.automute_speaker)
7786 + spec->gpio_data = spec->gen.hp_jack_present ?
7787 + spec->gpio_eapd_hp : spec->gpio_eapd_speaker;
7788 + else
7789 + spec->gpio_data =
7790 + spec->gpio_eapd_hp | spec->gpio_eapd_speaker;
7791 snd_hda_codec_write(codec, 0x01, 0,
7792 AC_VERB_SET_GPIO_DATA, spec->gpio_data);
7793 }
7794 diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
7795 index ef198903c0c3..600af5878e75 100644
7796 --- a/sound/pci/hda/patch_conexant.c
7797 +++ b/sound/pci/hda/patch_conexant.c
7798 @@ -204,8 +204,13 @@ static void cx_auto_reboot_notify(struct hda_codec *codec)
7799 {
7800 struct conexant_spec *spec = codec->spec;
7801
7802 - if (codec->core.vendor_id != 0x14f150f2)
7803 + switch (codec->core.vendor_id) {
7804 + case 0x14f150f2: /* CX20722 */
7805 + case 0x14f150f4: /* CX20724 */
7806 + break;
7807 + default:
7808 return;
7809 + }
7810
7811 /* Turn the CX20722 codec into D3 to avoid spurious noises
7812 from the internal speaker during (and after) reboot */
7813 diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
7814 index 70c945603379..f7bcd8dbac14 100644
7815 --- a/sound/pci/hda/patch_hdmi.c
7816 +++ b/sound/pci/hda/patch_hdmi.c
7817 @@ -2353,6 +2353,10 @@ static void intel_pin_eld_notify(void *audio_ptr, int port)
7818 struct hda_codec *codec = audio_ptr;
7819 int pin_nid = port + 0x04;
7820
7821 + /* we assume only from port-B to port-D */
7822 + if (port < 1 || port > 3)
7823 + return;
7824 +
7825 /* skip notification during system suspend (but not in runtime PM);
7826 * the state will be updated at resume
7827 */
7828 diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
7829 index c2430b36e1ce..6968b796baa3 100644
7830 --- a/sound/pci/hda/patch_realtek.c
7831 +++ b/sound/pci/hda/patch_realtek.c
7832 @@ -5529,6 +5529,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
7833 SND_PCI_QUIRK(0x17aa, 0x2226, "ThinkPad X250", ALC292_FIXUP_TPT440_DOCK),
7834 SND_PCI_QUIRK(0x17aa, 0x2233, "Thinkpad", ALC293_FIXUP_LENOVO_SPK_NOISE),
7835 SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
7836 + SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
7837 SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
7838 SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC),
7839 SND_PCI_QUIRK(0x17aa, 0x3978, "IdeaPad Y410P", ALC269_FIXUP_NO_SHUTUP),
7840 diff --git a/sound/pci/intel8x0.c b/sound/pci/intel8x0.c
7841 index 42bcbac801a3..ccdab29a8b66 100644
7842 --- a/sound/pci/intel8x0.c
7843 +++ b/sound/pci/intel8x0.c
7844 @@ -2879,6 +2879,7 @@ static void intel8x0_measure_ac97_clock(struct intel8x0 *chip)
7845
7846 static struct snd_pci_quirk intel8x0_clock_list[] = {
7847 SND_PCI_QUIRK(0x0e11, 0x008a, "AD1885", 41000),
7848 + SND_PCI_QUIRK(0x1014, 0x0581, "AD1981B", 48000),
7849 SND_PCI_QUIRK(0x1028, 0x00be, "AD1885", 44100),
7850 SND_PCI_QUIRK(0x1028, 0x0177, "AD1980", 48000),
7851 SND_PCI_QUIRK(0x1028, 0x01ad, "AD1981B", 48000),
7852 diff --git a/sound/soc/samsung/ac97.c b/sound/soc/samsung/ac97.c
7853 index e4145509d63c..9c5219392460 100644
7854 --- a/sound/soc/samsung/ac97.c
7855 +++ b/sound/soc/samsung/ac97.c
7856 @@ -324,7 +324,7 @@ static const struct snd_soc_component_driver s3c_ac97_component = {
7857
7858 static int s3c_ac97_probe(struct platform_device *pdev)
7859 {
7860 - struct resource *mem_res, *dmatx_res, *dmarx_res, *dmamic_res, *irq_res;
7861 + struct resource *mem_res, *irq_res;
7862 struct s3c_audio_pdata *ac97_pdata;
7863 int ret;
7864
7865 @@ -335,24 +335,6 @@ static int s3c_ac97_probe(struct platform_device *pdev)
7866 }
7867
7868 /* Check for availability of necessary resource */
7869 - dmatx_res = platform_get_resource(pdev, IORESOURCE_DMA, 0);
7870 - if (!dmatx_res) {
7871 - dev_err(&pdev->dev, "Unable to get AC97-TX dma resource\n");
7872 - return -ENXIO;
7873 - }
7874 -
7875 - dmarx_res = platform_get_resource(pdev, IORESOURCE_DMA, 1);
7876 - if (!dmarx_res) {
7877 - dev_err(&pdev->dev, "Unable to get AC97-RX dma resource\n");
7878 - return -ENXIO;
7879 - }
7880 -
7881 - dmamic_res = platform_get_resource(pdev, IORESOURCE_DMA, 2);
7882 - if (!dmamic_res) {
7883 - dev_err(&pdev->dev, "Unable to get AC97-MIC dma resource\n");
7884 - return -ENXIO;
7885 - }
7886 -
7887 irq_res = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
7888 if (!irq_res) {
7889 dev_err(&pdev->dev, "AC97 IRQ not provided!\n");
7890 @@ -364,11 +346,11 @@ static int s3c_ac97_probe(struct platform_device *pdev)
7891 if (IS_ERR(s3c_ac97.regs))
7892 return PTR_ERR(s3c_ac97.regs);
7893
7894 - s3c_ac97_pcm_out.channel = dmatx_res->start;
7895 + s3c_ac97_pcm_out.slave = ac97_pdata->dma_playback;
7896 s3c_ac97_pcm_out.dma_addr = mem_res->start + S3C_AC97_PCM_DATA;
7897 - s3c_ac97_pcm_in.channel = dmarx_res->start;
7898 + s3c_ac97_pcm_in.slave = ac97_pdata->dma_capture;
7899 s3c_ac97_pcm_in.dma_addr = mem_res->start + S3C_AC97_PCM_DATA;
7900 - s3c_ac97_mic_in.channel = dmamic_res->start;
7901 + s3c_ac97_mic_in.slave = ac97_pdata->dma_capture_mic;
7902 s3c_ac97_mic_in.dma_addr = mem_res->start + S3C_AC97_MIC_DATA;
7903
7904 init_completion(&s3c_ac97.done);
7905 diff --git a/sound/soc/samsung/dma.h b/sound/soc/samsung/dma.h
7906 index 0e85dcfec023..085ef30f5ca2 100644
7907 --- a/sound/soc/samsung/dma.h
7908 +++ b/sound/soc/samsung/dma.h
7909 @@ -15,7 +15,7 @@
7910 #include <sound/dmaengine_pcm.h>
7911
7912 struct s3c_dma_params {
7913 - int channel; /* Channel ID */
7914 + void *slave; /* Channel ID */
7915 dma_addr_t dma_addr;
7916 int dma_size; /* Size of the DMA transfer */
7917 char *ch_name;
7918 diff --git a/sound/soc/samsung/dmaengine.c b/sound/soc/samsung/dmaengine.c
7919 index 506f5bf6d082..727008d57d14 100644
7920 --- a/sound/soc/samsung/dmaengine.c
7921 +++ b/sound/soc/samsung/dmaengine.c
7922 @@ -50,14 +50,14 @@ void samsung_asoc_init_dma_data(struct snd_soc_dai *dai,
7923
7924 if (playback) {
7925 playback_data = &playback->dma_data;
7926 - playback_data->filter_data = (void *)playback->channel;
7927 + playback_data->filter_data = playback->slave;
7928 playback_data->chan_name = playback->ch_name;
7929 playback_data->addr = playback->dma_addr;
7930 playback_data->addr_width = playback->dma_size;
7931 }
7932 if (capture) {
7933 capture_data = &capture->dma_data;
7934 - capture_data->filter_data = (void *)capture->channel;
7935 + capture_data->filter_data = capture->slave;
7936 capture_data->chan_name = capture->ch_name;
7937 capture_data->addr = capture->dma_addr;
7938 capture_data->addr_width = capture->dma_size;
7939 diff --git a/sound/soc/samsung/i2s.c b/sound/soc/samsung/i2s.c
7940 index 7dbf899b2af2..e163b0148c4b 100644
7941 --- a/sound/soc/samsung/i2s.c
7942 +++ b/sound/soc/samsung/i2s.c
7943 @@ -1260,27 +1260,14 @@ static int samsung_i2s_probe(struct platform_device *pdev)
7944 pri_dai->lock = &pri_dai->spinlock;
7945
7946 if (!np) {
7947 - res = platform_get_resource(pdev, IORESOURCE_DMA, 0);
7948 - if (!res) {
7949 - dev_err(&pdev->dev,
7950 - "Unable to get I2S-TX dma resource\n");
7951 - return -ENXIO;
7952 - }
7953 - pri_dai->dma_playback.channel = res->start;
7954 -
7955 - res = platform_get_resource(pdev, IORESOURCE_DMA, 1);
7956 - if (!res) {
7957 - dev_err(&pdev->dev,
7958 - "Unable to get I2S-RX dma resource\n");
7959 - return -ENXIO;
7960 - }
7961 - pri_dai->dma_capture.channel = res->start;
7962 -
7963 if (i2s_pdata == NULL) {
7964 dev_err(&pdev->dev, "Can't work without s3c_audio_pdata\n");
7965 return -EINVAL;
7966 }
7967
7968 + pri_dai->dma_playback.slave = i2s_pdata->dma_playback;
7969 + pri_dai->dma_capture.slave = i2s_pdata->dma_capture;
7970 +
7971 if (&i2s_pdata->type)
7972 i2s_cfg = &i2s_pdata->type.i2s;
7973
7974 @@ -1341,11 +1328,8 @@ static int samsung_i2s_probe(struct platform_device *pdev)
7975 sec_dai->dma_playback.dma_addr = regs_base + I2STXDS;
7976 sec_dai->dma_playback.ch_name = "tx-sec";
7977
7978 - if (!np) {
7979 - res = platform_get_resource(pdev, IORESOURCE_DMA, 2);
7980 - if (res)
7981 - sec_dai->dma_playback.channel = res->start;
7982 - }
7983 + if (!np)
7984 + sec_dai->dma_playback.slave = i2s_pdata->dma_play_sec;
7985
7986 sec_dai->dma_playback.dma_size = 4;
7987 sec_dai->addr = pri_dai->addr;
7988 diff --git a/sound/soc/samsung/pcm.c b/sound/soc/samsung/pcm.c
7989 index b320a9d3fbf8..c77f324e0bb8 100644
7990 --- a/sound/soc/samsung/pcm.c
7991 +++ b/sound/soc/samsung/pcm.c
7992 @@ -486,7 +486,7 @@ static const struct snd_soc_component_driver s3c_pcm_component = {
7993 static int s3c_pcm_dev_probe(struct platform_device *pdev)
7994 {
7995 struct s3c_pcm_info *pcm;
7996 - struct resource *mem_res, *dmatx_res, *dmarx_res;
7997 + struct resource *mem_res;
7998 struct s3c_audio_pdata *pcm_pdata;
7999 int ret;
8000
8001 @@ -499,18 +499,6 @@ static int s3c_pcm_dev_probe(struct platform_device *pdev)
8002 pcm_pdata = pdev->dev.platform_data;
8003
8004 /* Check for availability of necessary resource */
8005 - dmatx_res = platform_get_resource(pdev, IORESOURCE_DMA, 0);
8006 - if (!dmatx_res) {
8007 - dev_err(&pdev->dev, "Unable to get PCM-TX dma resource\n");
8008 - return -ENXIO;
8009 - }
8010 -
8011 - dmarx_res = platform_get_resource(pdev, IORESOURCE_DMA, 1);
8012 - if (!dmarx_res) {
8013 - dev_err(&pdev->dev, "Unable to get PCM-RX dma resource\n");
8014 - return -ENXIO;
8015 - }
8016 -
8017 mem_res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
8018 if (!mem_res) {
8019 dev_err(&pdev->dev, "Unable to get register resource\n");
8020 @@ -568,8 +556,10 @@ static int s3c_pcm_dev_probe(struct platform_device *pdev)
8021 s3c_pcm_stereo_out[pdev->id].dma_addr = mem_res->start
8022 + S3C_PCM_TXFIFO;
8023
8024 - s3c_pcm_stereo_in[pdev->id].channel = dmarx_res->start;
8025 - s3c_pcm_stereo_out[pdev->id].channel = dmatx_res->start;
8026 + if (pcm_pdata) {
8027 + s3c_pcm_stereo_in[pdev->id].slave = pcm_pdata->dma_capture;
8028 + s3c_pcm_stereo_out[pdev->id].slave = pcm_pdata->dma_playback;
8029 + }
8030
8031 pcm->dma_capture = &s3c_pcm_stereo_in[pdev->id];
8032 pcm->dma_playback = &s3c_pcm_stereo_out[pdev->id];
8033 diff --git a/sound/soc/samsung/s3c2412-i2s.c b/sound/soc/samsung/s3c2412-i2s.c
8034 index 2b766d212ce0..77d27c85a32a 100644
8035 --- a/sound/soc/samsung/s3c2412-i2s.c
8036 +++ b/sound/soc/samsung/s3c2412-i2s.c
8037 @@ -34,13 +34,13 @@
8038 #include "s3c2412-i2s.h"
8039
8040 static struct s3c_dma_params s3c2412_i2s_pcm_stereo_out = {
8041 - .channel = DMACH_I2S_OUT,
8042 + .slave = (void *)(uintptr_t)DMACH_I2S_OUT,
8043 .ch_name = "tx",
8044 .dma_size = 4,
8045 };
8046
8047 static struct s3c_dma_params s3c2412_i2s_pcm_stereo_in = {
8048 - .channel = DMACH_I2S_IN,
8049 + .slave = (void *)(uintptr_t)DMACH_I2S_IN,
8050 .ch_name = "rx",
8051 .dma_size = 4,
8052 };
8053 diff --git a/sound/soc/samsung/s3c24xx-i2s.c b/sound/soc/samsung/s3c24xx-i2s.c
8054 index 5bf723689692..9da3a77ea2c7 100644
8055 --- a/sound/soc/samsung/s3c24xx-i2s.c
8056 +++ b/sound/soc/samsung/s3c24xx-i2s.c
8057 @@ -32,13 +32,13 @@
8058 #include "s3c24xx-i2s.h"
8059
8060 static struct s3c_dma_params s3c24xx_i2s_pcm_stereo_out = {
8061 - .channel = DMACH_I2S_OUT,
8062 + .slave = (void *)(uintptr_t)DMACH_I2S_OUT,
8063 .ch_name = "tx",
8064 .dma_size = 2,
8065 };
8066
8067 static struct s3c_dma_params s3c24xx_i2s_pcm_stereo_in = {
8068 - .channel = DMACH_I2S_IN,
8069 + .slave = (void *)(uintptr_t)DMACH_I2S_IN,
8070 .ch_name = "rx",
8071 .dma_size = 2,
8072 };
8073 diff --git a/sound/soc/samsung/spdif.c b/sound/soc/samsung/spdif.c
8074 index 36dbc0e96004..9dd7ee6d03ff 100644
8075 --- a/sound/soc/samsung/spdif.c
8076 +++ b/sound/soc/samsung/spdif.c
8077 @@ -359,7 +359,7 @@ static const struct snd_soc_component_driver samsung_spdif_component = {
8078 static int spdif_probe(struct platform_device *pdev)
8079 {
8080 struct s3c_audio_pdata *spdif_pdata;
8081 - struct resource *mem_res, *dma_res;
8082 + struct resource *mem_res;
8083 struct samsung_spdif_info *spdif;
8084 int ret;
8085
8086 @@ -367,12 +367,6 @@ static int spdif_probe(struct platform_device *pdev)
8087
8088 dev_dbg(&pdev->dev, "Entered %s\n", __func__);
8089
8090 - dma_res = platform_get_resource(pdev, IORESOURCE_DMA, 0);
8091 - if (!dma_res) {
8092 - dev_err(&pdev->dev, "Unable to get dma resource.\n");
8093 - return -ENXIO;
8094 - }
8095 -
8096 mem_res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
8097 if (!mem_res) {
8098 dev_err(&pdev->dev, "Unable to get register resource.\n");
8099 @@ -432,7 +426,7 @@ static int spdif_probe(struct platform_device *pdev)
8100
8101 spdif_stereo_out.dma_size = 2;
8102 spdif_stereo_out.dma_addr = mem_res->start + DATA_OUTBUF;
8103 - spdif_stereo_out.channel = dma_res->start;
8104 + spdif_stereo_out.slave = spdif_pdata ? spdif_pdata->dma_playback : NULL;
8105
8106 spdif->dma_playback = &spdif_stereo_out;
8107
8108 diff --git a/sound/usb/clock.c b/sound/usb/clock.c
8109 index 2ed260b10f6d..7ccbcaf6a147 100644
8110 --- a/sound/usb/clock.c
8111 +++ b/sound/usb/clock.c
8112 @@ -285,6 +285,8 @@ static int set_sample_rate_v1(struct snd_usb_audio *chip, int iface,
8113 unsigned char data[3];
8114 int err, crate;
8115
8116 + if (get_iface_desc(alts)->bNumEndpoints < 1)
8117 + return -EINVAL;
8118 ep = get_endpoint(alts, 0)->bEndpointAddress;
8119
8120 /* if endpoint doesn't have sampling rate control, bail out */
8121 diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
8122 index 7b1cb365ffab..c07a7eda42a2 100644
8123 --- a/sound/usb/endpoint.c
8124 +++ b/sound/usb/endpoint.c
8125 @@ -438,6 +438,9 @@ exit_clear:
8126 *
8127 * New endpoints will be added to chip->ep_list and must be freed by
8128 * calling snd_usb_endpoint_free().
8129 + *
8130 + * For SND_USB_ENDPOINT_TYPE_SYNC, the caller needs to guarantee that
8131 + * bNumEndpoints > 1 beforehand.
8132 */
8133 struct snd_usb_endpoint *snd_usb_add_endpoint(struct snd_usb_audio *chip,
8134 struct usb_host_interface *alts,
8135 diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
8136 index 279025650568..f6c3bf79af9a 100644
8137 --- a/sound/usb/mixer_quirks.c
8138 +++ b/sound/usb/mixer_quirks.c
8139 @@ -1519,7 +1519,11 @@ static int snd_microii_spdif_default_get(struct snd_kcontrol *kcontrol,
8140
8141 /* use known values for that card: interface#1 altsetting#1 */
8142 iface = usb_ifnum_to_if(chip->dev, 1);
8143 + if (!iface || iface->num_altsetting < 2)
8144 + return -EINVAL;
8145 alts = &iface->altsetting[1];
8146 + if (get_iface_desc(alts)->bNumEndpoints < 1)
8147 + return -EINVAL;
8148 ep = get_endpoint(alts, 0)->bEndpointAddress;
8149
8150 err = snd_usb_ctl_msg(chip->dev,
8151 diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
8152 index 9245f52d43bd..44d178ee9177 100644
8153 --- a/sound/usb/pcm.c
8154 +++ b/sound/usb/pcm.c
8155 @@ -159,6 +159,8 @@ static int init_pitch_v1(struct snd_usb_audio *chip, int iface,
8156 unsigned char data[1];
8157 int err;
8158
8159 + if (get_iface_desc(alts)->bNumEndpoints < 1)
8160 + return -EINVAL;
8161 ep = get_endpoint(alts, 0)->bEndpointAddress;
8162
8163 data[0] = 1;
8164 diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
8165 index c458d60d5030..cd7eac28edee 100644
8166 --- a/sound/usb/quirks.c
8167 +++ b/sound/usb/quirks.c
8168 @@ -150,6 +150,7 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip,
8169 usb_audio_err(chip, "cannot memdup\n");
8170 return -ENOMEM;
8171 }
8172 + INIT_LIST_HEAD(&fp->list);
8173 if (fp->nr_rates > MAX_NR_RATES) {
8174 kfree(fp);
8175 return -EINVAL;
8176 @@ -167,19 +168,20 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip,
8177 stream = (fp->endpoint & USB_DIR_IN)
8178 ? SNDRV_PCM_STREAM_CAPTURE : SNDRV_PCM_STREAM_PLAYBACK;
8179 err = snd_usb_add_audio_stream(chip, stream, fp);
8180 - if (err < 0) {
8181 - kfree(fp);
8182 - kfree(rate_table);
8183 - return err;
8184 - }
8185 + if (err < 0)
8186 + goto error;
8187 if (fp->iface != get_iface_desc(&iface->altsetting[0])->bInterfaceNumber ||
8188 fp->altset_idx >= iface->num_altsetting) {
8189 - kfree(fp);
8190 - kfree(rate_table);
8191 - return -EINVAL;
8192 + err = -EINVAL;
8193 + goto error;
8194 }
8195 alts = &iface->altsetting[fp->altset_idx];
8196 altsd = get_iface_desc(alts);
8197 + if (altsd->bNumEndpoints < 1) {
8198 + err = -EINVAL;
8199 + goto error;
8200 + }
8201 +
8202 fp->protocol = altsd->bInterfaceProtocol;
8203
8204 if (fp->datainterval == 0)
8205 @@ -190,6 +192,12 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip,
8206 snd_usb_init_pitch(chip, fp->iface, alts, fp);
8207 snd_usb_init_sample_rate(chip, fp->iface, alts, fp, fp->rate_max);
8208 return 0;
8209 +
8210 + error:
8211 + list_del(&fp->list); /* unlink for avoiding double-free */
8212 + kfree(fp);
8213 + kfree(rate_table);
8214 + return err;
8215 }
8216
8217 static int create_auto_pcm_quirk(struct snd_usb_audio *chip,
8218 @@ -462,6 +470,7 @@ static int create_uaxx_quirk(struct snd_usb_audio *chip,
8219 fp->ep_attr = get_endpoint(alts, 0)->bmAttributes;
8220 fp->datainterval = 0;
8221 fp->maxpacksize = le16_to_cpu(get_endpoint(alts, 0)->wMaxPacketSize);
8222 + INIT_LIST_HEAD(&fp->list);
8223
8224 switch (fp->maxpacksize) {
8225 case 0x120:
8226 @@ -485,6 +494,7 @@ static int create_uaxx_quirk(struct snd_usb_audio *chip,
8227 ? SNDRV_PCM_STREAM_CAPTURE : SNDRV_PCM_STREAM_PLAYBACK;
8228 err = snd_usb_add_audio_stream(chip, stream, fp);
8229 if (err < 0) {
8230 + list_del(&fp->list); /* unlink for avoiding double-free */
8231 kfree(fp);
8232 return err;
8233 }
8234 @@ -1121,6 +1131,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
8235 switch (chip->usb_id) {
8236 case USB_ID(0x045E, 0x075D): /* MS Lifecam Cinema */
8237 case USB_ID(0x045E, 0x076D): /* MS Lifecam HD-5000 */
8238 + case USB_ID(0x045E, 0x076E): /* MS Lifecam HD-5001 */
8239 case USB_ID(0x045E, 0x076F): /* MS Lifecam HD-6000 */
8240 case USB_ID(0x045E, 0x0772): /* MS Lifecam Studio */
8241 case USB_ID(0x045E, 0x0779): /* MS Lifecam HD-3000 */
8242 diff --git a/sound/usb/stream.c b/sound/usb/stream.c
8243 index 8ee14f2365e7..3b23102230c0 100644
8244 --- a/sound/usb/stream.c
8245 +++ b/sound/usb/stream.c
8246 @@ -316,7 +316,9 @@ static struct snd_pcm_chmap_elem *convert_chmap(int channels, unsigned int bits,
8247 /*
8248 * add this endpoint to the chip instance.
8249 * if a stream with the same endpoint already exists, append to it.
8250 - * if not, create a new pcm stream.
8251 + * if not, create a new pcm stream. note, fp is added to the substream
8252 + * fmt_list and will be freed on the chip instance release. do not free
8253 + * fp or do remove it from the substream fmt_list to avoid double-free.
8254 */
8255 int snd_usb_add_audio_stream(struct snd_usb_audio *chip,
8256 int stream,
8257 @@ -677,6 +679,7 @@ int snd_usb_parse_audio_interface(struct snd_usb_audio *chip, int iface_no)
8258 * (fp->maxpacksize & 0x7ff);
8259 fp->attributes = parse_uac_endpoint_attributes(chip, alts, protocol, iface_no);
8260 fp->clock = clock;
8261 + INIT_LIST_HEAD(&fp->list);
8262
8263 /* some quirks for attributes here */
8264
8265 @@ -725,6 +728,7 @@ int snd_usb_parse_audio_interface(struct snd_usb_audio *chip, int iface_no)
8266 dev_dbg(&dev->dev, "%u:%d: add audio endpoint %#x\n", iface_no, altno, fp->endpoint);
8267 err = snd_usb_add_audio_stream(chip, stream, fp);
8268 if (err < 0) {
8269 + list_del(&fp->list); /* unlink for avoiding double-free */
8270 kfree(fp->rate_table);
8271 kfree(fp->chmap);
8272 kfree(fp);
8273 diff --git a/tools/hv/Makefile b/tools/hv/Makefile
8274 index a8ab79556926..a8c4644022a6 100644
8275 --- a/tools/hv/Makefile
8276 +++ b/tools/hv/Makefile
8277 @@ -5,6 +5,8 @@ PTHREAD_LIBS = -lpthread
8278 WARNINGS = -Wall -Wextra
8279 CFLAGS = $(WARNINGS) -g $(PTHREAD_LIBS) $(shell getconf LFS_CFLAGS)
8280
8281 +CFLAGS += -D__EXPORTED_HEADERS__ -I../../include/uapi -I../../include
8282 +
8283 all: hv_kvp_daemon hv_vss_daemon hv_fcopy_daemon
8284 %: %.c
8285 $(CC) $(CFLAGS) -o $@ $^
8286 diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c
8287 index b48e87693aa5..a35db828bd0d 100644
8288 --- a/tools/perf/util/parse-events.c
8289 +++ b/tools/perf/util/parse-events.c
8290 @@ -2101,11 +2101,11 @@ char *parse_events_formats_error_string(char *additional_terms)
8291
8292 /* valid terms */
8293 if (additional_terms) {
8294 - if (!asprintf(&str, "valid terms: %s,%s",
8295 - additional_terms, static_terms))
8296 + if (asprintf(&str, "valid terms: %s,%s",
8297 + additional_terms, static_terms) < 0)
8298 goto fail;
8299 } else {
8300 - if (!asprintf(&str, "valid terms: %s", static_terms))
8301 + if (asprintf(&str, "valid terms: %s", static_terms) < 0)
8302 goto fail;
8303 }
8304 return str;
8305 diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c
8306 index e4b173dec4b9..6f2a0279476c 100644
8307 --- a/tools/perf/util/pmu.c
8308 +++ b/tools/perf/util/pmu.c
8309 @@ -283,13 +283,12 @@ static int pmu_aliases_parse(char *dir, struct list_head *head)
8310 {
8311 struct dirent *evt_ent;
8312 DIR *event_dir;
8313 - int ret = 0;
8314
8315 event_dir = opendir(dir);
8316 if (!event_dir)
8317 return -EINVAL;
8318
8319 - while (!ret && (evt_ent = readdir(event_dir))) {
8320 + while ((evt_ent = readdir(event_dir))) {
8321 char path[PATH_MAX];
8322 char *name = evt_ent->d_name;
8323 FILE *file;
8324 @@ -305,17 +304,19 @@ static int pmu_aliases_parse(char *dir, struct list_head *head)
8325
8326 snprintf(path, PATH_MAX, "%s/%s", dir, name);
8327
8328 - ret = -EINVAL;
8329 file = fopen(path, "r");
8330 - if (!file)
8331 - break;
8332 + if (!file) {
8333 + pr_debug("Cannot open %s\n", path);
8334 + continue;
8335 + }
8336
8337 - ret = perf_pmu__new_alias(head, dir, name, file);
8338 + if (perf_pmu__new_alias(head, dir, name, file) < 0)
8339 + pr_debug("Cannot set up %s\n", name);
8340 fclose(file);
8341 }
8342
8343 closedir(event_dir);
8344 - return ret;
8345 + return 0;
8346 }
8347
8348 /*
8349 diff --git a/tools/perf/util/setup.py b/tools/perf/util/setup.py
8350 index 1833103768cb..c8680984d2d6 100644
8351 --- a/tools/perf/util/setup.py
8352 +++ b/tools/perf/util/setup.py
8353 @@ -22,6 +22,7 @@ cflags = getenv('CFLAGS', '').split()
8354 # switch off several checks (need to be at the end of cflags list)
8355 cflags += ['-fno-strict-aliasing', '-Wno-write-strings', '-Wno-unused-parameter' ]
8356
8357 +src_perf = getenv('srctree') + '/tools/perf'
8358 build_lib = getenv('PYTHON_EXTBUILD_LIB')
8359 build_tmp = getenv('PYTHON_EXTBUILD_TMP')
8360 libtraceevent = getenv('LIBTRACEEVENT')
8361 @@ -30,6 +31,9 @@ libapikfs = getenv('LIBAPI')
8362 ext_sources = [f.strip() for f in file('util/python-ext-sources')
8363 if len(f.strip()) > 0 and f[0] != '#']
8364
8365 +# use full paths with source files
8366 +ext_sources = map(lambda x: '%s/%s' % (src_perf, x) , ext_sources)
8367 +
8368 perf = Extension('perf',
8369 sources = ext_sources,
8370 include_dirs = ['util/include'],
8371 diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
8372 index 7338e30421d8..fefbf2d148ef 100644
8373 --- a/virt/kvm/kvm_main.c
8374 +++ b/virt/kvm/kvm_main.c
8375 @@ -547,6 +547,16 @@ static struct kvm *kvm_create_vm(unsigned long type)
8376 if (!kvm)
8377 return ERR_PTR(-ENOMEM);
8378
8379 + spin_lock_init(&kvm->mmu_lock);
8380 + atomic_inc(&current->mm->mm_count);
8381 + kvm->mm = current->mm;
8382 + kvm_eventfd_init(kvm);
8383 + mutex_init(&kvm->lock);
8384 + mutex_init(&kvm->irq_lock);
8385 + mutex_init(&kvm->slots_lock);
8386 + atomic_set(&kvm->users_count, 1);
8387 + INIT_LIST_HEAD(&kvm->devices);
8388 +
8389 r = kvm_arch_init_vm(kvm, type);
8390 if (r)
8391 goto out_err_no_disable;
8392 @@ -579,16 +589,6 @@ static struct kvm *kvm_create_vm(unsigned long type)
8393 goto out_err;
8394 }
8395
8396 - spin_lock_init(&kvm->mmu_lock);
8397 - kvm->mm = current->mm;
8398 - atomic_inc(&kvm->mm->mm_count);
8399 - kvm_eventfd_init(kvm);
8400 - mutex_init(&kvm->lock);
8401 - mutex_init(&kvm->irq_lock);
8402 - mutex_init(&kvm->slots_lock);
8403 - atomic_set(&kvm->users_count, 1);
8404 - INIT_LIST_HEAD(&kvm->devices);
8405 -
8406 r = kvm_init_mmu_notifier(kvm);
8407 if (r)
8408 goto out_err;
8409 @@ -613,6 +613,7 @@ out_err_no_disable:
8410 for (i = 0; i < KVM_ADDRESS_SPACE_NUM; i++)
8411 kvm_free_memslots(kvm, kvm->memslots[i]);
8412 kvm_arch_free_vm(kvm);
8413 + mmdrop(current->mm);
8414 return ERR_PTR(r);
8415 }
8416