Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-4.4/0153-4.4.54-all-fixes.patch

    Annotation of /trunk/kernel-alx/patches-4.4/0153-4.4.54-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 2889 - (hide annotations) (download)
    Mon Mar 27 13:49:26 2017 UTC (7 years, 2 months ago) by niro
    File size: 53714 byte(s) 
    linux-4.4.54
    1 niro 2889 diff --git a/Makefile b/Makefile
    2     index 10aec937e9e4..7f54ac081cf3 100644
    3     --- a/Makefile
    4     +++ b/Makefile
    5     @@ -1,6 +1,6 @@
    6     VERSION = 4
    7     PATCHLEVEL = 4
    8     -SUBLEVEL = 53
    9     +SUBLEVEL = 54
    10     EXTRAVERSION =
    11     NAME = Blurry Fish Butt
    12    
    13     diff --git a/arch/s390/include/asm/processor.h b/arch/s390/include/asm/processor.h
    14     index c1ea67db8404..c61ed7890cef 100644
    15     --- a/arch/s390/include/asm/processor.h
    16     +++ b/arch/s390/include/asm/processor.h
    17     @@ -74,7 +74,8 @@ extern void execve_tail(void);
    18     * User space process size: 2GB for 31 bit, 4TB or 8PT for 64 bit.
    19     */
    20    
    21     -#define TASK_SIZE_OF(tsk) ((tsk)->mm->context.asce_limit)
    22     +#define TASK_SIZE_OF(tsk) ((tsk)->mm ? \
    23     + (tsk)->mm->context.asce_limit : TASK_MAX_SIZE)
    24     #define TASK_UNMAPPED_BASE (test_thread_flag(TIF_31BIT) ? \
    25     (1UL << 30) : (1UL << 41))
    26     #define TASK_SIZE TASK_SIZE_OF(current)
    27     diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
    28     index 1f581eb61bc2..d097d71685df 100644
    29     --- a/arch/s390/kernel/setup.c
    30     +++ b/arch/s390/kernel/setup.c
    31     @@ -805,10 +805,10 @@ static void __init setup_randomness(void)
    32     {
    33     struct sysinfo_3_2_2 *vmms;
    34    
    35     - vmms = (struct sysinfo_3_2_2 *) alloc_page(GFP_KERNEL);
    36     - if (vmms && stsi(vmms, 3, 2, 2) == 0 && vmms->count)
    37     - add_device_randomness(&vmms, vmms->count);
    38     - free_page((unsigned long) vmms);
    39     + vmms = (struct sysinfo_3_2_2 *) memblock_alloc(PAGE_SIZE, PAGE_SIZE);
    40     + if (stsi(vmms, 3, 2, 2) == 0 && vmms->count)
    41     + add_device_randomness(&vmms->vm, sizeof(vmms->vm[0]) * vmms->count);
    42     + memblock_free((unsigned long) vmms, PAGE_SIZE);
    43     }
    44    
    45     /*
    46     diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
    47     index 575dc123bda2..23e3f5d77a24 100644
    48     --- a/arch/s390/kvm/kvm-s390.c
    49     +++ b/arch/s390/kvm/kvm-s390.c
    50     @@ -295,6 +295,9 @@ int kvm_vm_ioctl_get_dirty_log(struct kvm *kvm,
    51     struct kvm_memory_slot *memslot;
    52     int is_dirty = 0;
    53    
    54     + if (kvm_is_ucontrol(kvm))
    55     + return -EINVAL;
    56     +
    57     mutex_lock(&kvm->slots_lock);
    58    
    59     r = -EINVAL;
    60     diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
    61     index 64f60a48def1..3a7ae80dc49d 100644
    62     --- a/arch/x86/kvm/vmx.c
    63     +++ b/arch/x86/kvm/vmx.c
    64     @@ -3499,7 +3499,7 @@ static void fix_rmode_seg(int seg, struct kvm_segment *save)
    65     }
    66    
    67     vmcs_write16(sf->selector, var.selector);
    68     - vmcs_write32(sf->base, var.base);
    69     + vmcs_writel(sf->base, var.base);
    70     vmcs_write32(sf->limit, var.limit);
    71     vmcs_write32(sf->ar_bytes, vmx_segment_access_rights(&var));
    72     }
    73     @@ -7905,7 +7905,7 @@ static void kvm_flush_pml_buffers(struct kvm *kvm)
    74     static void vmx_dump_sel(char *name, uint32_t sel)
    75     {
    76     pr_err("%s sel=0x%04x, attr=0x%05x, limit=0x%08x, base=0x%016lx\n",
    77     - name, vmcs_read32(sel),
    78     + name, vmcs_read16(sel),
    79     vmcs_read32(sel + GUEST_ES_AR_BYTES - GUEST_ES_SELECTOR),
    80     vmcs_read32(sel + GUEST_ES_LIMIT - GUEST_ES_SELECTOR),
    81     vmcs_readl(sel + GUEST_ES_BASE - GUEST_ES_SELECTOR));
    82     diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c
    83     index 9735691f37f1..49ccbd9022f6 100644
    84     --- a/arch/xtensa/kernel/setup.c
    85     +++ b/arch/xtensa/kernel/setup.c
    86     @@ -133,6 +133,8 @@ static int __init parse_tag_initrd(const bp_tag_t* tag)
    87    
    88     __tagtable(BP_TAG_INITRD, parse_tag_initrd);
    89    
    90     +#endif /* CONFIG_BLK_DEV_INITRD */
    91     +
    92     #ifdef CONFIG_OF
    93    
    94     static int __init parse_tag_fdt(const bp_tag_t *tag)
    95     @@ -145,8 +147,6 @@ __tagtable(BP_TAG_FDT, parse_tag_fdt);
    96    
    97     #endif /* CONFIG_OF */
    98    
    99     -#endif /* CONFIG_BLK_DEV_INITRD */
    100     -
    101     static int __init parse_tag_cmdline(const bp_tag_t* tag)
    102     {
    103     strlcpy(command_line, (char *)(tag->data), COMMAND_LINE_SIZE);
    104     diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
    105     index 0beaa52df66b..5df8e1234505 100644
    106     --- a/drivers/bluetooth/ath3k.c
    107     +++ b/drivers/bluetooth/ath3k.c
    108     @@ -94,6 +94,7 @@ static const struct usb_device_id ath3k_table[] = {
    109     { USB_DEVICE(0x04CA, 0x300f) },
    110     { USB_DEVICE(0x04CA, 0x3010) },
    111     { USB_DEVICE(0x04CA, 0x3014) },
    112     + { USB_DEVICE(0x04CA, 0x3018) },
    113     { USB_DEVICE(0x0930, 0x0219) },
    114     { USB_DEVICE(0x0930, 0x021c) },
    115     { USB_DEVICE(0x0930, 0x0220) },
    116     @@ -160,6 +161,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = {
    117     { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
    118     { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
    119     { USB_DEVICE(0x04ca, 0x3014), .driver_info = BTUSB_ATH3012 },
    120     + { USB_DEVICE(0x04ca, 0x3018), .driver_info = BTUSB_ATH3012 },
    121     { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
    122     { USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 },
    123     { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
    124     diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
    125     index c306b483de60..cd6b141b9825 100644
    126     --- a/drivers/bluetooth/btusb.c
    127     +++ b/drivers/bluetooth/btusb.c
    128     @@ -208,6 +208,7 @@ static const struct usb_device_id blacklist_table[] = {
    129     { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
    130     { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
    131     { USB_DEVICE(0x04ca, 0x3014), .driver_info = BTUSB_ATH3012 },
    132     + { USB_DEVICE(0x04ca, 0x3018), .driver_info = BTUSB_ATH3012 },
    133     { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
    134     { USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 },
    135     { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
    136     diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
    137     index c161eeda417b..267749a94c5a 100644
    138     --- a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
    139     +++ b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
    140     @@ -3704,9 +3704,15 @@ static void dce_v11_0_encoder_add(struct amdgpu_device *adev,
    141     default:
    142     encoder->possible_crtcs = 0x3;
    143     break;
    144     + case 3:
    145     + encoder->possible_crtcs = 0x7;
    146     + break;
    147     case 4:
    148     encoder->possible_crtcs = 0xf;
    149     break;
    150     + case 5:
    151     + encoder->possible_crtcs = 0x1f;
    152     + break;
    153     case 6:
    154     encoder->possible_crtcs = 0x3f;
    155     break;
    156     diff --git a/drivers/gpu/drm/ast/ast_post.c b/drivers/gpu/drm/ast/ast_post.c
    157     index 810c51d92b99..30672a3df8a9 100644
    158     --- a/drivers/gpu/drm/ast/ast_post.c
    159     +++ b/drivers/gpu/drm/ast/ast_post.c
    160     @@ -58,13 +58,9 @@ bool ast_is_vga_enabled(struct drm_device *dev)
    161     /* TODO 1180 */
    162     } else {
    163     ch = ast_io_read8(ast, AST_IO_VGA_ENABLE_PORT);
    164     - if (ch) {
    165     - ast_open_key(ast);
    166     - ch = ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb6, 0xff);
    167     - return ch & 0x04;
    168     - }
    169     + return !!(ch & 0x01);
    170     }
    171     - return 0;
    172     + return false;
    173     }
    174    
    175     static const u8 extreginfo[] = { 0x0f, 0x04, 0x1c, 0xff };
    176     @@ -375,8 +371,8 @@ void ast_post_gpu(struct drm_device *dev)
    177     pci_write_config_dword(ast->dev->pdev, 0x04, reg);
    178    
    179     ast_enable_vga(dev);
    180     - ast_enable_mmio(dev);
    181     ast_open_key(ast);
    182     + ast_enable_mmio(dev);
    183     ast_set_def_ext_reg(dev);
    184    
    185     if (ast->chip == AST2300 || ast->chip == AST2400)
    186     @@ -1630,12 +1626,44 @@ static void ast_init_dram_2300(struct drm_device *dev)
    187     temp |= 0x73;
    188     ast_write32(ast, 0x12008, temp);
    189    
    190     + param.dram_freq = 396;
    191     param.dram_type = AST_DDR3;
    192     + temp = ast_mindwm(ast, 0x1e6e2070);
    193     if (temp & 0x01000000)
    194     param.dram_type = AST_DDR2;
    195     - param.dram_chipid = ast->dram_type;
    196     - param.dram_freq = ast->mclk;
    197     - param.vram_size = ast->vram_size;
    198     + switch (temp & 0x18000000) {
    199     + case 0:
    200     + param.dram_chipid = AST_DRAM_512Mx16;
    201     + break;
    202     + default:
    203     + case 0x08000000:
    204     + param.dram_chipid = AST_DRAM_1Gx16;
    205     + break;
    206     + case 0x10000000:
    207     + param.dram_chipid = AST_DRAM_2Gx16;
    208     + break;
    209     + case 0x18000000:
    210     + param.dram_chipid = AST_DRAM_4Gx16;
    211     + break;
    212     + }
    213     + switch (temp & 0x0c) {
    214     + default:
    215     + case 0x00:
    216     + param.vram_size = AST_VIDMEM_SIZE_8M;
    217     + break;
    218     +
    219     + case 0x04:
    220     + param.vram_size = AST_VIDMEM_SIZE_16M;
    221     + break;
    222     +
    223     + case 0x08:
    224     + param.vram_size = AST_VIDMEM_SIZE_32M;
    225     + break;
    226     +
    227     + case 0x0c:
    228     + param.vram_size = AST_VIDMEM_SIZE_64M;
    229     + break;
    230     + }
    231    
    232     if (param.dram_type == AST_DDR3) {
    233     get_ddr3_info(ast, &param);
    234     diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
    235     index 1ac29d703c12..ea443fafb934 100644
    236     --- a/drivers/gpu/drm/drm_atomic_helper.c
    237     +++ b/drivers/gpu/drm/drm_atomic_helper.c
    238     @@ -265,7 +265,7 @@ mode_fixup(struct drm_atomic_state *state)
    239     struct drm_connector *connector;
    240     struct drm_connector_state *conn_state;
    241     int i;
    242     - bool ret;
    243     + int ret;
    244    
    245     for_each_crtc_in_state(state, crtc, crtc_state, i) {
    246     if (!crtc_state->mode_changed &&
    247     diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
    248     index 8c9ac021608f..cc1e16fd7e76 100644
    249     --- a/drivers/gpu/drm/drm_edid.c
    250     +++ b/drivers/gpu/drm/drm_edid.c
    251     @@ -144,6 +144,9 @@ static struct edid_quirk {
    252    
    253     /* Panel in Samsung NP700G7A-S01PL notebook reports 6bpc */
    254     { "SEC", 0xd033, EDID_QUIRK_FORCE_8BPC },
    255     +
    256     + /* Rotel RSX-1058 forwards sink's EDID but only does HDMI 1.1*/
    257     + { "ETR", 13896, EDID_QUIRK_FORCE_8BPC },
    258     };
    259    
    260     /*
    261     diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
    262     index 3f802163f7d4..e7c18519274a 100644
    263     --- a/drivers/gpu/drm/i915/intel_pm.c
    264     +++ b/drivers/gpu/drm/i915/intel_pm.c
    265     @@ -6803,7 +6803,18 @@ static void ivybridge_init_clock_gating(struct drm_device *dev)
    266    
    267     static void vlv_init_display_clock_gating(struct drm_i915_private *dev_priv)
    268     {
    269     - I915_WRITE(DSPCLK_GATE_D, VRHUNIT_CLOCK_GATE_DISABLE);
    270     + u32 val;
    271     +
    272     + /*
    273     + * On driver load, a pipe may be active and driving a DSI display.
    274     + * Preserve DPOUNIT_CLOCK_GATE_DISABLE to avoid the pipe getting stuck
    275     + * (and never recovering) in this case. intel_dsi_post_disable() will
    276     + * clear it when we turn off the display.
    277     + */
    278     + val = I915_READ(DSPCLK_GATE_D);
    279     + val &= DPOUNIT_CLOCK_GATE_DISABLE;
    280     + val |= VRHUNIT_CLOCK_GATE_DISABLE;
    281     + I915_WRITE(DSPCLK_GATE_D, val);
    282    
    283     /*
    284     * Disable trickle feed and enable pnd deadline calculation
    285     diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
    286     index 4ae8b56b1847..037c38bb5333 100644
    287     --- a/drivers/gpu/drm/ttm/ttm_bo.c
    288     +++ b/drivers/gpu/drm/ttm/ttm_bo.c
    289     @@ -1621,7 +1621,6 @@ static int ttm_bo_swapout(struct ttm_mem_shrink *shrink)
    290     struct ttm_buffer_object *bo;
    291     int ret = -EBUSY;
    292     int put_count;
    293     - uint32_t swap_placement = (TTM_PL_FLAG_CACHED | TTM_PL_FLAG_SYSTEM);
    294    
    295     spin_lock(&glob->lru_lock);
    296     list_for_each_entry(bo, &glob->swap_lru, swap) {
    297     @@ -1657,7 +1656,8 @@ static int ttm_bo_swapout(struct ttm_mem_shrink *shrink)
    298     if (unlikely(ret != 0))
    299     goto out;
    300    
    301     - if ((bo->mem.placement & swap_placement) != swap_placement) {
    302     + if (bo->mem.mem_type != TTM_PL_SYSTEM ||
    303     + bo->ttm->caching_state != tt_cached) {
    304     struct ttm_mem_reg evict_mem;
    305    
    306     evict_mem = bo->mem;
    307     diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c
    308     index 89fd0113aa5c..57c191798699 100644
    309     --- a/drivers/hv/hv.c
    310     +++ b/drivers/hv/hv.c
    311     @@ -219,7 +219,7 @@ int hv_init(void)
    312     /* See if the hypercall page is already set */
    313     rdmsrl(HV_X64_MSR_HYPERCALL, hypercall_msr.as_uint64);
    314    
    315     - virtaddr = __vmalloc(PAGE_SIZE, GFP_KERNEL, PAGE_KERNEL_EXEC);
    316     + virtaddr = __vmalloc(PAGE_SIZE, GFP_KERNEL, PAGE_KERNEL_RX);
    317    
    318     if (!virtaddr)
    319     goto cleanup;
    320     diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
    321     index 3ba7de5f9379..2018d24344de 100644
    322     --- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
    323     +++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
    324     @@ -1488,12 +1488,14 @@ static ssize_t set_mode(struct device *d, struct device_attribute *attr,
    325    
    326     ret = ipoib_set_mode(dev, buf);
    327    
    328     - rtnl_unlock();
    329     -
    330     - if (!ret)
    331     - return count;
    332     + /* The assumption is that the function ipoib_set_mode returned
    333     + * with the rtnl held by it, if not the value -EBUSY returned,
    334     + * then no need to rtnl_unlock
    335     + */
    336     + if (ret != -EBUSY)
    337     + rtnl_unlock();
    338    
    339     - return ret;
    340     + return (!ret || ret == -EBUSY) ? count : ret;
    341     }
    342    
    343     static DEVICE_ATTR(mode, S_IWUSR | S_IRUGO, show_mode, set_mode);
    344     diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
    345     index 8a4d10452d61..8efcff1beb8f 100644
    346     --- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
    347     +++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
    348     @@ -464,8 +464,7 @@ int ipoib_set_mode(struct net_device *dev, const char *buf)
    349     priv->tx_wr.wr.send_flags &= ~IB_SEND_IP_CSUM;
    350    
    351     ipoib_flush_paths(dev);
    352     - rtnl_lock();
    353     - return 0;
    354     + return (!rtnl_trylock()) ? -EBUSY : 0;
    355     }
    356    
    357     if (!strcmp(buf, "datagram\n")) {
    358     @@ -474,8 +473,7 @@ int ipoib_set_mode(struct net_device *dev, const char *buf)
    359     dev_set_mtu(dev, min(priv->mcast_mtu, dev->mtu));
    360     rtnl_unlock();
    361     ipoib_flush_paths(dev);
    362     - rtnl_lock();
    363     - return 0;
    364     + return (!rtnl_trylock()) ? -EBUSY : 0;
    365     }
    366    
    367     return -EINVAL;
    368     @@ -628,6 +626,14 @@ void ipoib_mark_paths_invalid(struct net_device *dev)
    369     spin_unlock_irq(&priv->lock);
    370     }
    371    
    372     +static void push_pseudo_header(struct sk_buff *skb, const char *daddr)
    373     +{
    374     + struct ipoib_pseudo_header *phdr;
    375     +
    376     + phdr = (struct ipoib_pseudo_header *)skb_push(skb, sizeof(*phdr));
    377     + memcpy(phdr->hwaddr, daddr, INFINIBAND_ALEN);
    378     +}
    379     +
    380     void ipoib_flush_paths(struct net_device *dev)
    381     {
    382     struct ipoib_dev_priv *priv = netdev_priv(dev);
    383     @@ -852,8 +858,7 @@ static void neigh_add_path(struct sk_buff *skb, u8 *daddr,
    384     }
    385     if (skb_queue_len(&neigh->queue) <
    386     IPOIB_MAX_PATH_REC_QUEUE) {
    387     - /* put pseudoheader back on for next time */
    388     - skb_push(skb, IPOIB_PSEUDO_LEN);
    389     + push_pseudo_header(skb, neigh->daddr);
    390     __skb_queue_tail(&neigh->queue, skb);
    391     } else {
    392     ipoib_warn(priv, "queue length limit %d. Packet drop.\n",
    393     @@ -871,10 +876,12 @@ static void neigh_add_path(struct sk_buff *skb, u8 *daddr,
    394    
    395     if (!path->query && path_rec_start(dev, path))
    396     goto err_path;
    397     - if (skb_queue_len(&neigh->queue) < IPOIB_MAX_PATH_REC_QUEUE)
    398     + if (skb_queue_len(&neigh->queue) < IPOIB_MAX_PATH_REC_QUEUE) {
    399     + push_pseudo_header(skb, neigh->daddr);
    400     __skb_queue_tail(&neigh->queue, skb);
    401     - else
    402     + } else {
    403     goto err_drop;
    404     + }
    405     }
    406    
    407     spin_unlock_irqrestore(&priv->lock, flags);
    408     @@ -910,8 +917,7 @@ static void unicast_arp_send(struct sk_buff *skb, struct net_device *dev,
    409     }
    410     if (path) {
    411     if (skb_queue_len(&path->queue) < IPOIB_MAX_PATH_REC_QUEUE) {
    412     - /* put pseudoheader back on for next time */
    413     - skb_push(skb, IPOIB_PSEUDO_LEN);
    414     + push_pseudo_header(skb, phdr->hwaddr);
    415     __skb_queue_tail(&path->queue, skb);
    416     } else {
    417     ++dev->stats.tx_dropped;
    418     @@ -943,8 +949,7 @@ static void unicast_arp_send(struct sk_buff *skb, struct net_device *dev,
    419     return;
    420     } else if ((path->query || !path_rec_start(dev, path)) &&
    421     skb_queue_len(&path->queue) < IPOIB_MAX_PATH_REC_QUEUE) {
    422     - /* put pseudoheader back on for next time */
    423     - skb_push(skb, IPOIB_PSEUDO_LEN);
    424     + push_pseudo_header(skb, phdr->hwaddr);
    425     __skb_queue_tail(&path->queue, skb);
    426     } else {
    427     ++dev->stats.tx_dropped;
    428     @@ -1025,8 +1030,7 @@ send_using_neigh:
    429     }
    430    
    431     if (skb_queue_len(&neigh->queue) < IPOIB_MAX_PATH_REC_QUEUE) {
    432     - /* put pseudoheader back on for next time */
    433     - skb_push(skb, sizeof(*phdr));
    434     + push_pseudo_header(skb, phdr->hwaddr);
    435     spin_lock_irqsave(&priv->lock, flags);
    436     __skb_queue_tail(&neigh->queue, skb);
    437     spin_unlock_irqrestore(&priv->lock, flags);
    438     @@ -1058,7 +1062,6 @@ static int ipoib_hard_header(struct sk_buff *skb,
    439     unsigned short type,
    440     const void *daddr, const void *saddr, unsigned len)
    441     {
    442     - struct ipoib_pseudo_header *phdr;
    443     struct ipoib_header *header;
    444    
    445     header = (struct ipoib_header *) skb_push(skb, sizeof *header);
    446     @@ -1071,8 +1074,7 @@ static int ipoib_hard_header(struct sk_buff *skb,
    447     * destination address into skb hard header so we can figure out where
    448     * to send the packet later.
    449     */
    450     - phdr = (struct ipoib_pseudo_header *) skb_push(skb, sizeof(*phdr));
    451     - memcpy(phdr->hwaddr, daddr, INFINIBAND_ALEN);
    452     + push_pseudo_header(skb, daddr);
    453    
    454     return IPOIB_HARD_LEN;
    455     }
    456     diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
    457     index 5f0f4fc58f43..e397f1b0af09 100644
    458     --- a/drivers/infiniband/ulp/srp/ib_srp.c
    459     +++ b/drivers/infiniband/ulp/srp/ib_srp.c
    460     @@ -1787,17 +1787,24 @@ static void srp_process_rsp(struct srp_rdma_ch *ch, struct srp_rsp *rsp)
    461     if (unlikely(rsp->tag & SRP_TAG_TSK_MGMT)) {
    462     spin_lock_irqsave(&ch->lock, flags);
    463     ch->req_lim += be32_to_cpu(rsp->req_lim_delta);
    464     + if (rsp->tag == ch->tsk_mgmt_tag) {
    465     + ch->tsk_mgmt_status = -1;
    466     + if (be32_to_cpu(rsp->resp_data_len) >= 4)
    467     + ch->tsk_mgmt_status = rsp->data[3];
    468     + complete(&ch->tsk_mgmt_done);
    469     + } else {
    470     + shost_printk(KERN_ERR, target->scsi_host,
    471     + "Received tsk mgmt response too late for tag %#llx\n",
    472     + rsp->tag);
    473     + }
    474     spin_unlock_irqrestore(&ch->lock, flags);
    475     -
    476     - ch->tsk_mgmt_status = -1;
    477     - if (be32_to_cpu(rsp->resp_data_len) >= 4)
    478     - ch->tsk_mgmt_status = rsp->data[3];
    479     - complete(&ch->tsk_mgmt_done);
    480     } else {
    481     scmnd = scsi_host_find_tag(target->scsi_host, rsp->tag);
    482     - if (scmnd) {
    483     + if (scmnd && scmnd->host_scribble) {
    484     req = (void *)scmnd->host_scribble;
    485     scmnd = srp_claim_req(ch, req, NULL, scmnd);
    486     + } else {
    487     + scmnd = NULL;
    488     }
    489     if (!scmnd) {
    490     shost_printk(KERN_ERR, target->scsi_host,
    491     @@ -2469,19 +2476,18 @@ srp_change_queue_depth(struct scsi_device *sdev, int qdepth)
    492     }
    493    
    494     static int srp_send_tsk_mgmt(struct srp_rdma_ch *ch, u64 req_tag, u64 lun,
    495     - u8 func)
    496     + u8 func, u8 *status)
    497     {
    498     struct srp_target_port *target = ch->target;
    499     struct srp_rport *rport = target->rport;
    500     struct ib_device *dev = target->srp_host->srp_dev->dev;
    501     struct srp_iu *iu;
    502     struct srp_tsk_mgmt *tsk_mgmt;
    503     + int res;
    504    
    505     if (!ch->connected || target->qp_in_error)
    506     return -1;
    507    
    508     - init_completion(&ch->tsk_mgmt_done);
    509     -
    510     /*
    511     * Lock the rport mutex to avoid that srp_create_ch_ib() is
    512     * invoked while a task management function is being sent.
    513     @@ -2504,10 +2510,16 @@ static int srp_send_tsk_mgmt(struct srp_rdma_ch *ch, u64 req_tag, u64 lun,
    514    
    515     tsk_mgmt->opcode = SRP_TSK_MGMT;
    516     int_to_scsilun(lun, &tsk_mgmt->lun);
    517     - tsk_mgmt->tag = req_tag | SRP_TAG_TSK_MGMT;
    518     tsk_mgmt->tsk_mgmt_func = func;
    519     tsk_mgmt->task_tag = req_tag;
    520    
    521     + spin_lock_irq(&ch->lock);
    522     + ch->tsk_mgmt_tag = (ch->tsk_mgmt_tag + 1) | SRP_TAG_TSK_MGMT;
    523     + tsk_mgmt->tag = ch->tsk_mgmt_tag;
    524     + spin_unlock_irq(&ch->lock);
    525     +
    526     + init_completion(&ch->tsk_mgmt_done);
    527     +
    528     ib_dma_sync_single_for_device(dev, iu->dma, sizeof *tsk_mgmt,
    529     DMA_TO_DEVICE);
    530     if (srp_post_send(ch, iu, sizeof(*tsk_mgmt))) {
    531     @@ -2516,13 +2528,15 @@ static int srp_send_tsk_mgmt(struct srp_rdma_ch *ch, u64 req_tag, u64 lun,
    532    
    533     return -1;
    534     }
    535     + res = wait_for_completion_timeout(&ch->tsk_mgmt_done,
    536     + msecs_to_jiffies(SRP_ABORT_TIMEOUT_MS));
    537     + if (res > 0 && status)
    538     + *status = ch->tsk_mgmt_status;
    539     mutex_unlock(&rport->mutex);
    540    
    541     - if (!wait_for_completion_timeout(&ch->tsk_mgmt_done,
    542     - msecs_to_jiffies(SRP_ABORT_TIMEOUT_MS)))
    543     - return -1;
    544     + WARN_ON_ONCE(res < 0);
    545    
    546     - return 0;
    547     + return res > 0 ? 0 : -1;
    548     }
    549    
    550     static int srp_abort(struct scsi_cmnd *scmnd)
    551     @@ -2548,7 +2562,7 @@ static int srp_abort(struct scsi_cmnd *scmnd)
    552     shost_printk(KERN_ERR, target->scsi_host,
    553     "Sending SRP abort for tag %#x\n", tag);
    554     if (srp_send_tsk_mgmt(ch, tag, scmnd->device->lun,
    555     - SRP_TSK_ABORT_TASK) == 0)
    556     + SRP_TSK_ABORT_TASK, NULL) == 0)
    557     ret = SUCCESS;
    558     else if (target->rport->state == SRP_RPORT_LOST)
    559     ret = FAST_IO_FAIL;
    560     @@ -2566,14 +2580,15 @@ static int srp_reset_device(struct scsi_cmnd *scmnd)
    561     struct srp_target_port *target = host_to_target(scmnd->device->host);
    562     struct srp_rdma_ch *ch;
    563     int i;
    564     + u8 status;
    565    
    566     shost_printk(KERN_ERR, target->scsi_host, "SRP reset_device called\n");
    567    
    568     ch = &target->ch[0];
    569     if (srp_send_tsk_mgmt(ch, SRP_TAG_NO_REQ, scmnd->device->lun,
    570     - SRP_TSK_LUN_RESET))
    571     + SRP_TSK_LUN_RESET, &status))
    572     return FAILED;
    573     - if (ch->tsk_mgmt_status)
    574     + if (status)
    575     return FAILED;
    576    
    577     for (i = 0; i < target->ch_count; i++) {
    578     diff --git a/drivers/infiniband/ulp/srp/ib_srp.h b/drivers/infiniband/ulp/srp/ib_srp.h
    579     index f6af531f9f32..109eea94d0f9 100644
    580     --- a/drivers/infiniband/ulp/srp/ib_srp.h
    581     +++ b/drivers/infiniband/ulp/srp/ib_srp.h
    582     @@ -168,6 +168,7 @@ struct srp_rdma_ch {
    583     int max_ti_iu_len;
    584     int comp_vector;
    585    
    586     + u64 tsk_mgmt_tag;
    587     struct completion tsk_mgmt_done;
    588     u8 tsk_mgmt_status;
    589     bool connected;
    590     diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c
    591     index 25aba9886990..0e67145bc418 100644
    592     --- a/drivers/net/ethernet/marvell/mvpp2.c
    593     +++ b/drivers/net/ethernet/marvell/mvpp2.c
    594     @@ -993,7 +993,7 @@ static void mvpp2_txq_inc_put(struct mvpp2_txq_pcpu *txq_pcpu,
    595     txq_pcpu->buffs + txq_pcpu->txq_put_index;
    596     tx_buf->skb = skb;
    597     tx_buf->size = tx_desc->data_size;
    598     - tx_buf->phys = tx_desc->buf_phys_addr;
    599     + tx_buf->phys = tx_desc->buf_phys_addr + tx_desc->packet_offset;
    600     txq_pcpu->txq_put_index++;
    601     if (txq_pcpu->txq_put_index == txq_pcpu->size)
    602     txq_pcpu->txq_put_index = 0;
    603     diff --git a/drivers/net/ieee802154/fakelb.c b/drivers/net/ieee802154/fakelb.c
    604     index 860d4aed8274..43617ded3773 100644
    605     --- a/drivers/net/ieee802154/fakelb.c
    606     +++ b/drivers/net/ieee802154/fakelb.c
    607     @@ -30,7 +30,7 @@
    608     static int numlbs = 2;
    609    
    610     static LIST_HEAD(fakelb_phys);
    611     -static DEFINE_SPINLOCK(fakelb_phys_lock);
    612     +static DEFINE_MUTEX(fakelb_phys_lock);
    613    
    614     static LIST_HEAD(fakelb_ifup_phys);
    615     static DEFINE_RWLOCK(fakelb_ifup_phys_lock);
    616     @@ -180,9 +180,9 @@ static int fakelb_add_one(struct device *dev)
    617     if (err)
    618     goto err_reg;
    619    
    620     - spin_lock(&fakelb_phys_lock);
    621     + mutex_lock(&fakelb_phys_lock);
    622     list_add_tail(&phy->list, &fakelb_phys);
    623     - spin_unlock(&fakelb_phys_lock);
    624     + mutex_unlock(&fakelb_phys_lock);
    625    
    626     return 0;
    627    
    628     @@ -214,10 +214,10 @@ static int fakelb_probe(struct platform_device *pdev)
    629     return 0;
    630    
    631     err_slave:
    632     - spin_lock(&fakelb_phys_lock);
    633     + mutex_lock(&fakelb_phys_lock);
    634     list_for_each_entry_safe(phy, tmp, &fakelb_phys, list)
    635     fakelb_del(phy);
    636     - spin_unlock(&fakelb_phys_lock);
    637     + mutex_unlock(&fakelb_phys_lock);
    638     return err;
    639     }
    640    
    641     @@ -225,10 +225,10 @@ static int fakelb_remove(struct platform_device *pdev)
    642     {
    643     struct fakelb_phy *phy, *tmp;
    644    
    645     - spin_lock(&fakelb_phys_lock);
    646     + mutex_lock(&fakelb_phys_lock);
    647     list_for_each_entry_safe(phy, tmp, &fakelb_phys, list)
    648     fakelb_del(phy);
    649     - spin_unlock(&fakelb_phys_lock);
    650     + mutex_unlock(&fakelb_phys_lock);
    651     return 0;
    652     }
    653    
    654     diff --git a/drivers/pwm/pwm-pca9685.c b/drivers/pwm/pwm-pca9685.c
    655     index 117fccf7934a..01a6a83f625d 100644
    656     --- a/drivers/pwm/pwm-pca9685.c
    657     +++ b/drivers/pwm/pwm-pca9685.c
    658     @@ -65,7 +65,6 @@
    659     #define PCA9685_MAXCHAN 0x10
    660    
    661     #define LED_FULL (1 << 4)
    662     -#define MODE1_RESTART (1 << 7)
    663     #define MODE1_SLEEP (1 << 4)
    664     #define MODE2_INVRT (1 << 4)
    665     #define MODE2_OUTDRV (1 << 2)
    666     @@ -117,16 +116,6 @@ static int pca9685_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
    667     udelay(500);
    668    
    669     pca->period_ns = period_ns;
    670     -
    671     - /*
    672     - * If the duty cycle did not change, restart PWM with
    673     - * the same duty cycle to period ratio and return.
    674     - */
    675     - if (duty_ns == pca->duty_ns) {
    676     - regmap_update_bits(pca->regmap, PCA9685_MODE1,
    677     - MODE1_RESTART, 0x1);
    678     - return 0;
    679     - }
    680     } else {
    681     dev_err(chip->dev,
    682     "prescaler not set: period out of bounds!\n");
    683     diff --git a/drivers/s390/block/dcssblk.c b/drivers/s390/block/dcssblk.c
    684     index 94a8f4ab57bc..ae1dc37e4068 100644
    685     --- a/drivers/s390/block/dcssblk.c
    686     +++ b/drivers/s390/block/dcssblk.c
    687     @@ -892,7 +892,7 @@ dcssblk_direct_access (struct block_device *bdev, sector_t secnum,
    688     dev_info = bdev->bd_disk->private_data;
    689     if (!dev_info)
    690     return -ENODEV;
    691     - dev_sz = dev_info->end - dev_info->start;
    692     + dev_sz = dev_info->end - dev_info->start + 1;
    693     offset = secnum * 512;
    694     addr = (void *) (dev_info->start + offset);
    695     *pfn = virt_to_phys(addr) >> PAGE_SHIFT;
    696     diff --git a/drivers/s390/cio/qdio_thinint.c b/drivers/s390/cio/qdio_thinint.c
    697     index 5d06253c2a7a..30e9fbbff051 100644
    698     --- a/drivers/s390/cio/qdio_thinint.c
    699     +++ b/drivers/s390/cio/qdio_thinint.c
    700     @@ -147,11 +147,11 @@ static inline void tiqdio_call_inq_handlers(struct qdio_irq *irq)
    701     struct qdio_q *q;
    702     int i;
    703    
    704     - for_each_input_queue(irq, q, i) {
    705     - if (!references_shared_dsci(irq) &&
    706     - has_multiple_inq_on_dsci(irq))
    707     - xchg(q->irq_ptr->dsci, 0);
    708     + if (!references_shared_dsci(irq) &&
    709     + has_multiple_inq_on_dsci(irq))
    710     + xchg(irq->dsci, 0);
    711    
    712     + for_each_input_queue(irq, q, i) {
    713     if (q->u.in.queue_start_poll) {
    714     /* skip if polling is enabled or already in work */
    715     if (test_and_set_bit(QDIO_QUEUE_IRQS_DISABLED,
    716     diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
    717     index 356c80fbb304..bb6a6c35324a 100644
    718     --- a/drivers/target/target_core_device.c
    719     +++ b/drivers/target/target_core_device.c
    720     @@ -77,12 +77,16 @@ transport_lookup_cmd_lun(struct se_cmd *se_cmd, u64 unpacked_lun)
    721     &deve->read_bytes);
    722    
    723     se_lun = rcu_dereference(deve->se_lun);
    724     +
    725     + if (!percpu_ref_tryget_live(&se_lun->lun_ref)) {
    726     + se_lun = NULL;
    727     + goto out_unlock;
    728     + }
    729     +
    730     se_cmd->se_lun = rcu_dereference(deve->se_lun);
    731     se_cmd->pr_res_key = deve->pr_res_key;
    732     se_cmd->orig_fe_lun = unpacked_lun;
    733     se_cmd->se_cmd_flags |= SCF_SE_LUN_CMD;
    734     -
    735     - percpu_ref_get(&se_lun->lun_ref);
    736     se_cmd->lun_ref_active = true;
    737    
    738     if ((se_cmd->data_direction == DMA_TO_DEVICE) &&
    739     @@ -96,6 +100,7 @@ transport_lookup_cmd_lun(struct se_cmd *se_cmd, u64 unpacked_lun)
    740     goto ref_dev;
    741     }
    742     }
    743     +out_unlock:
    744     rcu_read_unlock();
    745    
    746     if (!se_lun) {
    747     @@ -826,6 +831,7 @@ struct se_device *target_alloc_device(struct se_hba *hba, const char *name)
    748     xcopy_lun = &dev->xcopy_lun;
    749     rcu_assign_pointer(xcopy_lun->lun_se_dev, dev);
    750     init_completion(&xcopy_lun->lun_ref_comp);
    751     + init_completion(&xcopy_lun->lun_shutdown_comp);
    752     INIT_LIST_HEAD(&xcopy_lun->lun_deve_list);
    753     INIT_LIST_HEAD(&xcopy_lun->lun_dev_link);
    754     mutex_init(&xcopy_lun->lun_tg_pt_md_mutex);
    755     diff --git a/drivers/target/target_core_tpg.c b/drivers/target/target_core_tpg.c
    756     index 028854cda97b..2794c6ec5c3c 100644
    757     --- a/drivers/target/target_core_tpg.c
    758     +++ b/drivers/target/target_core_tpg.c
    759     @@ -539,7 +539,7 @@ static void core_tpg_lun_ref_release(struct percpu_ref *ref)
    760     {
    761     struct se_lun *lun = container_of(ref, struct se_lun, lun_ref);
    762    
    763     - complete(&lun->lun_ref_comp);
    764     + complete(&lun->lun_shutdown_comp);
    765     }
    766    
    767     int core_tpg_register(
    768     @@ -666,6 +666,7 @@ struct se_lun *core_tpg_alloc_lun(
    769     lun->lun_link_magic = SE_LUN_LINK_MAGIC;
    770     atomic_set(&lun->lun_acl_count, 0);
    771     init_completion(&lun->lun_ref_comp);
    772     + init_completion(&lun->lun_shutdown_comp);
    773     INIT_LIST_HEAD(&lun->lun_deve_list);
    774     INIT_LIST_HEAD(&lun->lun_dev_link);
    775     atomic_set(&lun->lun_tg_pt_secondary_offline, 0);
    776     diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
    777     index befe22744802..df2059984e14 100644
    778     --- a/drivers/target/target_core_transport.c
    779     +++ b/drivers/target/target_core_transport.c
    780     @@ -2680,10 +2680,39 @@ void target_wait_for_sess_cmds(struct se_session *se_sess)
    781     }
    782     EXPORT_SYMBOL(target_wait_for_sess_cmds);
    783    
    784     +static void target_lun_confirm(struct percpu_ref *ref)
    785     +{
    786     + struct se_lun *lun = container_of(ref, struct se_lun, lun_ref);
    787     +
    788     + complete(&lun->lun_ref_comp);
    789     +}
    790     +
    791     void transport_clear_lun_ref(struct se_lun *lun)
    792     {
    793     - percpu_ref_kill(&lun->lun_ref);
    794     + /*
    795     + * Mark the percpu-ref as DEAD, switch to atomic_t mode, drop
    796     + * the initial reference and schedule confirm kill to be
    797     + * executed after one full RCU grace period has completed.
    798     + */
    799     + percpu_ref_kill_and_confirm(&lun->lun_ref, target_lun_confirm);
    800     + /*
    801     + * The first completion waits for percpu_ref_switch_to_atomic_rcu()
    802     + * to call target_lun_confirm after lun->lun_ref has been marked
    803     + * as __PERCPU_REF_DEAD on all CPUs, and switches to atomic_t
    804     + * mode so that percpu_ref_tryget_live() lookup of lun->lun_ref
    805     + * fails for all new incoming I/O.
    806     + */
    807     wait_for_completion(&lun->lun_ref_comp);
    808     + /*
    809     + * The second completion waits for percpu_ref_put_many() to
    810     + * invoke ->release() after lun->lun_ref has switched to
    811     + * atomic_t mode, and lun->lun_ref.count has reached zero.
    812     + *
    813     + * At this point all target-core lun->lun_ref references have
    814     + * been dropped via transport_lun_remove_cmd(), and it's safe
    815     + * to proceed with the remaining LUN shutdown.
    816     + */
    817     + wait_for_completion(&lun->lun_shutdown_comp);
    818     }
    819    
    820     static bool
    821     diff --git a/drivers/tty/n_hdlc.c b/drivers/tty/n_hdlc.c
    822     index 644ddb841d9f..6d1e2f746ab4 100644
    823     --- a/drivers/tty/n_hdlc.c
    824     +++ b/drivers/tty/n_hdlc.c
    825     @@ -114,7 +114,7 @@
    826     #define DEFAULT_TX_BUF_COUNT 3
    827    
    828     struct n_hdlc_buf {
    829     - struct n_hdlc_buf *link;
    830     + struct list_head list_item;
    831     int count;
    832     char buf[1];
    833     };
    834     @@ -122,8 +122,7 @@ struct n_hdlc_buf {
    835     #define N_HDLC_BUF_SIZE (sizeof(struct n_hdlc_buf) + maxframe)
    836    
    837     struct n_hdlc_buf_list {
    838     - struct n_hdlc_buf *head;
    839     - struct n_hdlc_buf *tail;
    840     + struct list_head list;
    841     int count;
    842     spinlock_t spinlock;
    843     };
    844     @@ -136,7 +135,6 @@ struct n_hdlc_buf_list {
    845     * @backup_tty - TTY to use if tty gets closed
    846     * @tbusy - reentrancy flag for tx wakeup code
    847     * @woke_up - FIXME: describe this field
    848     - * @tbuf - currently transmitting tx buffer
    849     * @tx_buf_list - list of pending transmit frame buffers
    850     * @rx_buf_list - list of received frame buffers
    851     * @tx_free_buf_list - list unused transmit frame buffers
    852     @@ -149,7 +147,6 @@ struct n_hdlc {
    853     struct tty_struct *backup_tty;
    854     int tbusy;
    855     int woke_up;
    856     - struct n_hdlc_buf *tbuf;
    857     struct n_hdlc_buf_list tx_buf_list;
    858     struct n_hdlc_buf_list rx_buf_list;
    859     struct n_hdlc_buf_list tx_free_buf_list;
    860     @@ -159,7 +156,8 @@ struct n_hdlc {
    861     /*
    862     * HDLC buffer list manipulation functions
    863     */
    864     -static void n_hdlc_buf_list_init(struct n_hdlc_buf_list *list);
    865     +static void n_hdlc_buf_return(struct n_hdlc_buf_list *buf_list,
    866     + struct n_hdlc_buf *buf);
    867     static void n_hdlc_buf_put(struct n_hdlc_buf_list *list,
    868     struct n_hdlc_buf *buf);
    869     static struct n_hdlc_buf *n_hdlc_buf_get(struct n_hdlc_buf_list *list);
    870     @@ -209,16 +207,9 @@ static void flush_tx_queue(struct tty_struct *tty)
    871     {
    872     struct n_hdlc *n_hdlc = tty2n_hdlc(tty);
    873     struct n_hdlc_buf *buf;
    874     - unsigned long flags;
    875    
    876     while ((buf = n_hdlc_buf_get(&n_hdlc->tx_buf_list)))
    877     n_hdlc_buf_put(&n_hdlc->tx_free_buf_list, buf);
    878     - spin_lock_irqsave(&n_hdlc->tx_buf_list.spinlock, flags);
    879     - if (n_hdlc->tbuf) {
    880     - n_hdlc_buf_put(&n_hdlc->tx_free_buf_list, n_hdlc->tbuf);
    881     - n_hdlc->tbuf = NULL;
    882     - }
    883     - spin_unlock_irqrestore(&n_hdlc->tx_buf_list.spinlock, flags);
    884     }
    885    
    886     static struct tty_ldisc_ops n_hdlc_ldisc = {
    887     @@ -284,7 +275,6 @@ static void n_hdlc_release(struct n_hdlc *n_hdlc)
    888     } else
    889     break;
    890     }
    891     - kfree(n_hdlc->tbuf);
    892     kfree(n_hdlc);
    893    
    894     } /* end of n_hdlc_release() */
    895     @@ -403,13 +393,7 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty)
    896     n_hdlc->woke_up = 0;
    897     spin_unlock_irqrestore(&n_hdlc->tx_buf_list.spinlock, flags);
    898    
    899     - /* get current transmit buffer or get new transmit */
    900     - /* buffer from list of pending transmit buffers */
    901     -
    902     - tbuf = n_hdlc->tbuf;
    903     - if (!tbuf)
    904     - tbuf = n_hdlc_buf_get(&n_hdlc->tx_buf_list);
    905     -
    906     + tbuf = n_hdlc_buf_get(&n_hdlc->tx_buf_list);
    907     while (tbuf) {
    908     if (debuglevel >= DEBUG_LEVEL_INFO)
    909     printk("%s(%d)sending frame %p, count=%d\n",
    910     @@ -421,7 +405,7 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty)
    911    
    912     /* rollback was possible and has been done */
    913     if (actual == -ERESTARTSYS) {
    914     - n_hdlc->tbuf = tbuf;
    915     + n_hdlc_buf_return(&n_hdlc->tx_buf_list, tbuf);
    916     break;
    917     }
    918     /* if transmit error, throw frame away by */
    919     @@ -436,10 +420,7 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty)
    920    
    921     /* free current transmit buffer */
    922     n_hdlc_buf_put(&n_hdlc->tx_free_buf_list, tbuf);
    923     -
    924     - /* this tx buffer is done */
    925     - n_hdlc->tbuf = NULL;
    926     -
    927     +
    928     /* wait up sleeping writers */
    929     wake_up_interruptible(&tty->write_wait);
    930    
    931     @@ -449,10 +430,12 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty)
    932     if (debuglevel >= DEBUG_LEVEL_INFO)
    933     printk("%s(%d)frame %p pending\n",
    934     __FILE__,__LINE__,tbuf);
    935     -
    936     - /* buffer not accepted by driver */
    937     - /* set this buffer as pending buffer */
    938     - n_hdlc->tbuf = tbuf;
    939     +
    940     + /*
    941     + * the buffer was not accepted by driver,
    942     + * return it back into tx queue
    943     + */
    944     + n_hdlc_buf_return(&n_hdlc->tx_buf_list, tbuf);
    945     break;
    946     }
    947     }
    948     @@ -750,7 +733,8 @@ static int n_hdlc_tty_ioctl(struct tty_struct *tty, struct file *file,
    949     int error = 0;
    950     int count;
    951     unsigned long flags;
    952     -
    953     + struct n_hdlc_buf *buf = NULL;
    954     +
    955     if (debuglevel >= DEBUG_LEVEL_INFO)
    956     printk("%s(%d)n_hdlc_tty_ioctl() called %d\n",
    957     __FILE__,__LINE__,cmd);
    958     @@ -764,8 +748,10 @@ static int n_hdlc_tty_ioctl(struct tty_struct *tty, struct file *file,
    959     /* report count of read data available */
    960     /* in next available frame (if any) */
    961     spin_lock_irqsave(&n_hdlc->rx_buf_list.spinlock,flags);
    962     - if (n_hdlc->rx_buf_list.head)
    963     - count = n_hdlc->rx_buf_list.head->count;
    964     + buf = list_first_entry_or_null(&n_hdlc->rx_buf_list.list,
    965     + struct n_hdlc_buf, list_item);
    966     + if (buf)
    967     + count = buf->count;
    968     else
    969     count = 0;
    970     spin_unlock_irqrestore(&n_hdlc->rx_buf_list.spinlock,flags);
    971     @@ -777,8 +763,10 @@ static int n_hdlc_tty_ioctl(struct tty_struct *tty, struct file *file,
    972     count = tty_chars_in_buffer(tty);
    973     /* add size of next output frame in queue */
    974     spin_lock_irqsave(&n_hdlc->tx_buf_list.spinlock,flags);
    975     - if (n_hdlc->tx_buf_list.head)
    976     - count += n_hdlc->tx_buf_list.head->count;
    977     + buf = list_first_entry_or_null(&n_hdlc->tx_buf_list.list,
    978     + struct n_hdlc_buf, list_item);
    979     + if (buf)
    980     + count += buf->count;
    981     spin_unlock_irqrestore(&n_hdlc->tx_buf_list.spinlock,flags);
    982     error = put_user(count, (int __user *)arg);
    983     break;
    984     @@ -826,14 +814,14 @@ static unsigned int n_hdlc_tty_poll(struct tty_struct *tty, struct file *filp,
    985     poll_wait(filp, &tty->write_wait, wait);
    986    
    987     /* set bits for operations that won't block */
    988     - if (n_hdlc->rx_buf_list.head)
    989     + if (!list_empty(&n_hdlc->rx_buf_list.list))
    990     mask |= POLLIN | POLLRDNORM; /* readable */
    991     if (test_bit(TTY_OTHER_CLOSED, &tty->flags))
    992     mask |= POLLHUP;
    993     if (tty_hung_up_p(filp))
    994     mask |= POLLHUP;
    995     if (!tty_is_writelocked(tty) &&
    996     - n_hdlc->tx_free_buf_list.head)
    997     + !list_empty(&n_hdlc->tx_free_buf_list.list))
    998     mask |= POLLOUT | POLLWRNORM; /* writable */
    999     }
    1000     return mask;
    1001     @@ -853,11 +841,16 @@ static struct n_hdlc *n_hdlc_alloc(void)
    1002     if (!n_hdlc)
    1003     return NULL;
    1004    
    1005     - n_hdlc_buf_list_init(&n_hdlc->rx_free_buf_list);
    1006     - n_hdlc_buf_list_init(&n_hdlc->tx_free_buf_list);
    1007     - n_hdlc_buf_list_init(&n_hdlc->rx_buf_list);
    1008     - n_hdlc_buf_list_init(&n_hdlc->tx_buf_list);
    1009     -
    1010     + spin_lock_init(&n_hdlc->rx_free_buf_list.spinlock);
    1011     + spin_lock_init(&n_hdlc->tx_free_buf_list.spinlock);
    1012     + spin_lock_init(&n_hdlc->rx_buf_list.spinlock);
    1013     + spin_lock_init(&n_hdlc->tx_buf_list.spinlock);
    1014     +
    1015     + INIT_LIST_HEAD(&n_hdlc->rx_free_buf_list.list);
    1016     + INIT_LIST_HEAD(&n_hdlc->tx_free_buf_list.list);
    1017     + INIT_LIST_HEAD(&n_hdlc->rx_buf_list.list);
    1018     + INIT_LIST_HEAD(&n_hdlc->tx_buf_list.list);
    1019     +
    1020     /* allocate free rx buffer list */
    1021     for(i=0;i<DEFAULT_RX_BUF_COUNT;i++) {
    1022     buf = kmalloc(N_HDLC_BUF_SIZE, GFP_KERNEL);
    1023     @@ -885,63 +878,65 @@ static struct n_hdlc *n_hdlc_alloc(void)
    1024     } /* end of n_hdlc_alloc() */
    1025    
    1026     /**
    1027     - * n_hdlc_buf_list_init - initialize specified HDLC buffer list
    1028     - * @list - pointer to buffer list
    1029     + * n_hdlc_buf_return - put the HDLC buffer after the head of the specified list
    1030     + * @buf_list - pointer to the buffer list
    1031     + * @buf - pointer to the buffer
    1032     */
    1033     -static void n_hdlc_buf_list_init(struct n_hdlc_buf_list *list)
    1034     +static void n_hdlc_buf_return(struct n_hdlc_buf_list *buf_list,
    1035     + struct n_hdlc_buf *buf)
    1036     {
    1037     - memset(list, 0, sizeof(*list));
    1038     - spin_lock_init(&list->spinlock);
    1039     -} /* end of n_hdlc_buf_list_init() */
    1040     + unsigned long flags;
    1041     +
    1042     + spin_lock_irqsave(&buf_list->spinlock, flags);
    1043     +
    1044     + list_add(&buf->list_item, &buf_list->list);
    1045     + buf_list->count++;
    1046     +
    1047     + spin_unlock_irqrestore(&buf_list->spinlock, flags);
    1048     +}
    1049    
    1050     /**
    1051     * n_hdlc_buf_put - add specified HDLC buffer to tail of specified list
    1052     - * @list - pointer to buffer list
    1053     + * @buf_list - pointer to buffer list
    1054     * @buf - pointer to buffer
    1055     */
    1056     -static void n_hdlc_buf_put(struct n_hdlc_buf_list *list,
    1057     +static void n_hdlc_buf_put(struct n_hdlc_buf_list *buf_list,
    1058     struct n_hdlc_buf *buf)
    1059     {
    1060     unsigned long flags;
    1061     - spin_lock_irqsave(&list->spinlock,flags);
    1062     -
    1063     - buf->link=NULL;
    1064     - if (list->tail)
    1065     - list->tail->link = buf;
    1066     - else
    1067     - list->head = buf;
    1068     - list->tail = buf;
    1069     - (list->count)++;
    1070     -
    1071     - spin_unlock_irqrestore(&list->spinlock,flags);
    1072     -
    1073     +
    1074     + spin_lock_irqsave(&buf_list->spinlock, flags);
    1075     +
    1076     + list_add_tail(&buf->list_item, &buf_list->list);
    1077     + buf_list->count++;
    1078     +
    1079     + spin_unlock_irqrestore(&buf_list->spinlock, flags);
    1080     } /* end of n_hdlc_buf_put() */
    1081    
    1082     /**
    1083     * n_hdlc_buf_get - remove and return an HDLC buffer from list
    1084     - * @list - pointer to HDLC buffer list
    1085     + * @buf_list - pointer to HDLC buffer list
    1086     *
    1087     * Remove and return an HDLC buffer from the head of the specified HDLC buffer
    1088     * list.
    1089     * Returns a pointer to HDLC buffer if available, otherwise %NULL.
    1090     */
    1091     -static struct n_hdlc_buf* n_hdlc_buf_get(struct n_hdlc_buf_list *list)
    1092     +static struct n_hdlc_buf *n_hdlc_buf_get(struct n_hdlc_buf_list *buf_list)
    1093     {
    1094     unsigned long flags;
    1095     struct n_hdlc_buf *buf;
    1096     - spin_lock_irqsave(&list->spinlock,flags);
    1097     -
    1098     - buf = list->head;
    1099     +
    1100     + spin_lock_irqsave(&buf_list->spinlock, flags);
    1101     +
    1102     + buf = list_first_entry_or_null(&buf_list->list,
    1103     + struct n_hdlc_buf, list_item);
    1104     if (buf) {
    1105     - list->head = buf->link;
    1106     - (list->count)--;
    1107     + list_del(&buf->list_item);
    1108     + buf_list->count--;
    1109     }
    1110     - if (!list->head)
    1111     - list->tail = NULL;
    1112     -
    1113     - spin_unlock_irqrestore(&list->spinlock,flags);
    1114     +
    1115     + spin_unlock_irqrestore(&buf_list->spinlock, flags);
    1116     return buf;
    1117     -
    1118     } /* end of n_hdlc_buf_get() */
    1119    
    1120     static char hdlc_banner[] __initdata =
    1121     diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
    1122     index 029de3f99752..5b24ffd93649 100644
    1123     --- a/drivers/tty/serial/8250/8250_pci.c
    1124     +++ b/drivers/tty/serial/8250/8250_pci.c
    1125     @@ -2880,6 +2880,8 @@ enum pci_board_num_t {
    1126     pbn_b0_4_1152000_200,
    1127     pbn_b0_8_1152000_200,
    1128    
    1129     + pbn_b0_4_1250000,
    1130     +
    1131     pbn_b0_2_1843200,
    1132     pbn_b0_4_1843200,
    1133    
    1134     @@ -3113,6 +3115,13 @@ static struct pciserial_board pci_boards[] = {
    1135     .uart_offset = 0x200,
    1136     },
    1137    
    1138     + [pbn_b0_4_1250000] = {
    1139     + .flags = FL_BASE0,
    1140     + .num_ports = 4,
    1141     + .base_baud = 1250000,
    1142     + .uart_offset = 8,
    1143     + },
    1144     +
    1145     [pbn_b0_2_1843200] = {
    1146     .flags = FL_BASE0,
    1147     .num_ports = 2,
    1148     @@ -5778,6 +5787,10 @@ static struct pci_device_id serial_pci_tbl[] = {
    1149     { PCI_DEVICE(0x1c29, 0x1108), .driver_data = pbn_fintek_8 },
    1150     { PCI_DEVICE(0x1c29, 0x1112), .driver_data = pbn_fintek_12 },
    1151    
    1152     + /* MKS Tenta SCOM-080x serial cards */
    1153     + { PCI_DEVICE(0x1601, 0x0800), .driver_data = pbn_b0_4_1250000 },
    1154     + { PCI_DEVICE(0x1601, 0xa801), .driver_data = pbn_b0_4_1250000 },
    1155     +
    1156     /*
    1157     * These entries match devices with class COMMUNICATION_SERIAL,
    1158     * COMMUNICATION_MODEM or COMMUNICATION_MULTISERIAL
    1159     diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
    1160     index 239bc9cba28c..f54f77037d22 100644
    1161     --- a/fs/ceph/mds_client.c
    1162     +++ b/fs/ceph/mds_client.c
    1163     @@ -644,6 +644,9 @@ static void __unregister_request(struct ceph_mds_client *mdsc,
    1164     {
    1165     dout("__unregister_request %p tid %lld\n", req, req->r_tid);
    1166    
    1167     + /* Never leave an unregistered request on an unsafe list! */
    1168     + list_del_init(&req->r_unsafe_item);
    1169     +
    1170     if (req->r_tid == mdsc->oldest_tid) {
    1171     struct rb_node *p = rb_next(&req->r_node);
    1172     mdsc->oldest_tid = 0;
    1173     @@ -1051,7 +1054,6 @@ static void cleanup_session_requests(struct ceph_mds_client *mdsc,
    1174     while (!list_empty(&session->s_unsafe)) {
    1175     req = list_first_entry(&session->s_unsafe,
    1176     struct ceph_mds_request, r_unsafe_item);
    1177     - list_del_init(&req->r_unsafe_item);
    1178     pr_warn_ratelimited(" dropping unsafe request %llu\n",
    1179     req->r_tid);
    1180     __unregister_request(mdsc, req);
    1181     @@ -2477,7 +2479,6 @@ static void handle_reply(struct ceph_mds_session *session, struct ceph_msg *msg)
    1182     * useful we could do with a revised return value.
    1183     */
    1184     dout("got safe reply %llu, mds%d\n", tid, mds);
    1185     - list_del_init(&req->r_unsafe_item);
    1186    
    1187     /* last unsafe request during umount? */
    1188     if (mdsc->stopping && !__get_oldest_req(mdsc))
    1189     diff --git a/fs/fat/inode.c b/fs/fat/inode.c
    1190     index 509411dd3698..cf644d52c0cf 100644
    1191     --- a/fs/fat/inode.c
    1192     +++ b/fs/fat/inode.c
    1193     @@ -1269,6 +1269,16 @@ out:
    1194     return 0;
    1195     }
    1196    
    1197     +static void fat_dummy_inode_init(struct inode *inode)
    1198     +{
    1199     + /* Initialize this dummy inode to work as no-op. */
    1200     + MSDOS_I(inode)->mmu_private = 0;
    1201     + MSDOS_I(inode)->i_start = 0;
    1202     + MSDOS_I(inode)->i_logstart = 0;
    1203     + MSDOS_I(inode)->i_attrs = 0;
    1204     + MSDOS_I(inode)->i_pos = 0;
    1205     +}
    1206     +
    1207     static int fat_read_root(struct inode *inode)
    1208     {
    1209     struct msdos_sb_info *sbi = MSDOS_SB(inode->i_sb);
    1210     @@ -1713,12 +1723,13 @@ int fat_fill_super(struct super_block *sb, void *data, int silent, int isvfat,
    1211     fat_inode = new_inode(sb);
    1212     if (!fat_inode)
    1213     goto out_fail;
    1214     - MSDOS_I(fat_inode)->i_pos = 0;
    1215     + fat_dummy_inode_init(fat_inode);
    1216     sbi->fat_inode = fat_inode;
    1217    
    1218     fsinfo_inode = new_inode(sb);
    1219     if (!fsinfo_inode)
    1220     goto out_fail;
    1221     + fat_dummy_inode_init(fsinfo_inode);
    1222     fsinfo_inode->i_ino = MSDOS_FSINFO_INO;
    1223     sbi->fsinfo_inode = fsinfo_inode;
    1224     insert_inode_hash(fsinfo_inode);
    1225     diff --git a/fs/mount.h b/fs/mount.h
    1226     index 14db05d424f7..3dc7dea5a357 100644
    1227     --- a/fs/mount.h
    1228     +++ b/fs/mount.h
    1229     @@ -86,7 +86,6 @@ static inline int is_mounted(struct vfsmount *mnt)
    1230     }
    1231    
    1232     extern struct mount *__lookup_mnt(struct vfsmount *, struct dentry *);
    1233     -extern struct mount *__lookup_mnt_last(struct vfsmount *, struct dentry *);
    1234    
    1235     extern int __legitimize_mnt(struct vfsmount *, unsigned);
    1236     extern bool legitimize_mnt(struct vfsmount *, unsigned);
    1237     diff --git a/fs/namespace.c b/fs/namespace.c
    1238     index da98a1bbd8b5..7df3d406d3e0 100644
    1239     --- a/fs/namespace.c
    1240     +++ b/fs/namespace.c
    1241     @@ -638,28 +638,6 @@ struct mount *__lookup_mnt(struct vfsmount *mnt, struct dentry *dentry)
    1242     }
    1243    
    1244     /*
    1245     - * find the last mount at @dentry on vfsmount @mnt.
    1246     - * mount_lock must be held.
    1247     - */
    1248     -struct mount *__lookup_mnt_last(struct vfsmount *mnt, struct dentry *dentry)
    1249     -{
    1250     - struct mount *p, *res = NULL;
    1251     - p = __lookup_mnt(mnt, dentry);
    1252     - if (!p)
    1253     - goto out;
    1254     - if (!(p->mnt.mnt_flags & MNT_UMOUNT))
    1255     - res = p;
    1256     - hlist_for_each_entry_continue(p, mnt_hash) {
    1257     - if (&p->mnt_parent->mnt != mnt || p->mnt_mountpoint != dentry)
    1258     - break;
    1259     - if (!(p->mnt.mnt_flags & MNT_UMOUNT))
    1260     - res = p;
    1261     - }
    1262     -out:
    1263     - return res;
    1264     -}
    1265     -
    1266     -/*
    1267     * lookup_mnt - Return the first child mount mounted at path
    1268     *
    1269     * "First" means first mounted chronologically. If you create the
    1270     @@ -879,6 +857,13 @@ void mnt_set_mountpoint(struct mount *mnt,
    1271     hlist_add_head(&child_mnt->mnt_mp_list, &mp->m_list);
    1272     }
    1273    
    1274     +static void __attach_mnt(struct mount *mnt, struct mount *parent)
    1275     +{
    1276     + hlist_add_head_rcu(&mnt->mnt_hash,
    1277     + m_hash(&parent->mnt, mnt->mnt_mountpoint));
    1278     + list_add_tail(&mnt->mnt_child, &parent->mnt_mounts);
    1279     +}
    1280     +
    1281     /*
    1282     * vfsmount lock must be held for write
    1283     */
    1284     @@ -887,28 +872,45 @@ static void attach_mnt(struct mount *mnt,
    1285     struct mountpoint *mp)
    1286     {
    1287     mnt_set_mountpoint(parent, mp, mnt);
    1288     - hlist_add_head_rcu(&mnt->mnt_hash, m_hash(&parent->mnt, mp->m_dentry));
    1289     - list_add_tail(&mnt->mnt_child, &parent->mnt_mounts);
    1290     + __attach_mnt(mnt, parent);
    1291     }
    1292    
    1293     -static void attach_shadowed(struct mount *mnt,
    1294     - struct mount *parent,
    1295     - struct mount *shadows)
    1296     +void mnt_change_mountpoint(struct mount *parent, struct mountpoint *mp, struct mount *mnt)
    1297     {
    1298     - if (shadows) {
    1299     - hlist_add_behind_rcu(&mnt->mnt_hash, &shadows->mnt_hash);
    1300     - list_add(&mnt->mnt_child, &shadows->mnt_child);
    1301     - } else {
    1302     - hlist_add_head_rcu(&mnt->mnt_hash,
    1303     - m_hash(&parent->mnt, mnt->mnt_mountpoint));
    1304     - list_add_tail(&mnt->mnt_child, &parent->mnt_mounts);
    1305     - }
    1306     + struct mountpoint *old_mp = mnt->mnt_mp;
    1307     + struct dentry *old_mountpoint = mnt->mnt_mountpoint;
    1308     + struct mount *old_parent = mnt->mnt_parent;
    1309     +
    1310     + list_del_init(&mnt->mnt_child);
    1311     + hlist_del_init(&mnt->mnt_mp_list);
    1312     + hlist_del_init_rcu(&mnt->mnt_hash);
    1313     +
    1314     + attach_mnt(mnt, parent, mp);
    1315     +
    1316     + put_mountpoint(old_mp);
    1317     +
    1318     + /*
    1319     + * Safely avoid even the suggestion this code might sleep or
    1320     + * lock the mount hash by taking advantage of the knowledge that
    1321     + * mnt_change_mountpoint will not release the final reference
    1322     + * to a mountpoint.
    1323     + *
    1324     + * During mounting, the mount passed in as the parent mount will
    1325     + * continue to use the old mountpoint and during unmounting, the
    1326     + * old mountpoint will continue to exist until namespace_unlock,
    1327     + * which happens well after mnt_change_mountpoint.
    1328     + */
    1329     + spin_lock(&old_mountpoint->d_lock);
    1330     + old_mountpoint->d_lockref.count--;
    1331     + spin_unlock(&old_mountpoint->d_lock);
    1332     +
    1333     + mnt_add_count(old_parent, -1);
    1334     }
    1335    
    1336     /*
    1337     * vfsmount lock must be held for write
    1338     */
    1339     -static void commit_tree(struct mount *mnt, struct mount *shadows)
    1340     +static void commit_tree(struct mount *mnt)
    1341     {
    1342     struct mount *parent = mnt->mnt_parent;
    1343     struct mount *m;
    1344     @@ -923,7 +925,7 @@ static void commit_tree(struct mount *mnt, struct mount *shadows)
    1345    
    1346     list_splice(&head, n->list.prev);
    1347    
    1348     - attach_shadowed(mnt, parent, shadows);
    1349     + __attach_mnt(mnt, parent);
    1350     touch_mnt_namespace(n);
    1351     }
    1352    
    1353     @@ -1718,7 +1720,6 @@ struct mount *copy_tree(struct mount *mnt, struct dentry *dentry,
    1354     continue;
    1355    
    1356     for (s = r; s; s = next_mnt(s, r)) {
    1357     - struct mount *t = NULL;
    1358     if (!(flag & CL_COPY_UNBINDABLE) &&
    1359     IS_MNT_UNBINDABLE(s)) {
    1360     s = skip_mnt_tree(s);
    1361     @@ -1740,14 +1741,7 @@ struct mount *copy_tree(struct mount *mnt, struct dentry *dentry,
    1362     goto out;
    1363     lock_mount_hash();
    1364     list_add_tail(&q->mnt_list, &res->mnt_list);
    1365     - mnt_set_mountpoint(parent, p->mnt_mp, q);
    1366     - if (!list_empty(&parent->mnt_mounts)) {
    1367     - t = list_last_entry(&parent->mnt_mounts,
    1368     - struct mount, mnt_child);
    1369     - if (t->mnt_mp != p->mnt_mp)
    1370     - t = NULL;
    1371     - }
    1372     - attach_shadowed(q, parent, t);
    1373     + attach_mnt(q, parent, p->mnt_mp);
    1374     unlock_mount_hash();
    1375     }
    1376     }
    1377     @@ -1925,10 +1919,18 @@ static int attach_recursive_mnt(struct mount *source_mnt,
    1378     struct path *parent_path)
    1379     {
    1380     HLIST_HEAD(tree_list);
    1381     + struct mountpoint *smp;
    1382     struct mount *child, *p;
    1383     struct hlist_node *n;
    1384     int err;
    1385    
    1386     + /* Preallocate a mountpoint in case the new mounts need
    1387     + * to be tucked under other mounts.
    1388     + */
    1389     + smp = get_mountpoint(source_mnt->mnt.mnt_root);
    1390     + if (IS_ERR(smp))
    1391     + return PTR_ERR(smp);
    1392     +
    1393     if (IS_MNT_SHARED(dest_mnt)) {
    1394     err = invent_group_ids(source_mnt, true);
    1395     if (err)
    1396     @@ -1948,16 +1950,19 @@ static int attach_recursive_mnt(struct mount *source_mnt,
    1397     touch_mnt_namespace(source_mnt->mnt_ns);
    1398     } else {
    1399     mnt_set_mountpoint(dest_mnt, dest_mp, source_mnt);
    1400     - commit_tree(source_mnt, NULL);
    1401     + commit_tree(source_mnt);
    1402     }
    1403    
    1404     hlist_for_each_entry_safe(child, n, &tree_list, mnt_hash) {
    1405     struct mount *q;
    1406     hlist_del_init(&child->mnt_hash);
    1407     - q = __lookup_mnt_last(&child->mnt_parent->mnt,
    1408     - child->mnt_mountpoint);
    1409     - commit_tree(child, q);
    1410     + q = __lookup_mnt(&child->mnt_parent->mnt,
    1411     + child->mnt_mountpoint);
    1412     + if (q)
    1413     + mnt_change_mountpoint(child, smp, q);
    1414     + commit_tree(child);
    1415     }
    1416     + put_mountpoint(smp);
    1417     unlock_mount_hash();
    1418    
    1419     return 0;
    1420     @@ -1970,6 +1975,10 @@ static int attach_recursive_mnt(struct mount *source_mnt,
    1421     unlock_mount_hash();
    1422     cleanup_group_ids(source_mnt, NULL);
    1423     out:
    1424     + read_seqlock_excl(&mount_lock);
    1425     + put_mountpoint(smp);
    1426     + read_sequnlock_excl(&mount_lock);
    1427     +
    1428     return err;
    1429     }
    1430    
    1431     diff --git a/fs/pnode.c b/fs/pnode.c
    1432     index 99899705b105..b9f2af59b9a6 100644
    1433     --- a/fs/pnode.c
    1434     +++ b/fs/pnode.c
    1435     @@ -324,6 +324,21 @@ out:
    1436     return ret;
    1437     }
    1438    
    1439     +static struct mount *find_topper(struct mount *mnt)
    1440     +{
    1441     + /* If there is exactly one mount covering mnt completely return it. */
    1442     + struct mount *child;
    1443     +
    1444     + if (!list_is_singular(&mnt->mnt_mounts))
    1445     + return NULL;
    1446     +
    1447     + child = list_first_entry(&mnt->mnt_mounts, struct mount, mnt_child);
    1448     + if (child->mnt_mountpoint != mnt->mnt.mnt_root)
    1449     + return NULL;
    1450     +
    1451     + return child;
    1452     +}
    1453     +
    1454     /*
    1455     * return true if the refcount is greater than count
    1456     */
    1457     @@ -344,9 +359,8 @@ static inline int do_refcount_check(struct mount *mnt, int count)
    1458     */
    1459     int propagate_mount_busy(struct mount *mnt, int refcnt)
    1460     {
    1461     - struct mount *m, *child;
    1462     + struct mount *m, *child, *topper;
    1463     struct mount *parent = mnt->mnt_parent;
    1464     - int ret = 0;
    1465    
    1466     if (mnt == parent)
    1467     return do_refcount_check(mnt, refcnt);
    1468     @@ -361,12 +375,24 @@ int propagate_mount_busy(struct mount *mnt, int refcnt)
    1469    
    1470     for (m = propagation_next(parent, parent); m;
    1471     m = propagation_next(m, parent)) {
    1472     - child = __lookup_mnt_last(&m->mnt, mnt->mnt_mountpoint);
    1473     - if (child && list_empty(&child->mnt_mounts) &&
    1474     - (ret = do_refcount_check(child, 1)))
    1475     - break;
    1476     + int count = 1;
    1477     + child = __lookup_mnt(&m->mnt, mnt->mnt_mountpoint);
    1478     + if (!child)
    1479     + continue;
    1480     +
    1481     + /* Is there exactly one mount on the child that covers
    1482     + * it completely whose reference should be ignored?
    1483     + */
    1484     + topper = find_topper(child);
    1485     + if (topper)
    1486     + count += 1;
    1487     + else if (!list_empty(&child->mnt_mounts))
    1488     + continue;
    1489     +
    1490     + if (do_refcount_check(child, count))
    1491     + return 1;
    1492     }
    1493     - return ret;
    1494     + return 0;
    1495     }
    1496    
    1497     /*
    1498     @@ -383,7 +409,7 @@ void propagate_mount_unlock(struct mount *mnt)
    1499    
    1500     for (m = propagation_next(parent, parent); m;
    1501     m = propagation_next(m, parent)) {
    1502     - child = __lookup_mnt_last(&m->mnt, mnt->mnt_mountpoint);
    1503     + child = __lookup_mnt(&m->mnt, mnt->mnt_mountpoint);
    1504     if (child)
    1505     child->mnt.mnt_flags &= ~MNT_LOCKED;
    1506     }
    1507     @@ -401,9 +427,11 @@ static void mark_umount_candidates(struct mount *mnt)
    1508    
    1509     for (m = propagation_next(parent, parent); m;
    1510     m = propagation_next(m, parent)) {
    1511     - struct mount *child = __lookup_mnt_last(&m->mnt,
    1512     + struct mount *child = __lookup_mnt(&m->mnt,
    1513     mnt->mnt_mountpoint);
    1514     - if (child && (!IS_MNT_LOCKED(child) || IS_MNT_MARKED(m))) {
    1515     + if (!child || (child->mnt.mnt_flags & MNT_UMOUNT))
    1516     + continue;
    1517     + if (!IS_MNT_LOCKED(child) || IS_MNT_MARKED(m)) {
    1518     SET_MNT_MARK(child);
    1519     }
    1520     }
    1521     @@ -422,8 +450,8 @@ static void __propagate_umount(struct mount *mnt)
    1522    
    1523     for (m = propagation_next(parent, parent); m;
    1524     m = propagation_next(m, parent)) {
    1525     -
    1526     - struct mount *child = __lookup_mnt_last(&m->mnt,
    1527     + struct mount *topper;
    1528     + struct mount *child = __lookup_mnt(&m->mnt,
    1529     mnt->mnt_mountpoint);
    1530     /*
    1531     * umount the child only if the child has no children
    1532     @@ -432,6 +460,15 @@ static void __propagate_umount(struct mount *mnt)
    1533     if (!child || !IS_MNT_MARKED(child))
    1534     continue;
    1535     CLEAR_MNT_MARK(child);
    1536     +
    1537     + /* If there is exactly one mount covering all of child
    1538     + * replace child with that mount.
    1539     + */
    1540     + topper = find_topper(child);
    1541     + if (topper)
    1542     + mnt_change_mountpoint(child->mnt_parent, child->mnt_mp,
    1543     + topper);
    1544     +
    1545     if (list_empty(&child->mnt_mounts)) {
    1546     list_del_init(&child->mnt_child);
    1547     child->mnt.mnt_flags |= MNT_UMOUNT;
    1548     diff --git a/fs/pnode.h b/fs/pnode.h
    1549     index 0fcdbe7ca648..623f01772bec 100644
    1550     --- a/fs/pnode.h
    1551     +++ b/fs/pnode.h
    1552     @@ -49,6 +49,8 @@ int get_dominating_id(struct mount *mnt, const struct path *root);
    1553     unsigned int mnt_get_count(struct mount *mnt);
    1554     void mnt_set_mountpoint(struct mount *, struct mountpoint *,
    1555     struct mount *);
    1556     +void mnt_change_mountpoint(struct mount *parent, struct mountpoint *mp,
    1557     + struct mount *mnt);
    1558     struct mount *copy_tree(struct mount *, struct dentry *, int);
    1559     bool is_path_reachable(struct mount *, struct dentry *,
    1560     const struct path *root);
    1561     diff --git a/include/linux/ceph/osdmap.h b/include/linux/ceph/osdmap.h
    1562     index e55c08bc3a96..0abc56140c83 100644
    1563     --- a/include/linux/ceph/osdmap.h
    1564     +++ b/include/linux/ceph/osdmap.h
    1565     @@ -49,7 +49,7 @@ static inline bool ceph_can_shift_osds(struct ceph_pg_pool_info *pool)
    1566     case CEPH_POOL_TYPE_EC:
    1567     return false;
    1568     default:
    1569     - BUG_ON(1);
    1570     + BUG();
    1571     }
    1572     }
    1573    
    1574     diff --git a/include/linux/lockd/lockd.h b/include/linux/lockd/lockd.h
    1575     index c15373894a42..b37dee3acaba 100644
    1576     --- a/include/linux/lockd/lockd.h
    1577     +++ b/include/linux/lockd/lockd.h
    1578     @@ -355,7 +355,8 @@ static inline int nlm_privileged_requester(const struct svc_rqst *rqstp)
    1579     static inline int nlm_compare_locks(const struct file_lock *fl1,
    1580     const struct file_lock *fl2)
    1581     {
    1582     - return fl1->fl_pid == fl2->fl_pid
    1583     + return file_inode(fl1->fl_file) == file_inode(fl2->fl_file)
    1584     + && fl1->fl_pid == fl2->fl_pid
    1585     && fl1->fl_owner == fl2->fl_owner
    1586     && fl1->fl_start == fl2->fl_start
    1587     && fl1->fl_end == fl2->fl_end
    1588     diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
    1589     index 800fe16cc36f..ed66414b91f0 100644
    1590     --- a/include/target/target_core_base.h
    1591     +++ b/include/target/target_core_base.h
    1592     @@ -740,6 +740,7 @@ struct se_lun {
    1593     struct config_group lun_group;
    1594     struct se_port_stat_grps port_stat_grps;
    1595     struct completion lun_ref_comp;
    1596     + struct completion lun_shutdown_comp;
    1597     struct percpu_ref lun_ref;
    1598     struct list_head lun_dev_link;
    1599     struct hlist_node link;
    1600     diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
    1601     index 00a43a70e1fc..0402fa45b343 100644
    1602     --- a/net/mac80211/pm.c
    1603     +++ b/net/mac80211/pm.c
    1604     @@ -168,6 +168,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
    1605     break;
    1606     }
    1607    
    1608     + flush_delayed_work(&sdata->dec_tailroom_needed_wk);
    1609     drv_remove_interface(local, sdata);
    1610     }
    1611    
    1612     diff --git a/tools/testing/ktest/ktest.pl b/tools/testing/ktest/ktest.pl
    1613     index d08e214ec6e7..223d88e25e05 100755
    1614     --- a/tools/testing/ktest/ktest.pl
    1615     +++ b/tools/testing/ktest/ktest.pl
    1616     @@ -2629,7 +2629,7 @@ sub do_run_test {
    1617     }
    1618    
    1619     waitpid $child_pid, 0;
    1620     - $child_exit = $?;
    1621     + $child_exit = $? >> 8;
    1622    
    1623     my $end_time = time;
    1624     $test_time = $end_time - $start_time;