Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-magellan/patches-3.15/0104-3.15.5-all-fixes.patch

    Annotation of /trunk/kernel-magellan/patches-3.15/0104-3.15.5-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 2485 - (hide annotations) (download)
    Mon Jul 21 12:24:50 2014 UTC (9 years, 9 months ago) by niro
    File size: 137365 byte(s) 
    -linux-3.15.5
    1 niro 2485 diff --git a/Documentation/devicetree/bindings/arm/armada-38x.txt b/Documentation/devicetree/bindings/arm/armada-38x.txt
    2     index 11f2330a6554..ad9f8ed4d9bd 100644
    3     --- a/Documentation/devicetree/bindings/arm/armada-38x.txt
    4     +++ b/Documentation/devicetree/bindings/arm/armada-38x.txt
    5     @@ -6,5 +6,15 @@ following property:
    6    
    7     Required root node property:
    8    
    9     - - compatible: must contain either "marvell,armada380" or
    10     - "marvell,armada385" depending on the variant of the SoC being used.
    11     + - compatible: must contain "marvell,armada380"
    12     +
    13     +In addition, boards using the Marvell Armada 385 SoC shall have the
    14     +following property before the previous one:
    15     +
    16     +Required root node property:
    17     +
    18     +compatible: must contain "marvell,armada385"
    19     +
    20     +Example:
    21     +
    22     +compatible = "marvell,a385-rd", "marvell,armada385", "marvell,armada380";
    23     diff --git a/Documentation/sysctl/vm.txt b/Documentation/sysctl/vm.txt
    24     index dd9d0e33b443..d3e6d844fa14 100644
    25     --- a/Documentation/sysctl/vm.txt
    26     +++ b/Documentation/sysctl/vm.txt
    27     @@ -702,7 +702,8 @@ The batch value of each per cpu pagelist is also updated as a result. It is
    28     set to pcp->high/4. The upper limit of batch is (PAGE_SHIFT * 8)
    29    
    30     The initial value is zero. Kernel does not use this value at boot time to set
    31     -the high water marks for each per cpu page list.
    32     +the high water marks for each per cpu page list. If the user writes '0' to this
    33     +sysctl, it will revert to this default behavior.
    34    
    35     ==============================================================
    36    
    37     diff --git a/Makefile b/Makefile
    38     index 25ecc1dd5bb5..e6b01ed8fd9f 100644
    39     --- a/Makefile
    40     +++ b/Makefile
    41     @@ -1,6 +1,6 @@
    42     VERSION = 3
    43     PATCHLEVEL = 15
    44     -SUBLEVEL = 4
    45     +SUBLEVEL = 5
    46     EXTRAVERSION =
    47     NAME = Shuffling Zombie Juror
    48    
    49     diff --git a/arch/arc/kernel/ctx_sw_asm.S b/arch/arc/kernel/ctx_sw_asm.S
    50     index 2ff0347a2fd7..e248594097e7 100644
    51     --- a/arch/arc/kernel/ctx_sw_asm.S
    52     +++ b/arch/arc/kernel/ctx_sw_asm.S
    53     @@ -10,9 +10,9 @@
    54     * -This is the more "natural" hand written assembler
    55     */
    56    
    57     +#include <linux/linkage.h>
    58     #include <asm/entry.h> /* For the SAVE_* macros */
    59     #include <asm/asm-offsets.h>
    60     -#include <asm/linkage.h>
    61    
    62     #define KSP_WORD_OFF ((TASK_THREAD + THREAD_KSP) / 4)
    63    
    64     diff --git a/arch/arm/boot/dts/armada-380.dtsi b/arch/arm/boot/dts/armada-380.dtsi
    65     index 6d0f03c98ee9..a284b611d3e3 100644
    66     --- a/arch/arm/boot/dts/armada-380.dtsi
    67     +++ b/arch/arm/boot/dts/armada-380.dtsi
    68     @@ -16,7 +16,7 @@
    69    
    70     / {
    71     model = "Marvell Armada 380 family SoC";
    72     - compatible = "marvell,armada380", "marvell,armada38x";
    73     + compatible = "marvell,armada380";
    74    
    75     cpus {
    76     #address-cells = <1>;
    77     diff --git a/arch/arm/boot/dts/armada-385-db.dts b/arch/arm/boot/dts/armada-385-db.dts
    78     index 6828d77696a6..b0e27e169712 100644
    79     --- a/arch/arm/boot/dts/armada-385-db.dts
    80     +++ b/arch/arm/boot/dts/armada-385-db.dts
    81     @@ -16,7 +16,7 @@
    82    
    83     / {
    84     model = "Marvell Armada 385 Development Board";
    85     - compatible = "marvell,a385-db", "marvell,armada385", "marvell,armada38x";
    86     + compatible = "marvell,a385-db", "marvell,armada385", "marvell,armada380";
    87    
    88     chosen {
    89     bootargs = "console=ttyS0,115200 earlyprintk";
    90     diff --git a/arch/arm/boot/dts/armada-385-rd.dts b/arch/arm/boot/dts/armada-385-rd.dts
    91     index 45250c88814b..229408aeecb2 100644
    92     --- a/arch/arm/boot/dts/armada-385-rd.dts
    93     +++ b/arch/arm/boot/dts/armada-385-rd.dts
    94     @@ -17,7 +17,7 @@
    95    
    96     / {
    97     model = "Marvell Armada 385 Reference Design";
    98     - compatible = "marvell,a385-rd", "marvell,armada385", "marvell,armada38x";
    99     + compatible = "marvell,a385-rd", "marvell,armada385", "marvell,armada380";
    100    
    101     chosen {
    102     bootargs = "console=ttyS0,115200 earlyprintk";
    103     diff --git a/arch/arm/boot/dts/armada-385.dtsi b/arch/arm/boot/dts/armada-385.dtsi
    104     index da801964a257..2dff97fb46bc 100644
    105     --- a/arch/arm/boot/dts/armada-385.dtsi
    106     +++ b/arch/arm/boot/dts/armada-385.dtsi
    107     @@ -16,7 +16,7 @@
    108    
    109     / {
    110     model = "Marvell Armada 385 family SoC";
    111     - compatible = "marvell,armada385", "marvell,armada38x";
    112     + compatible = "marvell,armada385", "marvell,armada380";
    113    
    114     cpus {
    115     #address-cells = <1>;
    116     diff --git a/arch/arm/boot/dts/armada-38x.dtsi b/arch/arm/boot/dts/armada-38x.dtsi
    117     index ca8813bb99ba..9a5914ddb4ea 100644
    118     --- a/arch/arm/boot/dts/armada-38x.dtsi
    119     +++ b/arch/arm/boot/dts/armada-38x.dtsi
    120     @@ -20,7 +20,7 @@
    121    
    122     / {
    123     model = "Marvell Armada 38x family SoC";
    124     - compatible = "marvell,armada38x";
    125     + compatible = "marvell,armada380";
    126    
    127     aliases {
    128     gpio0 = &gpio0;
    129     diff --git a/arch/arm/mach-omap2/mux.c b/arch/arm/mach-omap2/mux.c
    130     index 48094b58c88f..b12a4f9fc9d0 100644
    131     --- a/arch/arm/mach-omap2/mux.c
    132     +++ b/arch/arm/mach-omap2/mux.c
    133     @@ -183,8 +183,10 @@ static int __init _omap_mux_get_by_name(struct omap_mux_partition *partition,
    134     m0_entry = mux->muxnames[0];
    135    
    136     /* First check for full name in mode0.muxmode format */
    137     - if (mode0_len && strncmp(muxname, m0_entry, mode0_len))
    138     - continue;
    139     + if (mode0_len)
    140     + if (strncmp(muxname, m0_entry, mode0_len) ||
    141     + (strlen(m0_entry) != mode0_len))
    142     + continue;
    143    
    144     /* Then check for muxmode only */
    145     for (i = 0; i < OMAP_MUX_NR_MODES; i++) {
    146     diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
    147     index 39ac630d83de..a8e4bdbbb4b8 100644
    148     --- a/arch/arm64/kernel/entry.S
    149     +++ b/arch/arm64/kernel/entry.S
    150     @@ -275,7 +275,6 @@ el1_sp_pc:
    151     * Stack or PC alignment exception handling
    152     */
    153     mrs x0, far_el1
    154     - mov x1, x25
    155     mov x2, sp
    156     b do_sp_pc_abort
    157     el1_undef:
    158     diff --git a/arch/arm64/mm/flush.c b/arch/arm64/mm/flush.c
    159     index e4193e3adc7f..0d64089d28b5 100644
    160     --- a/arch/arm64/mm/flush.c
    161     +++ b/arch/arm64/mm/flush.c
    162     @@ -79,7 +79,8 @@ void __sync_icache_dcache(pte_t pte, unsigned long addr)
    163     return;
    164    
    165     if (!test_and_set_bit(PG_dcache_clean, &page->flags)) {
    166     - __flush_dcache_area(page_address(page), PAGE_SIZE);
    167     + __flush_dcache_area(page_address(page),
    168     + PAGE_SIZE << compound_order(page));
    169     __flush_icache_all();
    170     } else if (icache_is_aivivt()) {
    171     __flush_icache_all();
    172     diff --git a/arch/ia64/include/uapi/asm/fcntl.h b/arch/ia64/include/uapi/asm/fcntl.h
    173     index 1dd275dc8f65..7b485876cad4 100644
    174     --- a/arch/ia64/include/uapi/asm/fcntl.h
    175     +++ b/arch/ia64/include/uapi/asm/fcntl.h
    176     @@ -8,6 +8,7 @@
    177     #define force_o_largefile() \
    178     (personality(current->personality) != PER_LINUX32)
    179    
    180     +#include <linux/personality.h>
    181     #include <asm-generic/fcntl.h>
    182    
    183     #endif /* _ASM_IA64_FCNTL_H */
    184     diff --git a/arch/unicore32/mm/alignment.c b/arch/unicore32/mm/alignment.c
    185     index de7dc5fdd58b..24e836023e6c 100644
    186     --- a/arch/unicore32/mm/alignment.c
    187     +++ b/arch/unicore32/mm/alignment.c
    188     @@ -21,6 +21,7 @@
    189     #include <linux/sched.h>
    190     #include <linux/uaccess.h>
    191    
    192     +#include <asm/pgtable.h>
    193     #include <asm/tlbflush.h>
    194     #include <asm/unaligned.h>
    195    
    196     diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
    197     index 7de069afb382..520197517138 100644
    198     --- a/arch/x86/include/asm/kvm_host.h
    199     +++ b/arch/x86/include/asm/kvm_host.h
    200     @@ -99,7 +99,7 @@ static inline gfn_t gfn_to_index(gfn_t gfn, gfn_t base_gfn, int level)
    201     #define KVM_REFILL_PAGES 25
    202     #define KVM_MAX_CPUID_ENTRIES 80
    203     #define KVM_NR_FIXED_MTRR_REGION 88
    204     -#define KVM_NR_VAR_MTRR 8
    205     +#define KVM_NR_VAR_MTRR 10
    206    
    207     #define ASYNC_PF_PER_VCPU 64
    208    
    209     @@ -466,7 +466,7 @@ struct kvm_vcpu_arch {
    210     bool nmi_injected; /* Trying to inject an NMI this entry */
    211    
    212     struct mtrr_state_type mtrr_state;
    213     - u32 pat;
    214     + u64 pat;
    215    
    216     unsigned switch_db_regs;
    217     unsigned long db[KVM_NR_DB_REGS];
    218     diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
    219     index 20316c67b824..5521f7c14a11 100644
    220     --- a/arch/x86/kvm/x86.c
    221     +++ b/arch/x86/kvm/x86.c
    222     @@ -1912,7 +1912,7 @@ static int set_msr_hyperv_pw(struct kvm_vcpu *vcpu, u32 msr, u64 data)
    223     if (!(data & HV_X64_MSR_TSC_REFERENCE_ENABLE))
    224     break;
    225     gfn = data >> HV_X64_MSR_TSC_REFERENCE_ADDRESS_SHIFT;
    226     - if (kvm_write_guest(kvm, data,
    227     + if (kvm_write_guest(kvm, gfn << HV_X64_MSR_TSC_REFERENCE_ADDRESS_SHIFT,
    228     &tsc_ref, sizeof(tsc_ref)))
    229     return 1;
    230     mark_page_dirty(kvm, gfn);
    231     diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
    232     index 1039fb9ff5f5..95ee425bf7c6 100644
    233     --- a/block/blk-cgroup.c
    234     +++ b/block/blk-cgroup.c
    235     @@ -80,7 +80,7 @@ static struct blkcg_gq *blkg_alloc(struct blkcg *blkcg, struct request_queue *q,
    236     blkg->q = q;
    237     INIT_LIST_HEAD(&blkg->q_node);
    238     blkg->blkcg = blkcg;
    239     - blkg->refcnt = 1;
    240     + atomic_set(&blkg->refcnt, 1);
    241    
    242     /* root blkg uses @q->root_rl, init rl only for !root blkgs */
    243     if (blkcg != &blkcg_root) {
    244     @@ -399,11 +399,8 @@ void __blkg_release_rcu(struct rcu_head *rcu_head)
    245    
    246     /* release the blkcg and parent blkg refs this blkg has been holding */
    247     css_put(&blkg->blkcg->css);
    248     - if (blkg->parent) {
    249     - spin_lock_irq(blkg->q->queue_lock);
    250     + if (blkg->parent)
    251     blkg_put(blkg->parent);
    252     - spin_unlock_irq(blkg->q->queue_lock);
    253     - }
    254    
    255     blkg_free(blkg);
    256     }
    257     diff --git a/block/blk-cgroup.h b/block/blk-cgroup.h
    258     index 371fe8e92ab5..75012d8d900c 100644
    259     --- a/block/blk-cgroup.h
    260     +++ b/block/blk-cgroup.h
    261     @@ -18,6 +18,7 @@
    262     #include <linux/seq_file.h>
    263     #include <linux/radix-tree.h>
    264     #include <linux/blkdev.h>
    265     +#include <linux/atomic.h>
    266    
    267     /* Max limits for throttle policy */
    268     #define THROTL_IOPS_MAX UINT_MAX
    269     @@ -104,7 +105,7 @@ struct blkcg_gq {
    270     struct request_list rl;
    271    
    272     /* reference count */
    273     - int refcnt;
    274     + atomic_t refcnt;
    275    
    276     /* is this blkg online? protected by both blkcg and q locks */
    277     bool online;
    278     @@ -257,13 +258,12 @@ static inline int blkg_path(struct blkcg_gq *blkg, char *buf, int buflen)
    279     * blkg_get - get a blkg reference
    280     * @blkg: blkg to get
    281     *
    282     - * The caller should be holding queue_lock and an existing reference.
    283     + * The caller should be holding an existing reference.
    284     */
    285     static inline void blkg_get(struct blkcg_gq *blkg)
    286     {
    287     - lockdep_assert_held(blkg->q->queue_lock);
    288     - WARN_ON_ONCE(!blkg->refcnt);
    289     - blkg->refcnt++;
    290     + WARN_ON_ONCE(atomic_read(&blkg->refcnt) <= 0);
    291     + atomic_inc(&blkg->refcnt);
    292     }
    293    
    294     void __blkg_release_rcu(struct rcu_head *rcu);
    295     @@ -271,14 +271,11 @@ void __blkg_release_rcu(struct rcu_head *rcu);
    296     /**
    297     * blkg_put - put a blkg reference
    298     * @blkg: blkg to put
    299     - *
    300     - * The caller should be holding queue_lock.
    301     */
    302     static inline void blkg_put(struct blkcg_gq *blkg)
    303     {
    304     - lockdep_assert_held(blkg->q->queue_lock);
    305     - WARN_ON_ONCE(blkg->refcnt <= 0);
    306     - if (!--blkg->refcnt)
    307     + WARN_ON_ONCE(atomic_read(&blkg->refcnt) <= 0);
    308     + if (atomic_dec_and_test(&blkg->refcnt))
    309     call_rcu(&blkg->rcu_head, __blkg_release_rcu);
    310     }
    311    
    312     diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
    313     index 4c95b503b09e..684806c14f84 100644
    314     --- a/drivers/block/rbd.c
    315     +++ b/drivers/block/rbd.c
    316     @@ -1366,6 +1366,14 @@ static bool obj_request_exists_test(struct rbd_obj_request *obj_request)
    317     return test_bit(OBJ_REQ_EXISTS, &obj_request->flags) != 0;
    318     }
    319    
    320     +static bool obj_request_overlaps_parent(struct rbd_obj_request *obj_request)
    321     +{
    322     + struct rbd_device *rbd_dev = obj_request->img_request->rbd_dev;
    323     +
    324     + return obj_request->img_offset <
    325     + round_up(rbd_dev->parent_overlap, rbd_obj_bytes(&rbd_dev->header));
    326     +}
    327     +
    328     static void rbd_obj_request_get(struct rbd_obj_request *obj_request)
    329     {
    330     dout("%s: obj %p (was %d)\n", __func__, obj_request,
    331     @@ -1382,6 +1390,13 @@ static void rbd_obj_request_put(struct rbd_obj_request *obj_request)
    332     kref_put(&obj_request->kref, rbd_obj_request_destroy);
    333     }
    334    
    335     +static void rbd_img_request_get(struct rbd_img_request *img_request)
    336     +{
    337     + dout("%s: img %p (was %d)\n", __func__, img_request,
    338     + atomic_read(&img_request->kref.refcount));
    339     + kref_get(&img_request->kref);
    340     +}
    341     +
    342     static bool img_request_child_test(struct rbd_img_request *img_request);
    343     static void rbd_parent_request_destroy(struct kref *kref);
    344     static void rbd_img_request_destroy(struct kref *kref);
    345     @@ -2142,6 +2157,7 @@ static void rbd_img_obj_callback(struct rbd_obj_request *obj_request)
    346     img_request->next_completion = which;
    347     out:
    348     spin_unlock_irq(&img_request->completion_lock);
    349     + rbd_img_request_put(img_request);
    350    
    351     if (!more)
    352     rbd_img_request_complete(img_request);
    353     @@ -2242,6 +2258,7 @@ static int rbd_img_request_fill(struct rbd_img_request *img_request,
    354     goto out_unwind;
    355     obj_request->osd_req = osd_req;
    356     obj_request->callback = rbd_img_obj_callback;
    357     + rbd_img_request_get(img_request);
    358    
    359     if (write_request) {
    360     osd_req_op_alloc_hint_init(osd_req, which,
    361     @@ -2674,7 +2691,7 @@ static int rbd_img_obj_request_submit(struct rbd_obj_request *obj_request)
    362     */
    363     if (!img_request_write_test(img_request) ||
    364     !img_request_layered_test(img_request) ||
    365     - rbd_dev->parent_overlap <= obj_request->img_offset ||
    366     + !obj_request_overlaps_parent(obj_request) ||
    367     ((known = obj_request_known_test(obj_request)) &&
    368     obj_request_exists_test(obj_request))) {
    369    
    370     diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
    371     index 48eccb350180..089e72cd37be 100644
    372     --- a/drivers/block/zram/zram_drv.c
    373     +++ b/drivers/block/zram/zram_drv.c
    374     @@ -622,8 +622,10 @@ static void zram_reset_device(struct zram *zram, bool reset_capacity)
    375     memset(&zram->stats, 0, sizeof(zram->stats));
    376    
    377     zram->disksize = 0;
    378     - if (reset_capacity)
    379     + if (reset_capacity) {
    380     set_capacity(zram->disk, 0);
    381     + revalidate_disk(zram->disk);
    382     + }
    383     up_write(&zram->init_lock);
    384     }
    385    
    386     @@ -664,6 +666,7 @@ static ssize_t disksize_store(struct device *dev,
    387     zram->comp = comp;
    388     zram->disksize = disksize;
    389     set_capacity(zram->disk, zram->disksize >> SECTOR_SHIFT);
    390     + revalidate_disk(zram->disk);
    391     up_write(&zram->init_lock);
    392     return len;
    393    
    394     diff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c
    395     index 00f878a04d3f..0996a3a39855 100644
    396     --- a/drivers/clk/qcom/clk-rcg2.c
    397     +++ b/drivers/clk/qcom/clk-rcg2.c
    398     @@ -55,7 +55,7 @@ static int clk_rcg2_is_enabled(struct clk_hw *hw)
    399     if (ret)
    400     return ret;
    401    
    402     - return (cmd & CMD_ROOT_OFF) != 0;
    403     + return (cmd & CMD_ROOT_OFF) == 0;
    404     }
    405    
    406     static u8 clk_rcg2_get_parent(struct clk_hw *hw)
    407     diff --git a/drivers/clk/qcom/mmcc-msm8974.c b/drivers/clk/qcom/mmcc-msm8974.c
    408     index c95774514b81..6a0ae77d1939 100644
    409     --- a/drivers/clk/qcom/mmcc-msm8974.c
    410     +++ b/drivers/clk/qcom/mmcc-msm8974.c
    411     @@ -169,6 +169,7 @@ static struct clk_pll mmpll0 = {
    412     .config_reg = 0x0014,
    413     .mode_reg = 0x0000,
    414     .status_reg = 0x001c,
    415     + .status_bit = 17,
    416     .clkr.hw.init = &(struct clk_init_data){
    417     .name = "mmpll0",
    418     .parent_names = (const char *[]){ "xo" },
    419     @@ -192,9 +193,10 @@ static struct clk_pll mmpll1 = {
    420     .l_reg = 0x0044,
    421     .m_reg = 0x0048,
    422     .n_reg = 0x004c,
    423     - .config_reg = 0x0054,
    424     + .config_reg = 0x0050,
    425     .mode_reg = 0x0040,
    426     .status_reg = 0x005c,
    427     + .status_bit = 17,
    428     .clkr.hw.init = &(struct clk_init_data){
    429     .name = "mmpll1",
    430     .parent_names = (const char *[]){ "xo" },
    431     @@ -218,7 +220,7 @@ static struct clk_pll mmpll2 = {
    432     .l_reg = 0x4104,
    433     .m_reg = 0x4108,
    434     .n_reg = 0x410c,
    435     - .config_reg = 0x4114,
    436     + .config_reg = 0x4110,
    437     .mode_reg = 0x4100,
    438     .status_reg = 0x411c,
    439     .clkr.hw.init = &(struct clk_init_data){
    440     @@ -233,9 +235,10 @@ static struct clk_pll mmpll3 = {
    441     .l_reg = 0x0084,
    442     .m_reg = 0x0088,
    443     .n_reg = 0x008c,
    444     - .config_reg = 0x0094,
    445     + .config_reg = 0x0090,
    446     .mode_reg = 0x0080,
    447     .status_reg = 0x009c,
    448     + .status_bit = 17,
    449     .clkr.hw.init = &(struct clk_init_data){
    450     .name = "mmpll3",
    451     .parent_names = (const char *[]){ "xo" },
    452     @@ -2318,7 +2321,7 @@ static const struct pll_config mmpll1_config = {
    453     .vco_val = 0x0,
    454     .vco_mask = 0x3 << 20,
    455     .pre_div_val = 0x0,
    456     - .pre_div_mask = 0x3 << 12,
    457     + .pre_div_mask = 0x7 << 12,
    458     .post_div_val = 0x0,
    459     .post_div_mask = 0x3 << 8,
    460     .mn_ena_mask = BIT(24),
    461     @@ -2332,7 +2335,7 @@ static struct pll_config mmpll3_config = {
    462     .vco_val = 0x0,
    463     .vco_mask = 0x3 << 20,
    464     .pre_div_val = 0x0,
    465     - .pre_div_mask = 0x3 << 12,
    466     + .pre_div_mask = 0x7 << 12,
    467     .post_div_val = 0x0,
    468     .post_div_mask = 0x3 << 8,
    469     .mn_ena_mask = BIT(24),
    470     diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
    471     index db2e45b4808e..fcd0c9208e98 100644
    472     --- a/drivers/cpufreq/intel_pstate.c
    473     +++ b/drivers/cpufreq/intel_pstate.c
    474     @@ -200,10 +200,7 @@ static signed int pid_calc(struct _pid *pid, int32_t busy)
    475     pid->last_err = fp_error;
    476    
    477     result = pterm + mul_fp(pid->integral, pid->i_gain) + dterm;
    478     - if (result >= 0)
    479     - result = result + (1 << (FRAC_BITS-1));
    480     - else
    481     - result = result - (1 << (FRAC_BITS-1));
    482     + result = result + (1 << (FRAC_BITS-1));
    483     return (signed int)fp_toint(result);
    484     }
    485    
    486     diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
    487     index 03711d00aaae..8218078b6133 100644
    488     --- a/drivers/gpu/drm/drm_drv.c
    489     +++ b/drivers/gpu/drm/drm_drv.c
    490     @@ -419,8 +419,9 @@ long drm_ioctl(struct file *filp,
    491     retcode = -EFAULT;
    492     goto err_i1;
    493     }
    494     - } else
    495     + } else if (cmd & IOC_OUT) {
    496     memset(kdata, 0, usize);
    497     + }
    498    
    499     if (ioctl->flags & DRM_UNLOCKED)
    500     retcode = func(dev, kdata, file_priv);
    501     diff --git a/drivers/gpu/drm/i2c/tda998x_drv.c b/drivers/gpu/drm/i2c/tda998x_drv.c
    502     index 48af5cac1902..b98c969aeffa 100644
    503     --- a/drivers/gpu/drm/i2c/tda998x_drv.c
    504     +++ b/drivers/gpu/drm/i2c/tda998x_drv.c
    505     @@ -1183,7 +1183,6 @@ static void
    506     tda998x_encoder_destroy(struct drm_encoder *encoder)
    507     {
    508     struct tda998x_priv *priv = to_tda998x_priv(encoder);
    509     - drm_i2c_encoder_destroy(encoder);
    510    
    511     /* disable all IRQs and free the IRQ handler */
    512     cec_write(priv, REG_CEC_RXSHPDINTENA, 0);
    513     @@ -1193,6 +1192,7 @@ tda998x_encoder_destroy(struct drm_encoder *encoder)
    514    
    515     if (priv->cec)
    516     i2c_unregister_device(priv->cec);
    517     + drm_i2c_encoder_destroy(encoder);
    518     kfree(priv);
    519     }
    520    
    521     diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
    522     index 195fe5bc0aac..332259c42a50 100644
    523     --- a/drivers/gpu/drm/i915/i915_debugfs.c
    524     +++ b/drivers/gpu/drm/i915/i915_debugfs.c
    525     @@ -446,7 +446,9 @@ static int i915_gem_object_info(struct seq_file *m, void* data)
    526    
    527     memset(&stats, 0, sizeof(stats));
    528     stats.file_priv = file->driver_priv;
    529     + spin_lock(&file->table_lock);
    530     idr_for_each(&file->object_idr, per_file_stats, &stats);
    531     + spin_unlock(&file->table_lock);
    532     /*
    533     * Although we have a valid reference on file->pid, that does
    534     * not guarantee that the task_struct who called get_pid() is
    535     diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
    536     index 5deb22864c52..cc245429781f 100644
    537     --- a/drivers/gpu/drm/i915/i915_gem_gtt.c
    538     +++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
    539     @@ -1811,6 +1811,13 @@ static inline unsigned int gen8_get_total_gtt_size(u16 bdw_gmch_ctl)
    540     bdw_gmch_ctl &= BDW_GMCH_GGMS_MASK;
    541     if (bdw_gmch_ctl)
    542     bdw_gmch_ctl = 1 << bdw_gmch_ctl;
    543     +
    544     +#ifdef CONFIG_X86_32
    545     + /* Limit 32b platforms to a 2GB GGTT: 4 << 20 / pte size * PAGE_SIZE */
    546     + if (bdw_gmch_ctl > 4)
    547     + bdw_gmch_ctl = 4;
    548     +#endif
    549     +
    550     return bdw_gmch_ctl << 20;
    551     }
    552    
    553     diff --git a/drivers/gpu/drm/i915/i915_gpu_error.c b/drivers/gpu/drm/i915/i915_gpu_error.c
    554     index 12f1d43b2d68..8c7a7d891ff9 100644
    555     --- a/drivers/gpu/drm/i915/i915_gpu_error.c
    556     +++ b/drivers/gpu/drm/i915/i915_gpu_error.c
    557     @@ -894,6 +894,8 @@ static void i915_gem_record_rings(struct drm_device *dev,
    558     for (i = 0; i < I915_NUM_RINGS; i++) {
    559     struct intel_ring_buffer *ring = &dev_priv->ring[i];
    560    
    561     + error->ring[i].pid = -1;
    562     +
    563     if (ring->dev == NULL)
    564     continue;
    565    
    566     @@ -901,7 +903,6 @@ static void i915_gem_record_rings(struct drm_device *dev,
    567    
    568     i915_record_ring_state(dev, ring, &error->ring[i]);
    569    
    570     - error->ring[i].pid = -1;
    571     request = i915_gem_find_active_request(ring);
    572     if (request) {
    573     /* We need to copy these to an anonymous buffer
    574     diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
    575     index f98ba4e6e70b..e9830cd52d22 100644
    576     --- a/drivers/gpu/drm/i915/i915_irq.c
    577     +++ b/drivers/gpu/drm/i915/i915_irq.c
    578     @@ -2561,10 +2561,14 @@ static int semaphore_passed(struct intel_ring_buffer *ring)
    579     struct intel_ring_buffer *signaller;
    580     u32 seqno, ctl;
    581    
    582     - ring->hangcheck.deadlock = true;
    583     + ring->hangcheck.deadlock++;
    584    
    585     signaller = semaphore_waits_for(ring, &seqno);
    586     - if (signaller == NULL || signaller->hangcheck.deadlock)
    587     + if (signaller == NULL)
    588     + return -1;
    589     +
    590     + /* Prevent pathological recursion due to driver bugs */
    591     + if (signaller->hangcheck.deadlock >= I915_NUM_RINGS)
    592     return -1;
    593    
    594     /* cursory check for an unkickable deadlock */
    595     @@ -2572,7 +2576,13 @@ static int semaphore_passed(struct intel_ring_buffer *ring)
    596     if (ctl & RING_WAIT_SEMAPHORE && semaphore_passed(signaller) < 0)
    597     return -1;
    598    
    599     - return i915_seqno_passed(signaller->get_seqno(signaller, false), seqno);
    600     + if (i915_seqno_passed(signaller->get_seqno(signaller, false), seqno))
    601     + return 1;
    602     +
    603     + if (signaller->hangcheck.deadlock)
    604     + return -1;
    605     +
    606     + return 0;
    607     }
    608    
    609     static void semaphore_clear_deadlocks(struct drm_i915_private *dev_priv)
    610     @@ -2581,7 +2591,7 @@ static void semaphore_clear_deadlocks(struct drm_i915_private *dev_priv)
    611     int i;
    612    
    613     for_each_ring(ring, dev_priv, i)
    614     - ring->hangcheck.deadlock = false;
    615     + ring->hangcheck.deadlock = 0;
    616     }
    617    
    618     static enum intel_ring_hangcheck_action
    619     diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
    620     index aff4a113cda3..7eda7440d776 100644
    621     --- a/drivers/gpu/drm/i915/intel_bios.c
    622     +++ b/drivers/gpu/drm/i915/intel_bios.c
    623     @@ -287,9 +287,6 @@ parse_lfp_backlight(struct drm_i915_private *dev_priv, struct bdb_header *bdb)
    624     const struct bdb_lfp_backlight_data *backlight_data;
    625     const struct bdb_lfp_backlight_data_entry *entry;
    626    
    627     - /* Err to enabling backlight if no backlight block. */
    628     - dev_priv->vbt.backlight.present = true;
    629     -
    630     backlight_data = find_section(bdb, BDB_LVDS_BACKLIGHT);
    631     if (!backlight_data)
    632     return;
    633     @@ -839,6 +836,9 @@ init_vbt_defaults(struct drm_i915_private *dev_priv)
    634    
    635     dev_priv->vbt.crt_ddc_pin = GMBUS_PORT_VGADDC;
    636    
    637     + /* Default to having backlight */
    638     + dev_priv->vbt.backlight.present = true;
    639     +
    640     /* LFP panel data */
    641     dev_priv->vbt.lvds_dither = 1;
    642     dev_priv->vbt.lvds_vbt = 0;
    643     diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
    644     index cb8cfb7e0974..8b2538356371 100644
    645     --- a/drivers/gpu/drm/i915/intel_panel.c
    646     +++ b/drivers/gpu/drm/i915/intel_panel.c
    647     @@ -723,9 +723,6 @@ static void i965_enable_backlight(struct intel_connector *connector)
    648     ctl = freq << 16;
    649     I915_WRITE(BLC_PWM_CTL, ctl);
    650    
    651     - /* XXX: combine this into above write? */
    652     - intel_panel_actually_set_backlight(connector, panel->backlight.level);
    653     -
    654     ctl2 = BLM_PIPE(pipe);
    655     if (panel->backlight.combination_mode)
    656     ctl2 |= BLM_COMBINATION_MODE;
    657     @@ -734,6 +731,8 @@ static void i965_enable_backlight(struct intel_connector *connector)
    658     I915_WRITE(BLC_PWM_CTL2, ctl2);
    659     POSTING_READ(BLC_PWM_CTL2);
    660     I915_WRITE(BLC_PWM_CTL2, ctl2 | BLM_PWM_ENABLE);
    661     +
    662     + intel_panel_actually_set_backlight(connector, panel->backlight.level);
    663     }
    664    
    665     static void vlv_enable_backlight(struct intel_connector *connector)
    666     diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
    667     index d93dcf683e8c..2b68c35eec15 100644
    668     --- a/drivers/gpu/drm/i915/intel_pm.c
    669     +++ b/drivers/gpu/drm/i915/intel_pm.c
    670     @@ -511,8 +511,7 @@ void intel_update_fbc(struct drm_device *dev)
    671     obj = intel_fb->obj;
    672     adjusted_mode = &intel_crtc->config.adjusted_mode;
    673    
    674     - if (i915.enable_fbc < 0 &&
    675     - INTEL_INFO(dev)->gen <= 7 && !IS_HASWELL(dev)) {
    676     + if (i915.enable_fbc < 0) {
    677     if (set_no_fbc_reason(dev_priv, FBC_CHIP_DEFAULT))
    678     DRM_DEBUG_KMS("disabled per chip default\n");
    679     goto out_disable;
    680     @@ -5314,10 +5313,25 @@ bool intel_display_power_enabled_sw(struct drm_i915_private *dev_priv,
    681     enum intel_display_power_domain domain)
    682     {
    683     struct i915_power_domains *power_domains;
    684     + struct i915_power_well *power_well;
    685     + bool is_enabled;
    686     + int i;
    687     +
    688     + if (dev_priv->pm.suspended)
    689     + return false;
    690    
    691     power_domains = &dev_priv->power_domains;
    692     + is_enabled = true;
    693     + for_each_power_well_rev(i, power_well, BIT(domain), power_domains) {
    694     + if (power_well->always_on)
    695     + continue;
    696    
    697     - return power_domains->domain_use_count[domain];
    698     + if (!power_well->count) {
    699     + is_enabled = false;
    700     + break;
    701     + }
    702     + }
    703     + return is_enabled;
    704     }
    705    
    706     bool intel_display_power_enabled(struct drm_i915_private *dev_priv,
    707     @@ -5706,33 +5720,56 @@ void intel_display_power_put(struct drm_i915_private *dev_priv,
    708     static struct i915_power_domains *hsw_pwr;
    709    
    710     /* Display audio driver power well request */
    711     -void i915_request_power_well(void)
    712     +int i915_request_power_well(void)
    713     {
    714     struct drm_i915_private *dev_priv;
    715    
    716     - if (WARN_ON(!hsw_pwr))
    717     - return;
    718     + if (!hsw_pwr)
    719     + return -ENODEV;
    720    
    721     dev_priv = container_of(hsw_pwr, struct drm_i915_private,
    722     power_domains);
    723     intel_display_power_get(dev_priv, POWER_DOMAIN_AUDIO);
    724     + return 0;
    725     }
    726     EXPORT_SYMBOL_GPL(i915_request_power_well);
    727    
    728     /* Display audio driver power well release */
    729     -void i915_release_power_well(void)
    730     +int i915_release_power_well(void)
    731     {
    732     struct drm_i915_private *dev_priv;
    733    
    734     - if (WARN_ON(!hsw_pwr))
    735     - return;
    736     + if (!hsw_pwr)
    737     + return -ENODEV;
    738    
    739     dev_priv = container_of(hsw_pwr, struct drm_i915_private,
    740     power_domains);
    741     intel_display_power_put(dev_priv, POWER_DOMAIN_AUDIO);
    742     + return 0;
    743     }
    744     EXPORT_SYMBOL_GPL(i915_release_power_well);
    745    
    746     +/*
    747     + * Private interface for the audio driver to get CDCLK in kHz.
    748     + *
    749     + * Caller must request power well using i915_request_power_well() prior to
    750     + * making the call.
    751     + */
    752     +int i915_get_cdclk_freq(void)
    753     +{
    754     + struct drm_i915_private *dev_priv;
    755     +
    756     + if (!hsw_pwr)
    757     + return -ENODEV;
    758     +
    759     + dev_priv = container_of(hsw_pwr, struct drm_i915_private,
    760     + power_domains);
    761     +
    762     + return intel_ddi_get_cdclk_freq(dev_priv);
    763     +}
    764     +EXPORT_SYMBOL_GPL(i915_get_cdclk_freq);
    765     +
    766     +
    767     #define POWER_DOMAIN_MASK (BIT(POWER_DOMAIN_NUM) - 1)
    768    
    769     #define HSW_ALWAYS_ON_POWER_DOMAINS ( \
    770     diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.h b/drivers/gpu/drm/i915/intel_ringbuffer.h
    771     index 2b91c4b4d34b..4a978b97b47d 100644
    772     --- a/drivers/gpu/drm/i915/intel_ringbuffer.h
    773     +++ b/drivers/gpu/drm/i915/intel_ringbuffer.h
    774     @@ -51,7 +51,7 @@ struct intel_ring_hangcheck {
    775     u32 seqno;
    776     int score;
    777     enum intel_ring_hangcheck_action action;
    778     - bool deadlock;
    779     + int deadlock;
    780     };
    781    
    782     struct intel_ring_buffer {
    783     diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
    784     index 46be00d66df3..6317953d5773 100644
    785     --- a/drivers/gpu/drm/i915/intel_sdvo.c
    786     +++ b/drivers/gpu/drm/i915/intel_sdvo.c
    787     @@ -1383,7 +1383,9 @@ static void intel_sdvo_get_config(struct intel_encoder *encoder,
    788     >> SDVO_PORT_MULTIPLY_SHIFT) + 1;
    789     }
    790    
    791     - dotclock = pipe_config->port_clock / pipe_config->pixel_multiplier;
    792     + dotclock = pipe_config->port_clock;
    793     + if (pipe_config->pixel_multiplier)
    794     + dotclock /= pipe_config->pixel_multiplier;
    795    
    796     if (HAS_PCH_SPLIT(dev))
    797     ironlake_check_encoder_dotclock(pipe_config, dotclock);
    798     diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/nv04.c b/drivers/gpu/drm/nouveau/core/engine/disp/nv04.c
    799     index 6c89af792889..94a2cc69ec2c 100644
    800     --- a/drivers/gpu/drm/nouveau/core/engine/disp/nv04.c
    801     +++ b/drivers/gpu/drm/nouveau/core/engine/disp/nv04.c
    802     @@ -51,6 +51,14 @@ nv04_disp_scanoutpos(struct nouveau_object *object, u32 mthd,
    803     args->htotal = nv_rd32(priv, 0x680824 + (head * 0x2000)) & 0xffff;
    804     args->hblanke = args->htotal - 1;
    805    
    806     + /*
    807     + * If output is vga instead of digital then vtotal/htotal is invalid
    808     + * so we have to give up and trigger the timestamping fallback in the
    809     + * drm core.
    810     + */
    811     + if (!args->vtotal || !args->htotal)
    812     + return -ENOTSUPP;
    813     +
    814     args->time[0] = ktime_to_ns(ktime_get());
    815     line = nv_rd32(priv, 0x600868 + (head * 0x2000));
    816     args->time[1] = ktime_to_ns(ktime_get());
    817     diff --git a/drivers/gpu/drm/nouveau/core/engine/graph/ctxnv108.c b/drivers/gpu/drm/nouveau/core/engine/graph/ctxnv108.c
    818     index 48351b4d6d6b..8de4a4291548 100644
    819     --- a/drivers/gpu/drm/nouveau/core/engine/graph/ctxnv108.c
    820     +++ b/drivers/gpu/drm/nouveau/core/engine/graph/ctxnv108.c
    821     @@ -545,10 +545,12 @@ nv108_grctx_generate_mods(struct nvc0_graph_priv *priv, struct nvc0_grctx *info)
    822     mmio_list(0x408010, 0x80000000, 0, 0);
    823     mmio_list(0x419004, 0x00000000, 8, 1);
    824     mmio_list(0x419008, 0x00000000, 0, 0);
    825     + mmio_list(0x4064cc, 0x80000000, 0, 0);
    826     mmio_list(0x408004, 0x00000000, 8, 0);
    827     mmio_list(0x408008, 0x80000030, 0, 0);
    828     mmio_list(0x418808, 0x00000000, 8, 0);
    829     mmio_list(0x41880c, 0x80000030, 0, 0);
    830     + mmio_list(0x4064c8, 0x00c20200, 0, 0);
    831     mmio_list(0x418810, 0x80000000, 12, 2);
    832     mmio_list(0x419848, 0x10000000, 12, 2);
    833    
    834     diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c
    835     index e8822a934c48..90d8bf8ce0dc 100644
    836     --- a/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c
    837     +++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c
    838     @@ -26,6 +26,7 @@
    839    
    840     const struct nouveau_mc_intr
    841     nv50_mc_intr[] = {
    842     + { 0x04000000, NVDEV_ENGINE_DISP }, /* DISP before FIFO, so pageflip-timestamping works! */
    843     { 0x00000001, NVDEV_ENGINE_MPEG },
    844     { 0x00000100, NVDEV_ENGINE_FIFO },
    845     { 0x00001000, NVDEV_ENGINE_GR },
    846     @@ -34,7 +35,6 @@ nv50_mc_intr[] = {
    847     { 0x00020000, NVDEV_ENGINE_VP }, /* NV84- */
    848     { 0x00100000, NVDEV_SUBDEV_TIMER },
    849     { 0x00200000, NVDEV_SUBDEV_GPIO },
    850     - { 0x04000000, NVDEV_ENGINE_DISP },
    851     { 0x10000000, NVDEV_SUBDEV_BUS },
    852     { 0x80000000, NVDEV_ENGINE_SW },
    853     { 0x0002d101, NVDEV_SUBDEV_FB },
    854     diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv98.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nv98.c
    855     index f8a6f18e2d34..95b3d35388a8 100644
    856     --- a/drivers/gpu/drm/nouveau/core/subdev/mc/nv98.c
    857     +++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv98.c
    858     @@ -26,6 +26,7 @@
    859    
    860     static const struct nouveau_mc_intr
    861     nv98_mc_intr[] = {
    862     + { 0x04000000, NVDEV_ENGINE_DISP }, /* DISP first, so pageflip timestamps work */
    863     { 0x00000001, NVDEV_ENGINE_PPP },
    864     { 0x00000100, NVDEV_ENGINE_FIFO },
    865     { 0x00001000, NVDEV_ENGINE_GR },
    866     @@ -37,7 +38,6 @@ nv98_mc_intr[] = {
    867     { 0x00100000, NVDEV_SUBDEV_TIMER },
    868     { 0x00200000, NVDEV_SUBDEV_GPIO },
    869     { 0x00400000, NVDEV_ENGINE_COPY0 }, /* NVA3- */
    870     - { 0x04000000, NVDEV_ENGINE_DISP },
    871     { 0x10000000, NVDEV_SUBDEV_BUS },
    872     { 0x80000000, NVDEV_ENGINE_SW },
    873     { 0x0042d101, NVDEV_SUBDEV_FB },
    874     diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nvc0.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nvc0.c
    875     index 34472d317097..ac7f99a15fa7 100644
    876     --- a/drivers/gpu/drm/nouveau/core/subdev/mc/nvc0.c
    877     +++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nvc0.c
    878     @@ -26,6 +26,7 @@
    879    
    880     const struct nouveau_mc_intr
    881     nvc0_mc_intr[] = {
    882     + { 0x04000000, NVDEV_ENGINE_DISP }, /* DISP first, so pageflip timestamps work. */
    883     { 0x00000001, NVDEV_ENGINE_PPP },
    884     { 0x00000020, NVDEV_ENGINE_COPY0 },
    885     { 0x00000040, NVDEV_ENGINE_COPY1 },
    886     @@ -40,7 +41,6 @@ nvc0_mc_intr[] = {
    887     { 0x00200000, NVDEV_SUBDEV_GPIO },
    888     { 0x01000000, NVDEV_SUBDEV_PWR },
    889     { 0x02000000, NVDEV_SUBDEV_LTCG },
    890     - { 0x04000000, NVDEV_ENGINE_DISP },
    891     { 0x08000000, NVDEV_SUBDEV_FB },
    892     { 0x10000000, NVDEV_SUBDEV_BUS },
    893     { 0x40000000, NVDEV_SUBDEV_IBUS },
    894     diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
    895     index da764a4ed958..64938b77b38c 100644
    896     --- a/drivers/gpu/drm/nouveau/nouveau_display.c
    897     +++ b/drivers/gpu/drm/nouveau/nouveau_display.c
    898     @@ -736,6 +736,9 @@ nouveau_crtc_page_flip(struct drm_crtc *crtc, struct drm_framebuffer *fb,
    899     fb->bits_per_pixel, fb->pitches[0], crtc->x, crtc->y,
    900     new_bo->bo.offset };
    901    
    902     + /* Keep vblanks on during flip, for the target crtc of this flip */
    903     + drm_vblank_get(dev, nouveau_crtc(crtc)->index);
    904     +
    905     /* Emit a page flip */
    906     if (nv_device(drm->device)->card_type >= NV_50) {
    907     ret = nv50_display_flip_next(crtc, fb, chan, swap_interval);
    908     @@ -779,6 +782,7 @@ nouveau_crtc_page_flip(struct drm_crtc *crtc, struct drm_framebuffer *fb,
    909     return 0;
    910    
    911     fail_unreserve:
    912     + drm_vblank_put(dev, nouveau_crtc(crtc)->index);
    913     ttm_bo_unreserve(&old_bo->bo);
    914     fail_unpin:
    915     mutex_unlock(&chan->cli->mutex);
    916     @@ -798,6 +802,7 @@ nouveau_finish_page_flip(struct nouveau_channel *chan,
    917     struct drm_device *dev = drm->dev;
    918     struct nouveau_page_flip_state *s;
    919     unsigned long flags;
    920     + int crtcid = -1;
    921    
    922     spin_lock_irqsave(&dev->event_lock, flags);
    923    
    924     @@ -808,8 +813,16 @@ nouveau_finish_page_flip(struct nouveau_channel *chan,
    925     }
    926    
    927     s = list_first_entry(&fctx->flip, struct nouveau_page_flip_state, head);
    928     - if (s->event)
    929     - drm_send_vblank_event(dev, s->crtc, s->event);
    930     + if (s->event) {
    931     + /* Vblank timestamps/counts are only correct on >= NV-50 */
    932     + if (nv_device(drm->device)->card_type >= NV_50)
    933     + crtcid = s->crtc;
    934     +
    935     + drm_send_vblank_event(dev, crtcid, s->event);
    936     + }
    937     +
    938     + /* Give up ownership of vblank for page-flipped crtc */
    939     + drm_vblank_put(dev, s->crtc);
    940    
    941     list_del(&s->head);
    942     if (ps)
    943     diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
    944     index e911898348f8..c5f35b0d2983 100644
    945     --- a/drivers/gpu/drm/radeon/atombios_crtc.c
    946     +++ b/drivers/gpu/drm/radeon/atombios_crtc.c
    947     @@ -862,14 +862,16 @@ static void atombios_crtc_program_pll(struct drm_crtc *crtc,
    948     args.v5.ucMiscInfo = 0; /* HDMI depth, etc. */
    949     if (ss_enabled && (ss->type & ATOM_EXTERNAL_SS_MASK))
    950     args.v5.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_REF_DIV_SRC;
    951     - switch (bpc) {
    952     - case 8:
    953     - default:
    954     - args.v5.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_HDMI_24BPP;
    955     - break;
    956     - case 10:
    957     - args.v5.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_HDMI_30BPP;
    958     - break;
    959     + if (encoder_mode == ATOM_ENCODER_MODE_HDMI) {
    960     + switch (bpc) {
    961     + case 8:
    962     + default:
    963     + args.v5.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_HDMI_24BPP;
    964     + break;
    965     + case 10:
    966     + args.v5.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_HDMI_30BPP;
    967     + break;
    968     + }
    969     }
    970     args.v5.ucTransmitterID = encoder_id;
    971     args.v5.ucEncoderMode = encoder_mode;
    972     @@ -884,20 +886,22 @@ static void atombios_crtc_program_pll(struct drm_crtc *crtc,
    973     args.v6.ucMiscInfo = 0; /* HDMI depth, etc. */
    974     if (ss_enabled && (ss->type & ATOM_EXTERNAL_SS_MASK))
    975     args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_REF_DIV_SRC;
    976     - switch (bpc) {
    977     - case 8:
    978     - default:
    979     - args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_24BPP;
    980     - break;
    981     - case 10:
    982     - args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_30BPP;
    983     - break;
    984     - case 12:
    985     - args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_36BPP;
    986     - break;
    987     - case 16:
    988     - args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_48BPP;
    989     - break;
    990     + if (encoder_mode == ATOM_ENCODER_MODE_HDMI) {
    991     + switch (bpc) {
    992     + case 8:
    993     + default:
    994     + args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_24BPP;
    995     + break;
    996     + case 10:
    997     + args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_30BPP;
    998     + break;
    999     + case 12:
    1000     + args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_36BPP;
    1001     + break;
    1002     + case 16:
    1003     + args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_48BPP;
    1004     + break;
    1005     + }
    1006     }
    1007     args.v6.ucTransmitterID = encoder_id;
    1008     args.v6.ucEncoderMode = encoder_mode;
    1009     diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
    1010     index 54e4f52549af..87afe966a307 100644
    1011     --- a/drivers/gpu/drm/radeon/atombios_dp.c
    1012     +++ b/drivers/gpu/drm/radeon/atombios_dp.c
    1013     @@ -281,6 +281,19 @@ static int dp_get_max_dp_pix_clock(int link_rate,
    1014    
    1015     /***** radeon specific DP functions *****/
    1016    
    1017     +static int radeon_dp_get_max_link_rate(struct drm_connector *connector,
    1018     + u8 dpcd[DP_DPCD_SIZE])
    1019     +{
    1020     + int max_link_rate;
    1021     +
    1022     + if (radeon_connector_is_dp12_capable(connector))
    1023     + max_link_rate = min(drm_dp_max_link_rate(dpcd), 540000);
    1024     + else
    1025     + max_link_rate = min(drm_dp_max_link_rate(dpcd), 270000);
    1026     +
    1027     + return max_link_rate;
    1028     +}
    1029     +
    1030     /* First get the min lane# when low rate is used according to pixel clock
    1031     * (prefer low rate), second check max lane# supported by DP panel,
    1032     * if the max lane# < low rate lane# then use max lane# instead.
    1033     @@ -290,7 +303,7 @@ static int radeon_dp_get_dp_lane_number(struct drm_connector *connector,
    1034     int pix_clock)
    1035     {
    1036     int bpp = convert_bpc_to_bpp(radeon_get_monitor_bpc(connector));
    1037     - int max_link_rate = drm_dp_max_link_rate(dpcd);
    1038     + int max_link_rate = radeon_dp_get_max_link_rate(connector, dpcd);
    1039     int max_lane_num = drm_dp_max_lane_count(dpcd);
    1040     int lane_num;
    1041     int max_dp_pix_clock;
    1042     @@ -328,7 +341,7 @@ static int radeon_dp_get_dp_link_clock(struct drm_connector *connector,
    1043     return 540000;
    1044     }
    1045    
    1046     - return drm_dp_max_link_rate(dpcd);
    1047     + return radeon_dp_get_max_link_rate(connector, dpcd);
    1048     }
    1049    
    1050     static u8 radeon_dp_encoder_service(struct radeon_device *rdev,
    1051     diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
    1052     index e6eb5097597f..2b2908440644 100644
    1053     --- a/drivers/gpu/drm/radeon/atombios_encoders.c
    1054     +++ b/drivers/gpu/drm/radeon/atombios_encoders.c
    1055     @@ -1884,8 +1884,11 @@ atombios_set_encoder_crtc_source(struct drm_encoder *encoder)
    1056     args.v2.ucEncodeMode = ATOM_ENCODER_MODE_CRT;
    1057     else
    1058     args.v2.ucEncodeMode = atombios_get_encoder_mode(encoder);
    1059     - } else
    1060     + } else if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT)) {
    1061     + args.v2.ucEncodeMode = ATOM_ENCODER_MODE_LVDS;
    1062     + } else {
    1063     args.v2.ucEncodeMode = atombios_get_encoder_mode(encoder);
    1064     + }
    1065     switch (radeon_encoder->encoder_id) {
    1066     case ENCODER_OBJECT_ID_INTERNAL_UNIPHY:
    1067     case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1:
    1068     diff --git a/drivers/gpu/drm/radeon/cikd.h b/drivers/gpu/drm/radeon/cikd.h
    1069     index dd7926394a8f..e6d2dbbe4f6e 100644
    1070     --- a/drivers/gpu/drm/radeon/cikd.h
    1071     +++ b/drivers/gpu/drm/radeon/cikd.h
    1072     @@ -1751,12 +1751,12 @@
    1073     #define EOP_TC_WB_ACTION_EN (1 << 15) /* L2 */
    1074     #define EOP_TCL1_ACTION_EN (1 << 16)
    1075     #define EOP_TC_ACTION_EN (1 << 17) /* L2 */
    1076     +#define EOP_TCL2_VOLATILE (1 << 24)
    1077     #define EOP_CACHE_POLICY(x) ((x) << 25)
    1078     /* 0 - LRU
    1079     * 1 - Stream
    1080     * 2 - Bypass
    1081     */
    1082     -#define EOP_TCL2_VOLATILE (1 << 27)
    1083     #define DATA_SEL(x) ((x) << 29)
    1084     /* 0 - discard
    1085     * 1 - send low 32bit data
    1086     diff --git a/drivers/gpu/drm/radeon/cypress_dpm.c b/drivers/gpu/drm/radeon/cypress_dpm.c
    1087     index 5a9a5f4d7888..47d31e915758 100644
    1088     --- a/drivers/gpu/drm/radeon/cypress_dpm.c
    1089     +++ b/drivers/gpu/drm/radeon/cypress_dpm.c
    1090     @@ -1551,7 +1551,7 @@ int cypress_populate_smc_voltage_tables(struct radeon_device *rdev,
    1091    
    1092     table->voltageMaskTable.highMask[RV770_SMC_VOLTAGEMASK_VDDCI] = 0;
    1093     table->voltageMaskTable.lowMask[RV770_SMC_VOLTAGEMASK_VDDCI] =
    1094     - cpu_to_be32(eg_pi->vddc_voltage_table.mask_low);
    1095     + cpu_to_be32(eg_pi->vddci_voltage_table.mask_low);
    1096     }
    1097    
    1098     return 0;
    1099     diff --git a/drivers/gpu/drm/radeon/ni_dpm.c b/drivers/gpu/drm/radeon/ni_dpm.c
    1100     index 004c931606c4..01fc4888e6fe 100644
    1101     --- a/drivers/gpu/drm/radeon/ni_dpm.c
    1102     +++ b/drivers/gpu/drm/radeon/ni_dpm.c
    1103     @@ -1315,7 +1315,7 @@ static void ni_populate_smc_voltage_tables(struct radeon_device *rdev,
    1104    
    1105     table->voltageMaskTable.highMask[NISLANDS_SMC_VOLTAGEMASK_VDDCI] = 0;
    1106     table->voltageMaskTable.lowMask[NISLANDS_SMC_VOLTAGEMASK_VDDCI] =
    1107     - cpu_to_be32(eg_pi->vddc_voltage_table.mask_low);
    1108     + cpu_to_be32(eg_pi->vddci_voltage_table.mask_low);
    1109     }
    1110     }
    1111    
    1112     diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
    1113     index ea50e0ae7bf7..bf73a04791ed 100644
    1114     --- a/drivers/gpu/drm/radeon/radeon_connectors.c
    1115     +++ b/drivers/gpu/drm/radeon/radeon_connectors.c
    1116     @@ -1387,7 +1387,7 @@ bool radeon_connector_is_dp12_capable(struct drm_connector *connector)
    1117     struct radeon_device *rdev = dev->dev_private;
    1118    
    1119     if (ASIC_IS_DCE5(rdev) &&
    1120     - (rdev->clock.dp_extclk >= 53900) &&
    1121     + (rdev->clock.default_dispclk >= 53900) &&
    1122     radeon_connector_encoder_is_hbr2(connector)) {
    1123     return true;
    1124     }
    1125     diff --git a/drivers/gpu/drm/radeon/radeon_vce.c b/drivers/gpu/drm/radeon/radeon_vce.c
    1126     index 3971d968af6c..aa21c31a846c 100644
    1127     --- a/drivers/gpu/drm/radeon/radeon_vce.c
    1128     +++ b/drivers/gpu/drm/radeon/radeon_vce.c
    1129     @@ -66,6 +66,7 @@ int radeon_vce_init(struct radeon_device *rdev)
    1130     case CHIP_BONAIRE:
    1131     case CHIP_KAVERI:
    1132     case CHIP_KABINI:
    1133     + case CHIP_HAWAII:
    1134     case CHIP_MULLINS:
    1135     fw_name = FIRMWARE_BONAIRE;
    1136     break;
    1137     diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
    1138     index a89ad938eacf..b031b48dbb3c 100644
    1139     --- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
    1140     +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
    1141     @@ -179,7 +179,6 @@ static int vmw_fb_set_par(struct fb_info *info)
    1142     vmw_write(vmw_priv, SVGA_REG_DISPLAY_POSITION_Y, info->var.yoffset);
    1143     vmw_write(vmw_priv, SVGA_REG_DISPLAY_WIDTH, info->var.xres);
    1144     vmw_write(vmw_priv, SVGA_REG_DISPLAY_HEIGHT, info->var.yres);
    1145     - vmw_write(vmw_priv, SVGA_REG_BYTES_PER_LINE, info->fix.line_length);
    1146     vmw_write(vmw_priv, SVGA_REG_DISPLAY_ID, SVGA_ID_INVALID);
    1147     }
    1148    
    1149     diff --git a/drivers/gpu/vga/vga_switcheroo.c b/drivers/gpu/vga/vga_switcheroo.c
    1150     index ec0ae2d1686a..6866448083b2 100644
    1151     --- a/drivers/gpu/vga/vga_switcheroo.c
    1152     +++ b/drivers/gpu/vga/vga_switcheroo.c
    1153     @@ -623,7 +623,8 @@ static int vga_switcheroo_runtime_suspend(struct device *dev)
    1154     ret = dev->bus->pm->runtime_suspend(dev);
    1155     if (ret)
    1156     return ret;
    1157     -
    1158     + if (vgasr_priv.handler->switchto)
    1159     + vgasr_priv.handler->switchto(VGA_SWITCHEROO_IGD);
    1160     vga_switcheroo_power_switch(pdev, VGA_SWITCHEROO_OFF);
    1161     return 0;
    1162     }
    1163     diff --git a/drivers/hwmon/ina2xx.c b/drivers/hwmon/ina2xx.c
    1164     index 93d26e8af3e2..bfd3f3eeabcd 100644
    1165     --- a/drivers/hwmon/ina2xx.c
    1166     +++ b/drivers/hwmon/ina2xx.c
    1167     @@ -148,7 +148,8 @@ static int ina2xx_get_value(struct ina2xx_data *data, u8 reg)
    1168    
    1169     switch (reg) {
    1170     case INA2XX_SHUNT_VOLTAGE:
    1171     - val = DIV_ROUND_CLOSEST(data->regs[reg],
    1172     + /* signed register */
    1173     + val = DIV_ROUND_CLOSEST((s16)data->regs[reg],
    1174     data->config->shunt_div);
    1175     break;
    1176     case INA2XX_BUS_VOLTAGE:
    1177     @@ -160,8 +161,8 @@ static int ina2xx_get_value(struct ina2xx_data *data, u8 reg)
    1178     val = data->regs[reg] * data->config->power_lsb;
    1179     break;
    1180     case INA2XX_CURRENT:
    1181     - /* LSB=1mA (selected). Is in mA */
    1182     - val = data->regs[reg];
    1183     + /* signed register, LSB=1mA (selected), in mA */
    1184     + val = (s16)data->regs[reg];
    1185     break;
    1186     default:
    1187     /* programmer goofed */
    1188     diff --git a/drivers/iio/adc/twl4030-madc.c b/drivers/iio/adc/twl4030-madc.c
    1189     index 7de1c4c87942..eb86786e698e 100644
    1190     --- a/drivers/iio/adc/twl4030-madc.c
    1191     +++ b/drivers/iio/adc/twl4030-madc.c
    1192     @@ -645,6 +645,7 @@ int twl4030_get_madc_conversion(int channel_no)
    1193     req.channels = (1 << channel_no);
    1194     req.method = TWL4030_MADC_SW2;
    1195     req.active = 0;
    1196     + req.raw = 0;
    1197     req.func_cb = NULL;
    1198     ret = twl4030_madc_conversion(&req);
    1199     if (ret < 0)
    1200     diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c
    1201     index 0cf5f8e06cfc..1e8e94d4db7d 100644
    1202     --- a/drivers/iio/inkern.c
    1203     +++ b/drivers/iio/inkern.c
    1204     @@ -183,7 +183,7 @@ static struct iio_channel *of_iio_channel_get_by_name(struct device_node *np,
    1205     else if (name && index >= 0) {
    1206     pr_err("ERROR: could not get IIO channel %s:%s(%i)\n",
    1207     np->full_name, name ? name : "", index);
    1208     - return chan;
    1209     + return NULL;
    1210     }
    1211    
    1212     /*
    1213     @@ -193,8 +193,9 @@ static struct iio_channel *of_iio_channel_get_by_name(struct device_node *np,
    1214     */
    1215     np = np->parent;
    1216     if (np && !of_get_property(np, "io-channel-ranges", NULL))
    1217     - break;
    1218     + return NULL;
    1219     }
    1220     +
    1221     return chan;
    1222     }
    1223    
    1224     @@ -317,6 +318,7 @@ struct iio_channel *iio_channel_get(struct device *dev,
    1225     if (channel != NULL)
    1226     return channel;
    1227     }
    1228     +
    1229     return iio_channel_get_sys(name, channel_name);
    1230     }
    1231     EXPORT_SYMBOL_GPL(iio_channel_get);
    1232     diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
    1233     index f256ffc02e29..7119079719e4 100644
    1234     --- a/drivers/iommu/intel-iommu.c
    1235     +++ b/drivers/iommu/intel-iommu.c
    1236     @@ -3799,14 +3799,11 @@ int dmar_iommu_notify_scope_dev(struct dmar_pci_notify_info *info)
    1237     ((void *)rmrr) + rmrr->header.length,
    1238     rmrr->segment, rmrru->devices,
    1239     rmrru->devices_cnt);
    1240     - if (ret > 0)
    1241     - break;
    1242     - else if(ret < 0)
    1243     + if(ret < 0)
    1244     return ret;
    1245     } else if (info->event == BUS_NOTIFY_DEL_DEVICE) {
    1246     - if (dmar_remove_dev_scope(info, rmrr->segment,
    1247     - rmrru->devices, rmrru->devices_cnt))
    1248     - break;
    1249     + dmar_remove_dev_scope(info, rmrr->segment,
    1250     + rmrru->devices, rmrru->devices_cnt);
    1251     }
    1252     }
    1253    
    1254     diff --git a/drivers/irqchip/spear-shirq.c b/drivers/irqchip/spear-shirq.c
    1255     index 3fdda3a40269..6ce6bd3441bf 100644
    1256     --- a/drivers/irqchip/spear-shirq.c
    1257     +++ b/drivers/irqchip/spear-shirq.c
    1258     @@ -125,7 +125,7 @@ static struct spear_shirq spear320_shirq_ras2 = {
    1259     };
    1260    
    1261     static struct spear_shirq spear320_shirq_ras3 = {
    1262     - .irq_nr = 3,
    1263     + .irq_nr = 7,
    1264     .irq_bit_off = 0,
    1265     .invalid_irq = 1,
    1266     .regs = {
    1267     diff --git a/drivers/md/dm-era-target.c b/drivers/md/dm-era-target.c
    1268     index 414dad4cb49b..ad913cd4aded 100644
    1269     --- a/drivers/md/dm-era-target.c
    1270     +++ b/drivers/md/dm-era-target.c
    1271     @@ -1391,7 +1391,8 @@ static int era_is_congested(struct dm_target_callbacks *cb, int bdi_bits)
    1272    
    1273     static void era_destroy(struct era *era)
    1274     {
    1275     - metadata_close(era->md);
    1276     + if (era->md)
    1277     + metadata_close(era->md);
    1278    
    1279     if (era->wq)
    1280     destroy_workqueue(era->wq);
    1281     diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
    1282     index 242ac2ea5f29..6b4793d71fb6 100644
    1283     --- a/drivers/md/dm-thin.c
    1284     +++ b/drivers/md/dm-thin.c
    1285     @@ -3068,7 +3068,8 @@ static void set_discard_limits(struct pool_c *pt, struct queue_limits *limits)
    1286     */
    1287     if (pt->adjusted_pf.discard_passdown) {
    1288     data_limits = &bdev_get_queue(pt->data_dev->bdev)->limits;
    1289     - limits->discard_granularity = data_limits->discard_granularity;
    1290     + limits->discard_granularity = max(data_limits->discard_granularity,
    1291     + pool->sectors_per_block << SECTOR_SHIFT);
    1292     } else
    1293     limits->discard_granularity = pool->sectors_per_block << SECTOR_SHIFT;
    1294     }
    1295     diff --git a/drivers/md/md.c b/drivers/md/md.c
    1296     index 2382cfc9bb3f..9a182092f4a8 100644
    1297     --- a/drivers/md/md.c
    1298     +++ b/drivers/md/md.c
    1299     @@ -7491,6 +7491,19 @@ void md_do_sync(struct md_thread *thread)
    1300     rdev->recovery_offset < j)
    1301     j = rdev->recovery_offset;
    1302     rcu_read_unlock();
    1303     +
    1304     + /* If there is a bitmap, we need to make sure all
    1305     + * writes that started before we added a spare
    1306     + * complete before we start doing a recovery.
    1307     + * Otherwise the write might complete and (via
    1308     + * bitmap_endwrite) set a bit in the bitmap after the
    1309     + * recovery has checked that bit and skipped that
    1310     + * region.
    1311     + */
    1312     + if (mddev->bitmap) {
    1313     + mddev->pers->quiesce(mddev, 1);
    1314     + mddev->pers->quiesce(mddev, 0);
    1315     + }
    1316     }
    1317    
    1318     printk(KERN_INFO "md: %s of RAID array %s\n", desc, mdname(mddev));
    1319     diff --git a/drivers/mmc/host/rtsx_pci_sdmmc.c b/drivers/mmc/host/rtsx_pci_sdmmc.c
    1320     index 0b9ded13a3ae..1c68e0d2c82d 100644
    1321     --- a/drivers/mmc/host/rtsx_pci_sdmmc.c
    1322     +++ b/drivers/mmc/host/rtsx_pci_sdmmc.c
    1323     @@ -236,6 +236,9 @@ static void sd_send_cmd_get_rsp(struct realtek_pci_sdmmc *host,
    1324     case MMC_RSP_R1:
    1325     rsp_type = SD_RSP_TYPE_R1;
    1326     break;
    1327     + case MMC_RSP_R1 & ~MMC_RSP_CRC:
    1328     + rsp_type = SD_RSP_TYPE_R1 | SD_NO_CHECK_CRC7;
    1329     + break;
    1330     case MMC_RSP_R1B:
    1331     rsp_type = SD_RSP_TYPE_R1b;
    1332     break;
    1333     diff --git a/drivers/mtd/nand/fsl_elbc_nand.c b/drivers/mtd/nand/fsl_elbc_nand.c
    1334     index ec549cd9849f..545a5c002f09 100644
    1335     --- a/drivers/mtd/nand/fsl_elbc_nand.c
    1336     +++ b/drivers/mtd/nand/fsl_elbc_nand.c
    1337     @@ -723,6 +723,19 @@ static int fsl_elbc_write_page(struct mtd_info *mtd, struct nand_chip *chip,
    1338     return 0;
    1339     }
    1340    
    1341     +/* ECC will be calculated automatically, and errors will be detected in
    1342     + * waitfunc.
    1343     + */
    1344     +static int fsl_elbc_write_subpage(struct mtd_info *mtd, struct nand_chip *chip,
    1345     + uint32_t offset, uint32_t data_len,
    1346     + const uint8_t *buf, int oob_required)
    1347     +{
    1348     + fsl_elbc_write_buf(mtd, buf, mtd->writesize);
    1349     + fsl_elbc_write_buf(mtd, chip->oob_poi, mtd->oobsize);
    1350     +
    1351     + return 0;
    1352     +}
    1353     +
    1354     static int fsl_elbc_chip_init(struct fsl_elbc_mtd *priv)
    1355     {
    1356     struct fsl_lbc_ctrl *ctrl = priv->ctrl;
    1357     @@ -761,6 +774,7 @@ static int fsl_elbc_chip_init(struct fsl_elbc_mtd *priv)
    1358    
    1359     chip->ecc.read_page = fsl_elbc_read_page;
    1360     chip->ecc.write_page = fsl_elbc_write_page;
    1361     + chip->ecc.write_subpage = fsl_elbc_write_subpage;
    1362    
    1363     /* If CS Base Register selects full hardware ECC then use it */
    1364     if ((in_be32(&lbc->bank[priv->bank].br) & BR_DECC) ==
    1365     diff --git a/drivers/mtd/nand/omap2.c b/drivers/mtd/nand/omap2.c
    1366     index 1ff49b80bdaf..0a685089c3fd 100644
    1367     --- a/drivers/mtd/nand/omap2.c
    1368     +++ b/drivers/mtd/nand/omap2.c
    1369     @@ -1382,7 +1382,7 @@ static int omap_elm_correct_data(struct mtd_info *mtd, u_char *data,
    1370    
    1371     /* Check if any error reported */
    1372     if (!is_error_reported)
    1373     - return 0;
    1374     + return stat;
    1375    
    1376     /* Decode BCH error using ELM module */
    1377     elm_decode_bch_error_page(info->elm_dev, ecc_vec, err_vec);
    1378     diff --git a/drivers/mtd/nand/pxa3xx_nand.c b/drivers/mtd/nand/pxa3xx_nand.c
    1379     index 7588fe2c127f..3003611b6865 100644
    1380     --- a/drivers/mtd/nand/pxa3xx_nand.c
    1381     +++ b/drivers/mtd/nand/pxa3xx_nand.c
    1382     @@ -127,10 +127,10 @@
    1383    
    1384     /* macros for registers read/write */
    1385     #define nand_writel(info, off, val) \
    1386     - __raw_writel((val), (info)->mmio_base + (off))
    1387     + writel_relaxed((val), (info)->mmio_base + (off))
    1388    
    1389     #define nand_readl(info, off) \
    1390     - __raw_readl((info)->mmio_base + (off))
    1391     + readl_relaxed((info)->mmio_base + (off))
    1392    
    1393     /* error code and state */
    1394     enum {
    1395     diff --git a/drivers/net/ethernet/allwinner/sun4i-emac.c b/drivers/net/ethernet/allwinner/sun4i-emac.c
    1396     index 28460676b8ca..d81e7167a8b5 100644
    1397     --- a/drivers/net/ethernet/allwinner/sun4i-emac.c
    1398     +++ b/drivers/net/ethernet/allwinner/sun4i-emac.c
    1399     @@ -736,6 +736,7 @@ static int emac_open(struct net_device *dev)
    1400    
    1401     ret = emac_mdio_probe(dev);
    1402     if (ret < 0) {
    1403     + free_irq(dev->irq, dev);
    1404     netdev_err(dev, "cannot probe MDIO bus\n");
    1405     return ret;
    1406     }
    1407     diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.c b/drivers/net/ethernet/mellanox/mlx4/fw.c
    1408     index d16a4d118903..ef242e19766f 100644
    1409     --- a/drivers/net/ethernet/mellanox/mlx4/fw.c
    1410     +++ b/drivers/net/ethernet/mellanox/mlx4/fw.c
    1411     @@ -414,7 +414,7 @@ int mlx4_QUERY_FUNC_CAP(struct mlx4_dev *dev, u32 gen_or_port,
    1412    
    1413     MLX4_GET(func_cap->flags1, outbox, QUERY_FUNC_CAP_FLAGS1_OFFSET);
    1414     if (dev->caps.port_type[gen_or_port] == MLX4_PORT_TYPE_ETH) {
    1415     - if (func_cap->flags1 & QUERY_FUNC_CAP_FLAGS1_OFFSET) {
    1416     + if (func_cap->flags1 & QUERY_FUNC_CAP_FLAGS1_FORCE_VLAN) {
    1417     mlx4_err(dev, "VLAN is enforced on this port\n");
    1418     err = -EPROTONOSUPPORT;
    1419     goto out;
    1420     diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
    1421     index c187d748115f..8fa321f39dfd 100644
    1422     --- a/drivers/net/ethernet/mellanox/mlx4/main.c
    1423     +++ b/drivers/net/ethernet/mellanox/mlx4/main.c
    1424     @@ -2800,7 +2800,7 @@ static struct pci_driver mlx4_driver = {
    1425     .name = DRV_NAME,
    1426     .id_table = mlx4_pci_table,
    1427     .probe = mlx4_init_one,
    1428     - .shutdown = mlx4_remove_one,
    1429     + .shutdown = __mlx4_remove_one,
    1430     .remove = mlx4_remove_one,
    1431     .err_handler = &mlx4_err_handler,
    1432     };
    1433     diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c
    1434     index 31adb8cf0291..22d050fc5475 100644
    1435     --- a/drivers/net/wireless/b43/xmit.c
    1436     +++ b/drivers/net/wireless/b43/xmit.c
    1437     @@ -811,9 +811,13 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr)
    1438     break;
    1439     case B43_PHYTYPE_G:
    1440     status.band = IEEE80211_BAND_2GHZ;
    1441     - /* chanid is the radio channel cookie value as used
    1442     - * to tune the radio. */
    1443     - status.freq = chanid + 2400;
    1444     + /* Somewhere between 478.104 and 508.1084 firmware for G-PHY
    1445     + * has been modified to be compatible with N-PHY and others.
    1446     + */
    1447     + if (dev->fw.rev >= 508)
    1448     + status.freq = ieee80211_channel_to_frequency(chanid, status.band);
    1449     + else
    1450     + status.freq = chanid + 2400;
    1451     break;
    1452     case B43_PHYTYPE_N:
    1453     case B43_PHYTYPE_LP:
    1454     diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
    1455     index 2365553f1ef7..295b24cefe2d 100644
    1456     --- a/drivers/net/wireless/iwlwifi/pcie/trans.c
    1457     +++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
    1458     @@ -454,6 +454,7 @@ static int iwl_pcie_prepare_card_hw(struct iwl_trans *trans)
    1459     {
    1460     int ret;
    1461     int t = 0;
    1462     + int iter;
    1463    
    1464     IWL_DEBUG_INFO(trans, "iwl_trans_prepare_card_hw enter\n");
    1465    
    1466     @@ -462,18 +463,23 @@ static int iwl_pcie_prepare_card_hw(struct iwl_trans *trans)
    1467     if (ret >= 0)
    1468     return 0;
    1469    
    1470     - /* If HW is not ready, prepare the conditions to check again */
    1471     - iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG,
    1472     - CSR_HW_IF_CONFIG_REG_PREPARE);
    1473     + for (iter = 0; iter < 10; iter++) {
    1474     + /* If HW is not ready, prepare the conditions to check again */
    1475     + iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG,
    1476     + CSR_HW_IF_CONFIG_REG_PREPARE);
    1477     +
    1478     + do {
    1479     + ret = iwl_pcie_set_hw_ready(trans);
    1480     + if (ret >= 0)
    1481     + return 0;
    1482    
    1483     - do {
    1484     - ret = iwl_pcie_set_hw_ready(trans);
    1485     - if (ret >= 0)
    1486     - return 0;
    1487     + usleep_range(200, 1000);
    1488     + t += 200;
    1489     + } while (t < 150000);
    1490     + msleep(25);
    1491     + }
    1492    
    1493     - usleep_range(200, 1000);
    1494     - t += 200;
    1495     - } while (t < 150000);
    1496     + IWL_DEBUG_INFO(trans, "got NIC after %d iterations\n", iter);
    1497    
    1498     return ret;
    1499     }
    1500     diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
    1501     index 2f1cd929c6f6..a511cccc9f01 100644
    1502     --- a/drivers/net/wireless/rt2x00/rt2500pci.c
    1503     +++ b/drivers/net/wireless/rt2x00/rt2500pci.c
    1504     @@ -1681,8 +1681,13 @@ static int rt2500pci_init_eeprom(struct rt2x00_dev *rt2x00dev)
    1505     /*
    1506     * Detect if this device has an hardware controlled radio.
    1507     */
    1508     - if (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_HARDWARE_RADIO))
    1509     + if (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_HARDWARE_RADIO)) {
    1510     __set_bit(CAPABILITY_HW_BUTTON, &rt2x00dev->cap_flags);
    1511     + /*
    1512     + * On this device RFKILL initialized during probe does not work.
    1513     + */
    1514     + __set_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags);
    1515     + }
    1516    
    1517     /*
    1518     * Check if the BBP tuning should be enabled.
    1519     diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
    1520     index e3b885d8f7db..5d45a1a740a4 100644
    1521     --- a/drivers/net/wireless/rt2x00/rt2x00.h
    1522     +++ b/drivers/net/wireless/rt2x00/rt2x00.h
    1523     @@ -693,6 +693,7 @@ enum rt2x00_capability_flags {
    1524     REQUIRE_SW_SEQNO,
    1525     REQUIRE_HT_TX_DESC,
    1526     REQUIRE_PS_AUTOWAKE,
    1527     + REQUIRE_DELAYED_RFKILL,
    1528    
    1529     /*
    1530     * Capabilities
    1531     diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
    1532     index 2bde6729f5e6..4fa43a2eeb73 100644
    1533     --- a/drivers/net/wireless/rt2x00/rt2x00dev.c
    1534     +++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
    1535     @@ -1126,9 +1126,10 @@ static void rt2x00lib_uninitialize(struct rt2x00_dev *rt2x00dev)
    1536     return;
    1537    
    1538     /*
    1539     - * Unregister extra components.
    1540     + * Stop rfkill polling.
    1541     */
    1542     - rt2x00rfkill_unregister(rt2x00dev);
    1543     + if (test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
    1544     + rt2x00rfkill_unregister(rt2x00dev);
    1545    
    1546     /*
    1547     * Allow the HW to uninitialize.
    1548     @@ -1166,6 +1167,12 @@ static int rt2x00lib_initialize(struct rt2x00_dev *rt2x00dev)
    1549    
    1550     set_bit(DEVICE_STATE_INITIALIZED, &rt2x00dev->flags);
    1551    
    1552     + /*
    1553     + * Start rfkill polling.
    1554     + */
    1555     + if (test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
    1556     + rt2x00rfkill_register(rt2x00dev);
    1557     +
    1558     return 0;
    1559     }
    1560    
    1561     @@ -1375,7 +1382,12 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
    1562     rt2x00link_register(rt2x00dev);
    1563     rt2x00leds_register(rt2x00dev);
    1564     rt2x00debug_register(rt2x00dev);
    1565     - rt2x00rfkill_register(rt2x00dev);
    1566     +
    1567     + /*
    1568     + * Start rfkill polling.
    1569     + */
    1570     + if (!test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
    1571     + rt2x00rfkill_register(rt2x00dev);
    1572    
    1573     return 0;
    1574    
    1575     @@ -1391,6 +1403,12 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
    1576     clear_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
    1577    
    1578     /*
    1579     + * Stop rfkill polling.
    1580     + */
    1581     + if (!test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
    1582     + rt2x00rfkill_unregister(rt2x00dev);
    1583     +
    1584     + /*
    1585     * Disable radio.
    1586     */
    1587     rt2x00lib_disable_radio(rt2x00dev);
    1588     diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
    1589     index a87ee9b6585a..87a8ad5d2eb7 100644
    1590     --- a/drivers/net/wireless/rt2x00/rt2x00mac.c
    1591     +++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
    1592     @@ -487,6 +487,8 @@ int rt2x00mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
    1593     crypto.cipher = rt2x00crypto_key_to_cipher(key);
    1594     if (crypto.cipher == CIPHER_NONE)
    1595     return -EOPNOTSUPP;
    1596     + if (crypto.cipher == CIPHER_TKIP && rt2x00_is_usb(rt2x00dev))
    1597     + return -EOPNOTSUPP;
    1598    
    1599     crypto.cmd = cmd;
    1600    
    1601     diff --git a/drivers/regulator/tps65218-regulator.c b/drivers/regulator/tps65218-regulator.c
    1602     index cec72fa71d1d..676e3fb0a0f5 100644
    1603     --- a/drivers/regulator/tps65218-regulator.c
    1604     +++ b/drivers/regulator/tps65218-regulator.c
    1605     @@ -226,7 +226,7 @@ static const struct regulator_desc regulators[] = {
    1606     1, -1, -1, TPS65218_REG_ENABLE1,
    1607     TPS65218_ENABLE1_DC6_EN, NULL, NULL, 0),
    1608     TPS65218_REGULATOR("LDO1", TPS65218_LDO_1, tps65218_ldo1_dcdc34_ops, 64,
    1609     - TPS65218_REG_CONTROL_DCDC4,
    1610     + TPS65218_REG_CONTROL_LDO1,
    1611     TPS65218_CONTROL_LDO1_MASK, TPS65218_REG_ENABLE2,
    1612     TPS65218_ENABLE2_LDO1_EN, NULL, ldo1_dcdc3_ranges,
    1613     2),
    1614     @@ -257,6 +257,7 @@ static int tps65218_regulator_probe(struct platform_device *pdev)
    1615     config.init_data = init_data;
    1616     config.driver_data = tps;
    1617     config.regmap = tps->regmap;
    1618     + config.of_node = pdev->dev.of_node;
    1619    
    1620     rdev = devm_regulator_register(&pdev->dev, &regulators[id], &config);
    1621     if (IS_ERR(rdev)) {
    1622     diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c
    1623     index fa764406df68..c5bb0e0a36b9 100644
    1624     --- a/drivers/scsi/ibmvscsi/ibmvscsi.c
    1625     +++ b/drivers/scsi/ibmvscsi/ibmvscsi.c
    1626     @@ -185,6 +185,11 @@ static struct viosrp_crq *crq_queue_next_crq(struct crq_queue *queue)
    1627     if (crq->valid & 0x80) {
    1628     if (++queue->cur == queue->size)
    1629     queue->cur = 0;
    1630     +
    1631     + /* Ensure the read of the valid bit occurs before reading any
    1632     + * other bits of the CRQ entry
    1633     + */
    1634     + rmb();
    1635     } else
    1636     crq = NULL;
    1637     spin_unlock_irqrestore(&queue->lock, flags);
    1638     @@ -203,6 +208,11 @@ static int ibmvscsi_send_crq(struct ibmvscsi_host_data *hostdata,
    1639     {
    1640     struct vio_dev *vdev = to_vio_dev(hostdata->dev);
    1641    
    1642     + /*
    1643     + * Ensure the command buffer is flushed to memory before handing it
    1644     + * over to the VIOS to prevent it from fetching any stale data.
    1645     + */
    1646     + mb();
    1647     return plpar_hcall_norets(H_SEND_CRQ, vdev->unit_address, word1, word2);
    1648     }
    1649    
    1650     @@ -797,7 +807,8 @@ static void purge_requests(struct ibmvscsi_host_data *hostdata, int error_code)
    1651     evt->hostdata->dev);
    1652     if (evt->cmnd_done)
    1653     evt->cmnd_done(evt->cmnd);
    1654     - } else if (evt->done)
    1655     + } else if (evt->done && evt->crq.format != VIOSRP_MAD_FORMAT &&
    1656     + evt->iu.srp.login_req.opcode != SRP_LOGIN_REQ)
    1657     evt->done(evt);
    1658     free_event_struct(&evt->hostdata->pool, evt);
    1659     spin_lock_irqsave(hostdata->host->host_lock, flags);
    1660     diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
    1661     index f17aa7aa7879..d941f25fa999 100644
    1662     --- a/drivers/scsi/scsi_error.c
    1663     +++ b/drivers/scsi/scsi_error.c
    1664     @@ -131,7 +131,7 @@ scmd_eh_abort_handler(struct work_struct *work)
    1665     "aborting command %p\n", scmd));
    1666     rtn = scsi_try_to_abort_cmd(sdev->host->hostt, scmd);
    1667     if (rtn == SUCCESS) {
    1668     - scmd->result |= DID_TIME_OUT << 16;
    1669     + set_host_byte(scmd, DID_TIME_OUT);
    1670     if (scsi_host_eh_past_deadline(sdev->host)) {
    1671     SCSI_LOG_ERROR_RECOVERY(3,
    1672     scmd_printk(KERN_INFO, scmd,
    1673     @@ -167,7 +167,7 @@ scmd_eh_abort_handler(struct work_struct *work)
    1674     scmd_printk(KERN_WARNING, scmd,
    1675     "scmd %p terminate "
    1676     "aborted command\n", scmd));
    1677     - scmd->result |= DID_TIME_OUT << 16;
    1678     + set_host_byte(scmd, DID_TIME_OUT);
    1679     scsi_finish_command(scmd);
    1680     }
    1681     }
    1682     @@ -291,7 +291,7 @@ enum blk_eh_timer_return scsi_times_out(struct request *req)
    1683     if (scsi_abort_command(scmd) == SUCCESS)
    1684     return BLK_EH_NOT_HANDLED;
    1685    
    1686     - scmd->result |= DID_TIME_OUT << 16;
    1687     + set_host_byte(scmd, DID_TIME_OUT);
    1688    
    1689     if (unlikely(rtn == BLK_EH_NOT_HANDLED &&
    1690     !scsi_eh_scmd_add(scmd, SCSI_EH_CANCEL_CMD)))
    1691     @@ -1776,7 +1776,7 @@ int scsi_decide_disposition(struct scsi_cmnd *scmd)
    1692     break;
    1693     case DID_ABORT:
    1694     if (scmd->eh_eflags & SCSI_EH_ABORT_SCHEDULED) {
    1695     - scmd->result |= DID_TIME_OUT << 16;
    1696     + set_host_byte(scmd, DID_TIME_OUT);
    1697     return SUCCESS;
    1698     }
    1699     case DID_NO_CONNECT:
    1700     diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
    1701     index efcbcd182863..bffbd4b42111 100644
    1702     --- a/drivers/scsi/sd.c
    1703     +++ b/drivers/scsi/sd.c
    1704     @@ -2455,7 +2455,10 @@ sd_read_cache_type(struct scsi_disk *sdkp, unsigned char *buffer)
    1705     }
    1706    
    1707     sdkp->DPOFUA = (data.device_specific & 0x10) != 0;
    1708     - if (sdkp->DPOFUA && !sdkp->device->use_10_for_rw) {
    1709     + if (sdp->broken_fua) {
    1710     + sd_first_printk(KERN_NOTICE, sdkp, "Disabling FUA\n");
    1711     + sdkp->DPOFUA = 0;
    1712     + } else if (sdkp->DPOFUA && !sdkp->device->use_10_for_rw) {
    1713     sd_first_printk(KERN_NOTICE, sdkp,
    1714     "Uses READ/WRITE(6), disabling FUA\n");
    1715     sdkp->DPOFUA = 0;
    1716     diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
    1717     index db3b494e5926..8490aa411739 100644
    1718     --- a/drivers/scsi/virtio_scsi.c
    1719     +++ b/drivers/scsi/virtio_scsi.c
    1720     @@ -273,6 +273,16 @@ static void virtscsi_req_done(struct virtqueue *vq)
    1721     virtscsi_vq_done(vscsi, req_vq, virtscsi_complete_cmd);
    1722     };
    1723    
    1724     +static void virtscsi_poll_requests(struct virtio_scsi *vscsi)
    1725     +{
    1726     + int i, num_vqs;
    1727     +
    1728     + num_vqs = vscsi->num_queues;
    1729     + for (i = 0; i < num_vqs; i++)
    1730     + virtscsi_vq_done(vscsi, &vscsi->req_vqs[i],
    1731     + virtscsi_complete_cmd);
    1732     +}
    1733     +
    1734     static void virtscsi_complete_free(struct virtio_scsi *vscsi, void *buf)
    1735     {
    1736     struct virtio_scsi_cmd *cmd = buf;
    1737     @@ -291,6 +301,8 @@ static void virtscsi_ctrl_done(struct virtqueue *vq)
    1738     virtscsi_vq_done(vscsi, &vscsi->ctrl_vq, virtscsi_complete_free);
    1739     };
    1740    
    1741     +static void virtscsi_handle_event(struct work_struct *work);
    1742     +
    1743     static int virtscsi_kick_event(struct virtio_scsi *vscsi,
    1744     struct virtio_scsi_event_node *event_node)
    1745     {
    1746     @@ -298,6 +310,7 @@ static int virtscsi_kick_event(struct virtio_scsi *vscsi,
    1747     struct scatterlist sg;
    1748     unsigned long flags;
    1749    
    1750     + INIT_WORK(&event_node->work, virtscsi_handle_event);
    1751     sg_init_one(&sg, &event_node->event, sizeof(struct virtio_scsi_event));
    1752    
    1753     spin_lock_irqsave(&vscsi->event_vq.vq_lock, flags);
    1754     @@ -415,7 +428,6 @@ static void virtscsi_complete_event(struct virtio_scsi *vscsi, void *buf)
    1755     {
    1756     struct virtio_scsi_event_node *event_node = buf;
    1757    
    1758     - INIT_WORK(&event_node->work, virtscsi_handle_event);
    1759     schedule_work(&event_node->work);
    1760     }
    1761    
    1762     @@ -605,6 +617,18 @@ static int virtscsi_tmf(struct virtio_scsi *vscsi, struct virtio_scsi_cmd *cmd)
    1763     cmd->resp.tmf.response == VIRTIO_SCSI_S_FUNCTION_SUCCEEDED)
    1764     ret = SUCCESS;
    1765    
    1766     + /*
    1767     + * The spec guarantees that all requests related to the TMF have
    1768     + * been completed, but the callback might not have run yet if
    1769     + * we're using independent interrupts (e.g. MSI). Poll the
    1770     + * virtqueues once.
    1771     + *
    1772     + * In the abort case, sc->scsi_done will do nothing, because
    1773     + * the block layer must have detected a timeout and as a result
    1774     + * REQ_ATOM_COMPLETE has been set.
    1775     + */
    1776     + virtscsi_poll_requests(vscsi);
    1777     +
    1778     out:
    1779     mempool_free(cmd, virtscsi_cmd_pool);
    1780     return ret;
    1781     diff --git a/drivers/staging/iio/adc/ad7291.c b/drivers/staging/iio/adc/ad7291.c
    1782     index 357cef2a6f4c..7194bd138762 100644
    1783     --- a/drivers/staging/iio/adc/ad7291.c
    1784     +++ b/drivers/staging/iio/adc/ad7291.c
    1785     @@ -465,7 +465,7 @@ static int ad7291_probe(struct i2c_client *client,
    1786     struct ad7291_platform_data *pdata = client->dev.platform_data;
    1787     struct ad7291_chip_info *chip;
    1788     struct iio_dev *indio_dev;
    1789     - int ret = 0;
    1790     + int ret;
    1791    
    1792     indio_dev = devm_iio_device_alloc(&client->dev, sizeof(*chip));
    1793     if (!indio_dev)
    1794     @@ -475,7 +475,7 @@ static int ad7291_probe(struct i2c_client *client,
    1795     if (pdata && pdata->use_external_ref) {
    1796     chip->reg = devm_regulator_get(&client->dev, "vref");
    1797     if (IS_ERR(chip->reg))
    1798     - return ret;
    1799     + return PTR_ERR(chip->reg);
    1800    
    1801     ret = regulator_enable(chip->reg);
    1802     if (ret)
    1803     diff --git a/drivers/staging/tidspbridge/core/tiomap3430.c b/drivers/staging/tidspbridge/core/tiomap3430.c
    1804     index 8945b4e3a2a6..cb50120ed7b5 100644
    1805     --- a/drivers/staging/tidspbridge/core/tiomap3430.c
    1806     +++ b/drivers/staging/tidspbridge/core/tiomap3430.c
    1807     @@ -280,8 +280,10 @@ static int bridge_brd_monitor(struct bridge_dev_context *dev_ctxt)
    1808     OMAP3430_IVA2_MOD, OMAP2_CM_CLKSTCTRL);
    1809    
    1810     /* Wait until the state has moved to ON */
    1811     - while (*pdata->dsp_prm_read(OMAP3430_IVA2_MOD, OMAP2_PM_PWSTST)&
    1812     - OMAP_INTRANSITION_MASK);
    1813     + while ((*pdata->dsp_prm_read)(OMAP3430_IVA2_MOD,
    1814     + OMAP2_PM_PWSTST) &
    1815     + OMAP_INTRANSITION_MASK)
    1816     + ;
    1817     /* Disable Automatic transition */
    1818     (*pdata->dsp_cm_write)(OMAP34XX_CLKSTCTRL_DISABLE_AUTO,
    1819     OMAP3430_IVA2_MOD, OMAP2_CM_CLKSTCTRL);
    1820     diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
    1821     index fe9d129c8735..0391f17020f6 100644
    1822     --- a/drivers/tty/n_tty.c
    1823     +++ b/drivers/tty/n_tty.c
    1824     @@ -1214,15 +1214,16 @@ static void n_tty_receive_parity_error(struct tty_struct *tty, unsigned char c)
    1825     {
    1826     struct n_tty_data *ldata = tty->disc_data;
    1827    
    1828     - if (I_IGNPAR(tty))
    1829     - return;
    1830     - if (I_PARMRK(tty)) {
    1831     - put_tty_queue('\377', ldata);
    1832     - put_tty_queue('\0', ldata);
    1833     - put_tty_queue(c, ldata);
    1834     - } else if (I_INPCK(tty))
    1835     - put_tty_queue('\0', ldata);
    1836     - else
    1837     + if (I_INPCK(tty)) {
    1838     + if (I_IGNPAR(tty))
    1839     + return;
    1840     + if (I_PARMRK(tty)) {
    1841     + put_tty_queue('\377', ldata);
    1842     + put_tty_queue('\0', ldata);
    1843     + put_tty_queue(c, ldata);
    1844     + } else
    1845     + put_tty_queue('\0', ldata);
    1846     + } else
    1847     put_tty_queue(c, ldata);
    1848     if (waitqueue_active(&tty->read_wait))
    1849     wake_up_interruptible(&tty->read_wait);
    1850     diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
    1851     index 2d4bd3929e50..1c17ab591444 100644
    1852     --- a/drivers/tty/serial/8250/8250_core.c
    1853     +++ b/drivers/tty/serial/8250/8250_core.c
    1854     @@ -2360,7 +2360,7 @@ serial8250_do_set_termios(struct uart_port *port, struct ktermios *termios,
    1855     port->read_status_mask = UART_LSR_OE | UART_LSR_THRE | UART_LSR_DR;
    1856     if (termios->c_iflag & INPCK)
    1857     port->read_status_mask |= UART_LSR_FE | UART_LSR_PE;
    1858     - if (termios->c_iflag & (BRKINT | PARMRK))
    1859     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    1860     port->read_status_mask |= UART_LSR_BI;
    1861    
    1862     /*
    1863     diff --git a/drivers/tty/serial/altera_uart.c b/drivers/tty/serial/altera_uart.c
    1864     index 501667e3e3f5..323376668b72 100644
    1865     --- a/drivers/tty/serial/altera_uart.c
    1866     +++ b/drivers/tty/serial/altera_uart.c
    1867     @@ -185,6 +185,12 @@ static void altera_uart_set_termios(struct uart_port *port,
    1868     uart_update_timeout(port, termios->c_cflag, baud);
    1869     altera_uart_writel(port, baudclk, ALTERA_UART_DIVISOR_REG);
    1870     spin_unlock_irqrestore(&port->lock, flags);
    1871     +
    1872     + /*
    1873     + * FIXME: port->read_status_mask and port->ignore_status_mask
    1874     + * need to be initialized based on termios settings for
    1875     + * INPCK, IGNBRK, IGNPAR, PARMRK, BRKINT
    1876     + */
    1877     }
    1878    
    1879     static void altera_uart_rx_chars(struct altera_uart *pp)
    1880     diff --git a/drivers/tty/serial/amba-pl010.c b/drivers/tty/serial/amba-pl010.c
    1881     index 01c9e72433e1..971af1e22d0f 100644
    1882     --- a/drivers/tty/serial/amba-pl010.c
    1883     +++ b/drivers/tty/serial/amba-pl010.c
    1884     @@ -420,7 +420,7 @@ pl010_set_termios(struct uart_port *port, struct ktermios *termios,
    1885     uap->port.read_status_mask = UART01x_RSR_OE;
    1886     if (termios->c_iflag & INPCK)
    1887     uap->port.read_status_mask |= UART01x_RSR_FE | UART01x_RSR_PE;
    1888     - if (termios->c_iflag & (BRKINT | PARMRK))
    1889     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    1890     uap->port.read_status_mask |= UART01x_RSR_BE;
    1891    
    1892     /*
    1893     diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
    1894     index dacf0a09ab24..c2ee793aedae 100644
    1895     --- a/drivers/tty/serial/amba-pl011.c
    1896     +++ b/drivers/tty/serial/amba-pl011.c
    1897     @@ -1744,7 +1744,7 @@ pl011_set_termios(struct uart_port *port, struct ktermios *termios,
    1898     port->read_status_mask = UART011_DR_OE | 255;
    1899     if (termios->c_iflag & INPCK)
    1900     port->read_status_mask |= UART011_DR_FE | UART011_DR_PE;
    1901     - if (termios->c_iflag & (BRKINT | PARMRK))
    1902     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    1903     port->read_status_mask |= UART011_DR_BE;
    1904    
    1905     /*
    1906     diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
    1907     index 53eeea13ff16..372212956f6c 100644
    1908     --- a/drivers/tty/serial/atmel_serial.c
    1909     +++ b/drivers/tty/serial/atmel_serial.c
    1910     @@ -1784,7 +1784,7 @@ static void atmel_set_termios(struct uart_port *port, struct ktermios *termios,
    1911     port->read_status_mask = ATMEL_US_OVRE;
    1912     if (termios->c_iflag & INPCK)
    1913     port->read_status_mask |= (ATMEL_US_FRAME | ATMEL_US_PARE);
    1914     - if (termios->c_iflag & (BRKINT | PARMRK))
    1915     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    1916     port->read_status_mask |= ATMEL_US_RXBRK;
    1917    
    1918     if (atmel_use_pdc_rx(port))
    1919     diff --git a/drivers/tty/serial/bcm63xx_uart.c b/drivers/tty/serial/bcm63xx_uart.c
    1920     index a47421e4627c..231519022b73 100644
    1921     --- a/drivers/tty/serial/bcm63xx_uart.c
    1922     +++ b/drivers/tty/serial/bcm63xx_uart.c
    1923     @@ -567,7 +567,7 @@ static void bcm_uart_set_termios(struct uart_port *port,
    1924     port->read_status_mask |= UART_FIFO_FRAMEERR_MASK;
    1925     port->read_status_mask |= UART_FIFO_PARERR_MASK;
    1926     }
    1927     - if (new->c_iflag & (BRKINT))
    1928     + if (new->c_iflag & (IGNBRK | BRKINT))
    1929     port->read_status_mask |= UART_FIFO_BRKDET_MASK;
    1930    
    1931     port->ignore_status_mask = 0;
    1932     diff --git a/drivers/tty/serial/bfin_uart.c b/drivers/tty/serial/bfin_uart.c
    1933     index 869ceba2ec57..ac86a20992e9 100644
    1934     --- a/drivers/tty/serial/bfin_uart.c
    1935     +++ b/drivers/tty/serial/bfin_uart.c
    1936     @@ -833,7 +833,7 @@ bfin_serial_set_termios(struct uart_port *port, struct ktermios *termios,
    1937     port->read_status_mask = OE;
    1938     if (termios->c_iflag & INPCK)
    1939     port->read_status_mask |= (FE | PE);
    1940     - if (termios->c_iflag & (BRKINT | PARMRK))
    1941     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    1942     port->read_status_mask |= BI;
    1943    
    1944     /*
    1945     diff --git a/drivers/tty/serial/dz.c b/drivers/tty/serial/dz.c
    1946     index 2f2b2e538a54..cdbbc788230a 100644
    1947     --- a/drivers/tty/serial/dz.c
    1948     +++ b/drivers/tty/serial/dz.c
    1949     @@ -625,7 +625,7 @@ static void dz_set_termios(struct uart_port *uport, struct ktermios *termios,
    1950     dport->port.read_status_mask = DZ_OERR;
    1951     if (termios->c_iflag & INPCK)
    1952     dport->port.read_status_mask |= DZ_FERR | DZ_PERR;
    1953     - if (termios->c_iflag & (BRKINT | PARMRK))
    1954     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    1955     dport->port.read_status_mask |= DZ_BREAK;
    1956    
    1957     /* characters to ignore */
    1958     diff --git a/drivers/tty/serial/efm32-uart.c b/drivers/tty/serial/efm32-uart.c
    1959     index c167a710dc39..e65f4c840ab4 100644
    1960     --- a/drivers/tty/serial/efm32-uart.c
    1961     +++ b/drivers/tty/serial/efm32-uart.c
    1962     @@ -407,7 +407,7 @@ static void efm32_uart_set_termios(struct uart_port *port,
    1963     if (new->c_iflag & INPCK)
    1964     port->read_status_mask |=
    1965     UARTn_RXDATAX_FERR | UARTn_RXDATAX_PERR;
    1966     - if (new->c_iflag & (BRKINT | PARMRK))
    1967     + if (new->c_iflag & (IGNBRK | BRKINT | PARMRK))
    1968     port->read_status_mask |= SW_UARTn_RXDATAX_BERR;
    1969    
    1970     port->ignore_status_mask = 0;
    1971     diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
    1972     index c5eb897de9de..49385c86cfba 100644
    1973     --- a/drivers/tty/serial/fsl_lpuart.c
    1974     +++ b/drivers/tty/serial/fsl_lpuart.c
    1975     @@ -902,7 +902,7 @@ lpuart_set_termios(struct uart_port *port, struct ktermios *termios,
    1976     sport->port.read_status_mask = 0;
    1977     if (termios->c_iflag & INPCK)
    1978     sport->port.read_status_mask |= (UARTSR1_FE | UARTSR1_PE);
    1979     - if (termios->c_iflag & (BRKINT | PARMRK))
    1980     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    1981     sport->port.read_status_mask |= UARTSR1_FE;
    1982    
    1983     /* characters to ignore */
    1984     diff --git a/drivers/tty/serial/ip22zilog.c b/drivers/tty/serial/ip22zilog.c
    1985     index 1d9420548e16..1efd4c36ba0c 100644
    1986     --- a/drivers/tty/serial/ip22zilog.c
    1987     +++ b/drivers/tty/serial/ip22zilog.c
    1988     @@ -850,7 +850,7 @@ ip22zilog_convert_to_zs(struct uart_ip22zilog_port *up, unsigned int cflag,
    1989     up->port.read_status_mask = Rx_OVR;
    1990     if (iflag & INPCK)
    1991     up->port.read_status_mask |= CRC_ERR | PAR_ERR;
    1992     - if (iflag & (BRKINT | PARMRK))
    1993     + if (iflag & (IGNBRK | BRKINT | PARMRK))
    1994     up->port.read_status_mask |= BRK_ABRT;
    1995    
    1996     up->port.ignore_status_mask = 0;
    1997     diff --git a/drivers/tty/serial/m32r_sio.c b/drivers/tty/serial/m32r_sio.c
    1998     index 9cd9b4eba9fc..68f2c53e0b54 100644
    1999     --- a/drivers/tty/serial/m32r_sio.c
    2000     +++ b/drivers/tty/serial/m32r_sio.c
    2001     @@ -737,7 +737,7 @@ static void m32r_sio_set_termios(struct uart_port *port,
    2002     up->port.read_status_mask = UART_LSR_OE | UART_LSR_THRE | UART_LSR_DR;
    2003     if (termios->c_iflag & INPCK)
    2004     up->port.read_status_mask |= UART_LSR_FE | UART_LSR_PE;
    2005     - if (termios->c_iflag & (BRKINT | PARMRK))
    2006     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    2007     up->port.read_status_mask |= UART_LSR_BI;
    2008    
    2009     /*
    2010     diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c
    2011     index 2a99d0c61b9e..ba285cd45b59 100644
    2012     --- a/drivers/tty/serial/max310x.c
    2013     +++ b/drivers/tty/serial/max310x.c
    2014     @@ -835,7 +835,7 @@ static void max310x_set_termios(struct uart_port *port,
    2015     if (termios->c_iflag & INPCK)
    2016     port->read_status_mask |= MAX310X_LSR_RXPAR_BIT |
    2017     MAX310X_LSR_FRERR_BIT;
    2018     - if (termios->c_iflag & (BRKINT | PARMRK))
    2019     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    2020     port->read_status_mask |= MAX310X_LSR_RXBRK_BIT;
    2021    
    2022     /* Set status ignore mask */
    2023     diff --git a/drivers/tty/serial/mcf.c b/drivers/tty/serial/mcf.c
    2024     index 0edfaf8cd269..a6f085717f94 100644
    2025     --- a/drivers/tty/serial/mcf.c
    2026     +++ b/drivers/tty/serial/mcf.c
    2027     @@ -248,6 +248,12 @@ static void mcf_set_termios(struct uart_port *port, struct ktermios *termios,
    2028     mr1 |= MCFUART_MR1_PARITYNONE;
    2029     }
    2030    
    2031     + /*
    2032     + * FIXME: port->read_status_mask and port->ignore_status_mask
    2033     + * need to be initialized based on termios settings for
    2034     + * INPCK, IGNBRK, IGNPAR, PARMRK, BRKINT
    2035     + */
    2036     +
    2037     if (termios->c_cflag & CSTOPB)
    2038     mr2 |= MCFUART_MR2_STOP2;
    2039     else
    2040     diff --git a/drivers/tty/serial/mfd.c b/drivers/tty/serial/mfd.c
    2041     index 52c930fac210..445799dc9846 100644
    2042     --- a/drivers/tty/serial/mfd.c
    2043     +++ b/drivers/tty/serial/mfd.c
    2044     @@ -977,7 +977,7 @@ serial_hsu_set_termios(struct uart_port *port, struct ktermios *termios,
    2045     up->port.read_status_mask = UART_LSR_OE | UART_LSR_THRE | UART_LSR_DR;
    2046     if (termios->c_iflag & INPCK)
    2047     up->port.read_status_mask |= UART_LSR_FE | UART_LSR_PE;
    2048     - if (termios->c_iflag & (BRKINT | PARMRK))
    2049     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    2050     up->port.read_status_mask |= UART_LSR_BI;
    2051    
    2052     /* Characters to ignore */
    2053     diff --git a/drivers/tty/serial/mpsc.c b/drivers/tty/serial/mpsc.c
    2054     index e30a3ca3cea3..759c6a6fa74a 100644
    2055     --- a/drivers/tty/serial/mpsc.c
    2056     +++ b/drivers/tty/serial/mpsc.c
    2057     @@ -1458,7 +1458,7 @@ static void mpsc_set_termios(struct uart_port *port, struct ktermios *termios,
    2058     pi->port.read_status_mask |= SDMA_DESC_CMDSTAT_PE
    2059     | SDMA_DESC_CMDSTAT_FR;
    2060    
    2061     - if (termios->c_iflag & (BRKINT | PARMRK))
    2062     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    2063     pi->port.read_status_mask |= SDMA_DESC_CMDSTAT_BR;
    2064    
    2065     /* Characters/events to ignore */
    2066     diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c
    2067     index 053b98eb46c8..7307dc4145ec 100644
    2068     --- a/drivers/tty/serial/msm_serial.c
    2069     +++ b/drivers/tty/serial/msm_serial.c
    2070     @@ -583,7 +583,7 @@ static void msm_set_termios(struct uart_port *port, struct ktermios *termios,
    2071     port->read_status_mask = 0;
    2072     if (termios->c_iflag & INPCK)
    2073     port->read_status_mask |= UART_SR_PAR_FRAME_ERR;
    2074     - if (termios->c_iflag & (BRKINT | PARMRK))
    2075     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    2076     port->read_status_mask |= UART_SR_RX_BREAK;
    2077    
    2078     uart_update_timeout(port, termios->c_cflag, baud);
    2079     diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c
    2080     index aa97fd845b4d..d98f1d4a9bd3 100644
    2081     --- a/drivers/tty/serial/mxs-auart.c
    2082     +++ b/drivers/tty/serial/mxs-auart.c
    2083     @@ -604,7 +604,7 @@ static void mxs_auart_settermios(struct uart_port *u,
    2084    
    2085     if (termios->c_iflag & INPCK)
    2086     u->read_status_mask |= AUART_STAT_PERR;
    2087     - if (termios->c_iflag & (BRKINT | PARMRK))
    2088     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    2089     u->read_status_mask |= AUART_STAT_BERR;
    2090    
    2091     /*
    2092     diff --git a/drivers/tty/serial/netx-serial.c b/drivers/tty/serial/netx-serial.c
    2093     index 0a4dd70d29eb..7a6745601d4e 100644
    2094     --- a/drivers/tty/serial/netx-serial.c
    2095     +++ b/drivers/tty/serial/netx-serial.c
    2096     @@ -419,7 +419,7 @@ netx_set_termios(struct uart_port *port, struct ktermios *termios,
    2097     }
    2098    
    2099     port->read_status_mask = 0;
    2100     - if (termios->c_iflag & (BRKINT | PARMRK))
    2101     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    2102     port->read_status_mask |= SR_BE;
    2103     if (termios->c_iflag & INPCK)
    2104     port->read_status_mask |= SR_PE | SR_FE;
    2105     diff --git a/drivers/tty/serial/pmac_zilog.c b/drivers/tty/serial/pmac_zilog.c
    2106     index e9d420ff3931..8193635103ee 100644
    2107     --- a/drivers/tty/serial/pmac_zilog.c
    2108     +++ b/drivers/tty/serial/pmac_zilog.c
    2109     @@ -1092,7 +1092,7 @@ static void pmz_convert_to_zs(struct uart_pmac_port *uap, unsigned int cflag,
    2110     uap->port.read_status_mask = Rx_OVR;
    2111     if (iflag & INPCK)
    2112     uap->port.read_status_mask |= CRC_ERR | PAR_ERR;
    2113     - if (iflag & (BRKINT | PARMRK))
    2114     + if (iflag & (IGNBRK | BRKINT | PARMRK))
    2115     uap->port.read_status_mask |= BRK_ABRT;
    2116    
    2117     uap->port.ignore_status_mask = 0;
    2118     diff --git a/drivers/tty/serial/pnx8xxx_uart.c b/drivers/tty/serial/pnx8xxx_uart.c
    2119     index de6c05c63683..2ba24a45c97f 100644
    2120     --- a/drivers/tty/serial/pnx8xxx_uart.c
    2121     +++ b/drivers/tty/serial/pnx8xxx_uart.c
    2122     @@ -477,7 +477,7 @@ pnx8xxx_set_termios(struct uart_port *port, struct ktermios *termios,
    2123     sport->port.read_status_mask |=
    2124     FIFO_TO_SM(PNX8XXX_UART_FIFO_RXFE) |
    2125     FIFO_TO_SM(PNX8XXX_UART_FIFO_RXPAR);
    2126     - if (termios->c_iflag & (BRKINT | PARMRK))
    2127     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    2128     sport->port.read_status_mask |=
    2129     ISTAT_TO_SM(PNX8XXX_UART_INT_BREAK);
    2130    
    2131     diff --git a/drivers/tty/serial/pxa.c b/drivers/tty/serial/pxa.c
    2132     index f9f20f383760..fc3f308cd6c1 100644
    2133     --- a/drivers/tty/serial/pxa.c
    2134     +++ b/drivers/tty/serial/pxa.c
    2135     @@ -492,7 +492,7 @@ serial_pxa_set_termios(struct uart_port *port, struct ktermios *termios,
    2136     up->port.read_status_mask = UART_LSR_OE | UART_LSR_THRE | UART_LSR_DR;
    2137     if (termios->c_iflag & INPCK)
    2138     up->port.read_status_mask |= UART_LSR_FE | UART_LSR_PE;
    2139     - if (termios->c_iflag & (BRKINT | PARMRK))
    2140     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    2141     up->port.read_status_mask |= UART_LSR_BI;
    2142    
    2143     /*
    2144     diff --git a/drivers/tty/serial/sb1250-duart.c b/drivers/tty/serial/sb1250-duart.c
    2145     index a7cdec2962dd..771f361c47ea 100644
    2146     --- a/drivers/tty/serial/sb1250-duart.c
    2147     +++ b/drivers/tty/serial/sb1250-duart.c
    2148     @@ -596,7 +596,7 @@ static void sbd_set_termios(struct uart_port *uport, struct ktermios *termios,
    2149     if (termios->c_iflag & INPCK)
    2150     uport->read_status_mask |= M_DUART_FRM_ERR |
    2151     M_DUART_PARITY_ERR;
    2152     - if (termios->c_iflag & (BRKINT | PARMRK))
    2153     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    2154     uport->read_status_mask |= M_DUART_RCVD_BRK;
    2155    
    2156     uport->ignore_status_mask = 0;
    2157     diff --git a/drivers/tty/serial/sccnxp.c b/drivers/tty/serial/sccnxp.c
    2158     index a447f71538ef..75ea83278ba4 100644
    2159     --- a/drivers/tty/serial/sccnxp.c
    2160     +++ b/drivers/tty/serial/sccnxp.c
    2161     @@ -667,7 +667,7 @@ static void sccnxp_set_termios(struct uart_port *port,
    2162     port->read_status_mask = SR_OVR;
    2163     if (termios->c_iflag & INPCK)
    2164     port->read_status_mask |= SR_PE | SR_FE;
    2165     - if (termios->c_iflag & (BRKINT | PARMRK))
    2166     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    2167     port->read_status_mask |= SR_BRK;
    2168    
    2169     /* Set status ignore mask */
    2170     diff --git a/drivers/tty/serial/serial_ks8695.c b/drivers/tty/serial/serial_ks8695.c
    2171     index e1caa99e3d3b..5c79bdab985d 100644
    2172     --- a/drivers/tty/serial/serial_ks8695.c
    2173     +++ b/drivers/tty/serial/serial_ks8695.c
    2174     @@ -437,7 +437,7 @@ static void ks8695uart_set_termios(struct uart_port *port, struct ktermios *term
    2175     port->read_status_mask = URLS_URROE;
    2176     if (termios->c_iflag & INPCK)
    2177     port->read_status_mask |= (URLS_URFE | URLS_URPE);
    2178     - if (termios->c_iflag & (BRKINT | PARMRK))
    2179     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    2180     port->read_status_mask |= URLS_URBI;
    2181    
    2182     /*
    2183     diff --git a/drivers/tty/serial/serial_txx9.c b/drivers/tty/serial/serial_txx9.c
    2184     index 90a080b1f9ee..cbf501da5df3 100644
    2185     --- a/drivers/tty/serial/serial_txx9.c
    2186     +++ b/drivers/tty/serial/serial_txx9.c
    2187     @@ -702,7 +702,7 @@ serial_txx9_set_termios(struct uart_port *port, struct ktermios *termios,
    2188     TXX9_SIDISR_TDIS | TXX9_SIDISR_RDIS;
    2189     if (termios->c_iflag & INPCK)
    2190     up->port.read_status_mask |= TXX9_SIDISR_UFER | TXX9_SIDISR_UPER;
    2191     - if (termios->c_iflag & (BRKINT | PARMRK))
    2192     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    2193     up->port.read_status_mask |= TXX9_SIDISR_UBRK;
    2194    
    2195     /*
    2196     diff --git a/drivers/tty/serial/sirfsoc_uart.c b/drivers/tty/serial/sirfsoc_uart.c
    2197     index 68b0fd4b9a6a..3146feb15255 100644
    2198     --- a/drivers/tty/serial/sirfsoc_uart.c
    2199     +++ b/drivers/tty/serial/sirfsoc_uart.c
    2200     @@ -907,7 +907,7 @@ static void sirfsoc_uart_set_termios(struct uart_port *port,
    2201     if (termios->c_iflag & INPCK)
    2202     port->read_status_mask |= uint_en->sirfsoc_frm_err_en;
    2203     }
    2204     - if (termios->c_iflag & (BRKINT | PARMRK))
    2205     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    2206     port->read_status_mask |= uint_en->sirfsoc_rxd_brk_en;
    2207     if (sirfport->uart_reg->uart_type == SIRF_REAL_UART) {
    2208     if (termios->c_iflag & IGNPAR)
    2209     diff --git a/drivers/tty/serial/st-asc.c b/drivers/tty/serial/st-asc.c
    2210     index dd3a96e07026..3e707ba5bab9 100644
    2211     --- a/drivers/tty/serial/st-asc.c
    2212     +++ b/drivers/tty/serial/st-asc.c
    2213     @@ -547,7 +547,7 @@ static void asc_set_termios(struct uart_port *port, struct ktermios *termios,
    2214     ascport->port.read_status_mask = ASC_RXBUF_DUMMY_OE;
    2215     if (termios->c_iflag & INPCK)
    2216     ascport->port.read_status_mask |= ASC_RXBUF_FE | ASC_RXBUF_PE;
    2217     - if (termios->c_iflag & (BRKINT | PARMRK))
    2218     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    2219     ascport->port.read_status_mask |= ASC_RXBUF_DUMMY_BE;
    2220    
    2221     /*
    2222     diff --git a/drivers/tty/serial/sunsab.c b/drivers/tty/serial/sunsab.c
    2223     index 5faa8e905e98..80a58eca785b 100644
    2224     --- a/drivers/tty/serial/sunsab.c
    2225     +++ b/drivers/tty/serial/sunsab.c
    2226     @@ -719,7 +719,7 @@ static void sunsab_convert_to_sab(struct uart_sunsab_port *up, unsigned int cfla
    2227     if (iflag & INPCK)
    2228     up->port.read_status_mask |= (SAB82532_ISR0_PERR |
    2229     SAB82532_ISR0_FERR);
    2230     - if (iflag & (BRKINT | PARMRK))
    2231     + if (iflag & (IGNBRK | BRKINT | PARMRK))
    2232     up->port.read_status_mask |= (SAB82532_ISR1_BRK << 8);
    2233    
    2234     /*
    2235     diff --git a/drivers/tty/serial/sunsu.c b/drivers/tty/serial/sunsu.c
    2236     index 9a0f24f83720..5326ae195e5f 100644
    2237     --- a/drivers/tty/serial/sunsu.c
    2238     +++ b/drivers/tty/serial/sunsu.c
    2239     @@ -834,7 +834,7 @@ sunsu_change_speed(struct uart_port *port, unsigned int cflag,
    2240     up->port.read_status_mask = UART_LSR_OE | UART_LSR_THRE | UART_LSR_DR;
    2241     if (iflag & INPCK)
    2242     up->port.read_status_mask |= UART_LSR_FE | UART_LSR_PE;
    2243     - if (iflag & (BRKINT | PARMRK))
    2244     + if (iflag & (IGNBRK | BRKINT | PARMRK))
    2245     up->port.read_status_mask |= UART_LSR_BI;
    2246    
    2247     /*
    2248     diff --git a/drivers/tty/serial/sunzilog.c b/drivers/tty/serial/sunzilog.c
    2249     index a2c40ed287d2..a85db8b87156 100644
    2250     --- a/drivers/tty/serial/sunzilog.c
    2251     +++ b/drivers/tty/serial/sunzilog.c
    2252     @@ -915,7 +915,7 @@ sunzilog_convert_to_zs(struct uart_sunzilog_port *up, unsigned int cflag,
    2253     up->port.read_status_mask = Rx_OVR;
    2254     if (iflag & INPCK)
    2255     up->port.read_status_mask |= CRC_ERR | PAR_ERR;
    2256     - if (iflag & (BRKINT | PARMRK))
    2257     + if (iflag & (IGNBRK | BRKINT | PARMRK))
    2258     up->port.read_status_mask |= BRK_ABRT;
    2259    
    2260     up->port.ignore_status_mask = 0;
    2261     diff --git a/drivers/tty/serial/ucc_uart.c b/drivers/tty/serial/ucc_uart.c
    2262     index d569ca58bab6..1c52074c38df 100644
    2263     --- a/drivers/tty/serial/ucc_uart.c
    2264     +++ b/drivers/tty/serial/ucc_uart.c
    2265     @@ -936,7 +936,7 @@ static void qe_uart_set_termios(struct uart_port *port,
    2266     port->read_status_mask = BD_SC_EMPTY | BD_SC_OV;
    2267     if (termios->c_iflag & INPCK)
    2268     port->read_status_mask |= BD_SC_FR | BD_SC_PR;
    2269     - if (termios->c_iflag & (BRKINT | PARMRK))
    2270     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    2271     port->read_status_mask |= BD_SC_BR;
    2272    
    2273     /*
    2274     diff --git a/drivers/tty/serial/vr41xx_siu.c b/drivers/tty/serial/vr41xx_siu.c
    2275     index a63c14bc9a24..db0c8a4ab03e 100644
    2276     --- a/drivers/tty/serial/vr41xx_siu.c
    2277     +++ b/drivers/tty/serial/vr41xx_siu.c
    2278     @@ -559,7 +559,7 @@ static void siu_set_termios(struct uart_port *port, struct ktermios *new,
    2279     port->read_status_mask = UART_LSR_THRE | UART_LSR_OE | UART_LSR_DR;
    2280     if (c_iflag & INPCK)
    2281     port->read_status_mask |= UART_LSR_FE | UART_LSR_PE;
    2282     - if (c_iflag & (BRKINT | PARMRK))
    2283     + if (c_iflag & (IGNBRK | BRKINT | PARMRK))
    2284     port->read_status_mask |= UART_LSR_BI;
    2285    
    2286     port->ignore_status_mask = 0;
    2287     diff --git a/drivers/tty/serial/zs.c b/drivers/tty/serial/zs.c
    2288     index 6a169877109b..2b65bb7ffb8a 100644
    2289     --- a/drivers/tty/serial/zs.c
    2290     +++ b/drivers/tty/serial/zs.c
    2291     @@ -923,7 +923,7 @@ static void zs_set_termios(struct uart_port *uport, struct ktermios *termios,
    2292     uport->read_status_mask = Rx_OVR;
    2293     if (termios->c_iflag & INPCK)
    2294     uport->read_status_mask |= FRM_ERR | PAR_ERR;
    2295     - if (termios->c_iflag & (BRKINT | PARMRK))
    2296     + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    2297     uport->read_status_mask |= Rx_BRK;
    2298    
    2299     uport->ignore_status_mask = 0;
    2300     diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
    2301     index 7739c64ef259..482c45b777d3 100644
    2302     --- a/drivers/usb/chipidea/udc.c
    2303     +++ b/drivers/usb/chipidea/udc.c
    2304     @@ -1328,6 +1328,7 @@ static int ep_dequeue(struct usb_ep *ep, struct usb_request *req)
    2305     struct ci_hw_ep *hwep = container_of(ep, struct ci_hw_ep, ep);
    2306     struct ci_hw_req *hwreq = container_of(req, struct ci_hw_req, req);
    2307     unsigned long flags;
    2308     + struct td_node *node, *tmpnode;
    2309    
    2310     if (ep == NULL || req == NULL || hwreq->req.status != -EALREADY ||
    2311     hwep->ep.desc == NULL || list_empty(&hwreq->queue) ||
    2312     @@ -1338,6 +1339,12 @@ static int ep_dequeue(struct usb_ep *ep, struct usb_request *req)
    2313    
    2314     hw_ep_flush(hwep->ci, hwep->num, hwep->dir);
    2315    
    2316     + list_for_each_entry_safe(node, tmpnode, &hwreq->tds, td) {
    2317     + dma_pool_free(hwep->td_pool, node->ptr, node->dma);
    2318     + list_del(&node->td);
    2319     + kfree(node);
    2320     + }
    2321     +
    2322     /* pop request */
    2323     list_del_init(&hwreq->queue);
    2324    
    2325     diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c
    2326     index 1e12b3ee56fd..ddb54ee4ca73 100644
    2327     --- a/drivers/usb/gadget/f_fs.c
    2328     +++ b/drivers/usb/gadget/f_fs.c
    2329     @@ -1508,11 +1508,13 @@ static int functionfs_bind(struct ffs_data *ffs, struct usb_composite_dev *cdev)
    2330     ffs->ep0req->context = ffs;
    2331    
    2332     lang = ffs->stringtabs;
    2333     - for (lang = ffs->stringtabs; *lang; ++lang) {
    2334     - struct usb_string *str = (*lang)->strings;
    2335     - int id = first_id;
    2336     - for (; str->s; ++id, ++str)
    2337     - str->id = id;
    2338     + if (lang) {
    2339     + for (; *lang; ++lang) {
    2340     + struct usb_string *str = (*lang)->strings;
    2341     + int id = first_id;
    2342     + for (; str->s; ++id, ++str)
    2343     + str->id = id;
    2344     + }
    2345     }
    2346    
    2347     ffs->gadget = cdev->gadget;
    2348     diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
    2349     index 7a0e3c720c00..d0c65d6faf93 100644
    2350     --- a/drivers/usb/host/xhci-ring.c
    2351     +++ b/drivers/usb/host/xhci-ring.c
    2352     @@ -1611,8 +1611,11 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
    2353     xhci_handle_cmd_reset_ep(xhci, slot_id, cmd_trb, cmd_comp_code);
    2354     break;
    2355     case TRB_RESET_DEV:
    2356     - WARN_ON(slot_id != TRB_TO_SLOT_ID(
    2357     - le32_to_cpu(cmd_trb->generic.field[3])));
    2358     + /* SLOT_ID field in reset device cmd completion event TRB is 0.
    2359     + * Use the SLOT_ID from the command TRB instead (xhci 4.6.11)
    2360     + */
    2361     + slot_id = TRB_TO_SLOT_ID(
    2362     + le32_to_cpu(cmd_trb->generic.field[3]));
    2363     xhci_handle_cmd_reset_dev(xhci, slot_id, event);
    2364     break;
    2365     case TRB_NEC_GET_FW:
    2366     @@ -3696,7 +3699,7 @@ static unsigned int xhci_get_burst_count(struct xhci_hcd *xhci,
    2367     return 0;
    2368    
    2369     max_burst = urb->ep->ss_ep_comp.bMaxBurst;
    2370     - return roundup(total_packet_count, max_burst + 1) - 1;
    2371     + return DIV_ROUND_UP(total_packet_count, max_burst + 1) - 1;
    2372     }
    2373    
    2374     /*
    2375     diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
    2376     index 300836972faa..3f8e2c18962f 100644
    2377     --- a/drivers/usb/host/xhci.c
    2378     +++ b/drivers/usb/host/xhci.c
    2379     @@ -932,7 +932,7 @@ int xhci_suspend(struct xhci_hcd *xhci)
    2380     */
    2381     int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
    2382     {
    2383     - u32 command, temp = 0;
    2384     + u32 command, temp = 0, status;
    2385     struct usb_hcd *hcd = xhci_to_hcd(xhci);
    2386     struct usb_hcd *secondary_hcd;
    2387     int retval = 0;
    2388     @@ -1050,8 +1050,12 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
    2389    
    2390     done:
    2391     if (retval == 0) {
    2392     - usb_hcd_resume_root_hub(hcd);
    2393     - usb_hcd_resume_root_hub(xhci->shared_hcd);
    2394     + /* Resume root hubs only when have pending events. */
    2395     + status = readl(&xhci->op_regs->status);
    2396     + if (status & STS_EINT) {
    2397     + usb_hcd_resume_root_hub(hcd);
    2398     + usb_hcd_resume_root_hub(xhci->shared_hcd);
    2399     + }
    2400     }
    2401    
    2402     /*
    2403     diff --git a/drivers/usb/musb/musb_am335x.c b/drivers/usb/musb/musb_am335x.c
    2404     index d2353781bd2d..1e58ed2361cc 100644
    2405     --- a/drivers/usb/musb/musb_am335x.c
    2406     +++ b/drivers/usb/musb/musb_am335x.c
    2407     @@ -19,21 +19,6 @@ err:
    2408     return ret;
    2409     }
    2410    
    2411     -static int of_remove_populated_child(struct device *dev, void *d)
    2412     -{
    2413     - struct platform_device *pdev = to_platform_device(dev);
    2414     -
    2415     - of_device_unregister(pdev);
    2416     - return 0;
    2417     -}
    2418     -
    2419     -static int am335x_child_remove(struct platform_device *pdev)
    2420     -{
    2421     - device_for_each_child(&pdev->dev, NULL, of_remove_populated_child);
    2422     - pm_runtime_disable(&pdev->dev);
    2423     - return 0;
    2424     -}
    2425     -
    2426     static const struct of_device_id am335x_child_of_match[] = {
    2427     { .compatible = "ti,am33xx-usb" },
    2428     { },
    2429     @@ -42,13 +27,17 @@ MODULE_DEVICE_TABLE(of, am335x_child_of_match);
    2430    
    2431     static struct platform_driver am335x_child_driver = {
    2432     .probe = am335x_child_probe,
    2433     - .remove = am335x_child_remove,
    2434     .driver = {
    2435     .name = "am335x-usb-childs",
    2436     .of_match_table = am335x_child_of_match,
    2437     },
    2438     };
    2439    
    2440     -module_platform_driver(am335x_child_driver);
    2441     +static int __init am335x_child_init(void)
    2442     +{
    2443     + return platform_driver_register(&am335x_child_driver);
    2444     +}
    2445     +module_init(am335x_child_init);
    2446     +
    2447     MODULE_DESCRIPTION("AM33xx child devices");
    2448     MODULE_LICENSE("GPL v2");
    2449     diff --git a/drivers/usb/musb/musb_cppi41.c b/drivers/usb/musb/musb_cppi41.c
    2450     index 7b8bbf53127e..5341bb223b7c 100644
    2451     --- a/drivers/usb/musb/musb_cppi41.c
    2452     +++ b/drivers/usb/musb/musb_cppi41.c
    2453     @@ -318,7 +318,7 @@ static void cppi41_dma_callback(void *private_data)
    2454     }
    2455     list_add_tail(&cppi41_channel->tx_check,
    2456     &controller->early_tx_list);
    2457     - if (!hrtimer_active(&controller->early_tx)) {
    2458     + if (!hrtimer_is_queued(&controller->early_tx)) {
    2459     hrtimer_start_range_ns(&controller->early_tx,
    2460     ktime_set(0, 140 * NSEC_PER_USEC),
    2461     40 * NSEC_PER_USEC,
    2462     diff --git a/drivers/usb/musb/ux500.c b/drivers/usb/musb/ux500.c
    2463     index c2e45e632723..f202e5088461 100644
    2464     --- a/drivers/usb/musb/ux500.c
    2465     +++ b/drivers/usb/musb/ux500.c
    2466     @@ -274,7 +274,6 @@ static int ux500_probe(struct platform_device *pdev)
    2467     musb->dev.parent = &pdev->dev;
    2468     musb->dev.dma_mask = &pdev->dev.coherent_dma_mask;
    2469     musb->dev.coherent_dma_mask = pdev->dev.coherent_dma_mask;
    2470     - musb->dev.of_node = pdev->dev.of_node;
    2471    
    2472     glue->dev = &pdev->dev;
    2473     glue->musb = musb;
    2474     diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
    2475     index edf3b124583c..115662c16dcc 100644
    2476     --- a/drivers/usb/serial/ftdi_sio.c
    2477     +++ b/drivers/usb/serial/ftdi_sio.c
    2478     @@ -1566,14 +1566,17 @@ static void ftdi_set_max_packet_size(struct usb_serial_port *port)
    2479     struct usb_device *udev = serial->dev;
    2480    
    2481     struct usb_interface *interface = serial->interface;
    2482     - struct usb_endpoint_descriptor *ep_desc = &interface->cur_altsetting->endpoint[1].desc;
    2483     + struct usb_endpoint_descriptor *ep_desc;
    2484    
    2485     unsigned num_endpoints;
    2486     - int i;
    2487     + unsigned i;
    2488    
    2489     num_endpoints = interface->cur_altsetting->desc.bNumEndpoints;
    2490     dev_info(&udev->dev, "Number of endpoints %d\n", num_endpoints);
    2491    
    2492     + if (!num_endpoints)
    2493     + return;
    2494     +
    2495     /* NOTE: some customers have programmed FT232R/FT245R devices
    2496     * with an endpoint size of 0 - not good. In this case, we
    2497     * want to override the endpoint descriptor setting and use a
    2498     diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
    2499     index 70ede84f4f6b..e25e8ca09fe2 100644
    2500     --- a/drivers/usb/serial/option.c
    2501     +++ b/drivers/usb/serial/option.c
    2502     @@ -352,6 +352,9 @@ static void option_instat_callback(struct urb *urb);
    2503     /* Zoom */
    2504     #define ZOOM_PRODUCT_4597 0x9607
    2505    
    2506     +/* SpeedUp SU9800 usb 3g modem */
    2507     +#define SPEEDUP_PRODUCT_SU9800 0x9800
    2508     +
    2509     /* Haier products */
    2510     #define HAIER_VENDOR_ID 0x201e
    2511     #define HAIER_PRODUCT_CE100 0x2009
    2512     @@ -372,8 +375,12 @@ static void option_instat_callback(struct urb *urb);
    2513     /* Olivetti products */
    2514     #define OLIVETTI_VENDOR_ID 0x0b3c
    2515     #define OLIVETTI_PRODUCT_OLICARD100 0xc000
    2516     +#define OLIVETTI_PRODUCT_OLICARD120 0xc001
    2517     +#define OLIVETTI_PRODUCT_OLICARD140 0xc002
    2518     #define OLIVETTI_PRODUCT_OLICARD145 0xc003
    2519     +#define OLIVETTI_PRODUCT_OLICARD155 0xc004
    2520     #define OLIVETTI_PRODUCT_OLICARD200 0xc005
    2521     +#define OLIVETTI_PRODUCT_OLICARD160 0xc00a
    2522     #define OLIVETTI_PRODUCT_OLICARD500 0xc00b
    2523    
    2524     /* Celot products */
    2525     @@ -1577,6 +1584,7 @@ static const struct usb_device_id option_ids[] = {
    2526     { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14),
    2527     .driver_info = (kernel_ulong_t)&four_g_w14_blacklist
    2528     },
    2529     + { USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, SPEEDUP_PRODUCT_SU9800, 0xff) },
    2530     { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) },
    2531     { USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) },
    2532     { USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) },
    2533     @@ -1611,15 +1619,21 @@ static const struct usb_device_id option_ids[] = {
    2534     { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDMNET) },
    2535     { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, /* HC28 enumerates with Siemens or Cinterion VID depending on FW revision */
    2536     { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) },
    2537     -
    2538     - { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) },
    2539     + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100),
    2540     + .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    2541     + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD120),
    2542     + .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    2543     + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD140),
    2544     + .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    2545     { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD145) },
    2546     + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD155),
    2547     + .driver_info = (kernel_ulong_t)&net_intf6_blacklist },
    2548     { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD200),
    2549     - .driver_info = (kernel_ulong_t)&net_intf6_blacklist
    2550     - },
    2551     + .driver_info = (kernel_ulong_t)&net_intf6_blacklist },
    2552     + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD160),
    2553     + .driver_info = (kernel_ulong_t)&net_intf6_blacklist },
    2554     { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD500),
    2555     - .driver_info = (kernel_ulong_t)&net_intf4_blacklist
    2556     - },
    2557     + .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    2558     { USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */
    2559     { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/
    2560     { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM600) },
    2561     diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c
    2562     index 9d38ddc8da49..866b5df36ed1 100644
    2563     --- a/drivers/usb/storage/scsiglue.c
    2564     +++ b/drivers/usb/storage/scsiglue.c
    2565     @@ -256,6 +256,10 @@ static int slave_configure(struct scsi_device *sdev)
    2566     if (us->fflags & US_FL_WRITE_CACHE)
    2567     sdev->wce_default_on = 1;
    2568    
    2569     + /* A few buggy USB-ATA bridges don't understand FUA */
    2570     + if (us->fflags & US_FL_BROKEN_FUA)
    2571     + sdev->broken_fua = 1;
    2572     +
    2573     } else {
    2574    
    2575     /* Non-disk-type devices don't need to blacklist any pages
    2576     diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
    2577     index 174a447868cd..80a5b366255f 100644
    2578     --- a/drivers/usb/storage/unusual_devs.h
    2579     +++ b/drivers/usb/storage/unusual_devs.h
    2580     @@ -1936,6 +1936,13 @@ UNUSUAL_DEV( 0x14cd, 0x6600, 0x0201, 0x0201,
    2581     USB_SC_DEVICE, USB_PR_DEVICE, NULL,
    2582     US_FL_IGNORE_RESIDUE ),
    2583    
    2584     +/* Reported by Michael Büsch <m@bues.ch> */
    2585     +UNUSUAL_DEV( 0x152d, 0x0567, 0x0114, 0x0114,
    2586     + "JMicron",
    2587     + "USB to ATA/ATAPI Bridge",
    2588     + USB_SC_DEVICE, USB_PR_DEVICE, NULL,
    2589     + US_FL_BROKEN_FUA ),
    2590     +
    2591     /* Reported by Alexandre Oliva <oliva@lsd.ic.unicamp.br>
    2592     * JMicron responds to USN and several other SCSI ioctls with a
    2593     * residue that causes subsequent I/O requests to fail. */
    2594     diff --git a/drivers/video/fbdev/fb-puv3.c b/drivers/video/fbdev/fb-puv3.c
    2595     index 6db9ebd042a3..88fa2e70a0bb 100644
    2596     --- a/drivers/video/fbdev/fb-puv3.c
    2597     +++ b/drivers/video/fbdev/fb-puv3.c
    2598     @@ -18,8 +18,10 @@
    2599     #include <linux/fb.h>
    2600     #include <linux/init.h>
    2601     #include <linux/console.h>
    2602     +#include <linux/mm.h>
    2603    
    2604     #include <asm/sizes.h>
    2605     +#include <asm/pgtable.h>
    2606     #include <mach/hardware.h>
    2607    
    2608     /* Platform_data reserved for unifb registers. */
    2609     diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
    2610     index a62a5bdc0502..10f3c5c8783d 100644
    2611     --- a/fs/btrfs/disk-io.c
    2612     +++ b/fs/btrfs/disk-io.c
    2613     @@ -368,7 +368,8 @@ static int verify_parent_transid(struct extent_io_tree *io_tree,
    2614     out:
    2615     unlock_extent_cached(io_tree, eb->start, eb->start + eb->len - 1,
    2616     &cached_state, GFP_NOFS);
    2617     - btrfs_tree_read_unlock_blocking(eb);
    2618     + if (need_lock)
    2619     + btrfs_tree_read_unlock_blocking(eb);
    2620     return ret;
    2621     }
    2622    
    2623     diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c
    2624     index 0227b45ef00a..15e9505aa35f 100644
    2625     --- a/fs/cifs/cifs_unicode.c
    2626     +++ b/fs/cifs/cifs_unicode.c
    2627     @@ -290,7 +290,8 @@ int
    2628     cifsConvertToUTF16(__le16 *target, const char *source, int srclen,
    2629     const struct nls_table *cp, int mapChars)
    2630     {
    2631     - int i, j, charlen;
    2632     + int i, charlen;
    2633     + int j = 0;
    2634     char src_char;
    2635     __le16 dst_char;
    2636     wchar_t tmp;
    2637     @@ -298,12 +299,11 @@ cifsConvertToUTF16(__le16 *target, const char *source, int srclen,
    2638     if (!mapChars)
    2639     return cifs_strtoUTF16(target, source, PATH_MAX, cp);
    2640    
    2641     - for (i = 0, j = 0; i < srclen; j++) {
    2642     + for (i = 0; i < srclen; j++) {
    2643     src_char = source[i];
    2644     charlen = 1;
    2645     switch (src_char) {
    2646     case 0:
    2647     - put_unaligned(0, &target[j]);
    2648     goto ctoUTF16_out;
    2649     case ':':
    2650     dst_char = cpu_to_le16(UNI_COLON);
    2651     @@ -350,6 +350,7 @@ cifsConvertToUTF16(__le16 *target, const char *source, int srclen,
    2652     }
    2653    
    2654     ctoUTF16_out:
    2655     + put_unaligned(0, &target[j]); /* Null terminate target unicode string */
    2656     return j;
    2657     }
    2658    
    2659     diff --git a/fs/cifs/link.c b/fs/cifs/link.c
    2660     index 264ece71bdb2..68559fd557fb 100644
    2661     --- a/fs/cifs/link.c
    2662     +++ b/fs/cifs/link.c
    2663     @@ -374,7 +374,7 @@ cifs_create_mf_symlink(unsigned int xid, struct cifs_tcon *tcon,
    2664     oparms.cifs_sb = cifs_sb;
    2665     oparms.desired_access = GENERIC_WRITE;
    2666     oparms.create_options = create_options;
    2667     - oparms.disposition = FILE_OPEN;
    2668     + oparms.disposition = FILE_CREATE;
    2669     oparms.path = path;
    2670     oparms.fid = &fid;
    2671     oparms.reconnect = false;
    2672     diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c
    2673     index 594009f5f523..e6574d7b6642 100644
    2674     --- a/fs/ext4/indirect.c
    2675     +++ b/fs/ext4/indirect.c
    2676     @@ -389,7 +389,13 @@ static int ext4_alloc_branch(handle_t *handle, struct inode *inode,
    2677     return 0;
    2678     failed:
    2679     for (; i >= 0; i--) {
    2680     - if (i != indirect_blks && branch[i].bh)
    2681     + /*
    2682     + * We want to ext4_forget() only freshly allocated indirect
    2683     + * blocks. Buffer for new_blocks[i-1] is at branch[i].bh and
    2684     + * buffer at branch[0].bh is indirect block / inode already
    2685     + * existing before ext4_alloc_branch() was called.
    2686     + */
    2687     + if (i > 0 && i != indirect_blks && branch[i].bh)
    2688     ext4_forget(handle, 1, inode, branch[i].bh,
    2689     branch[i].bh->b_blocknr);
    2690     ext4_free_blocks(handle, inode, NULL, new_blocks[i],
    2691     @@ -1312,16 +1318,24 @@ static int free_hole_blocks(handle_t *handle, struct inode *inode,
    2692     blk = *i_data;
    2693     if (level > 0) {
    2694     ext4_lblk_t first2;
    2695     + ext4_lblk_t count2;
    2696     +
    2697     bh = sb_bread(inode->i_sb, le32_to_cpu(blk));
    2698     if (!bh) {
    2699     EXT4_ERROR_INODE_BLOCK(inode, le32_to_cpu(blk),
    2700     "Read failure");
    2701     return -EIO;
    2702     }
    2703     - first2 = (first > offset) ? first - offset : 0;
    2704     + if (first > offset) {
    2705     + first2 = first - offset;
    2706     + count2 = count;
    2707     + } else {
    2708     + first2 = 0;
    2709     + count2 = count - (offset - first);
    2710     + }
    2711     ret = free_hole_blocks(handle, inode, bh,
    2712     (__le32 *)bh->b_data, level - 1,
    2713     - first2, count - offset,
    2714     + first2, count2,
    2715     inode->i_sb->s_blocksize >> 2);
    2716     if (ret) {
    2717     brelse(bh);
    2718     diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
    2719     index d543222babf3..95e3720d1452 100644
    2720     --- a/fs/nfsd/nfs4proc.c
    2721     +++ b/fs/nfsd/nfs4proc.c
    2722     @@ -618,15 +618,6 @@ nfsd4_create(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
    2723    
    2724     switch (create->cr_type) {
    2725     case NF4LNK:
    2726     - /* ugh! we have to null-terminate the linktext, or
    2727     - * vfs_symlink() will choke. it is always safe to
    2728     - * null-terminate by brute force, since at worst we
    2729     - * will overwrite the first byte of the create namelen
    2730     - * in the XDR buffer, which has already been extracted
    2731     - * during XDR decode.
    2732     - */
    2733     - create->cr_linkname[create->cr_linklen] = 0;
    2734     -
    2735     status = nfsd_symlink(rqstp, &cstate->current_fh,
    2736     create->cr_name, create->cr_namelen,
    2737     create->cr_linkname, create->cr_linklen,
    2738     diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
    2739     index b4c49588eada..3297158241e5 100644
    2740     --- a/fs/nfsd/nfs4xdr.c
    2741     +++ b/fs/nfsd/nfs4xdr.c
    2742     @@ -602,7 +602,18 @@ nfsd4_decode_create(struct nfsd4_compoundargs *argp, struct nfsd4_create *create
    2743     READ_BUF(4);
    2744     READ32(create->cr_linklen);
    2745     READ_BUF(create->cr_linklen);
    2746     - SAVEMEM(create->cr_linkname, create->cr_linklen);
    2747     + /*
    2748     + * The VFS will want a null-terminated string, and
    2749     + * null-terminating in place isn't safe since this might
    2750     + * end on a page boundary:
    2751     + */
    2752     + create->cr_linkname =
    2753     + kmalloc(create->cr_linklen + 1, GFP_KERNEL);
    2754     + if (!create->cr_linkname)
    2755     + return nfserr_jukebox;
    2756     + memcpy(create->cr_linkname, p, create->cr_linklen);
    2757     + create->cr_linkname[create->cr_linklen] = '\0';
    2758     + defer_free(argp, kfree, create->cr_linkname);
    2759     break;
    2760     case NF4BLK:
    2761     case NF4CHR:
    2762     diff --git a/include/drm/i915_powerwell.h b/include/drm/i915_powerwell.h
    2763     index cfdc884405b7..baa6f11b1837 100644
    2764     --- a/include/drm/i915_powerwell.h
    2765     +++ b/include/drm/i915_powerwell.h
    2766     @@ -30,7 +30,8 @@
    2767     #define _I915_POWERWELL_H_
    2768    
    2769     /* For use by hda_i915 driver */
    2770     -extern void i915_request_power_well(void);
    2771     -extern void i915_release_power_well(void);
    2772     +extern int i915_request_power_well(void);
    2773     +extern int i915_release_power_well(void);
    2774     +extern int i915_get_cdclk_freq(void);
    2775    
    2776     #endif /* _I915_POWERWELL_H_ */
    2777     diff --git a/include/linux/usb_usual.h b/include/linux/usb_usual.h
    2778     index 1a64b26046ed..9b7de1b46437 100644
    2779     --- a/include/linux/usb_usual.h
    2780     +++ b/include/linux/usb_usual.h
    2781     @@ -70,7 +70,9 @@
    2782     US_FLAG(NEEDS_CAP16, 0x00400000) \
    2783     /* cannot handle READ_CAPACITY_10 */ \
    2784     US_FLAG(IGNORE_UAS, 0x00800000) \
    2785     - /* Device advertises UAS but it is broken */
    2786     + /* Device advertises UAS but it is broken */ \
    2787     + US_FLAG(BROKEN_FUA, 0x01000000) \
    2788     + /* Cannot handle FUA in WRITE or READ CDBs */ \
    2789    
    2790     #define US_FLAG(name, value) US_FL_##name = value ,
    2791     enum { US_DO_ALL_FLAGS };
    2792     diff --git a/include/scsi/scsi_cmnd.h b/include/scsi/scsi_cmnd.h
    2793     index a100c6e266c7..c95c0774a863 100644
    2794     --- a/include/scsi/scsi_cmnd.h
    2795     +++ b/include/scsi/scsi_cmnd.h
    2796     @@ -309,7 +309,7 @@ static inline void set_driver_byte(struct scsi_cmnd *cmd, char status)
    2797    
    2798     static inline unsigned scsi_transfer_length(struct scsi_cmnd *scmd)
    2799     {
    2800     - unsigned int xfer_len = blk_rq_bytes(scmd->request);
    2801     + unsigned int xfer_len = scsi_out(scmd)->length;
    2802     unsigned int prot_op = scsi_get_prot_op(scmd);
    2803     unsigned int sector_size = scmd->device->sector_size;
    2804    
    2805     diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
    2806     index 5853c913d2b0..27ab31017f09 100644
    2807     --- a/include/scsi/scsi_device.h
    2808     +++ b/include/scsi/scsi_device.h
    2809     @@ -173,6 +173,7 @@ struct scsi_device {
    2810     unsigned is_visible:1; /* is the device visible in sysfs */
    2811     unsigned wce_default_on:1; /* Cache is ON by default */
    2812     unsigned no_dif:1; /* T10 PI (DIF) should be disabled */
    2813     + unsigned broken_fua:1; /* Don't set FUA bit */
    2814    
    2815     atomic_t disk_events_disable_depth; /* disable depth for disk events */
    2816    
    2817     diff --git a/include/uapi/linux/usb/functionfs.h b/include/uapi/linux/usb/functionfs.h
    2818     index 2a4b4a72a4f9..24b68c59dcf8 100644
    2819     --- a/include/uapi/linux/usb/functionfs.h
    2820     +++ b/include/uapi/linux/usb/functionfs.h
    2821     @@ -33,6 +33,13 @@ struct usb_endpoint_descriptor_no_audio {
    2822     __u8 bInterval;
    2823     } __attribute__((packed));
    2824    
    2825     +/* Legacy format, deprecated as of 3.14. */
    2826     +struct usb_functionfs_descs_head {
    2827     + __le32 magic;
    2828     + __le32 length;
    2829     + __le32 fs_count;
    2830     + __le32 hs_count;
    2831     +} __attribute__((packed, deprecated));
    2832    
    2833     /*
    2834     * Descriptors format:
    2835     diff --git a/kernel/sysctl.c b/kernel/sysctl.c
    2836     index 74f5b580fe34..0e0373f51c58 100644
    2837     --- a/kernel/sysctl.c
    2838     +++ b/kernel/sysctl.c
    2839     @@ -136,7 +136,6 @@ static unsigned long dirty_bytes_min = 2 * PAGE_SIZE;
    2840     /* this is needed for the proc_dointvec_minmax for [fs_]overflow UID and GID */
    2841     static int maxolduid = 65535;
    2842     static int minolduid;
    2843     -static int min_percpu_pagelist_fract = 8;
    2844    
    2845     static int ngroups_max = NGROUPS_MAX;
    2846     static const int cap_last_cap = CAP_LAST_CAP;
    2847     @@ -1305,7 +1304,7 @@ static struct ctl_table vm_table[] = {
    2848     .maxlen = sizeof(percpu_pagelist_fraction),
    2849     .mode = 0644,
    2850     .proc_handler = percpu_pagelist_fraction_sysctl_handler,
    2851     - .extra1 = &min_percpu_pagelist_fract,
    2852     + .extra1 = &zero,
    2853     },
    2854     #ifdef CONFIG_MMU
    2855     {
    2856     diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
    2857     index e916972c6d87..1848dc6278b7 100644
    2858     --- a/kernel/trace/trace.c
    2859     +++ b/kernel/trace/trace.c
    2860     @@ -1367,7 +1367,6 @@ void tracing_start(void)
    2861    
    2862     arch_spin_unlock(&ftrace_max_lock);
    2863    
    2864     - ftrace_start();
    2865     out:
    2866     raw_spin_unlock_irqrestore(&global_trace.start_lock, flags);
    2867     }
    2868     @@ -1414,7 +1413,6 @@ void tracing_stop(void)
    2869     struct ring_buffer *buffer;
    2870     unsigned long flags;
    2871    
    2872     - ftrace_stop();
    2873     raw_spin_lock_irqsave(&global_trace.start_lock, flags);
    2874     if (global_trace.stop_count++)
    2875     goto out;
    2876     diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
    2877     index c082a7441345..da9d2614e82e 100644
    2878     --- a/kernel/trace/trace_uprobe.c
    2879     +++ b/kernel/trace/trace_uprobe.c
    2880     @@ -893,6 +893,9 @@ probe_event_enable(struct trace_uprobe *tu, struct ftrace_event_file *file,
    2881     int ret;
    2882    
    2883     if (file) {
    2884     + if (tu->tp.flags & TP_FLAG_PROFILE)
    2885     + return -EINTR;
    2886     +
    2887     link = kmalloc(sizeof(*link), GFP_KERNEL);
    2888     if (!link)
    2889     return -ENOMEM;
    2890     @@ -901,29 +904,40 @@ probe_event_enable(struct trace_uprobe *tu, struct ftrace_event_file *file,
    2891     list_add_tail_rcu(&link->list, &tu->tp.files);
    2892    
    2893     tu->tp.flags |= TP_FLAG_TRACE;
    2894     - } else
    2895     - tu->tp.flags |= TP_FLAG_PROFILE;
    2896     + } else {
    2897     + if (tu->tp.flags & TP_FLAG_TRACE)
    2898     + return -EINTR;
    2899    
    2900     - ret = uprobe_buffer_enable();
    2901     - if (ret < 0)
    2902     - return ret;
    2903     + tu->tp.flags |= TP_FLAG_PROFILE;
    2904     + }
    2905    
    2906     WARN_ON(!uprobe_filter_is_empty(&tu->filter));
    2907    
    2908     if (enabled)
    2909     return 0;
    2910    
    2911     + ret = uprobe_buffer_enable();
    2912     + if (ret)
    2913     + goto err_flags;
    2914     +
    2915     tu->consumer.filter = filter;
    2916     ret = uprobe_register(tu->inode, tu->offset, &tu->consumer);
    2917     - if (ret) {
    2918     - if (file) {
    2919     - list_del(&link->list);
    2920     - kfree(link);
    2921     - tu->tp.flags &= ~TP_FLAG_TRACE;
    2922     - } else
    2923     - tu->tp.flags &= ~TP_FLAG_PROFILE;
    2924     - }
    2925     + if (ret)
    2926     + goto err_buffer;
    2927     +
    2928     + return 0;
    2929     +
    2930     + err_buffer:
    2931     + uprobe_buffer_disable();
    2932    
    2933     + err_flags:
    2934     + if (file) {
    2935     + list_del(&link->list);
    2936     + kfree(link);
    2937     + tu->tp.flags &= ~TP_FLAG_TRACE;
    2938     + } else {
    2939     + tu->tp.flags &= ~TP_FLAG_PROFILE;
    2940     + }
    2941     return ret;
    2942     }
    2943    
    2944     diff --git a/mm/hugetlb.c b/mm/hugetlb.c
    2945     index c82290b9c1fc..a646f1598d58 100644
    2946     --- a/mm/hugetlb.c
    2947     +++ b/mm/hugetlb.c
    2948     @@ -2377,6 +2377,31 @@ static void set_huge_ptep_writable(struct vm_area_struct *vma,
    2949     update_mmu_cache(vma, address, ptep);
    2950     }
    2951    
    2952     +static int is_hugetlb_entry_migration(pte_t pte)
    2953     +{
    2954     + swp_entry_t swp;
    2955     +
    2956     + if (huge_pte_none(pte) || pte_present(pte))
    2957     + return 0;
    2958     + swp = pte_to_swp_entry(pte);
    2959     + if (non_swap_entry(swp) && is_migration_entry(swp))
    2960     + return 1;
    2961     + else
    2962     + return 0;
    2963     +}
    2964     +
    2965     +static int is_hugetlb_entry_hwpoisoned(pte_t pte)
    2966     +{
    2967     + swp_entry_t swp;
    2968     +
    2969     + if (huge_pte_none(pte) || pte_present(pte))
    2970     + return 0;
    2971     + swp = pte_to_swp_entry(pte);
    2972     + if (non_swap_entry(swp) && is_hwpoison_entry(swp))
    2973     + return 1;
    2974     + else
    2975     + return 0;
    2976     +}
    2977    
    2978     int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
    2979     struct vm_area_struct *vma)
    2980     @@ -2416,10 +2441,26 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
    2981     dst_ptl = huge_pte_lock(h, dst, dst_pte);
    2982     src_ptl = huge_pte_lockptr(h, src, src_pte);
    2983     spin_lock_nested(src_ptl, SINGLE_DEPTH_NESTING);
    2984     - if (!huge_pte_none(huge_ptep_get(src_pte))) {
    2985     + entry = huge_ptep_get(src_pte);
    2986     + if (huge_pte_none(entry)) { /* skip none entry */
    2987     + ;
    2988     + } else if (unlikely(is_hugetlb_entry_migration(entry) ||
    2989     + is_hugetlb_entry_hwpoisoned(entry))) {
    2990     + swp_entry_t swp_entry = pte_to_swp_entry(entry);
    2991     +
    2992     + if (is_write_migration_entry(swp_entry) && cow) {
    2993     + /*
    2994     + * COW mappings require pages in both
    2995     + * parent and child to be set to read.
    2996     + */
    2997     + make_migration_entry_read(&swp_entry);
    2998     + entry = swp_entry_to_pte(swp_entry);
    2999     + set_huge_pte_at(src, addr, src_pte, entry);
    3000     + }
    3001     + set_huge_pte_at(dst, addr, dst_pte, entry);
    3002     + } else {
    3003     if (cow)
    3004     huge_ptep_set_wrprotect(src, addr, src_pte);
    3005     - entry = huge_ptep_get(src_pte);
    3006     ptepage = pte_page(entry);
    3007     get_page(ptepage);
    3008     page_dup_rmap(ptepage);
    3009     @@ -2435,32 +2476,6 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
    3010     return ret;
    3011     }
    3012    
    3013     -static int is_hugetlb_entry_migration(pte_t pte)
    3014     -{
    3015     - swp_entry_t swp;
    3016     -
    3017     - if (huge_pte_none(pte) || pte_present(pte))
    3018     - return 0;
    3019     - swp = pte_to_swp_entry(pte);
    3020     - if (non_swap_entry(swp) && is_migration_entry(swp))
    3021     - return 1;
    3022     - else
    3023     - return 0;
    3024     -}
    3025     -
    3026     -static int is_hugetlb_entry_hwpoisoned(pte_t pte)
    3027     -{
    3028     - swp_entry_t swp;
    3029     -
    3030     - if (huge_pte_none(pte) || pte_present(pte))
    3031     - return 0;
    3032     - swp = pte_to_swp_entry(pte);
    3033     - if (non_swap_entry(swp) && is_hwpoison_entry(swp))
    3034     - return 1;
    3035     - else
    3036     - return 0;
    3037     -}
    3038     -
    3039     void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma,
    3040     unsigned long start, unsigned long end,
    3041     struct page *ref_page)
    3042     diff --git a/mm/memory.c b/mm/memory.c
    3043     index 037b812a9531..e302ae1dcce0 100644
    3044     --- a/mm/memory.c
    3045     +++ b/mm/memory.c
    3046     @@ -3920,9 +3920,6 @@ static int __handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
    3047     }
    3048     }
    3049    
    3050     - /* THP should already have been handled */
    3051     - BUG_ON(pmd_numa(*pmd));
    3052     -
    3053     /*
    3054     * Use __pte_alloc instead of pte_alloc_map, because we can't
    3055     * run pte_offset_map on the pmd, if an huge pmd could
    3056     diff --git a/mm/mempolicy.c b/mm/mempolicy.c
    3057     index 30cc47f8ffa0..35f9f91278fd 100644
    3058     --- a/mm/mempolicy.c
    3059     +++ b/mm/mempolicy.c
    3060     @@ -653,19 +653,18 @@ static unsigned long change_prot_numa(struct vm_area_struct *vma,
    3061     * @nodes and @flags,) it's isolated and queued to the pagelist which is
    3062     * passed via @private.)
    3063     */
    3064     -static struct vm_area_struct *
    3065     +static int
    3066     queue_pages_range(struct mm_struct *mm, unsigned long start, unsigned long end,
    3067     const nodemask_t *nodes, unsigned long flags, void *private)
    3068     {
    3069     - int err;
    3070     - struct vm_area_struct *first, *vma, *prev;
    3071     -
    3072     + int err = 0;
    3073     + struct vm_area_struct *vma, *prev;
    3074    
    3075     - first = find_vma(mm, start);
    3076     - if (!first)
    3077     - return ERR_PTR(-EFAULT);
    3078     + vma = find_vma(mm, start);
    3079     + if (!vma)
    3080     + return -EFAULT;
    3081     prev = NULL;
    3082     - for (vma = first; vma && vma->vm_start < end; vma = vma->vm_next) {
    3083     + for (; vma && vma->vm_start < end; vma = vma->vm_next) {
    3084     unsigned long endvma = vma->vm_end;
    3085    
    3086     if (endvma > end)
    3087     @@ -675,9 +674,9 @@ queue_pages_range(struct mm_struct *mm, unsigned long start, unsigned long end,
    3088    
    3089     if (!(flags & MPOL_MF_DISCONTIG_OK)) {
    3090     if (!vma->vm_next && vma->vm_end < end)
    3091     - return ERR_PTR(-EFAULT);
    3092     + return -EFAULT;
    3093     if (prev && prev->vm_end < vma->vm_start)
    3094     - return ERR_PTR(-EFAULT);
    3095     + return -EFAULT;
    3096     }
    3097    
    3098     if (flags & MPOL_MF_LAZY) {
    3099     @@ -691,15 +690,13 @@ queue_pages_range(struct mm_struct *mm, unsigned long start, unsigned long end,
    3100    
    3101     err = queue_pages_pgd_range(vma, start, endvma, nodes,
    3102     flags, private);
    3103     - if (err) {
    3104     - first = ERR_PTR(err);
    3105     + if (err)
    3106     break;
    3107     - }
    3108     }
    3109     next:
    3110     prev = vma;
    3111     }
    3112     - return first;
    3113     + return err;
    3114     }
    3115    
    3116     /*
    3117     @@ -1153,16 +1150,17 @@ out:
    3118    
    3119     /*
    3120     * Allocate a new page for page migration based on vma policy.
    3121     - * Start assuming that page is mapped by vma pointed to by @private.
    3122     + * Start by assuming the page is mapped by the same vma as contains @start.
    3123     * Search forward from there, if not. N.B., this assumes that the
    3124     * list of pages handed to migrate_pages()--which is how we get here--
    3125     * is in virtual address order.
    3126     */
    3127     -static struct page *new_vma_page(struct page *page, unsigned long private, int **x)
    3128     +static struct page *new_page(struct page *page, unsigned long start, int **x)
    3129     {
    3130     - struct vm_area_struct *vma = (struct vm_area_struct *)private;
    3131     + struct vm_area_struct *vma;
    3132     unsigned long uninitialized_var(address);
    3133    
    3134     + vma = find_vma(current->mm, start);
    3135     while (vma) {
    3136     address = page_address_in_vma(page, vma);
    3137     if (address != -EFAULT)
    3138     @@ -1192,7 +1190,7 @@ int do_migrate_pages(struct mm_struct *mm, const nodemask_t *from,
    3139     return -ENOSYS;
    3140     }
    3141    
    3142     -static struct page *new_vma_page(struct page *page, unsigned long private, int **x)
    3143     +static struct page *new_page(struct page *page, unsigned long start, int **x)
    3144     {
    3145     return NULL;
    3146     }
    3147     @@ -1202,7 +1200,6 @@ static long do_mbind(unsigned long start, unsigned long len,
    3148     unsigned short mode, unsigned short mode_flags,
    3149     nodemask_t *nmask, unsigned long flags)
    3150     {
    3151     - struct vm_area_struct *vma;
    3152     struct mm_struct *mm = current->mm;
    3153     struct mempolicy *new;
    3154     unsigned long end;
    3155     @@ -1268,11 +1265,9 @@ static long do_mbind(unsigned long start, unsigned long len,
    3156     if (err)
    3157     goto mpol_out;
    3158    
    3159     - vma = queue_pages_range(mm, start, end, nmask,
    3160     + err = queue_pages_range(mm, start, end, nmask,
    3161     flags | MPOL_MF_INVERT, &pagelist);
    3162     -
    3163     - err = PTR_ERR(vma); /* maybe ... */
    3164     - if (!IS_ERR(vma))
    3165     + if (!err)
    3166     err = mbind_range(mm, start, end, new);
    3167    
    3168     if (!err) {
    3169     @@ -1280,9 +1275,8 @@ static long do_mbind(unsigned long start, unsigned long len,
    3170    
    3171     if (!list_empty(&pagelist)) {
    3172     WARN_ON_ONCE(flags & MPOL_MF_LAZY);
    3173     - nr_failed = migrate_pages(&pagelist, new_vma_page,
    3174     - (unsigned long)vma,
    3175     - MIGRATE_SYNC, MR_MEMPOLICY_MBIND);
    3176     + nr_failed = migrate_pages(&pagelist, new_page,
    3177     + start, MIGRATE_SYNC, MR_MEMPOLICY_MBIND);
    3178     if (nr_failed)
    3179     putback_movable_pages(&pagelist);
    3180     }
    3181     diff --git a/mm/nommu.c b/mm/nommu.c
    3182     index 85f8d6698d48..431fd7c277cc 100644
    3183     --- a/mm/nommu.c
    3184     +++ b/mm/nommu.c
    3185     @@ -783,7 +783,7 @@ static void delete_vma_from_mm(struct vm_area_struct *vma)
    3186     for (i = 0; i < VMACACHE_SIZE; i++) {
    3187     /* if the vma is cached, invalidate the entire cache */
    3188     if (curr->vmacache[i] == vma) {
    3189     - vmacache_invalidate(curr->mm);
    3190     + vmacache_invalidate(mm);
    3191     break;
    3192     }
    3193     }
    3194     diff --git a/mm/page_alloc.c b/mm/page_alloc.c
    3195     index 56eb0eb382b1..d64f5f90000c 100644
    3196     --- a/mm/page_alloc.c
    3197     +++ b/mm/page_alloc.c
    3198     @@ -69,6 +69,7 @@
    3199    
    3200     /* prevent >1 _updater_ of zone percpu pageset ->high and ->batch fields */
    3201     static DEFINE_MUTEX(pcp_batch_high_lock);
    3202     +#define MIN_PERCPU_PAGELIST_FRACTION (8)
    3203    
    3204     #ifdef CONFIG_USE_PERCPU_NUMA_NODE_ID
    3205     DEFINE_PER_CPU(int, numa_node);
    3206     @@ -799,9 +800,21 @@ void __init init_cma_reserved_pageblock(struct page *page)
    3207     set_page_count(p, 0);
    3208     } while (++p, --i);
    3209    
    3210     - set_page_refcounted(page);
    3211     set_pageblock_migratetype(page, MIGRATE_CMA);
    3212     - __free_pages(page, pageblock_order);
    3213     +
    3214     + if (pageblock_order >= MAX_ORDER) {
    3215     + i = pageblock_nr_pages;
    3216     + p = page;
    3217     + do {
    3218     + set_page_refcounted(p);
    3219     + __free_pages(p, MAX_ORDER - 1);
    3220     + p += MAX_ORDER_NR_PAGES;
    3221     + } while (i -= MAX_ORDER_NR_PAGES);
    3222     + } else {
    3223     + set_page_refcounted(page);
    3224     + __free_pages(page, pageblock_order);
    3225     + }
    3226     +
    3227     adjust_managed_page_count(page, pageblock_nr_pages);
    3228     }
    3229     #endif
    3230     @@ -4107,7 +4120,7 @@ static void __meminit zone_init_free_lists(struct zone *zone)
    3231     memmap_init_zone((size), (nid), (zone), (start_pfn), MEMMAP_EARLY)
    3232     #endif
    3233    
    3234     -static int __meminit zone_batchsize(struct zone *zone)
    3235     +static int zone_batchsize(struct zone *zone)
    3236     {
    3237     #ifdef CONFIG_MMU
    3238     int batch;
    3239     @@ -4223,8 +4236,8 @@ static void pageset_set_high(struct per_cpu_pageset *p,
    3240     pageset_update(&p->pcp, high, batch);
    3241     }
    3242    
    3243     -static void __meminit pageset_set_high_and_batch(struct zone *zone,
    3244     - struct per_cpu_pageset *pcp)
    3245     +static void pageset_set_high_and_batch(struct zone *zone,
    3246     + struct per_cpu_pageset *pcp)
    3247     {
    3248     if (percpu_pagelist_fraction)
    3249     pageset_set_high(pcp,
    3250     @@ -5850,23 +5863,38 @@ int percpu_pagelist_fraction_sysctl_handler(ctl_table *table, int write,
    3251     void __user *buffer, size_t *length, loff_t *ppos)
    3252     {
    3253     struct zone *zone;
    3254     - unsigned int cpu;
    3255     + int old_percpu_pagelist_fraction;
    3256     int ret;
    3257    
    3258     + mutex_lock(&pcp_batch_high_lock);
    3259     + old_percpu_pagelist_fraction = percpu_pagelist_fraction;
    3260     +
    3261     ret = proc_dointvec_minmax(table, write, buffer, length, ppos);
    3262     - if (!write || (ret < 0))
    3263     - return ret;
    3264     + if (!write || ret < 0)
    3265     + goto out;
    3266     +
    3267     + /* Sanity checking to avoid pcp imbalance */
    3268     + if (percpu_pagelist_fraction &&
    3269     + percpu_pagelist_fraction < MIN_PERCPU_PAGELIST_FRACTION) {
    3270     + percpu_pagelist_fraction = old_percpu_pagelist_fraction;
    3271     + ret = -EINVAL;
    3272     + goto out;
    3273     + }
    3274     +
    3275     + /* No change? */
    3276     + if (percpu_pagelist_fraction == old_percpu_pagelist_fraction)
    3277     + goto out;
    3278    
    3279     - mutex_lock(&pcp_batch_high_lock);
    3280     for_each_populated_zone(zone) {
    3281     - unsigned long high;
    3282     - high = zone->managed_pages / percpu_pagelist_fraction;
    3283     + unsigned int cpu;
    3284     +
    3285     for_each_possible_cpu(cpu)
    3286     - pageset_set_high(per_cpu_ptr(zone->pageset, cpu),
    3287     - high);
    3288     + pageset_set_high_and_batch(zone,
    3289     + per_cpu_ptr(zone->pageset, cpu));
    3290     }
    3291     +out:
    3292     mutex_unlock(&pcp_batch_high_lock);
    3293     - return 0;
    3294     + return ret;
    3295     }
    3296    
    3297     int hashdist = HASHDIST_DEFAULT;
    3298     diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
    3299     index 521fd4f3985e..ea72cc0de9b7 100644
    3300     --- a/net/bluetooth/hci_conn.c
    3301     +++ b/net/bluetooth/hci_conn.c
    3302     @@ -584,11 +584,6 @@ static void hci_req_add_le_create_conn(struct hci_request *req,
    3303     if (hci_update_random_address(req, false, &own_addr_type))
    3304     return;
    3305    
    3306     - /* Save the address type used for this connnection attempt so we able
    3307     - * to retrieve this information if we need it.
    3308     - */
    3309     - conn->src_type = own_addr_type;
    3310     -
    3311     cp.scan_interval = cpu_to_le16(hdev->le_scan_interval);
    3312     cp.scan_window = cpu_to_le16(hdev->le_scan_window);
    3313     bacpy(&cp.peer_addr, &conn->dst);
    3314     @@ -826,7 +821,7 @@ static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
    3315     /* If we're already encrypted set the REAUTH_PEND flag,
    3316     * otherwise set the ENCRYPT_PEND.
    3317     */
    3318     - if (conn->key_type != 0xff)
    3319     + if (conn->link_mode & HCI_LM_ENCRYPT)
    3320     set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
    3321     else
    3322     set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
    3323     diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
    3324     index 0381d55f995d..40357c8e3d27 100644
    3325     --- a/net/bluetooth/hci_event.c
    3326     +++ b/net/bluetooth/hci_event.c
    3327     @@ -48,6 +48,10 @@ static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
    3328     smp_mb__after_clear_bit(); /* wake_up_bit advises about this barrier */
    3329     wake_up_bit(&hdev->flags, HCI_INQUIRY);
    3330    
    3331     + hci_dev_lock(hdev);
    3332     + hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
    3333     + hci_dev_unlock(hdev);
    3334     +
    3335     hci_conn_check_pending(hdev);
    3336     }
    3337    
    3338     @@ -3503,8 +3507,11 @@ static void hci_user_confirm_request_evt(struct hci_dev *hdev,
    3339    
    3340     /* If we're not the initiators request authorization to
    3341     * proceed from user space (mgmt_user_confirm with
    3342     - * confirm_hint set to 1). */
    3343     - if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
    3344     + * confirm_hint set to 1). The exception is if neither
    3345     + * side had MITM in which case we do auto-accept.
    3346     + */
    3347     + if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
    3348     + (loc_mitm || rem_mitm)) {
    3349     BT_DBG("Confirming auto-accept as acceptor");
    3350     confirm_hint = 1;
    3351     goto confirm;
    3352     diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
    3353     index dc4d301d3a72..1c97b7a4f170 100644
    3354     --- a/net/bluetooth/l2cap_core.c
    3355     +++ b/net/bluetooth/l2cap_core.c
    3356     @@ -1657,7 +1657,13 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
    3357     kfree_skb(conn->rx_skb);
    3358    
    3359     skb_queue_purge(&conn->pending_rx);
    3360     - flush_work(&conn->pending_rx_work);
    3361     +
    3362     + /* We can not call flush_work(&conn->pending_rx_work) here since we
    3363     + * might block if we are running on a worker from the same workqueue
    3364     + * pending_rx_work is waiting on.
    3365     + */
    3366     + if (work_pending(&conn->pending_rx_work))
    3367     + cancel_work_sync(&conn->pending_rx_work);
    3368    
    3369     l2cap_unregister_all_users(conn);
    3370    
    3371     diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
    3372     index ade3fb4c23bc..e1378693cc90 100644
    3373     --- a/net/bluetooth/l2cap_sock.c
    3374     +++ b/net/bluetooth/l2cap_sock.c
    3375     @@ -787,11 +787,6 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
    3376    
    3377     /*change security for LE channels */
    3378     if (chan->scid == L2CAP_CID_ATT) {
    3379     - if (!conn->hcon->out) {
    3380     - err = -EINVAL;
    3381     - break;
    3382     - }
    3383     -
    3384     if (smp_conn_security(conn->hcon, sec.level))
    3385     break;
    3386     sk->sk_state = BT_CONFIG;
    3387     diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
    3388     index c88b2b671849..a88cb3321361 100644
    3389     --- a/net/bluetooth/mgmt.c
    3390     +++ b/net/bluetooth/mgmt.c
    3391     @@ -1045,6 +1045,43 @@ static void clean_up_hci_complete(struct hci_dev *hdev, u8 status)
    3392     }
    3393     }
    3394    
    3395     +static void hci_stop_discovery(struct hci_request *req)
    3396     +{
    3397     + struct hci_dev *hdev = req->hdev;
    3398     + struct hci_cp_remote_name_req_cancel cp;
    3399     + struct inquiry_entry *e;
    3400     +
    3401     + switch (hdev->discovery.state) {
    3402     + case DISCOVERY_FINDING:
    3403     + if (test_bit(HCI_INQUIRY, &hdev->flags)) {
    3404     + hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
    3405     + } else {
    3406     + cancel_delayed_work(&hdev->le_scan_disable);
    3407     + hci_req_add_le_scan_disable(req);
    3408     + }
    3409     +
    3410     + break;
    3411     +
    3412     + case DISCOVERY_RESOLVING:
    3413     + e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
    3414     + NAME_PENDING);
    3415     + if (!e)
    3416     + return;
    3417     +
    3418     + bacpy(&cp.bdaddr, &e->data.bdaddr);
    3419     + hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
    3420     + &cp);
    3421     +
    3422     + break;
    3423     +
    3424     + default:
    3425     + /* Passive scanning */
    3426     + if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
    3427     + hci_req_add_le_scan_disable(req);
    3428     + break;
    3429     + }
    3430     +}
    3431     +
    3432     static int clean_up_hci_state(struct hci_dev *hdev)
    3433     {
    3434     struct hci_request req;
    3435     @@ -1061,9 +1098,7 @@ static int clean_up_hci_state(struct hci_dev *hdev)
    3436     if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
    3437     disable_advertising(&req);
    3438    
    3439     - if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
    3440     - hci_req_add_le_scan_disable(&req);
    3441     - }
    3442     + hci_stop_discovery(&req);
    3443    
    3444     list_for_each_entry(conn, &hdev->conn_hash.list, list) {
    3445     struct hci_cp_disconnect dc;
    3446     @@ -2997,8 +3032,13 @@ static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
    3447     }
    3448    
    3449     if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
    3450     - /* Continue with pairing via SMP */
    3451     + /* Continue with pairing via SMP. The hdev lock must be
    3452     + * released as SMP may try to recquire it for crypto
    3453     + * purposes.
    3454     + */
    3455     + hci_dev_unlock(hdev);
    3456     err = smp_user_confirm_reply(conn, mgmt_op, passkey);
    3457     + hci_dev_lock(hdev);
    3458    
    3459     if (!err)
    3460     err = cmd_complete(sk, hdev->id, mgmt_op,
    3461     @@ -3570,8 +3610,6 @@ static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
    3462     {
    3463     struct mgmt_cp_stop_discovery *mgmt_cp = data;
    3464     struct pending_cmd *cmd;
    3465     - struct hci_cp_remote_name_req_cancel cp;
    3466     - struct inquiry_entry *e;
    3467     struct hci_request req;
    3468     int err;
    3469    
    3470     @@ -3601,52 +3639,22 @@ static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
    3471    
    3472     hci_req_init(&req, hdev);
    3473    
    3474     - switch (hdev->discovery.state) {
    3475     - case DISCOVERY_FINDING:
    3476     - if (test_bit(HCI_INQUIRY, &hdev->flags)) {
    3477     - hci_req_add(&req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
    3478     - } else {
    3479     - cancel_delayed_work(&hdev->le_scan_disable);
    3480     -
    3481     - hci_req_add_le_scan_disable(&req);
    3482     - }
    3483     -
    3484     - break;
    3485     + hci_stop_discovery(&req);
    3486    
    3487     - case DISCOVERY_RESOLVING:
    3488     - e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
    3489     - NAME_PENDING);
    3490     - if (!e) {
    3491     - mgmt_pending_remove(cmd);
    3492     - err = cmd_complete(sk, hdev->id,
    3493     - MGMT_OP_STOP_DISCOVERY, 0,
    3494     - &mgmt_cp->type,
    3495     - sizeof(mgmt_cp->type));
    3496     - hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
    3497     - goto unlock;
    3498     - }
    3499     -
    3500     - bacpy(&cp.bdaddr, &e->data.bdaddr);
    3501     - hci_req_add(&req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
    3502     - &cp);
    3503     -
    3504     - break;
    3505     -
    3506     - default:
    3507     - BT_DBG("unknown discovery state %u", hdev->discovery.state);
    3508     -
    3509     - mgmt_pending_remove(cmd);
    3510     - err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
    3511     - MGMT_STATUS_FAILED, &mgmt_cp->type,
    3512     - sizeof(mgmt_cp->type));
    3513     + err = hci_req_run(&req, stop_discovery_complete);
    3514     + if (!err) {
    3515     + hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
    3516     goto unlock;
    3517     }
    3518    
    3519     - err = hci_req_run(&req, stop_discovery_complete);
    3520     - if (err < 0)
    3521     - mgmt_pending_remove(cmd);
    3522     - else
    3523     - hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
    3524     + mgmt_pending_remove(cmd);
    3525     +
    3526     + /* If no HCI commands were sent we're done */
    3527     + if (err == -ENODATA) {
    3528     + err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
    3529     + &mgmt_cp->type, sizeof(mgmt_cp->type));
    3530     + hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
    3531     + }
    3532    
    3533     unlock:
    3534     hci_dev_unlock(hdev);
    3535     diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
    3536     index 956d127528cb..863425a5886e 100644
    3537     --- a/net/bluetooth/smp.c
    3538     +++ b/net/bluetooth/smp.c
    3539     @@ -533,7 +533,7 @@ static void random_work(struct work_struct *work)
    3540     hci_le_start_enc(hcon, ediv, rand, stk);
    3541     hcon->enc_key_size = smp->enc_key_size;
    3542     } else {
    3543     - u8 stk[16];
    3544     + u8 stk[16], auth;
    3545     __le64 rand = 0;
    3546     __le16 ediv = 0;
    3547    
    3548     @@ -545,8 +545,13 @@ static void random_work(struct work_struct *work)
    3549     memset(stk + smp->enc_key_size, 0,
    3550     SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
    3551    
    3552     + if (hcon->pending_sec_level == BT_SECURITY_HIGH)
    3553     + auth = 1;
    3554     + else
    3555     + auth = 0;
    3556     +
    3557     hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
    3558     - HCI_SMP_STK_SLAVE, 0, stk, smp->enc_key_size,
    3559     + HCI_SMP_STK_SLAVE, auth, stk, smp->enc_key_size,
    3560     ediv, rand);
    3561     }
    3562    
    3563     diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
    3564     index 40a648938985..e205ebabfa50 100644
    3565     --- a/net/mac80211/debugfs_netdev.c
    3566     +++ b/net/mac80211/debugfs_netdev.c
    3567     @@ -34,8 +34,7 @@ static ssize_t ieee80211_if_read(
    3568     ssize_t ret = -EINVAL;
    3569    
    3570     read_lock(&dev_base_lock);
    3571     - if (sdata->dev->reg_state == NETREG_REGISTERED)
    3572     - ret = (*format)(sdata, buf, sizeof(buf));
    3573     + ret = (*format)(sdata, buf, sizeof(buf));
    3574     read_unlock(&dev_base_lock);
    3575    
    3576     if (ret >= 0)
    3577     @@ -62,8 +61,7 @@ static ssize_t ieee80211_if_write(
    3578    
    3579     ret = -ENODEV;
    3580     rtnl_lock();
    3581     - if (sdata->dev->reg_state == NETREG_REGISTERED)
    3582     - ret = (*write)(sdata, buf, count);
    3583     + ret = (*write)(sdata, buf, count);
    3584     rtnl_unlock();
    3585    
    3586     return ret;
    3587     diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
    3588     index 06d28787945b..53cf876b97b2 100644
    3589     --- a/net/mac80211/ibss.c
    3590     +++ b/net/mac80211/ibss.c
    3591     @@ -1648,6 +1648,7 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
    3592     sdata->u.ibss.control_port = params->control_port;
    3593     sdata->u.ibss.userspace_handles_dfs = params->userspace_handles_dfs;
    3594     sdata->u.ibss.basic_rates = params->basic_rates;
    3595     + sdata->u.ibss.last_scan_completed = jiffies;
    3596    
    3597     /* fix basic_rates if channel does not support these rates */
    3598     rate_flags = ieee80211_chandef_rate_flags(&params->chandef);
    3599     diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
    3600     index 847d92f6bef6..8f8c11583630 100644
    3601     --- a/net/mac80211/sta_info.c
    3602     +++ b/net/mac80211/sta_info.c
    3603     @@ -240,6 +240,7 @@ void sta_info_free(struct ieee80211_local *local, struct sta_info *sta)
    3604    
    3605     sta_dbg(sta->sdata, "Destroyed STA %pM\n", sta->sta.addr);
    3606    
    3607     + kfree(rcu_dereference_raw(sta->sta.rates));
    3608     kfree(sta);
    3609     }
    3610    
    3611     diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
    3612     index 58579634427d..70123f48b6c9 100644
    3613     --- a/net/netfilter/nf_conntrack_netlink.c
    3614     +++ b/net/netfilter/nf_conntrack_netlink.c
    3615     @@ -1150,7 +1150,7 @@ static int ctnetlink_done_list(struct netlink_callback *cb)
    3616     static int
    3617     ctnetlink_dump_list(struct sk_buff *skb, struct netlink_callback *cb, bool dying)
    3618     {
    3619     - struct nf_conn *ct, *last = NULL;
    3620     + struct nf_conn *ct, *last;
    3621     struct nf_conntrack_tuple_hash *h;
    3622     struct hlist_nulls_node *n;
    3623     struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
    3624     @@ -1163,8 +1163,7 @@ ctnetlink_dump_list(struct sk_buff *skb, struct netlink_callback *cb, bool dying
    3625     if (cb->args[2])
    3626     return 0;
    3627    
    3628     - if (cb->args[0] == nr_cpu_ids)
    3629     - return 0;
    3630     + last = (struct nf_conn *)cb->args[1];
    3631    
    3632     for (cpu = cb->args[0]; cpu < nr_cpu_ids; cpu++) {
    3633     struct ct_pcpu *pcpu;
    3634     @@ -1174,7 +1173,6 @@ ctnetlink_dump_list(struct sk_buff *skb, struct netlink_callback *cb, bool dying
    3635    
    3636     pcpu = per_cpu_ptr(net->ct.pcpu_lists, cpu);
    3637     spin_lock_bh(&pcpu->lock);
    3638     - last = (struct nf_conn *)cb->args[1];
    3639     list = dying ? &pcpu->dying : &pcpu->unconfirmed;
    3640     restart:
    3641     hlist_nulls_for_each_entry(h, n, list, hnnode) {
    3642     @@ -1193,7 +1191,9 @@ restart:
    3643     ct);
    3644     rcu_read_unlock();
    3645     if (res < 0) {
    3646     - nf_conntrack_get(&ct->ct_general);
    3647     + if (!atomic_inc_not_zero(&ct->ct_general.use))
    3648     + continue;
    3649     + cb->args[0] = cpu;
    3650     cb->args[1] = (unsigned long)ct;
    3651     spin_unlock_bh(&pcpu->lock);
    3652     goto out;
    3653     @@ -1202,10 +1202,10 @@ restart:
    3654     if (cb->args[1]) {
    3655     cb->args[1] = 0;
    3656     goto restart;
    3657     - } else
    3658     - cb->args[2] = 1;
    3659     + }
    3660     spin_unlock_bh(&pcpu->lock);
    3661     }
    3662     + cb->args[2] = 1;
    3663     out:
    3664     if (last)
    3665     nf_ct_put(last);
    3666     diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
    3667     index 52ca952b802c..23247a0d2b69 100644
    3668     --- a/net/netfilter/nf_nat_core.c
    3669     +++ b/net/netfilter/nf_nat_core.c
    3670     @@ -517,6 +517,39 @@ static int nf_nat_proto_remove(struct nf_conn *i, void *data)
    3671     return i->status & IPS_NAT_MASK ? 1 : 0;
    3672     }
    3673    
    3674     +static int nf_nat_proto_clean(struct nf_conn *ct, void *data)
    3675     +{
    3676     + struct nf_conn_nat *nat = nfct_nat(ct);
    3677     +
    3678     + if (nf_nat_proto_remove(ct, data))
    3679     + return 1;
    3680     +
    3681     + if (!nat || !nat->ct)
    3682     + return 0;
    3683     +
    3684     + /* This netns is being destroyed, and conntrack has nat null binding.
    3685     + * Remove it from bysource hash, as the table will be freed soon.
    3686     + *
    3687     + * Else, when the conntrack is destoyed, nf_nat_cleanup_conntrack()
    3688     + * will delete entry from already-freed table.
    3689     + */
    3690     + if (!del_timer(&ct->timeout))
    3691     + return 1;
    3692     +
    3693     + spin_lock_bh(&nf_nat_lock);
    3694     + hlist_del_rcu(&nat->bysource);
    3695     + ct->status &= ~IPS_NAT_DONE_MASK;
    3696     + nat->ct = NULL;
    3697     + spin_unlock_bh(&nf_nat_lock);
    3698     +
    3699     + add_timer(&ct->timeout);
    3700     +
    3701     + /* don't delete conntrack. Although that would make things a lot
    3702     + * simpler, we'd end up flushing all conntracks on nat rmmod.
    3703     + */
    3704     + return 0;
    3705     +}
    3706     +
    3707     static void nf_nat_l4proto_clean(u8 l3proto, u8 l4proto)
    3708     {
    3709     struct nf_nat_proto_clean clean = {
    3710     @@ -787,7 +820,7 @@ static void __net_exit nf_nat_net_exit(struct net *net)
    3711     {
    3712     struct nf_nat_proto_clean clean = {};
    3713    
    3714     - nf_ct_iterate_cleanup(net, &nf_nat_proto_remove, &clean, 0, 0);
    3715     + nf_ct_iterate_cleanup(net, nf_nat_proto_clean, &clean, 0, 0);
    3716     synchronize_rcu();
    3717     nf_ct_free_hashtable(net->ct.nat_bysource, net->ct.nat_htable_size);
    3718     }
    3719     diff --git a/sound/pci/hda/hda_i915.c b/sound/pci/hda/hda_i915.c
    3720     index 9d07e4edacdb..8b4940ba33d6 100644
    3721     --- a/sound/pci/hda/hda_i915.c
    3722     +++ b/sound/pci/hda/hda_i915.c
    3723     @@ -20,24 +20,71 @@
    3724     #include <linux/module.h>
    3725     #include <sound/core.h>
    3726     #include <drm/i915_powerwell.h>
    3727     +#include "hda_priv.h"
    3728     #include "hda_i915.h"
    3729    
    3730     -static void (*get_power)(void);
    3731     -static void (*put_power)(void);
    3732     +/* Intel HSW/BDW display HDA controller Extended Mode registers.
    3733     + * EM4 (M value) and EM5 (N Value) are used to convert CDClk (Core Display
    3734     + * Clock) to 24MHz BCLK: BCLK = CDCLK * M / N
    3735     + * The values will be lost when the display power well is disabled.
    3736     + */
    3737     +#define ICH6_REG_EM4 0x100c
    3738     +#define ICH6_REG_EM5 0x1010
    3739     +
    3740     +static int (*get_power)(void);
    3741     +static int (*put_power)(void);
    3742     +static int (*get_cdclk)(void);
    3743    
    3744     -void hda_display_power(bool enable)
    3745     +int hda_display_power(bool enable)
    3746     {
    3747     if (!get_power || !put_power)
    3748     - return;
    3749     + return -ENODEV;
    3750    
    3751     pr_debug("HDA display power %s \n",
    3752     enable ? "Enable" : "Disable");
    3753     if (enable)
    3754     - get_power();
    3755     + return get_power();
    3756     else
    3757     - put_power();
    3758     + return put_power();
    3759     +}
    3760     +
    3761     +void haswell_set_bclk(struct azx *chip)
    3762     +{
    3763     + int cdclk_freq;
    3764     + unsigned int bclk_m, bclk_n;
    3765     +
    3766     + if (!get_cdclk)
    3767     + return;
    3768     +
    3769     + cdclk_freq = get_cdclk();
    3770     + switch (cdclk_freq) {
    3771     + case 337500:
    3772     + bclk_m = 16;
    3773     + bclk_n = 225;
    3774     + break;
    3775     +
    3776     + case 450000:
    3777     + default: /* default CDCLK 450MHz */
    3778     + bclk_m = 4;
    3779     + bclk_n = 75;
    3780     + break;
    3781     +
    3782     + case 540000:
    3783     + bclk_m = 4;
    3784     + bclk_n = 90;
    3785     + break;
    3786     +
    3787     + case 675000:
    3788     + bclk_m = 8;
    3789     + bclk_n = 225;
    3790     + break;
    3791     + }
    3792     +
    3793     + azx_writew(chip, EM4, bclk_m);
    3794     + azx_writew(chip, EM5, bclk_n);
    3795     }
    3796    
    3797     +
    3798     int hda_i915_init(void)
    3799     {
    3800     int err = 0;
    3801     @@ -55,6 +102,10 @@ int hda_i915_init(void)
    3802     return -ENODEV;
    3803     }
    3804    
    3805     + get_cdclk = symbol_request(i915_get_cdclk_freq);
    3806     + if (!get_cdclk) /* may have abnormal BCLK and audio playback rate */
    3807     + pr_warn("hda-i915: get_cdclk symbol get fail\n");
    3808     +
    3809     pr_debug("HDA driver get symbol successfully from i915 module\n");
    3810    
    3811     return err;
    3812     @@ -70,6 +121,10 @@ int hda_i915_exit(void)
    3813     symbol_put(i915_release_power_well);
    3814     put_power = NULL;
    3815     }
    3816     + if (get_cdclk) {
    3817     + symbol_put(i915_get_cdclk_freq);
    3818     + get_cdclk = NULL;
    3819     + }
    3820    
    3821     return 0;
    3822     }
    3823     diff --git a/sound/pci/hda/hda_i915.h b/sound/pci/hda/hda_i915.h
    3824     index 5a63da2c53e5..e6072c627583 100644
    3825     --- a/sound/pci/hda/hda_i915.h
    3826     +++ b/sound/pci/hda/hda_i915.h
    3827     @@ -17,11 +17,13 @@
    3828     #define __SOUND_HDA_I915_H
    3829    
    3830     #ifdef CONFIG_SND_HDA_I915
    3831     -void hda_display_power(bool enable);
    3832     +int hda_display_power(bool enable);
    3833     +void haswell_set_bclk(struct azx *chip);
    3834     int hda_i915_init(void);
    3835     int hda_i915_exit(void);
    3836     #else
    3837     -static inline void hda_display_power(bool enable) {}
    3838     +static inline int hda_display_power(bool enable) { return 0; }
    3839     +static inline void haswell_set_bclk(struct azx *chip) { return; }
    3840     static inline int hda_i915_init(void)
    3841     {
    3842     return -ENODEV;
    3843     diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
    3844     index 0176cf0e01d9..bc36f9cdd9d2 100644
    3845     --- a/sound/pci/hda/hda_intel.c
    3846     +++ b/sound/pci/hda/hda_intel.c
    3847     @@ -62,9 +62,9 @@
    3848     #include <linux/vga_switcheroo.h>
    3849     #include <linux/firmware.h>
    3850     #include "hda_codec.h"
    3851     -#include "hda_i915.h"
    3852     #include "hda_controller.h"
    3853     #include "hda_priv.h"
    3854     +#include "hda_i915.h"
    3855    
    3856    
    3857     static int index[SNDRV_CARDS] = SNDRV_DEFAULT_IDX;
    3858     @@ -282,21 +282,8 @@ static char *driver_short_names[] = {
    3859     [AZX_DRIVER_GENERIC] = "HD-Audio Generic",
    3860     };
    3861    
    3862     -
    3863     -/* Intel HSW/BDW display HDA controller Extended Mode registers.
    3864     - * EM4 (M value) and EM5 (N Value) are used to convert CDClk (Core Display
    3865     - * Clock) to 24MHz BCLK: BCLK = CDCLK * M / N
    3866     - * The values will be lost when the display power well is disabled.
    3867     - */
    3868     -#define ICH6_REG_EM4 0x100c
    3869     -#define ICH6_REG_EM5 0x1010
    3870     -
    3871     struct hda_intel {
    3872     struct azx chip;
    3873     -
    3874     - /* HSW/BDW display HDA controller to restore BCLK from CDCLK */
    3875     - unsigned int bclk_m;
    3876     - unsigned int bclk_n;
    3877     };
    3878    
    3879    
    3880     @@ -592,22 +579,6 @@ static int param_set_xint(const char *val, const struct kernel_param *kp)
    3881     #define azx_del_card_list(chip) /* NOP */
    3882     #endif /* CONFIG_PM */
    3883    
    3884     -static void haswell_save_bclk(struct azx *chip)
    3885     -{
    3886     - struct hda_intel *hda = container_of(chip, struct hda_intel, chip);
    3887     -
    3888     - hda->bclk_m = azx_readw(chip, EM4);
    3889     - hda->bclk_n = azx_readw(chip, EM5);
    3890     -}
    3891     -
    3892     -static void haswell_restore_bclk(struct azx *chip)
    3893     -{
    3894     - struct hda_intel *hda = container_of(chip, struct hda_intel, chip);
    3895     -
    3896     - azx_writew(chip, EM4, hda->bclk_m);
    3897     - azx_writew(chip, EM5, hda->bclk_n);
    3898     -}
    3899     -
    3900     #if defined(CONFIG_PM_SLEEP) || defined(SUPPORT_VGA_SWITCHEROO)
    3901     /*
    3902     * power management
    3903     @@ -635,12 +606,6 @@ static int azx_suspend(struct device *dev)
    3904     chip->irq = -1;
    3905     }
    3906    
    3907     - /* Save BCLK M/N values before they become invalid in D3.
    3908     - * Will test if display power well can be released now.
    3909     - */
    3910     - if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL)
    3911     - haswell_save_bclk(chip);
    3912     -
    3913     if (chip->msi)
    3914     pci_disable_msi(chip->pci);
    3915     pci_disable_device(pci);
    3916     @@ -662,7 +627,7 @@ static int azx_resume(struct device *dev)
    3917    
    3918     if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL) {
    3919     hda_display_power(true);
    3920     - haswell_restore_bclk(chip);
    3921     + haswell_set_bclk(chip);
    3922     }
    3923     pci_set_power_state(pci, PCI_D0);
    3924     pci_restore_state(pci);
    3925     @@ -707,10 +672,9 @@ static int azx_runtime_suspend(struct device *dev)
    3926     azx_stop_chip(chip);
    3927     azx_enter_link_reset(chip);
    3928     azx_clear_irq_pending(chip);
    3929     - if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL) {
    3930     - haswell_save_bclk(chip);
    3931     + if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL)
    3932     hda_display_power(false);
    3933     - }
    3934     +
    3935     return 0;
    3936     }
    3937    
    3938     @@ -730,7 +694,7 @@ static int azx_runtime_resume(struct device *dev)
    3939    
    3940     if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL) {
    3941     hda_display_power(true);
    3942     - haswell_restore_bclk(chip);
    3943     + haswell_set_bclk(chip);
    3944     }
    3945    
    3946     /* Read STATESTS before controller reset */
    3947     @@ -1426,6 +1390,10 @@ static int azx_first_init(struct azx *chip)
    3948    
    3949     /* initialize chip */
    3950     azx_init_pci(chip);
    3951     +
    3952     + if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL)
    3953     + haswell_set_bclk(chip);
    3954     +
    3955     azx_init_chip(chip, (probe_only[dev] & 2) == 0);
    3956    
    3957     /* codec detection */
    3958     @@ -1707,8 +1675,13 @@ static int azx_probe_continue(struct azx *chip)
    3959     "Error request power-well from i915\n");
    3960     goto out_free;
    3961     }
    3962     + err = hda_display_power(true);
    3963     + if (err < 0) {
    3964     + dev_err(chip->card->dev,
    3965     + "Cannot turn on display power on i915\n");
    3966     + goto out_free;
    3967     + }
    3968     #endif
    3969     - hda_display_power(true);
    3970     }
    3971    
    3972     err = azx_first_init(chip);
    3973     diff --git a/tools/usb/ffs-test.c b/tools/usb/ffs-test.c
    3974     index fe1e66b6ef40..a87e99f37c52 100644
    3975     --- a/tools/usb/ffs-test.c
    3976     +++ b/tools/usb/ffs-test.c
    3977     @@ -116,8 +116,8 @@ static const struct {
    3978     .header = {
    3979     .magic = cpu_to_le32(FUNCTIONFS_DESCRIPTORS_MAGIC),
    3980     .length = cpu_to_le32(sizeof descriptors),
    3981     - .fs_count = 3,
    3982     - .hs_count = 3,
    3983     + .fs_count = cpu_to_le32(3),
    3984     + .hs_count = cpu_to_le32(3),
    3985     },
    3986     .fs_descs = {
    3987     .intf = {