Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-magellan/patches-3.15/0104-3.15.5-all-fixes.patch

    Contents of /trunk/kernel-magellan/patches-3.15/0104-3.15.5-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 2485 - (show annotations) (download)
    Mon Jul 21 12:24:50 2014 UTC (9 years, 9 months ago) by niro
    File size: 137365 byte(s) 
    -linux-3.15.5
    1 diff --git a/Documentation/devicetree/bindings/arm/armada-38x.txt b/Documentation/devicetree/bindings/arm/armada-38x.txt
    2 index 11f2330a6554..ad9f8ed4d9bd 100644
    3 --- a/Documentation/devicetree/bindings/arm/armada-38x.txt
    4 +++ b/Documentation/devicetree/bindings/arm/armada-38x.txt
    5 @@ -6,5 +6,15 @@ following property:
    6
    7 Required root node property:
    8
    9 - - compatible: must contain either "marvell,armada380" or
    10 - "marvell,armada385" depending on the variant of the SoC being used.
    11 + - compatible: must contain "marvell,armada380"
    12 +
    13 +In addition, boards using the Marvell Armada 385 SoC shall have the
    14 +following property before the previous one:
    15 +
    16 +Required root node property:
    17 +
    18 +compatible: must contain "marvell,armada385"
    19 +
    20 +Example:
    21 +
    22 +compatible = "marvell,a385-rd", "marvell,armada385", "marvell,armada380";
    23 diff --git a/Documentation/sysctl/vm.txt b/Documentation/sysctl/vm.txt
    24 index dd9d0e33b443..d3e6d844fa14 100644
    25 --- a/Documentation/sysctl/vm.txt
    26 +++ b/Documentation/sysctl/vm.txt
    27 @@ -702,7 +702,8 @@ The batch value of each per cpu pagelist is also updated as a result. It is
    28 set to pcp->high/4. The upper limit of batch is (PAGE_SHIFT * 8)
    29
    30 The initial value is zero. Kernel does not use this value at boot time to set
    31 -the high water marks for each per cpu page list.
    32 +the high water marks for each per cpu page list. If the user writes '0' to this
    33 +sysctl, it will revert to this default behavior.
    34
    35 ==============================================================
    36
    37 diff --git a/Makefile b/Makefile
    38 index 25ecc1dd5bb5..e6b01ed8fd9f 100644
    39 --- a/Makefile
    40 +++ b/Makefile
    41 @@ -1,6 +1,6 @@
    42 VERSION = 3
    43 PATCHLEVEL = 15
    44 -SUBLEVEL = 4
    45 +SUBLEVEL = 5
    46 EXTRAVERSION =
    47 NAME = Shuffling Zombie Juror
    48
    49 diff --git a/arch/arc/kernel/ctx_sw_asm.S b/arch/arc/kernel/ctx_sw_asm.S
    50 index 2ff0347a2fd7..e248594097e7 100644
    51 --- a/arch/arc/kernel/ctx_sw_asm.S
    52 +++ b/arch/arc/kernel/ctx_sw_asm.S
    53 @@ -10,9 +10,9 @@
    54 * -This is the more "natural" hand written assembler
    55 */
    56
    57 +#include <linux/linkage.h>
    58 #include <asm/entry.h> /* For the SAVE_* macros */
    59 #include <asm/asm-offsets.h>
    60 -#include <asm/linkage.h>
    61
    62 #define KSP_WORD_OFF ((TASK_THREAD + THREAD_KSP) / 4)
    63
    64 diff --git a/arch/arm/boot/dts/armada-380.dtsi b/arch/arm/boot/dts/armada-380.dtsi
    65 index 6d0f03c98ee9..a284b611d3e3 100644
    66 --- a/arch/arm/boot/dts/armada-380.dtsi
    67 +++ b/arch/arm/boot/dts/armada-380.dtsi
    68 @@ -16,7 +16,7 @@
    69
    70 / {
    71 model = "Marvell Armada 380 family SoC";
    72 - compatible = "marvell,armada380", "marvell,armada38x";
    73 + compatible = "marvell,armada380";
    74
    75 cpus {
    76 #address-cells = <1>;
    77 diff --git a/arch/arm/boot/dts/armada-385-db.dts b/arch/arm/boot/dts/armada-385-db.dts
    78 index 6828d77696a6..b0e27e169712 100644
    79 --- a/arch/arm/boot/dts/armada-385-db.dts
    80 +++ b/arch/arm/boot/dts/armada-385-db.dts
    81 @@ -16,7 +16,7 @@
    82
    83 / {
    84 model = "Marvell Armada 385 Development Board";
    85 - compatible = "marvell,a385-db", "marvell,armada385", "marvell,armada38x";
    86 + compatible = "marvell,a385-db", "marvell,armada385", "marvell,armada380";
    87
    88 chosen {
    89 bootargs = "console=ttyS0,115200 earlyprintk";
    90 diff --git a/arch/arm/boot/dts/armada-385-rd.dts b/arch/arm/boot/dts/armada-385-rd.dts
    91 index 45250c88814b..229408aeecb2 100644
    92 --- a/arch/arm/boot/dts/armada-385-rd.dts
    93 +++ b/arch/arm/boot/dts/armada-385-rd.dts
    94 @@ -17,7 +17,7 @@
    95
    96 / {
    97 model = "Marvell Armada 385 Reference Design";
    98 - compatible = "marvell,a385-rd", "marvell,armada385", "marvell,armada38x";
    99 + compatible = "marvell,a385-rd", "marvell,armada385", "marvell,armada380";
    100
    101 chosen {
    102 bootargs = "console=ttyS0,115200 earlyprintk";
    103 diff --git a/arch/arm/boot/dts/armada-385.dtsi b/arch/arm/boot/dts/armada-385.dtsi
    104 index da801964a257..2dff97fb46bc 100644
    105 --- a/arch/arm/boot/dts/armada-385.dtsi
    106 +++ b/arch/arm/boot/dts/armada-385.dtsi
    107 @@ -16,7 +16,7 @@
    108
    109 / {
    110 model = "Marvell Armada 385 family SoC";
    111 - compatible = "marvell,armada385", "marvell,armada38x";
    112 + compatible = "marvell,armada385", "marvell,armada380";
    113
    114 cpus {
    115 #address-cells = <1>;
    116 diff --git a/arch/arm/boot/dts/armada-38x.dtsi b/arch/arm/boot/dts/armada-38x.dtsi
    117 index ca8813bb99ba..9a5914ddb4ea 100644
    118 --- a/arch/arm/boot/dts/armada-38x.dtsi
    119 +++ b/arch/arm/boot/dts/armada-38x.dtsi
    120 @@ -20,7 +20,7 @@
    121
    122 / {
    123 model = "Marvell Armada 38x family SoC";
    124 - compatible = "marvell,armada38x";
    125 + compatible = "marvell,armada380";
    126
    127 aliases {
    128 gpio0 = &gpio0;
    129 diff --git a/arch/arm/mach-omap2/mux.c b/arch/arm/mach-omap2/mux.c
    130 index 48094b58c88f..b12a4f9fc9d0 100644
    131 --- a/arch/arm/mach-omap2/mux.c
    132 +++ b/arch/arm/mach-omap2/mux.c
    133 @@ -183,8 +183,10 @@ static int __init _omap_mux_get_by_name(struct omap_mux_partition *partition,
    134 m0_entry = mux->muxnames[0];
    135
    136 /* First check for full name in mode0.muxmode format */
    137 - if (mode0_len && strncmp(muxname, m0_entry, mode0_len))
    138 - continue;
    139 + if (mode0_len)
    140 + if (strncmp(muxname, m0_entry, mode0_len) ||
    141 + (strlen(m0_entry) != mode0_len))
    142 + continue;
    143
    144 /* Then check for muxmode only */
    145 for (i = 0; i < OMAP_MUX_NR_MODES; i++) {
    146 diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
    147 index 39ac630d83de..a8e4bdbbb4b8 100644
    148 --- a/arch/arm64/kernel/entry.S
    149 +++ b/arch/arm64/kernel/entry.S
    150 @@ -275,7 +275,6 @@ el1_sp_pc:
    151 * Stack or PC alignment exception handling
    152 */
    153 mrs x0, far_el1
    154 - mov x1, x25
    155 mov x2, sp
    156 b do_sp_pc_abort
    157 el1_undef:
    158 diff --git a/arch/arm64/mm/flush.c b/arch/arm64/mm/flush.c
    159 index e4193e3adc7f..0d64089d28b5 100644
    160 --- a/arch/arm64/mm/flush.c
    161 +++ b/arch/arm64/mm/flush.c
    162 @@ -79,7 +79,8 @@ void __sync_icache_dcache(pte_t pte, unsigned long addr)
    163 return;
    164
    165 if (!test_and_set_bit(PG_dcache_clean, &page->flags)) {
    166 - __flush_dcache_area(page_address(page), PAGE_SIZE);
    167 + __flush_dcache_area(page_address(page),
    168 + PAGE_SIZE << compound_order(page));
    169 __flush_icache_all();
    170 } else if (icache_is_aivivt()) {
    171 __flush_icache_all();
    172 diff --git a/arch/ia64/include/uapi/asm/fcntl.h b/arch/ia64/include/uapi/asm/fcntl.h
    173 index 1dd275dc8f65..7b485876cad4 100644
    174 --- a/arch/ia64/include/uapi/asm/fcntl.h
    175 +++ b/arch/ia64/include/uapi/asm/fcntl.h
    176 @@ -8,6 +8,7 @@
    177 #define force_o_largefile() \
    178 (personality(current->personality) != PER_LINUX32)
    179
    180 +#include <linux/personality.h>
    181 #include <asm-generic/fcntl.h>
    182
    183 #endif /* _ASM_IA64_FCNTL_H */
    184 diff --git a/arch/unicore32/mm/alignment.c b/arch/unicore32/mm/alignment.c
    185 index de7dc5fdd58b..24e836023e6c 100644
    186 --- a/arch/unicore32/mm/alignment.c
    187 +++ b/arch/unicore32/mm/alignment.c
    188 @@ -21,6 +21,7 @@
    189 #include <linux/sched.h>
    190 #include <linux/uaccess.h>
    191
    192 +#include <asm/pgtable.h>
    193 #include <asm/tlbflush.h>
    194 #include <asm/unaligned.h>
    195
    196 diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
    197 index 7de069afb382..520197517138 100644
    198 --- a/arch/x86/include/asm/kvm_host.h
    199 +++ b/arch/x86/include/asm/kvm_host.h
    200 @@ -99,7 +99,7 @@ static inline gfn_t gfn_to_index(gfn_t gfn, gfn_t base_gfn, int level)
    201 #define KVM_REFILL_PAGES 25
    202 #define KVM_MAX_CPUID_ENTRIES 80
    203 #define KVM_NR_FIXED_MTRR_REGION 88
    204 -#define KVM_NR_VAR_MTRR 8
    205 +#define KVM_NR_VAR_MTRR 10
    206
    207 #define ASYNC_PF_PER_VCPU 64
    208
    209 @@ -466,7 +466,7 @@ struct kvm_vcpu_arch {
    210 bool nmi_injected; /* Trying to inject an NMI this entry */
    211
    212 struct mtrr_state_type mtrr_state;
    213 - u32 pat;
    214 + u64 pat;
    215
    216 unsigned switch_db_regs;
    217 unsigned long db[KVM_NR_DB_REGS];
    218 diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
    219 index 20316c67b824..5521f7c14a11 100644
    220 --- a/arch/x86/kvm/x86.c
    221 +++ b/arch/x86/kvm/x86.c
    222 @@ -1912,7 +1912,7 @@ static int set_msr_hyperv_pw(struct kvm_vcpu *vcpu, u32 msr, u64 data)
    223 if (!(data & HV_X64_MSR_TSC_REFERENCE_ENABLE))
    224 break;
    225 gfn = data >> HV_X64_MSR_TSC_REFERENCE_ADDRESS_SHIFT;
    226 - if (kvm_write_guest(kvm, data,
    227 + if (kvm_write_guest(kvm, gfn << HV_X64_MSR_TSC_REFERENCE_ADDRESS_SHIFT,
    228 &tsc_ref, sizeof(tsc_ref)))
    229 return 1;
    230 mark_page_dirty(kvm, gfn);
    231 diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
    232 index 1039fb9ff5f5..95ee425bf7c6 100644
    233 --- a/block/blk-cgroup.c
    234 +++ b/block/blk-cgroup.c
    235 @@ -80,7 +80,7 @@ static struct blkcg_gq *blkg_alloc(struct blkcg *blkcg, struct request_queue *q,
    236 blkg->q = q;
    237 INIT_LIST_HEAD(&blkg->q_node);
    238 blkg->blkcg = blkcg;
    239 - blkg->refcnt = 1;
    240 + atomic_set(&blkg->refcnt, 1);
    241
    242 /* root blkg uses @q->root_rl, init rl only for !root blkgs */
    243 if (blkcg != &blkcg_root) {
    244 @@ -399,11 +399,8 @@ void __blkg_release_rcu(struct rcu_head *rcu_head)
    245
    246 /* release the blkcg and parent blkg refs this blkg has been holding */
    247 css_put(&blkg->blkcg->css);
    248 - if (blkg->parent) {
    249 - spin_lock_irq(blkg->q->queue_lock);
    250 + if (blkg->parent)
    251 blkg_put(blkg->parent);
    252 - spin_unlock_irq(blkg->q->queue_lock);
    253 - }
    254
    255 blkg_free(blkg);
    256 }
    257 diff --git a/block/blk-cgroup.h b/block/blk-cgroup.h
    258 index 371fe8e92ab5..75012d8d900c 100644
    259 --- a/block/blk-cgroup.h
    260 +++ b/block/blk-cgroup.h
    261 @@ -18,6 +18,7 @@
    262 #include <linux/seq_file.h>
    263 #include <linux/radix-tree.h>
    264 #include <linux/blkdev.h>
    265 +#include <linux/atomic.h>
    266
    267 /* Max limits for throttle policy */
    268 #define THROTL_IOPS_MAX UINT_MAX
    269 @@ -104,7 +105,7 @@ struct blkcg_gq {
    270 struct request_list rl;
    271
    272 /* reference count */
    273 - int refcnt;
    274 + atomic_t refcnt;
    275
    276 /* is this blkg online? protected by both blkcg and q locks */
    277 bool online;
    278 @@ -257,13 +258,12 @@ static inline int blkg_path(struct blkcg_gq *blkg, char *buf, int buflen)
    279 * blkg_get - get a blkg reference
    280 * @blkg: blkg to get
    281 *
    282 - * The caller should be holding queue_lock and an existing reference.
    283 + * The caller should be holding an existing reference.
    284 */
    285 static inline void blkg_get(struct blkcg_gq *blkg)
    286 {
    287 - lockdep_assert_held(blkg->q->queue_lock);
    288 - WARN_ON_ONCE(!blkg->refcnt);
    289 - blkg->refcnt++;
    290 + WARN_ON_ONCE(atomic_read(&blkg->refcnt) <= 0);
    291 + atomic_inc(&blkg->refcnt);
    292 }
    293
    294 void __blkg_release_rcu(struct rcu_head *rcu);
    295 @@ -271,14 +271,11 @@ void __blkg_release_rcu(struct rcu_head *rcu);
    296 /**
    297 * blkg_put - put a blkg reference
    298 * @blkg: blkg to put
    299 - *
    300 - * The caller should be holding queue_lock.
    301 */
    302 static inline void blkg_put(struct blkcg_gq *blkg)
    303 {
    304 - lockdep_assert_held(blkg->q->queue_lock);
    305 - WARN_ON_ONCE(blkg->refcnt <= 0);
    306 - if (!--blkg->refcnt)
    307 + WARN_ON_ONCE(atomic_read(&blkg->refcnt) <= 0);
    308 + if (atomic_dec_and_test(&blkg->refcnt))
    309 call_rcu(&blkg->rcu_head, __blkg_release_rcu);
    310 }
    311
    312 diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
    313 index 4c95b503b09e..684806c14f84 100644
    314 --- a/drivers/block/rbd.c
    315 +++ b/drivers/block/rbd.c
    316 @@ -1366,6 +1366,14 @@ static bool obj_request_exists_test(struct rbd_obj_request *obj_request)
    317 return test_bit(OBJ_REQ_EXISTS, &obj_request->flags) != 0;
    318 }
    319
    320 +static bool obj_request_overlaps_parent(struct rbd_obj_request *obj_request)
    321 +{
    322 + struct rbd_device *rbd_dev = obj_request->img_request->rbd_dev;
    323 +
    324 + return obj_request->img_offset <
    325 + round_up(rbd_dev->parent_overlap, rbd_obj_bytes(&rbd_dev->header));
    326 +}
    327 +
    328 static void rbd_obj_request_get(struct rbd_obj_request *obj_request)
    329 {
    330 dout("%s: obj %p (was %d)\n", __func__, obj_request,
    331 @@ -1382,6 +1390,13 @@ static void rbd_obj_request_put(struct rbd_obj_request *obj_request)
    332 kref_put(&obj_request->kref, rbd_obj_request_destroy);
    333 }
    334
    335 +static void rbd_img_request_get(struct rbd_img_request *img_request)
    336 +{
    337 + dout("%s: img %p (was %d)\n", __func__, img_request,
    338 + atomic_read(&img_request->kref.refcount));
    339 + kref_get(&img_request->kref);
    340 +}
    341 +
    342 static bool img_request_child_test(struct rbd_img_request *img_request);
    343 static void rbd_parent_request_destroy(struct kref *kref);
    344 static void rbd_img_request_destroy(struct kref *kref);
    345 @@ -2142,6 +2157,7 @@ static void rbd_img_obj_callback(struct rbd_obj_request *obj_request)
    346 img_request->next_completion = which;
    347 out:
    348 spin_unlock_irq(&img_request->completion_lock);
    349 + rbd_img_request_put(img_request);
    350
    351 if (!more)
    352 rbd_img_request_complete(img_request);
    353 @@ -2242,6 +2258,7 @@ static int rbd_img_request_fill(struct rbd_img_request *img_request,
    354 goto out_unwind;
    355 obj_request->osd_req = osd_req;
    356 obj_request->callback = rbd_img_obj_callback;
    357 + rbd_img_request_get(img_request);
    358
    359 if (write_request) {
    360 osd_req_op_alloc_hint_init(osd_req, which,
    361 @@ -2674,7 +2691,7 @@ static int rbd_img_obj_request_submit(struct rbd_obj_request *obj_request)
    362 */
    363 if (!img_request_write_test(img_request) ||
    364 !img_request_layered_test(img_request) ||
    365 - rbd_dev->parent_overlap <= obj_request->img_offset ||
    366 + !obj_request_overlaps_parent(obj_request) ||
    367 ((known = obj_request_known_test(obj_request)) &&
    368 obj_request_exists_test(obj_request))) {
    369
    370 diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
    371 index 48eccb350180..089e72cd37be 100644
    372 --- a/drivers/block/zram/zram_drv.c
    373 +++ b/drivers/block/zram/zram_drv.c
    374 @@ -622,8 +622,10 @@ static void zram_reset_device(struct zram *zram, bool reset_capacity)
    375 memset(&zram->stats, 0, sizeof(zram->stats));
    376
    377 zram->disksize = 0;
    378 - if (reset_capacity)
    379 + if (reset_capacity) {
    380 set_capacity(zram->disk, 0);
    381 + revalidate_disk(zram->disk);
    382 + }
    383 up_write(&zram->init_lock);
    384 }
    385
    386 @@ -664,6 +666,7 @@ static ssize_t disksize_store(struct device *dev,
    387 zram->comp = comp;
    388 zram->disksize = disksize;
    389 set_capacity(zram->disk, zram->disksize >> SECTOR_SHIFT);
    390 + revalidate_disk(zram->disk);
    391 up_write(&zram->init_lock);
    392 return len;
    393
    394 diff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c
    395 index 00f878a04d3f..0996a3a39855 100644
    396 --- a/drivers/clk/qcom/clk-rcg2.c
    397 +++ b/drivers/clk/qcom/clk-rcg2.c
    398 @@ -55,7 +55,7 @@ static int clk_rcg2_is_enabled(struct clk_hw *hw)
    399 if (ret)
    400 return ret;
    401
    402 - return (cmd & CMD_ROOT_OFF) != 0;
    403 + return (cmd & CMD_ROOT_OFF) == 0;
    404 }
    405
    406 static u8 clk_rcg2_get_parent(struct clk_hw *hw)
    407 diff --git a/drivers/clk/qcom/mmcc-msm8974.c b/drivers/clk/qcom/mmcc-msm8974.c
    408 index c95774514b81..6a0ae77d1939 100644
    409 --- a/drivers/clk/qcom/mmcc-msm8974.c
    410 +++ b/drivers/clk/qcom/mmcc-msm8974.c
    411 @@ -169,6 +169,7 @@ static struct clk_pll mmpll0 = {
    412 .config_reg = 0x0014,
    413 .mode_reg = 0x0000,
    414 .status_reg = 0x001c,
    415 + .status_bit = 17,
    416 .clkr.hw.init = &(struct clk_init_data){
    417 .name = "mmpll0",
    418 .parent_names = (const char *[]){ "xo" },
    419 @@ -192,9 +193,10 @@ static struct clk_pll mmpll1 = {
    420 .l_reg = 0x0044,
    421 .m_reg = 0x0048,
    422 .n_reg = 0x004c,
    423 - .config_reg = 0x0054,
    424 + .config_reg = 0x0050,
    425 .mode_reg = 0x0040,
    426 .status_reg = 0x005c,
    427 + .status_bit = 17,
    428 .clkr.hw.init = &(struct clk_init_data){
    429 .name = "mmpll1",
    430 .parent_names = (const char *[]){ "xo" },
    431 @@ -218,7 +220,7 @@ static struct clk_pll mmpll2 = {
    432 .l_reg = 0x4104,
    433 .m_reg = 0x4108,
    434 .n_reg = 0x410c,
    435 - .config_reg = 0x4114,
    436 + .config_reg = 0x4110,
    437 .mode_reg = 0x4100,
    438 .status_reg = 0x411c,
    439 .clkr.hw.init = &(struct clk_init_data){
    440 @@ -233,9 +235,10 @@ static struct clk_pll mmpll3 = {
    441 .l_reg = 0x0084,
    442 .m_reg = 0x0088,
    443 .n_reg = 0x008c,
    444 - .config_reg = 0x0094,
    445 + .config_reg = 0x0090,
    446 .mode_reg = 0x0080,
    447 .status_reg = 0x009c,
    448 + .status_bit = 17,
    449 .clkr.hw.init = &(struct clk_init_data){
    450 .name = "mmpll3",
    451 .parent_names = (const char *[]){ "xo" },
    452 @@ -2318,7 +2321,7 @@ static const struct pll_config mmpll1_config = {
    453 .vco_val = 0x0,
    454 .vco_mask = 0x3 << 20,
    455 .pre_div_val = 0x0,
    456 - .pre_div_mask = 0x3 << 12,
    457 + .pre_div_mask = 0x7 << 12,
    458 .post_div_val = 0x0,
    459 .post_div_mask = 0x3 << 8,
    460 .mn_ena_mask = BIT(24),
    461 @@ -2332,7 +2335,7 @@ static struct pll_config mmpll3_config = {
    462 .vco_val = 0x0,
    463 .vco_mask = 0x3 << 20,
    464 .pre_div_val = 0x0,
    465 - .pre_div_mask = 0x3 << 12,
    466 + .pre_div_mask = 0x7 << 12,
    467 .post_div_val = 0x0,
    468 .post_div_mask = 0x3 << 8,
    469 .mn_ena_mask = BIT(24),
    470 diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
    471 index db2e45b4808e..fcd0c9208e98 100644
    472 --- a/drivers/cpufreq/intel_pstate.c
    473 +++ b/drivers/cpufreq/intel_pstate.c
    474 @@ -200,10 +200,7 @@ static signed int pid_calc(struct _pid *pid, int32_t busy)
    475 pid->last_err = fp_error;
    476
    477 result = pterm + mul_fp(pid->integral, pid->i_gain) + dterm;
    478 - if (result >= 0)
    479 - result = result + (1 << (FRAC_BITS-1));
    480 - else
    481 - result = result - (1 << (FRAC_BITS-1));
    482 + result = result + (1 << (FRAC_BITS-1));
    483 return (signed int)fp_toint(result);
    484 }
    485
    486 diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
    487 index 03711d00aaae..8218078b6133 100644
    488 --- a/drivers/gpu/drm/drm_drv.c
    489 +++ b/drivers/gpu/drm/drm_drv.c
    490 @@ -419,8 +419,9 @@ long drm_ioctl(struct file *filp,
    491 retcode = -EFAULT;
    492 goto err_i1;
    493 }
    494 - } else
    495 + } else if (cmd & IOC_OUT) {
    496 memset(kdata, 0, usize);
    497 + }
    498
    499 if (ioctl->flags & DRM_UNLOCKED)
    500 retcode = func(dev, kdata, file_priv);
    501 diff --git a/drivers/gpu/drm/i2c/tda998x_drv.c b/drivers/gpu/drm/i2c/tda998x_drv.c
    502 index 48af5cac1902..b98c969aeffa 100644
    503 --- a/drivers/gpu/drm/i2c/tda998x_drv.c
    504 +++ b/drivers/gpu/drm/i2c/tda998x_drv.c
    505 @@ -1183,7 +1183,6 @@ static void
    506 tda998x_encoder_destroy(struct drm_encoder *encoder)
    507 {
    508 struct tda998x_priv *priv = to_tda998x_priv(encoder);
    509 - drm_i2c_encoder_destroy(encoder);
    510
    511 /* disable all IRQs and free the IRQ handler */
    512 cec_write(priv, REG_CEC_RXSHPDINTENA, 0);
    513 @@ -1193,6 +1192,7 @@ tda998x_encoder_destroy(struct drm_encoder *encoder)
    514
    515 if (priv->cec)
    516 i2c_unregister_device(priv->cec);
    517 + drm_i2c_encoder_destroy(encoder);
    518 kfree(priv);
    519 }
    520
    521 diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
    522 index 195fe5bc0aac..332259c42a50 100644
    523 --- a/drivers/gpu/drm/i915/i915_debugfs.c
    524 +++ b/drivers/gpu/drm/i915/i915_debugfs.c
    525 @@ -446,7 +446,9 @@ static int i915_gem_object_info(struct seq_file *m, void* data)
    526
    527 memset(&stats, 0, sizeof(stats));
    528 stats.file_priv = file->driver_priv;
    529 + spin_lock(&file->table_lock);
    530 idr_for_each(&file->object_idr, per_file_stats, &stats);
    531 + spin_unlock(&file->table_lock);
    532 /*
    533 * Although we have a valid reference on file->pid, that does
    534 * not guarantee that the task_struct who called get_pid() is
    535 diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
    536 index 5deb22864c52..cc245429781f 100644
    537 --- a/drivers/gpu/drm/i915/i915_gem_gtt.c
    538 +++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
    539 @@ -1811,6 +1811,13 @@ static inline unsigned int gen8_get_total_gtt_size(u16 bdw_gmch_ctl)
    540 bdw_gmch_ctl &= BDW_GMCH_GGMS_MASK;
    541 if (bdw_gmch_ctl)
    542 bdw_gmch_ctl = 1 << bdw_gmch_ctl;
    543 +
    544 +#ifdef CONFIG_X86_32
    545 + /* Limit 32b platforms to a 2GB GGTT: 4 << 20 / pte size * PAGE_SIZE */
    546 + if (bdw_gmch_ctl > 4)
    547 + bdw_gmch_ctl = 4;
    548 +#endif
    549 +
    550 return bdw_gmch_ctl << 20;
    551 }
    552
    553 diff --git a/drivers/gpu/drm/i915/i915_gpu_error.c b/drivers/gpu/drm/i915/i915_gpu_error.c
    554 index 12f1d43b2d68..8c7a7d891ff9 100644
    555 --- a/drivers/gpu/drm/i915/i915_gpu_error.c
    556 +++ b/drivers/gpu/drm/i915/i915_gpu_error.c
    557 @@ -894,6 +894,8 @@ static void i915_gem_record_rings(struct drm_device *dev,
    558 for (i = 0; i < I915_NUM_RINGS; i++) {
    559 struct intel_ring_buffer *ring = &dev_priv->ring[i];
    560
    561 + error->ring[i].pid = -1;
    562 +
    563 if (ring->dev == NULL)
    564 continue;
    565
    566 @@ -901,7 +903,6 @@ static void i915_gem_record_rings(struct drm_device *dev,
    567
    568 i915_record_ring_state(dev, ring, &error->ring[i]);
    569
    570 - error->ring[i].pid = -1;
    571 request = i915_gem_find_active_request(ring);
    572 if (request) {
    573 /* We need to copy these to an anonymous buffer
    574 diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
    575 index f98ba4e6e70b..e9830cd52d22 100644
    576 --- a/drivers/gpu/drm/i915/i915_irq.c
    577 +++ b/drivers/gpu/drm/i915/i915_irq.c
    578 @@ -2561,10 +2561,14 @@ static int semaphore_passed(struct intel_ring_buffer *ring)
    579 struct intel_ring_buffer *signaller;
    580 u32 seqno, ctl;
    581
    582 - ring->hangcheck.deadlock = true;
    583 + ring->hangcheck.deadlock++;
    584
    585 signaller = semaphore_waits_for(ring, &seqno);
    586 - if (signaller == NULL || signaller->hangcheck.deadlock)
    587 + if (signaller == NULL)
    588 + return -1;
    589 +
    590 + /* Prevent pathological recursion due to driver bugs */
    591 + if (signaller->hangcheck.deadlock >= I915_NUM_RINGS)
    592 return -1;
    593
    594 /* cursory check for an unkickable deadlock */
    595 @@ -2572,7 +2576,13 @@ static int semaphore_passed(struct intel_ring_buffer *ring)
    596 if (ctl & RING_WAIT_SEMAPHORE && semaphore_passed(signaller) < 0)
    597 return -1;
    598
    599 - return i915_seqno_passed(signaller->get_seqno(signaller, false), seqno);
    600 + if (i915_seqno_passed(signaller->get_seqno(signaller, false), seqno))
    601 + return 1;
    602 +
    603 + if (signaller->hangcheck.deadlock)
    604 + return -1;
    605 +
    606 + return 0;
    607 }
    608
    609 static void semaphore_clear_deadlocks(struct drm_i915_private *dev_priv)
    610 @@ -2581,7 +2591,7 @@ static void semaphore_clear_deadlocks(struct drm_i915_private *dev_priv)
    611 int i;
    612
    613 for_each_ring(ring, dev_priv, i)
    614 - ring->hangcheck.deadlock = false;
    615 + ring->hangcheck.deadlock = 0;
    616 }
    617
    618 static enum intel_ring_hangcheck_action
    619 diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
    620 index aff4a113cda3..7eda7440d776 100644
    621 --- a/drivers/gpu/drm/i915/intel_bios.c
    622 +++ b/drivers/gpu/drm/i915/intel_bios.c
    623 @@ -287,9 +287,6 @@ parse_lfp_backlight(struct drm_i915_private *dev_priv, struct bdb_header *bdb)
    624 const struct bdb_lfp_backlight_data *backlight_data;
    625 const struct bdb_lfp_backlight_data_entry *entry;
    626
    627 - /* Err to enabling backlight if no backlight block. */
    628 - dev_priv->vbt.backlight.present = true;
    629 -
    630 backlight_data = find_section(bdb, BDB_LVDS_BACKLIGHT);
    631 if (!backlight_data)
    632 return;
    633 @@ -839,6 +836,9 @@ init_vbt_defaults(struct drm_i915_private *dev_priv)
    634
    635 dev_priv->vbt.crt_ddc_pin = GMBUS_PORT_VGADDC;
    636
    637 + /* Default to having backlight */
    638 + dev_priv->vbt.backlight.present = true;
    639 +
    640 /* LFP panel data */
    641 dev_priv->vbt.lvds_dither = 1;
    642 dev_priv->vbt.lvds_vbt = 0;
    643 diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
    644 index cb8cfb7e0974..8b2538356371 100644
    645 --- a/drivers/gpu/drm/i915/intel_panel.c
    646 +++ b/drivers/gpu/drm/i915/intel_panel.c
    647 @@ -723,9 +723,6 @@ static void i965_enable_backlight(struct intel_connector *connector)
    648 ctl = freq << 16;
    649 I915_WRITE(BLC_PWM_CTL, ctl);
    650
    651 - /* XXX: combine this into above write? */
    652 - intel_panel_actually_set_backlight(connector, panel->backlight.level);
    653 -
    654 ctl2 = BLM_PIPE(pipe);
    655 if (panel->backlight.combination_mode)
    656 ctl2 |= BLM_COMBINATION_MODE;
    657 @@ -734,6 +731,8 @@ static void i965_enable_backlight(struct intel_connector *connector)
    658 I915_WRITE(BLC_PWM_CTL2, ctl2);
    659 POSTING_READ(BLC_PWM_CTL2);
    660 I915_WRITE(BLC_PWM_CTL2, ctl2 | BLM_PWM_ENABLE);
    661 +
    662 + intel_panel_actually_set_backlight(connector, panel->backlight.level);
    663 }
    664
    665 static void vlv_enable_backlight(struct intel_connector *connector)
    666 diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
    667 index d93dcf683e8c..2b68c35eec15 100644
    668 --- a/drivers/gpu/drm/i915/intel_pm.c
    669 +++ b/drivers/gpu/drm/i915/intel_pm.c
    670 @@ -511,8 +511,7 @@ void intel_update_fbc(struct drm_device *dev)
    671 obj = intel_fb->obj;
    672 adjusted_mode = &intel_crtc->config.adjusted_mode;
    673
    674 - if (i915.enable_fbc < 0 &&
    675 - INTEL_INFO(dev)->gen <= 7 && !IS_HASWELL(dev)) {
    676 + if (i915.enable_fbc < 0) {
    677 if (set_no_fbc_reason(dev_priv, FBC_CHIP_DEFAULT))
    678 DRM_DEBUG_KMS("disabled per chip default\n");
    679 goto out_disable;
    680 @@ -5314,10 +5313,25 @@ bool intel_display_power_enabled_sw(struct drm_i915_private *dev_priv,
    681 enum intel_display_power_domain domain)
    682 {
    683 struct i915_power_domains *power_domains;
    684 + struct i915_power_well *power_well;
    685 + bool is_enabled;
    686 + int i;
    687 +
    688 + if (dev_priv->pm.suspended)
    689 + return false;
    690
    691 power_domains = &dev_priv->power_domains;
    692 + is_enabled = true;
    693 + for_each_power_well_rev(i, power_well, BIT(domain), power_domains) {
    694 + if (power_well->always_on)
    695 + continue;
    696
    697 - return power_domains->domain_use_count[domain];
    698 + if (!power_well->count) {
    699 + is_enabled = false;
    700 + break;
    701 + }
    702 + }
    703 + return is_enabled;
    704 }
    705
    706 bool intel_display_power_enabled(struct drm_i915_private *dev_priv,
    707 @@ -5706,33 +5720,56 @@ void intel_display_power_put(struct drm_i915_private *dev_priv,
    708 static struct i915_power_domains *hsw_pwr;
    709
    710 /* Display audio driver power well request */
    711 -void i915_request_power_well(void)
    712 +int i915_request_power_well(void)
    713 {
    714 struct drm_i915_private *dev_priv;
    715
    716 - if (WARN_ON(!hsw_pwr))
    717 - return;
    718 + if (!hsw_pwr)
    719 + return -ENODEV;
    720
    721 dev_priv = container_of(hsw_pwr, struct drm_i915_private,
    722 power_domains);
    723 intel_display_power_get(dev_priv, POWER_DOMAIN_AUDIO);
    724 + return 0;
    725 }
    726 EXPORT_SYMBOL_GPL(i915_request_power_well);
    727
    728 /* Display audio driver power well release */
    729 -void i915_release_power_well(void)
    730 +int i915_release_power_well(void)
    731 {
    732 struct drm_i915_private *dev_priv;
    733
    734 - if (WARN_ON(!hsw_pwr))
    735 - return;
    736 + if (!hsw_pwr)
    737 + return -ENODEV;
    738
    739 dev_priv = container_of(hsw_pwr, struct drm_i915_private,
    740 power_domains);
    741 intel_display_power_put(dev_priv, POWER_DOMAIN_AUDIO);
    742 + return 0;
    743 }
    744 EXPORT_SYMBOL_GPL(i915_release_power_well);
    745
    746 +/*
    747 + * Private interface for the audio driver to get CDCLK in kHz.
    748 + *
    749 + * Caller must request power well using i915_request_power_well() prior to
    750 + * making the call.
    751 + */
    752 +int i915_get_cdclk_freq(void)
    753 +{
    754 + struct drm_i915_private *dev_priv;
    755 +
    756 + if (!hsw_pwr)
    757 + return -ENODEV;
    758 +
    759 + dev_priv = container_of(hsw_pwr, struct drm_i915_private,
    760 + power_domains);
    761 +
    762 + return intel_ddi_get_cdclk_freq(dev_priv);
    763 +}
    764 +EXPORT_SYMBOL_GPL(i915_get_cdclk_freq);
    765 +
    766 +
    767 #define POWER_DOMAIN_MASK (BIT(POWER_DOMAIN_NUM) - 1)
    768
    769 #define HSW_ALWAYS_ON_POWER_DOMAINS ( \
    770 diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.h b/drivers/gpu/drm/i915/intel_ringbuffer.h
    771 index 2b91c4b4d34b..4a978b97b47d 100644
    772 --- a/drivers/gpu/drm/i915/intel_ringbuffer.h
    773 +++ b/drivers/gpu/drm/i915/intel_ringbuffer.h
    774 @@ -51,7 +51,7 @@ struct intel_ring_hangcheck {
    775 u32 seqno;
    776 int score;
    777 enum intel_ring_hangcheck_action action;
    778 - bool deadlock;
    779 + int deadlock;
    780 };
    781
    782 struct intel_ring_buffer {
    783 diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
    784 index 46be00d66df3..6317953d5773 100644
    785 --- a/drivers/gpu/drm/i915/intel_sdvo.c
    786 +++ b/drivers/gpu/drm/i915/intel_sdvo.c
    787 @@ -1383,7 +1383,9 @@ static void intel_sdvo_get_config(struct intel_encoder *encoder,
    788 >> SDVO_PORT_MULTIPLY_SHIFT) + 1;
    789 }
    790
    791 - dotclock = pipe_config->port_clock / pipe_config->pixel_multiplier;
    792 + dotclock = pipe_config->port_clock;
    793 + if (pipe_config->pixel_multiplier)
    794 + dotclock /= pipe_config->pixel_multiplier;
    795
    796 if (HAS_PCH_SPLIT(dev))
    797 ironlake_check_encoder_dotclock(pipe_config, dotclock);
    798 diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/nv04.c b/drivers/gpu/drm/nouveau/core/engine/disp/nv04.c
    799 index 6c89af792889..94a2cc69ec2c 100644
    800 --- a/drivers/gpu/drm/nouveau/core/engine/disp/nv04.c
    801 +++ b/drivers/gpu/drm/nouveau/core/engine/disp/nv04.c
    802 @@ -51,6 +51,14 @@ nv04_disp_scanoutpos(struct nouveau_object *object, u32 mthd,
    803 args->htotal = nv_rd32(priv, 0x680824 + (head * 0x2000)) & 0xffff;
    804 args->hblanke = args->htotal - 1;
    805
    806 + /*
    807 + * If output is vga instead of digital then vtotal/htotal is invalid
    808 + * so we have to give up and trigger the timestamping fallback in the
    809 + * drm core.
    810 + */
    811 + if (!args->vtotal || !args->htotal)
    812 + return -ENOTSUPP;
    813 +
    814 args->time[0] = ktime_to_ns(ktime_get());
    815 line = nv_rd32(priv, 0x600868 + (head * 0x2000));
    816 args->time[1] = ktime_to_ns(ktime_get());
    817 diff --git a/drivers/gpu/drm/nouveau/core/engine/graph/ctxnv108.c b/drivers/gpu/drm/nouveau/core/engine/graph/ctxnv108.c
    818 index 48351b4d6d6b..8de4a4291548 100644
    819 --- a/drivers/gpu/drm/nouveau/core/engine/graph/ctxnv108.c
    820 +++ b/drivers/gpu/drm/nouveau/core/engine/graph/ctxnv108.c
    821 @@ -545,10 +545,12 @@ nv108_grctx_generate_mods(struct nvc0_graph_priv *priv, struct nvc0_grctx *info)
    822 mmio_list(0x408010, 0x80000000, 0, 0);
    823 mmio_list(0x419004, 0x00000000, 8, 1);
    824 mmio_list(0x419008, 0x00000000, 0, 0);
    825 + mmio_list(0x4064cc, 0x80000000, 0, 0);
    826 mmio_list(0x408004, 0x00000000, 8, 0);
    827 mmio_list(0x408008, 0x80000030, 0, 0);
    828 mmio_list(0x418808, 0x00000000, 8, 0);
    829 mmio_list(0x41880c, 0x80000030, 0, 0);
    830 + mmio_list(0x4064c8, 0x00c20200, 0, 0);
    831 mmio_list(0x418810, 0x80000000, 12, 2);
    832 mmio_list(0x419848, 0x10000000, 12, 2);
    833
    834 diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c
    835 index e8822a934c48..90d8bf8ce0dc 100644
    836 --- a/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c
    837 +++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c
    838 @@ -26,6 +26,7 @@
    839
    840 const struct nouveau_mc_intr
    841 nv50_mc_intr[] = {
    842 + { 0x04000000, NVDEV_ENGINE_DISP }, /* DISP before FIFO, so pageflip-timestamping works! */
    843 { 0x00000001, NVDEV_ENGINE_MPEG },
    844 { 0x00000100, NVDEV_ENGINE_FIFO },
    845 { 0x00001000, NVDEV_ENGINE_GR },
    846 @@ -34,7 +35,6 @@ nv50_mc_intr[] = {
    847 { 0x00020000, NVDEV_ENGINE_VP }, /* NV84- */
    848 { 0x00100000, NVDEV_SUBDEV_TIMER },
    849 { 0x00200000, NVDEV_SUBDEV_GPIO },
    850 - { 0x04000000, NVDEV_ENGINE_DISP },
    851 { 0x10000000, NVDEV_SUBDEV_BUS },
    852 { 0x80000000, NVDEV_ENGINE_SW },
    853 { 0x0002d101, NVDEV_SUBDEV_FB },
    854 diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv98.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nv98.c
    855 index f8a6f18e2d34..95b3d35388a8 100644
    856 --- a/drivers/gpu/drm/nouveau/core/subdev/mc/nv98.c
    857 +++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv98.c
    858 @@ -26,6 +26,7 @@
    859
    860 static const struct nouveau_mc_intr
    861 nv98_mc_intr[] = {
    862 + { 0x04000000, NVDEV_ENGINE_DISP }, /* DISP first, so pageflip timestamps work */
    863 { 0x00000001, NVDEV_ENGINE_PPP },
    864 { 0x00000100, NVDEV_ENGINE_FIFO },
    865 { 0x00001000, NVDEV_ENGINE_GR },
    866 @@ -37,7 +38,6 @@ nv98_mc_intr[] = {
    867 { 0x00100000, NVDEV_SUBDEV_TIMER },
    868 { 0x00200000, NVDEV_SUBDEV_GPIO },
    869 { 0x00400000, NVDEV_ENGINE_COPY0 }, /* NVA3- */
    870 - { 0x04000000, NVDEV_ENGINE_DISP },
    871 { 0x10000000, NVDEV_SUBDEV_BUS },
    872 { 0x80000000, NVDEV_ENGINE_SW },
    873 { 0x0042d101, NVDEV_SUBDEV_FB },
    874 diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nvc0.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nvc0.c
    875 index 34472d317097..ac7f99a15fa7 100644
    876 --- a/drivers/gpu/drm/nouveau/core/subdev/mc/nvc0.c
    877 +++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nvc0.c
    878 @@ -26,6 +26,7 @@
    879
    880 const struct nouveau_mc_intr
    881 nvc0_mc_intr[] = {
    882 + { 0x04000000, NVDEV_ENGINE_DISP }, /* DISP first, so pageflip timestamps work. */
    883 { 0x00000001, NVDEV_ENGINE_PPP },
    884 { 0x00000020, NVDEV_ENGINE_COPY0 },
    885 { 0x00000040, NVDEV_ENGINE_COPY1 },
    886 @@ -40,7 +41,6 @@ nvc0_mc_intr[] = {
    887 { 0x00200000, NVDEV_SUBDEV_GPIO },
    888 { 0x01000000, NVDEV_SUBDEV_PWR },
    889 { 0x02000000, NVDEV_SUBDEV_LTCG },
    890 - { 0x04000000, NVDEV_ENGINE_DISP },
    891 { 0x08000000, NVDEV_SUBDEV_FB },
    892 { 0x10000000, NVDEV_SUBDEV_BUS },
    893 { 0x40000000, NVDEV_SUBDEV_IBUS },
    894 diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
    895 index da764a4ed958..64938b77b38c 100644
    896 --- a/drivers/gpu/drm/nouveau/nouveau_display.c
    897 +++ b/drivers/gpu/drm/nouveau/nouveau_display.c
    898 @@ -736,6 +736,9 @@ nouveau_crtc_page_flip(struct drm_crtc *crtc, struct drm_framebuffer *fb,
    899 fb->bits_per_pixel, fb->pitches[0], crtc->x, crtc->y,
    900 new_bo->bo.offset };
    901
    902 + /* Keep vblanks on during flip, for the target crtc of this flip */
    903 + drm_vblank_get(dev, nouveau_crtc(crtc)->index);
    904 +
    905 /* Emit a page flip */
    906 if (nv_device(drm->device)->card_type >= NV_50) {
    907 ret = nv50_display_flip_next(crtc, fb, chan, swap_interval);
    908 @@ -779,6 +782,7 @@ nouveau_crtc_page_flip(struct drm_crtc *crtc, struct drm_framebuffer *fb,
    909 return 0;
    910
    911 fail_unreserve:
    912 + drm_vblank_put(dev, nouveau_crtc(crtc)->index);
    913 ttm_bo_unreserve(&old_bo->bo);
    914 fail_unpin:
    915 mutex_unlock(&chan->cli->mutex);
    916 @@ -798,6 +802,7 @@ nouveau_finish_page_flip(struct nouveau_channel *chan,
    917 struct drm_device *dev = drm->dev;
    918 struct nouveau_page_flip_state *s;
    919 unsigned long flags;
    920 + int crtcid = -1;
    921
    922 spin_lock_irqsave(&dev->event_lock, flags);
    923
    924 @@ -808,8 +813,16 @@ nouveau_finish_page_flip(struct nouveau_channel *chan,
    925 }
    926
    927 s = list_first_entry(&fctx->flip, struct nouveau_page_flip_state, head);
    928 - if (s->event)
    929 - drm_send_vblank_event(dev, s->crtc, s->event);
    930 + if (s->event) {
    931 + /* Vblank timestamps/counts are only correct on >= NV-50 */
    932 + if (nv_device(drm->device)->card_type >= NV_50)
    933 + crtcid = s->crtc;
    934 +
    935 + drm_send_vblank_event(dev, crtcid, s->event);
    936 + }
    937 +
    938 + /* Give up ownership of vblank for page-flipped crtc */
    939 + drm_vblank_put(dev, s->crtc);
    940
    941 list_del(&s->head);
    942 if (ps)
    943 diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
    944 index e911898348f8..c5f35b0d2983 100644
    945 --- a/drivers/gpu/drm/radeon/atombios_crtc.c
    946 +++ b/drivers/gpu/drm/radeon/atombios_crtc.c
    947 @@ -862,14 +862,16 @@ static void atombios_crtc_program_pll(struct drm_crtc *crtc,
    948 args.v5.ucMiscInfo = 0; /* HDMI depth, etc. */
    949 if (ss_enabled && (ss->type & ATOM_EXTERNAL_SS_MASK))
    950 args.v5.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_REF_DIV_SRC;
    951 - switch (bpc) {
    952 - case 8:
    953 - default:
    954 - args.v5.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_HDMI_24BPP;
    955 - break;
    956 - case 10:
    957 - args.v5.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_HDMI_30BPP;
    958 - break;
    959 + if (encoder_mode == ATOM_ENCODER_MODE_HDMI) {
    960 + switch (bpc) {
    961 + case 8:
    962 + default:
    963 + args.v5.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_HDMI_24BPP;
    964 + break;
    965 + case 10:
    966 + args.v5.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_HDMI_30BPP;
    967 + break;
    968 + }
    969 }
    970 args.v5.ucTransmitterID = encoder_id;
    971 args.v5.ucEncoderMode = encoder_mode;
    972 @@ -884,20 +886,22 @@ static void atombios_crtc_program_pll(struct drm_crtc *crtc,
    973 args.v6.ucMiscInfo = 0; /* HDMI depth, etc. */
    974 if (ss_enabled && (ss->type & ATOM_EXTERNAL_SS_MASK))
    975 args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_REF_DIV_SRC;
    976 - switch (bpc) {
    977 - case 8:
    978 - default:
    979 - args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_24BPP;
    980 - break;
    981 - case 10:
    982 - args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_30BPP;
    983 - break;
    984 - case 12:
    985 - args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_36BPP;
    986 - break;
    987 - case 16:
    988 - args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_48BPP;
    989 - break;
    990 + if (encoder_mode == ATOM_ENCODER_MODE_HDMI) {
    991 + switch (bpc) {
    992 + case 8:
    993 + default:
    994 + args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_24BPP;
    995 + break;
    996 + case 10:
    997 + args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_30BPP;
    998 + break;
    999 + case 12:
    1000 + args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_36BPP;
    1001 + break;
    1002 + case 16:
    1003 + args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_48BPP;
    1004 + break;
    1005 + }
    1006 }
    1007 args.v6.ucTransmitterID = encoder_id;
    1008 args.v6.ucEncoderMode = encoder_mode;
    1009 diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
    1010 index 54e4f52549af..87afe966a307 100644
    1011 --- a/drivers/gpu/drm/radeon/atombios_dp.c
    1012 +++ b/drivers/gpu/drm/radeon/atombios_dp.c
    1013 @@ -281,6 +281,19 @@ static int dp_get_max_dp_pix_clock(int link_rate,
    1014
    1015 /***** radeon specific DP functions *****/
    1016
    1017 +static int radeon_dp_get_max_link_rate(struct drm_connector *connector,
    1018 + u8 dpcd[DP_DPCD_SIZE])
    1019 +{
    1020 + int max_link_rate;
    1021 +
    1022 + if (radeon_connector_is_dp12_capable(connector))
    1023 + max_link_rate = min(drm_dp_max_link_rate(dpcd), 540000);
    1024 + else
    1025 + max_link_rate = min(drm_dp_max_link_rate(dpcd), 270000);
    1026 +
    1027 + return max_link_rate;
    1028 +}
    1029 +
    1030 /* First get the min lane# when low rate is used according to pixel clock
    1031 * (prefer low rate), second check max lane# supported by DP panel,
    1032 * if the max lane# < low rate lane# then use max lane# instead.
    1033 @@ -290,7 +303,7 @@ static int radeon_dp_get_dp_lane_number(struct drm_connector *connector,
    1034 int pix_clock)
    1035 {
    1036 int bpp = convert_bpc_to_bpp(radeon_get_monitor_bpc(connector));
    1037 - int max_link_rate = drm_dp_max_link_rate(dpcd);
    1038 + int max_link_rate = radeon_dp_get_max_link_rate(connector, dpcd);
    1039 int max_lane_num = drm_dp_max_lane_count(dpcd);
    1040 int lane_num;
    1041 int max_dp_pix_clock;
    1042 @@ -328,7 +341,7 @@ static int radeon_dp_get_dp_link_clock(struct drm_connector *connector,
    1043 return 540000;
    1044 }
    1045
    1046 - return drm_dp_max_link_rate(dpcd);
    1047 + return radeon_dp_get_max_link_rate(connector, dpcd);
    1048 }
    1049
    1050 static u8 radeon_dp_encoder_service(struct radeon_device *rdev,
    1051 diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
    1052 index e6eb5097597f..2b2908440644 100644
    1053 --- a/drivers/gpu/drm/radeon/atombios_encoders.c
    1054 +++ b/drivers/gpu/drm/radeon/atombios_encoders.c
    1055 @@ -1884,8 +1884,11 @@ atombios_set_encoder_crtc_source(struct drm_encoder *encoder)
    1056 args.v2.ucEncodeMode = ATOM_ENCODER_MODE_CRT;
    1057 else
    1058 args.v2.ucEncodeMode = atombios_get_encoder_mode(encoder);
    1059 - } else
    1060 + } else if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT)) {
    1061 + args.v2.ucEncodeMode = ATOM_ENCODER_MODE_LVDS;
    1062 + } else {
    1063 args.v2.ucEncodeMode = atombios_get_encoder_mode(encoder);
    1064 + }
    1065 switch (radeon_encoder->encoder_id) {
    1066 case ENCODER_OBJECT_ID_INTERNAL_UNIPHY:
    1067 case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1:
    1068 diff --git a/drivers/gpu/drm/radeon/cikd.h b/drivers/gpu/drm/radeon/cikd.h
    1069 index dd7926394a8f..e6d2dbbe4f6e 100644
    1070 --- a/drivers/gpu/drm/radeon/cikd.h
    1071 +++ b/drivers/gpu/drm/radeon/cikd.h
    1072 @@ -1751,12 +1751,12 @@
    1073 #define EOP_TC_WB_ACTION_EN (1 << 15) /* L2 */
    1074 #define EOP_TCL1_ACTION_EN (1 << 16)
    1075 #define EOP_TC_ACTION_EN (1 << 17) /* L2 */
    1076 +#define EOP_TCL2_VOLATILE (1 << 24)
    1077 #define EOP_CACHE_POLICY(x) ((x) << 25)
    1078 /* 0 - LRU
    1079 * 1 - Stream
    1080 * 2 - Bypass
    1081 */
    1082 -#define EOP_TCL2_VOLATILE (1 << 27)
    1083 #define DATA_SEL(x) ((x) << 29)
    1084 /* 0 - discard
    1085 * 1 - send low 32bit data
    1086 diff --git a/drivers/gpu/drm/radeon/cypress_dpm.c b/drivers/gpu/drm/radeon/cypress_dpm.c
    1087 index 5a9a5f4d7888..47d31e915758 100644
    1088 --- a/drivers/gpu/drm/radeon/cypress_dpm.c
    1089 +++ b/drivers/gpu/drm/radeon/cypress_dpm.c
    1090 @@ -1551,7 +1551,7 @@ int cypress_populate_smc_voltage_tables(struct radeon_device *rdev,
    1091
    1092 table->voltageMaskTable.highMask[RV770_SMC_VOLTAGEMASK_VDDCI] = 0;
    1093 table->voltageMaskTable.lowMask[RV770_SMC_VOLTAGEMASK_VDDCI] =
    1094 - cpu_to_be32(eg_pi->vddc_voltage_table.mask_low);
    1095 + cpu_to_be32(eg_pi->vddci_voltage_table.mask_low);
    1096 }
    1097
    1098 return 0;
    1099 diff --git a/drivers/gpu/drm/radeon/ni_dpm.c b/drivers/gpu/drm/radeon/ni_dpm.c
    1100 index 004c931606c4..01fc4888e6fe 100644
    1101 --- a/drivers/gpu/drm/radeon/ni_dpm.c
    1102 +++ b/drivers/gpu/drm/radeon/ni_dpm.c
    1103 @@ -1315,7 +1315,7 @@ static void ni_populate_smc_voltage_tables(struct radeon_device *rdev,
    1104
    1105 table->voltageMaskTable.highMask[NISLANDS_SMC_VOLTAGEMASK_VDDCI] = 0;
    1106 table->voltageMaskTable.lowMask[NISLANDS_SMC_VOLTAGEMASK_VDDCI] =
    1107 - cpu_to_be32(eg_pi->vddc_voltage_table.mask_low);
    1108 + cpu_to_be32(eg_pi->vddci_voltage_table.mask_low);
    1109 }
    1110 }
    1111
    1112 diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
    1113 index ea50e0ae7bf7..bf73a04791ed 100644
    1114 --- a/drivers/gpu/drm/radeon/radeon_connectors.c
    1115 +++ b/drivers/gpu/drm/radeon/radeon_connectors.c
    1116 @@ -1387,7 +1387,7 @@ bool radeon_connector_is_dp12_capable(struct drm_connector *connector)
    1117 struct radeon_device *rdev = dev->dev_private;
    1118
    1119 if (ASIC_IS_DCE5(rdev) &&
    1120 - (rdev->clock.dp_extclk >= 53900) &&
    1121 + (rdev->clock.default_dispclk >= 53900) &&
    1122 radeon_connector_encoder_is_hbr2(connector)) {
    1123 return true;
    1124 }
    1125 diff --git a/drivers/gpu/drm/radeon/radeon_vce.c b/drivers/gpu/drm/radeon/radeon_vce.c
    1126 index 3971d968af6c..aa21c31a846c 100644
    1127 --- a/drivers/gpu/drm/radeon/radeon_vce.c
    1128 +++ b/drivers/gpu/drm/radeon/radeon_vce.c
    1129 @@ -66,6 +66,7 @@ int radeon_vce_init(struct radeon_device *rdev)
    1130 case CHIP_BONAIRE:
    1131 case CHIP_KAVERI:
    1132 case CHIP_KABINI:
    1133 + case CHIP_HAWAII:
    1134 case CHIP_MULLINS:
    1135 fw_name = FIRMWARE_BONAIRE;
    1136 break;
    1137 diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
    1138 index a89ad938eacf..b031b48dbb3c 100644
    1139 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
    1140 +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
    1141 @@ -179,7 +179,6 @@ static int vmw_fb_set_par(struct fb_info *info)
    1142 vmw_write(vmw_priv, SVGA_REG_DISPLAY_POSITION_Y, info->var.yoffset);
    1143 vmw_write(vmw_priv, SVGA_REG_DISPLAY_WIDTH, info->var.xres);
    1144 vmw_write(vmw_priv, SVGA_REG_DISPLAY_HEIGHT, info->var.yres);
    1145 - vmw_write(vmw_priv, SVGA_REG_BYTES_PER_LINE, info->fix.line_length);
    1146 vmw_write(vmw_priv, SVGA_REG_DISPLAY_ID, SVGA_ID_INVALID);
    1147 }
    1148
    1149 diff --git a/drivers/gpu/vga/vga_switcheroo.c b/drivers/gpu/vga/vga_switcheroo.c
    1150 index ec0ae2d1686a..6866448083b2 100644
    1151 --- a/drivers/gpu/vga/vga_switcheroo.c
    1152 +++ b/drivers/gpu/vga/vga_switcheroo.c
    1153 @@ -623,7 +623,8 @@ static int vga_switcheroo_runtime_suspend(struct device *dev)
    1154 ret = dev->bus->pm->runtime_suspend(dev);
    1155 if (ret)
    1156 return ret;
    1157 -
    1158 + if (vgasr_priv.handler->switchto)
    1159 + vgasr_priv.handler->switchto(VGA_SWITCHEROO_IGD);
    1160 vga_switcheroo_power_switch(pdev, VGA_SWITCHEROO_OFF);
    1161 return 0;
    1162 }
    1163 diff --git a/drivers/hwmon/ina2xx.c b/drivers/hwmon/ina2xx.c
    1164 index 93d26e8af3e2..bfd3f3eeabcd 100644
    1165 --- a/drivers/hwmon/ina2xx.c
    1166 +++ b/drivers/hwmon/ina2xx.c
    1167 @@ -148,7 +148,8 @@ static int ina2xx_get_value(struct ina2xx_data *data, u8 reg)
    1168
    1169 switch (reg) {
    1170 case INA2XX_SHUNT_VOLTAGE:
    1171 - val = DIV_ROUND_CLOSEST(data->regs[reg],
    1172 + /* signed register */
    1173 + val = DIV_ROUND_CLOSEST((s16)data->regs[reg],
    1174 data->config->shunt_div);
    1175 break;
    1176 case INA2XX_BUS_VOLTAGE:
    1177 @@ -160,8 +161,8 @@ static int ina2xx_get_value(struct ina2xx_data *data, u8 reg)
    1178 val = data->regs[reg] * data->config->power_lsb;
    1179 break;
    1180 case INA2XX_CURRENT:
    1181 - /* LSB=1mA (selected). Is in mA */
    1182 - val = data->regs[reg];
    1183 + /* signed register, LSB=1mA (selected), in mA */
    1184 + val = (s16)data->regs[reg];
    1185 break;
    1186 default:
    1187 /* programmer goofed */
    1188 diff --git a/drivers/iio/adc/twl4030-madc.c b/drivers/iio/adc/twl4030-madc.c
    1189 index 7de1c4c87942..eb86786e698e 100644
    1190 --- a/drivers/iio/adc/twl4030-madc.c
    1191 +++ b/drivers/iio/adc/twl4030-madc.c
    1192 @@ -645,6 +645,7 @@ int twl4030_get_madc_conversion(int channel_no)
    1193 req.channels = (1 << channel_no);
    1194 req.method = TWL4030_MADC_SW2;
    1195 req.active = 0;
    1196 + req.raw = 0;
    1197 req.func_cb = NULL;
    1198 ret = twl4030_madc_conversion(&req);
    1199 if (ret < 0)
    1200 diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c
    1201 index 0cf5f8e06cfc..1e8e94d4db7d 100644
    1202 --- a/drivers/iio/inkern.c
    1203 +++ b/drivers/iio/inkern.c
    1204 @@ -183,7 +183,7 @@ static struct iio_channel *of_iio_channel_get_by_name(struct device_node *np,
    1205 else if (name && index >= 0) {
    1206 pr_err("ERROR: could not get IIO channel %s:%s(%i)\n",
    1207 np->full_name, name ? name : "", index);
    1208 - return chan;
    1209 + return NULL;
    1210 }
    1211
    1212 /*
    1213 @@ -193,8 +193,9 @@ static struct iio_channel *of_iio_channel_get_by_name(struct device_node *np,
    1214 */
    1215 np = np->parent;
    1216 if (np && !of_get_property(np, "io-channel-ranges", NULL))
    1217 - break;
    1218 + return NULL;
    1219 }
    1220 +
    1221 return chan;
    1222 }
    1223
    1224 @@ -317,6 +318,7 @@ struct iio_channel *iio_channel_get(struct device *dev,
    1225 if (channel != NULL)
    1226 return channel;
    1227 }
    1228 +
    1229 return iio_channel_get_sys(name, channel_name);
    1230 }
    1231 EXPORT_SYMBOL_GPL(iio_channel_get);
    1232 diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
    1233 index f256ffc02e29..7119079719e4 100644
    1234 --- a/drivers/iommu/intel-iommu.c
    1235 +++ b/drivers/iommu/intel-iommu.c
    1236 @@ -3799,14 +3799,11 @@ int dmar_iommu_notify_scope_dev(struct dmar_pci_notify_info *info)
    1237 ((void *)rmrr) + rmrr->header.length,
    1238 rmrr->segment, rmrru->devices,
    1239 rmrru->devices_cnt);
    1240 - if (ret > 0)
    1241 - break;
    1242 - else if(ret < 0)
    1243 + if(ret < 0)
    1244 return ret;
    1245 } else if (info->event == BUS_NOTIFY_DEL_DEVICE) {
    1246 - if (dmar_remove_dev_scope(info, rmrr->segment,
    1247 - rmrru->devices, rmrru->devices_cnt))
    1248 - break;
    1249 + dmar_remove_dev_scope(info, rmrr->segment,
    1250 + rmrru->devices, rmrru->devices_cnt);
    1251 }
    1252 }
    1253
    1254 diff --git a/drivers/irqchip/spear-shirq.c b/drivers/irqchip/spear-shirq.c
    1255 index 3fdda3a40269..6ce6bd3441bf 100644
    1256 --- a/drivers/irqchip/spear-shirq.c
    1257 +++ b/drivers/irqchip/spear-shirq.c
    1258 @@ -125,7 +125,7 @@ static struct spear_shirq spear320_shirq_ras2 = {
    1259 };
    1260
    1261 static struct spear_shirq spear320_shirq_ras3 = {
    1262 - .irq_nr = 3,
    1263 + .irq_nr = 7,
    1264 .irq_bit_off = 0,
    1265 .invalid_irq = 1,
    1266 .regs = {
    1267 diff --git a/drivers/md/dm-era-target.c b/drivers/md/dm-era-target.c
    1268 index 414dad4cb49b..ad913cd4aded 100644
    1269 --- a/drivers/md/dm-era-target.c
    1270 +++ b/drivers/md/dm-era-target.c
    1271 @@ -1391,7 +1391,8 @@ static int era_is_congested(struct dm_target_callbacks *cb, int bdi_bits)
    1272
    1273 static void era_destroy(struct era *era)
    1274 {
    1275 - metadata_close(era->md);
    1276 + if (era->md)
    1277 + metadata_close(era->md);
    1278
    1279 if (era->wq)
    1280 destroy_workqueue(era->wq);
    1281 diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
    1282 index 242ac2ea5f29..6b4793d71fb6 100644
    1283 --- a/drivers/md/dm-thin.c
    1284 +++ b/drivers/md/dm-thin.c
    1285 @@ -3068,7 +3068,8 @@ static void set_discard_limits(struct pool_c *pt, struct queue_limits *limits)
    1286 */
    1287 if (pt->adjusted_pf.discard_passdown) {
    1288 data_limits = &bdev_get_queue(pt->data_dev->bdev)->limits;
    1289 - limits->discard_granularity = data_limits->discard_granularity;
    1290 + limits->discard_granularity = max(data_limits->discard_granularity,
    1291 + pool->sectors_per_block << SECTOR_SHIFT);
    1292 } else
    1293 limits->discard_granularity = pool->sectors_per_block << SECTOR_SHIFT;
    1294 }
    1295 diff --git a/drivers/md/md.c b/drivers/md/md.c
    1296 index 2382cfc9bb3f..9a182092f4a8 100644
    1297 --- a/drivers/md/md.c
    1298 +++ b/drivers/md/md.c
    1299 @@ -7491,6 +7491,19 @@ void md_do_sync(struct md_thread *thread)
    1300 rdev->recovery_offset < j)
    1301 j = rdev->recovery_offset;
    1302 rcu_read_unlock();
    1303 +
    1304 + /* If there is a bitmap, we need to make sure all
    1305 + * writes that started before we added a spare
    1306 + * complete before we start doing a recovery.
    1307 + * Otherwise the write might complete and (via
    1308 + * bitmap_endwrite) set a bit in the bitmap after the
    1309 + * recovery has checked that bit and skipped that
    1310 + * region.
    1311 + */
    1312 + if (mddev->bitmap) {
    1313 + mddev->pers->quiesce(mddev, 1);
    1314 + mddev->pers->quiesce(mddev, 0);
    1315 + }
    1316 }
    1317
    1318 printk(KERN_INFO "md: %s of RAID array %s\n", desc, mdname(mddev));
    1319 diff --git a/drivers/mmc/host/rtsx_pci_sdmmc.c b/drivers/mmc/host/rtsx_pci_sdmmc.c
    1320 index 0b9ded13a3ae..1c68e0d2c82d 100644
    1321 --- a/drivers/mmc/host/rtsx_pci_sdmmc.c
    1322 +++ b/drivers/mmc/host/rtsx_pci_sdmmc.c
    1323 @@ -236,6 +236,9 @@ static void sd_send_cmd_get_rsp(struct realtek_pci_sdmmc *host,
    1324 case MMC_RSP_R1:
    1325 rsp_type = SD_RSP_TYPE_R1;
    1326 break;
    1327 + case MMC_RSP_R1 & ~MMC_RSP_CRC:
    1328 + rsp_type = SD_RSP_TYPE_R1 | SD_NO_CHECK_CRC7;
    1329 + break;
    1330 case MMC_RSP_R1B:
    1331 rsp_type = SD_RSP_TYPE_R1b;
    1332 break;
    1333 diff --git a/drivers/mtd/nand/fsl_elbc_nand.c b/drivers/mtd/nand/fsl_elbc_nand.c
    1334 index ec549cd9849f..545a5c002f09 100644
    1335 --- a/drivers/mtd/nand/fsl_elbc_nand.c
    1336 +++ b/drivers/mtd/nand/fsl_elbc_nand.c
    1337 @@ -723,6 +723,19 @@ static int fsl_elbc_write_page(struct mtd_info *mtd, struct nand_chip *chip,
    1338 return 0;
    1339 }
    1340
    1341 +/* ECC will be calculated automatically, and errors will be detected in
    1342 + * waitfunc.
    1343 + */
    1344 +static int fsl_elbc_write_subpage(struct mtd_info *mtd, struct nand_chip *chip,
    1345 + uint32_t offset, uint32_t data_len,
    1346 + const uint8_t *buf, int oob_required)
    1347 +{
    1348 + fsl_elbc_write_buf(mtd, buf, mtd->writesize);
    1349 + fsl_elbc_write_buf(mtd, chip->oob_poi, mtd->oobsize);
    1350 +
    1351 + return 0;
    1352 +}
    1353 +
    1354 static int fsl_elbc_chip_init(struct fsl_elbc_mtd *priv)
    1355 {
    1356 struct fsl_lbc_ctrl *ctrl = priv->ctrl;
    1357 @@ -761,6 +774,7 @@ static int fsl_elbc_chip_init(struct fsl_elbc_mtd *priv)
    1358
    1359 chip->ecc.read_page = fsl_elbc_read_page;
    1360 chip->ecc.write_page = fsl_elbc_write_page;
    1361 + chip->ecc.write_subpage = fsl_elbc_write_subpage;
    1362
    1363 /* If CS Base Register selects full hardware ECC then use it */
    1364 if ((in_be32(&lbc->bank[priv->bank].br) & BR_DECC) ==
    1365 diff --git a/drivers/mtd/nand/omap2.c b/drivers/mtd/nand/omap2.c
    1366 index 1ff49b80bdaf..0a685089c3fd 100644
    1367 --- a/drivers/mtd/nand/omap2.c
    1368 +++ b/drivers/mtd/nand/omap2.c
    1369 @@ -1382,7 +1382,7 @@ static int omap_elm_correct_data(struct mtd_info *mtd, u_char *data,
    1370
    1371 /* Check if any error reported */
    1372 if (!is_error_reported)
    1373 - return 0;
    1374 + return stat;
    1375
    1376 /* Decode BCH error using ELM module */
    1377 elm_decode_bch_error_page(info->elm_dev, ecc_vec, err_vec);
    1378 diff --git a/drivers/mtd/nand/pxa3xx_nand.c b/drivers/mtd/nand/pxa3xx_nand.c
    1379 index 7588fe2c127f..3003611b6865 100644
    1380 --- a/drivers/mtd/nand/pxa3xx_nand.c
    1381 +++ b/drivers/mtd/nand/pxa3xx_nand.c
    1382 @@ -127,10 +127,10 @@
    1383
    1384 /* macros for registers read/write */
    1385 #define nand_writel(info, off, val) \
    1386 - __raw_writel((val), (info)->mmio_base + (off))
    1387 + writel_relaxed((val), (info)->mmio_base + (off))
    1388
    1389 #define nand_readl(info, off) \
    1390 - __raw_readl((info)->mmio_base + (off))
    1391 + readl_relaxed((info)->mmio_base + (off))
    1392
    1393 /* error code and state */
    1394 enum {
    1395 diff --git a/drivers/net/ethernet/allwinner/sun4i-emac.c b/drivers/net/ethernet/allwinner/sun4i-emac.c
    1396 index 28460676b8ca..d81e7167a8b5 100644
    1397 --- a/drivers/net/ethernet/allwinner/sun4i-emac.c
    1398 +++ b/drivers/net/ethernet/allwinner/sun4i-emac.c
    1399 @@ -736,6 +736,7 @@ static int emac_open(struct net_device *dev)
    1400
    1401 ret = emac_mdio_probe(dev);
    1402 if (ret < 0) {
    1403 + free_irq(dev->irq, dev);
    1404 netdev_err(dev, "cannot probe MDIO bus\n");
    1405 return ret;
    1406 }
    1407 diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.c b/drivers/net/ethernet/mellanox/mlx4/fw.c
    1408 index d16a4d118903..ef242e19766f 100644
    1409 --- a/drivers/net/ethernet/mellanox/mlx4/fw.c
    1410 +++ b/drivers/net/ethernet/mellanox/mlx4/fw.c
    1411 @@ -414,7 +414,7 @@ int mlx4_QUERY_FUNC_CAP(struct mlx4_dev *dev, u32 gen_or_port,
    1412
    1413 MLX4_GET(func_cap->flags1, outbox, QUERY_FUNC_CAP_FLAGS1_OFFSET);
    1414 if (dev->caps.port_type[gen_or_port] == MLX4_PORT_TYPE_ETH) {
    1415 - if (func_cap->flags1 & QUERY_FUNC_CAP_FLAGS1_OFFSET) {
    1416 + if (func_cap->flags1 & QUERY_FUNC_CAP_FLAGS1_FORCE_VLAN) {
    1417 mlx4_err(dev, "VLAN is enforced on this port\n");
    1418 err = -EPROTONOSUPPORT;
    1419 goto out;
    1420 diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
    1421 index c187d748115f..8fa321f39dfd 100644
    1422 --- a/drivers/net/ethernet/mellanox/mlx4/main.c
    1423 +++ b/drivers/net/ethernet/mellanox/mlx4/main.c
    1424 @@ -2800,7 +2800,7 @@ static struct pci_driver mlx4_driver = {
    1425 .name = DRV_NAME,
    1426 .id_table = mlx4_pci_table,
    1427 .probe = mlx4_init_one,
    1428 - .shutdown = mlx4_remove_one,
    1429 + .shutdown = __mlx4_remove_one,
    1430 .remove = mlx4_remove_one,
    1431 .err_handler = &mlx4_err_handler,
    1432 };
    1433 diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c
    1434 index 31adb8cf0291..22d050fc5475 100644
    1435 --- a/drivers/net/wireless/b43/xmit.c
    1436 +++ b/drivers/net/wireless/b43/xmit.c
    1437 @@ -811,9 +811,13 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr)
    1438 break;
    1439 case B43_PHYTYPE_G:
    1440 status.band = IEEE80211_BAND_2GHZ;
    1441 - /* chanid is the radio channel cookie value as used
    1442 - * to tune the radio. */
    1443 - status.freq = chanid + 2400;
    1444 + /* Somewhere between 478.104 and 508.1084 firmware for G-PHY
    1445 + * has been modified to be compatible with N-PHY and others.
    1446 + */
    1447 + if (dev->fw.rev >= 508)
    1448 + status.freq = ieee80211_channel_to_frequency(chanid, status.band);
    1449 + else
    1450 + status.freq = chanid + 2400;
    1451 break;
    1452 case B43_PHYTYPE_N:
    1453 case B43_PHYTYPE_LP:
    1454 diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
    1455 index 2365553f1ef7..295b24cefe2d 100644
    1456 --- a/drivers/net/wireless/iwlwifi/pcie/trans.c
    1457 +++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
    1458 @@ -454,6 +454,7 @@ static int iwl_pcie_prepare_card_hw(struct iwl_trans *trans)
    1459 {
    1460 int ret;
    1461 int t = 0;
    1462 + int iter;
    1463
    1464 IWL_DEBUG_INFO(trans, "iwl_trans_prepare_card_hw enter\n");
    1465
    1466 @@ -462,18 +463,23 @@ static int iwl_pcie_prepare_card_hw(struct iwl_trans *trans)
    1467 if (ret >= 0)
    1468 return 0;
    1469
    1470 - /* If HW is not ready, prepare the conditions to check again */
    1471 - iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG,
    1472 - CSR_HW_IF_CONFIG_REG_PREPARE);
    1473 + for (iter = 0; iter < 10; iter++) {
    1474 + /* If HW is not ready, prepare the conditions to check again */
    1475 + iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG,
    1476 + CSR_HW_IF_CONFIG_REG_PREPARE);
    1477 +
    1478 + do {
    1479 + ret = iwl_pcie_set_hw_ready(trans);
    1480 + if (ret >= 0)
    1481 + return 0;
    1482
    1483 - do {
    1484 - ret = iwl_pcie_set_hw_ready(trans);
    1485 - if (ret >= 0)
    1486 - return 0;
    1487 + usleep_range(200, 1000);
    1488 + t += 200;
    1489 + } while (t < 150000);
    1490 + msleep(25);
    1491 + }
    1492
    1493 - usleep_range(200, 1000);
    1494 - t += 200;
    1495 - } while (t < 150000);
    1496 + IWL_DEBUG_INFO(trans, "got NIC after %d iterations\n", iter);
    1497
    1498 return ret;
    1499 }
    1500 diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
    1501 index 2f1cd929c6f6..a511cccc9f01 100644
    1502 --- a/drivers/net/wireless/rt2x00/rt2500pci.c
    1503 +++ b/drivers/net/wireless/rt2x00/rt2500pci.c
    1504 @@ -1681,8 +1681,13 @@ static int rt2500pci_init_eeprom(struct rt2x00_dev *rt2x00dev)
    1505 /*
    1506 * Detect if this device has an hardware controlled radio.
    1507 */
    1508 - if (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_HARDWARE_RADIO))
    1509 + if (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_HARDWARE_RADIO)) {
    1510 __set_bit(CAPABILITY_HW_BUTTON, &rt2x00dev->cap_flags);
    1511 + /*
    1512 + * On this device RFKILL initialized during probe does not work.
    1513 + */
    1514 + __set_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags);
    1515 + }
    1516
    1517 /*
    1518 * Check if the BBP tuning should be enabled.
    1519 diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
    1520 index e3b885d8f7db..5d45a1a740a4 100644
    1521 --- a/drivers/net/wireless/rt2x00/rt2x00.h
    1522 +++ b/drivers/net/wireless/rt2x00/rt2x00.h
    1523 @@ -693,6 +693,7 @@ enum rt2x00_capability_flags {
    1524 REQUIRE_SW_SEQNO,
    1525 REQUIRE_HT_TX_DESC,
    1526 REQUIRE_PS_AUTOWAKE,
    1527 + REQUIRE_DELAYED_RFKILL,
    1528
    1529 /*
    1530 * Capabilities
    1531 diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
    1532 index 2bde6729f5e6..4fa43a2eeb73 100644
    1533 --- a/drivers/net/wireless/rt2x00/rt2x00dev.c
    1534 +++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
    1535 @@ -1126,9 +1126,10 @@ static void rt2x00lib_uninitialize(struct rt2x00_dev *rt2x00dev)
    1536 return;
    1537
    1538 /*
    1539 - * Unregister extra components.
    1540 + * Stop rfkill polling.
    1541 */
    1542 - rt2x00rfkill_unregister(rt2x00dev);
    1543 + if (test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
    1544 + rt2x00rfkill_unregister(rt2x00dev);
    1545
    1546 /*
    1547 * Allow the HW to uninitialize.
    1548 @@ -1166,6 +1167,12 @@ static int rt2x00lib_initialize(struct rt2x00_dev *rt2x00dev)
    1549
    1550 set_bit(DEVICE_STATE_INITIALIZED, &rt2x00dev->flags);
    1551
    1552 + /*
    1553 + * Start rfkill polling.
    1554 + */
    1555 + if (test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
    1556 + rt2x00rfkill_register(rt2x00dev);
    1557 +
    1558 return 0;
    1559 }
    1560
    1561 @@ -1375,7 +1382,12 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
    1562 rt2x00link_register(rt2x00dev);
    1563 rt2x00leds_register(rt2x00dev);
    1564 rt2x00debug_register(rt2x00dev);
    1565 - rt2x00rfkill_register(rt2x00dev);
    1566 +
    1567 + /*
    1568 + * Start rfkill polling.
    1569 + */
    1570 + if (!test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
    1571 + rt2x00rfkill_register(rt2x00dev);
    1572
    1573 return 0;
    1574
    1575 @@ -1391,6 +1403,12 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
    1576 clear_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
    1577
    1578 /*
    1579 + * Stop rfkill polling.
    1580 + */
    1581 + if (!test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
    1582 + rt2x00rfkill_unregister(rt2x00dev);
    1583 +
    1584 + /*
    1585 * Disable radio.
    1586 */
    1587 rt2x00lib_disable_radio(rt2x00dev);
    1588 diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
    1589 index a87ee9b6585a..87a8ad5d2eb7 100644
    1590 --- a/drivers/net/wireless/rt2x00/rt2x00mac.c
    1591 +++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
    1592 @@ -487,6 +487,8 @@ int rt2x00mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
    1593 crypto.cipher = rt2x00crypto_key_to_cipher(key);
    1594 if (crypto.cipher == CIPHER_NONE)
    1595 return -EOPNOTSUPP;
    1596 + if (crypto.cipher == CIPHER_TKIP && rt2x00_is_usb(rt2x00dev))
    1597 + return -EOPNOTSUPP;
    1598
    1599 crypto.cmd = cmd;
    1600
    1601 diff --git a/drivers/regulator/tps65218-regulator.c b/drivers/regulator/tps65218-regulator.c
    1602 index cec72fa71d1d..676e3fb0a0f5 100644
    1603 --- a/drivers/regulator/tps65218-regulator.c
    1604 +++ b/drivers/regulator/tps65218-regulator.c
    1605 @@ -226,7 +226,7 @@ static const struct regulator_desc regulators[] = {
    1606 1, -1, -1, TPS65218_REG_ENABLE1,
    1607 TPS65218_ENABLE1_DC6_EN, NULL, NULL, 0),
    1608 TPS65218_REGULATOR("LDO1", TPS65218_LDO_1, tps65218_ldo1_dcdc34_ops, 64,
    1609 - TPS65218_REG_CONTROL_DCDC4,
    1610 + TPS65218_REG_CONTROL_LDO1,
    1611 TPS65218_CONTROL_LDO1_MASK, TPS65218_REG_ENABLE2,
    1612 TPS65218_ENABLE2_LDO1_EN, NULL, ldo1_dcdc3_ranges,
    1613 2),
    1614 @@ -257,6 +257,7 @@ static int tps65218_regulator_probe(struct platform_device *pdev)
    1615 config.init_data = init_data;
    1616 config.driver_data = tps;
    1617 config.regmap = tps->regmap;
    1618 + config.of_node = pdev->dev.of_node;
    1619
    1620 rdev = devm_regulator_register(&pdev->dev, &regulators[id], &config);
    1621 if (IS_ERR(rdev)) {
    1622 diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c
    1623 index fa764406df68..c5bb0e0a36b9 100644
    1624 --- a/drivers/scsi/ibmvscsi/ibmvscsi.c
    1625 +++ b/drivers/scsi/ibmvscsi/ibmvscsi.c
    1626 @@ -185,6 +185,11 @@ static struct viosrp_crq *crq_queue_next_crq(struct crq_queue *queue)
    1627 if (crq->valid & 0x80) {
    1628 if (++queue->cur == queue->size)
    1629 queue->cur = 0;
    1630 +
    1631 + /* Ensure the read of the valid bit occurs before reading any
    1632 + * other bits of the CRQ entry
    1633 + */
    1634 + rmb();
    1635 } else
    1636 crq = NULL;
    1637 spin_unlock_irqrestore(&queue->lock, flags);
    1638 @@ -203,6 +208,11 @@ static int ibmvscsi_send_crq(struct ibmvscsi_host_data *hostdata,
    1639 {
    1640 struct vio_dev *vdev = to_vio_dev(hostdata->dev);
    1641
    1642 + /*
    1643 + * Ensure the command buffer is flushed to memory before handing it
    1644 + * over to the VIOS to prevent it from fetching any stale data.
    1645 + */
    1646 + mb();
    1647 return plpar_hcall_norets(H_SEND_CRQ, vdev->unit_address, word1, word2);
    1648 }
    1649
    1650 @@ -797,7 +807,8 @@ static void purge_requests(struct ibmvscsi_host_data *hostdata, int error_code)
    1651 evt->hostdata->dev);
    1652 if (evt->cmnd_done)
    1653 evt->cmnd_done(evt->cmnd);
    1654 - } else if (evt->done)
    1655 + } else if (evt->done && evt->crq.format != VIOSRP_MAD_FORMAT &&
    1656 + evt->iu.srp.login_req.opcode != SRP_LOGIN_REQ)
    1657 evt->done(evt);
    1658 free_event_struct(&evt->hostdata->pool, evt);
    1659 spin_lock_irqsave(hostdata->host->host_lock, flags);
    1660 diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
    1661 index f17aa7aa7879..d941f25fa999 100644
    1662 --- a/drivers/scsi/scsi_error.c
    1663 +++ b/drivers/scsi/scsi_error.c
    1664 @@ -131,7 +131,7 @@ scmd_eh_abort_handler(struct work_struct *work)
    1665 "aborting command %p\n", scmd));
    1666 rtn = scsi_try_to_abort_cmd(sdev->host->hostt, scmd);
    1667 if (rtn == SUCCESS) {
    1668 - scmd->result |= DID_TIME_OUT << 16;
    1669 + set_host_byte(scmd, DID_TIME_OUT);
    1670 if (scsi_host_eh_past_deadline(sdev->host)) {
    1671 SCSI_LOG_ERROR_RECOVERY(3,
    1672 scmd_printk(KERN_INFO, scmd,
    1673 @@ -167,7 +167,7 @@ scmd_eh_abort_handler(struct work_struct *work)
    1674 scmd_printk(KERN_WARNING, scmd,
    1675 "scmd %p terminate "
    1676 "aborted command\n", scmd));
    1677 - scmd->result |= DID_TIME_OUT << 16;
    1678 + set_host_byte(scmd, DID_TIME_OUT);
    1679 scsi_finish_command(scmd);
    1680 }
    1681 }
    1682 @@ -291,7 +291,7 @@ enum blk_eh_timer_return scsi_times_out(struct request *req)
    1683 if (scsi_abort_command(scmd) == SUCCESS)
    1684 return BLK_EH_NOT_HANDLED;
    1685
    1686 - scmd->result |= DID_TIME_OUT << 16;
    1687 + set_host_byte(scmd, DID_TIME_OUT);
    1688
    1689 if (unlikely(rtn == BLK_EH_NOT_HANDLED &&
    1690 !scsi_eh_scmd_add(scmd, SCSI_EH_CANCEL_CMD)))
    1691 @@ -1776,7 +1776,7 @@ int scsi_decide_disposition(struct scsi_cmnd *scmd)
    1692 break;
    1693 case DID_ABORT:
    1694 if (scmd->eh_eflags & SCSI_EH_ABORT_SCHEDULED) {
    1695 - scmd->result |= DID_TIME_OUT << 16;
    1696 + set_host_byte(scmd, DID_TIME_OUT);
    1697 return SUCCESS;
    1698 }
    1699 case DID_NO_CONNECT:
    1700 diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
    1701 index efcbcd182863..bffbd4b42111 100644
    1702 --- a/drivers/scsi/sd.c
    1703 +++ b/drivers/scsi/sd.c
    1704 @@ -2455,7 +2455,10 @@ sd_read_cache_type(struct scsi_disk *sdkp, unsigned char *buffer)
    1705 }
    1706
    1707 sdkp->DPOFUA = (data.device_specific & 0x10) != 0;
    1708 - if (sdkp->DPOFUA && !sdkp->device->use_10_for_rw) {
    1709 + if (sdp->broken_fua) {
    1710 + sd_first_printk(KERN_NOTICE, sdkp, "Disabling FUA\n");
    1711 + sdkp->DPOFUA = 0;
    1712 + } else if (sdkp->DPOFUA && !sdkp->device->use_10_for_rw) {
    1713 sd_first_printk(KERN_NOTICE, sdkp,
    1714 "Uses READ/WRITE(6), disabling FUA\n");
    1715 sdkp->DPOFUA = 0;
    1716 diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
    1717 index db3b494e5926..8490aa411739 100644
    1718 --- a/drivers/scsi/virtio_scsi.c
    1719 +++ b/drivers/scsi/virtio_scsi.c
    1720 @@ -273,6 +273,16 @@ static void virtscsi_req_done(struct virtqueue *vq)
    1721 virtscsi_vq_done(vscsi, req_vq, virtscsi_complete_cmd);
    1722 };
    1723
    1724 +static void virtscsi_poll_requests(struct virtio_scsi *vscsi)
    1725 +{
    1726 + int i, num_vqs;
    1727 +
    1728 + num_vqs = vscsi->num_queues;
    1729 + for (i = 0; i < num_vqs; i++)
    1730 + virtscsi_vq_done(vscsi, &vscsi->req_vqs[i],
    1731 + virtscsi_complete_cmd);
    1732 +}
    1733 +
    1734 static void virtscsi_complete_free(struct virtio_scsi *vscsi, void *buf)
    1735 {
    1736 struct virtio_scsi_cmd *cmd = buf;
    1737 @@ -291,6 +301,8 @@ static void virtscsi_ctrl_done(struct virtqueue *vq)
    1738 virtscsi_vq_done(vscsi, &vscsi->ctrl_vq, virtscsi_complete_free);
    1739 };
    1740
    1741 +static void virtscsi_handle_event(struct work_struct *work);
    1742 +
    1743 static int virtscsi_kick_event(struct virtio_scsi *vscsi,
    1744 struct virtio_scsi_event_node *event_node)
    1745 {
    1746 @@ -298,6 +310,7 @@ static int virtscsi_kick_event(struct virtio_scsi *vscsi,
    1747 struct scatterlist sg;
    1748 unsigned long flags;
    1749
    1750 + INIT_WORK(&event_node->work, virtscsi_handle_event);
    1751 sg_init_one(&sg, &event_node->event, sizeof(struct virtio_scsi_event));
    1752
    1753 spin_lock_irqsave(&vscsi->event_vq.vq_lock, flags);
    1754 @@ -415,7 +428,6 @@ static void virtscsi_complete_event(struct virtio_scsi *vscsi, void *buf)
    1755 {
    1756 struct virtio_scsi_event_node *event_node = buf;
    1757
    1758 - INIT_WORK(&event_node->work, virtscsi_handle_event);
    1759 schedule_work(&event_node->work);
    1760 }
    1761
    1762 @@ -605,6 +617,18 @@ static int virtscsi_tmf(struct virtio_scsi *vscsi, struct virtio_scsi_cmd *cmd)
    1763 cmd->resp.tmf.response == VIRTIO_SCSI_S_FUNCTION_SUCCEEDED)
    1764 ret = SUCCESS;
    1765
    1766 + /*
    1767 + * The spec guarantees that all requests related to the TMF have
    1768 + * been completed, but the callback might not have run yet if
    1769 + * we're using independent interrupts (e.g. MSI). Poll the
    1770 + * virtqueues once.
    1771 + *
    1772 + * In the abort case, sc->scsi_done will do nothing, because
    1773 + * the block layer must have detected a timeout and as a result
    1774 + * REQ_ATOM_COMPLETE has been set.
    1775 + */
    1776 + virtscsi_poll_requests(vscsi);
    1777 +
    1778 out:
    1779 mempool_free(cmd, virtscsi_cmd_pool);
    1780 return ret;
    1781 diff --git a/drivers/staging/iio/adc/ad7291.c b/drivers/staging/iio/adc/ad7291.c
    1782 index 357cef2a6f4c..7194bd138762 100644
    1783 --- a/drivers/staging/iio/adc/ad7291.c
    1784 +++ b/drivers/staging/iio/adc/ad7291.c
    1785 @@ -465,7 +465,7 @@ static int ad7291_probe(struct i2c_client *client,
    1786 struct ad7291_platform_data *pdata = client->dev.platform_data;
    1787 struct ad7291_chip_info *chip;
    1788 struct iio_dev *indio_dev;
    1789 - int ret = 0;
    1790 + int ret;
    1791
    1792 indio_dev = devm_iio_device_alloc(&client->dev, sizeof(*chip));
    1793 if (!indio_dev)
    1794 @@ -475,7 +475,7 @@ static int ad7291_probe(struct i2c_client *client,
    1795 if (pdata && pdata->use_external_ref) {
    1796 chip->reg = devm_regulator_get(&client->dev, "vref");
    1797 if (IS_ERR(chip->reg))
    1798 - return ret;
    1799 + return PTR_ERR(chip->reg);
    1800
    1801 ret = regulator_enable(chip->reg);
    1802 if (ret)
    1803 diff --git a/drivers/staging/tidspbridge/core/tiomap3430.c b/drivers/staging/tidspbridge/core/tiomap3430.c
    1804 index 8945b4e3a2a6..cb50120ed7b5 100644
    1805 --- a/drivers/staging/tidspbridge/core/tiomap3430.c
    1806 +++ b/drivers/staging/tidspbridge/core/tiomap3430.c
    1807 @@ -280,8 +280,10 @@ static int bridge_brd_monitor(struct bridge_dev_context *dev_ctxt)
    1808 OMAP3430_IVA2_MOD, OMAP2_CM_CLKSTCTRL);
    1809
    1810 /* Wait until the state has moved to ON */
    1811 - while (*pdata->dsp_prm_read(OMAP3430_IVA2_MOD, OMAP2_PM_PWSTST)&
    1812 - OMAP_INTRANSITION_MASK);
    1813 + while ((*pdata->dsp_prm_read)(OMAP3430_IVA2_MOD,
    1814 + OMAP2_PM_PWSTST) &
    1815 + OMAP_INTRANSITION_MASK)
    1816 + ;
    1817 /* Disable Automatic transition */
    1818 (*pdata->dsp_cm_write)(OMAP34XX_CLKSTCTRL_DISABLE_AUTO,
    1819 OMAP3430_IVA2_MOD, OMAP2_CM_CLKSTCTRL);
    1820 diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
    1821 index fe9d129c8735..0391f17020f6 100644
    1822 --- a/drivers/tty/n_tty.c
    1823 +++ b/drivers/tty/n_tty.c
    1824 @@ -1214,15 +1214,16 @@ static void n_tty_receive_parity_error(struct tty_struct *tty, unsigned char c)
    1825 {
    1826 struct n_tty_data *ldata = tty->disc_data;
    1827
    1828 - if (I_IGNPAR(tty))
    1829 - return;
    1830 - if (I_PARMRK(tty)) {
    1831 - put_tty_queue('\377', ldata);
    1832 - put_tty_queue('\0', ldata);
    1833 - put_tty_queue(c, ldata);
    1834 - } else if (I_INPCK(tty))
    1835 - put_tty_queue('\0', ldata);
    1836 - else
    1837 + if (I_INPCK(tty)) {
    1838 + if (I_IGNPAR(tty))
    1839 + return;
    1840 + if (I_PARMRK(tty)) {
    1841 + put_tty_queue('\377', ldata);
    1842 + put_tty_queue('\0', ldata);
    1843 + put_tty_queue(c, ldata);
    1844 + } else
    1845 + put_tty_queue('\0', ldata);
    1846 + } else
    1847 put_tty_queue(c, ldata);
    1848 if (waitqueue_active(&tty->read_wait))
    1849 wake_up_interruptible(&tty->read_wait);
    1850 diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
    1851 index 2d4bd3929e50..1c17ab591444 100644
    1852 --- a/drivers/tty/serial/8250/8250_core.c
    1853 +++ b/drivers/tty/serial/8250/8250_core.c
    1854 @@ -2360,7 +2360,7 @@ serial8250_do_set_termios(struct uart_port *port, struct ktermios *termios,
    1855 port->read_status_mask = UART_LSR_OE | UART_LSR_THRE | UART_LSR_DR;
    1856 if (termios->c_iflag & INPCK)
    1857 port->read_status_mask |= UART_LSR_FE | UART_LSR_PE;
    1858 - if (termios->c_iflag & (BRKINT | PARMRK))
    1859 + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    1860 port->read_status_mask |= UART_LSR_BI;
    1861
    1862 /*
    1863 diff --git a/drivers/tty/serial/altera_uart.c b/drivers/tty/serial/altera_uart.c
    1864 index 501667e3e3f5..323376668b72 100644
    1865 --- a/drivers/tty/serial/altera_uart.c
    1866 +++ b/drivers/tty/serial/altera_uart.c
    1867 @@ -185,6 +185,12 @@ static void altera_uart_set_termios(struct uart_port *port,
    1868 uart_update_timeout(port, termios->c_cflag, baud);
    1869 altera_uart_writel(port, baudclk, ALTERA_UART_DIVISOR_REG);
    1870 spin_unlock_irqrestore(&port->lock, flags);
    1871 +
    1872 + /*
    1873 + * FIXME: port->read_status_mask and port->ignore_status_mask
    1874 + * need to be initialized based on termios settings for
    1875 + * INPCK, IGNBRK, IGNPAR, PARMRK, BRKINT
    1876 + */
    1877 }
    1878
    1879 static void altera_uart_rx_chars(struct altera_uart *pp)
    1880 diff --git a/drivers/tty/serial/amba-pl010.c b/drivers/tty/serial/amba-pl010.c
    1881 index 01c9e72433e1..971af1e22d0f 100644
    1882 --- a/drivers/tty/serial/amba-pl010.c
    1883 +++ b/drivers/tty/serial/amba-pl010.c
    1884 @@ -420,7 +420,7 @@ pl010_set_termios(struct uart_port *port, struct ktermios *termios,
    1885 uap->port.read_status_mask = UART01x_RSR_OE;
    1886 if (termios->c_iflag & INPCK)
    1887 uap->port.read_status_mask |= UART01x_RSR_FE | UART01x_RSR_PE;
    1888 - if (termios->c_iflag & (BRKINT | PARMRK))
    1889 + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    1890 uap->port.read_status_mask |= UART01x_RSR_BE;
    1891
    1892 /*
    1893 diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
    1894 index dacf0a09ab24..c2ee793aedae 100644
    1895 --- a/drivers/tty/serial/amba-pl011.c
    1896 +++ b/drivers/tty/serial/amba-pl011.c
    1897 @@ -1744,7 +1744,7 @@ pl011_set_termios(struct uart_port *port, struct ktermios *termios,
    1898 port->read_status_mask = UART011_DR_OE | 255;
    1899 if (termios->c_iflag & INPCK)
    1900 port->read_status_mask |= UART011_DR_FE | UART011_DR_PE;
    1901 - if (termios->c_iflag & (BRKINT | PARMRK))
    1902 + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    1903 port->read_status_mask |= UART011_DR_BE;
    1904
    1905 /*
    1906 diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
    1907 index 53eeea13ff16..372212956f6c 100644
    1908 --- a/drivers/tty/serial/atmel_serial.c
    1909 +++ b/drivers/tty/serial/atmel_serial.c
    1910 @@ -1784,7 +1784,7 @@ static void atmel_set_termios(struct uart_port *port, struct ktermios *termios,
    1911 port->read_status_mask = ATMEL_US_OVRE;
    1912 if (termios->c_iflag & INPCK)
    1913 port->read_status_mask |= (ATMEL_US_FRAME | ATMEL_US_PARE);
    1914 - if (termios->c_iflag & (BRKINT | PARMRK))
    1915 + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    1916 port->read_status_mask |= ATMEL_US_RXBRK;
    1917
    1918 if (atmel_use_pdc_rx(port))
    1919 diff --git a/drivers/tty/serial/bcm63xx_uart.c b/drivers/tty/serial/bcm63xx_uart.c
    1920 index a47421e4627c..231519022b73 100644
    1921 --- a/drivers/tty/serial/bcm63xx_uart.c
    1922 +++ b/drivers/tty/serial/bcm63xx_uart.c
    1923 @@ -567,7 +567,7 @@ static void bcm_uart_set_termios(struct uart_port *port,
    1924 port->read_status_mask |= UART_FIFO_FRAMEERR_MASK;
    1925 port->read_status_mask |= UART_FIFO_PARERR_MASK;
    1926 }
    1927 - if (new->c_iflag & (BRKINT))
    1928 + if (new->c_iflag & (IGNBRK | BRKINT))
    1929 port->read_status_mask |= UART_FIFO_BRKDET_MASK;
    1930
    1931 port->ignore_status_mask = 0;
    1932 diff --git a/drivers/tty/serial/bfin_uart.c b/drivers/tty/serial/bfin_uart.c
    1933 index 869ceba2ec57..ac86a20992e9 100644
    1934 --- a/drivers/tty/serial/bfin_uart.c
    1935 +++ b/drivers/tty/serial/bfin_uart.c
    1936 @@ -833,7 +833,7 @@ bfin_serial_set_termios(struct uart_port *port, struct ktermios *termios,
    1937 port->read_status_mask = OE;
    1938 if (termios->c_iflag & INPCK)
    1939 port->read_status_mask |= (FE | PE);
    1940 - if (termios->c_iflag & (BRKINT | PARMRK))
    1941 + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    1942 port->read_status_mask |= BI;
    1943
    1944 /*
    1945 diff --git a/drivers/tty/serial/dz.c b/drivers/tty/serial/dz.c
    1946 index 2f2b2e538a54..cdbbc788230a 100644
    1947 --- a/drivers/tty/serial/dz.c
    1948 +++ b/drivers/tty/serial/dz.c
    1949 @@ -625,7 +625,7 @@ static void dz_set_termios(struct uart_port *uport, struct ktermios *termios,
    1950 dport->port.read_status_mask = DZ_OERR;
    1951 if (termios->c_iflag & INPCK)
    1952 dport->port.read_status_mask |= DZ_FERR | DZ_PERR;
    1953 - if (termios->c_iflag & (BRKINT | PARMRK))
    1954 + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    1955 dport->port.read_status_mask |= DZ_BREAK;
    1956
    1957 /* characters to ignore */
    1958 diff --git a/drivers/tty/serial/efm32-uart.c b/drivers/tty/serial/efm32-uart.c
    1959 index c167a710dc39..e65f4c840ab4 100644
    1960 --- a/drivers/tty/serial/efm32-uart.c
    1961 +++ b/drivers/tty/serial/efm32-uart.c
    1962 @@ -407,7 +407,7 @@ static void efm32_uart_set_termios(struct uart_port *port,
    1963 if (new->c_iflag & INPCK)
    1964 port->read_status_mask |=
    1965 UARTn_RXDATAX_FERR | UARTn_RXDATAX_PERR;
    1966 - if (new->c_iflag & (BRKINT | PARMRK))
    1967 + if (new->c_iflag & (IGNBRK | BRKINT | PARMRK))
    1968 port->read_status_mask |= SW_UARTn_RXDATAX_BERR;
    1969
    1970 port->ignore_status_mask = 0;
    1971 diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
    1972 index c5eb897de9de..49385c86cfba 100644
    1973 --- a/drivers/tty/serial/fsl_lpuart.c
    1974 +++ b/drivers/tty/serial/fsl_lpuart.c
    1975 @@ -902,7 +902,7 @@ lpuart_set_termios(struct uart_port *port, struct ktermios *termios,
    1976 sport->port.read_status_mask = 0;
    1977 if (termios->c_iflag & INPCK)
    1978 sport->port.read_status_mask |= (UARTSR1_FE | UARTSR1_PE);
    1979 - if (termios->c_iflag & (BRKINT | PARMRK))
    1980 + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    1981 sport->port.read_status_mask |= UARTSR1_FE;
    1982
    1983 /* characters to ignore */
    1984 diff --git a/drivers/tty/serial/ip22zilog.c b/drivers/tty/serial/ip22zilog.c
    1985 index 1d9420548e16..1efd4c36ba0c 100644
    1986 --- a/drivers/tty/serial/ip22zilog.c
    1987 +++ b/drivers/tty/serial/ip22zilog.c
    1988 @@ -850,7 +850,7 @@ ip22zilog_convert_to_zs(struct uart_ip22zilog_port *up, unsigned int cflag,
    1989 up->port.read_status_mask = Rx_OVR;
    1990 if (iflag & INPCK)
    1991 up->port.read_status_mask |= CRC_ERR | PAR_ERR;
    1992 - if (iflag & (BRKINT | PARMRK))
    1993 + if (iflag & (IGNBRK | BRKINT | PARMRK))
    1994 up->port.read_status_mask |= BRK_ABRT;
    1995
    1996 up->port.ignore_status_mask = 0;
    1997 diff --git a/drivers/tty/serial/m32r_sio.c b/drivers/tty/serial/m32r_sio.c
    1998 index 9cd9b4eba9fc..68f2c53e0b54 100644
    1999 --- a/drivers/tty/serial/m32r_sio.c
    2000 +++ b/drivers/tty/serial/m32r_sio.c
    2001 @@ -737,7 +737,7 @@ static void m32r_sio_set_termios(struct uart_port *port,
    2002 up->port.read_status_mask = UART_LSR_OE | UART_LSR_THRE | UART_LSR_DR;
    2003 if (termios->c_iflag & INPCK)
    2004 up->port.read_status_mask |= UART_LSR_FE | UART_LSR_PE;
    2005 - if (termios->c_iflag & (BRKINT | PARMRK))
    2006 + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    2007 up->port.read_status_mask |= UART_LSR_BI;
    2008
    2009 /*
    2010 diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c
    2011 index 2a99d0c61b9e..ba285cd45b59 100644
    2012 --- a/drivers/tty/serial/max310x.c
    2013 +++ b/drivers/tty/serial/max310x.c
    2014 @@ -835,7 +835,7 @@ static void max310x_set_termios(struct uart_port *port,
    2015 if (termios->c_iflag & INPCK)
    2016 port->read_status_mask |= MAX310X_LSR_RXPAR_BIT |
    2017 MAX310X_LSR_FRERR_BIT;
    2018 - if (termios->c_iflag & (BRKINT | PARMRK))
    2019 + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    2020 port->read_status_mask |= MAX310X_LSR_RXBRK_BIT;
    2021
    2022 /* Set status ignore mask */
    2023 diff --git a/drivers/tty/serial/mcf.c b/drivers/tty/serial/mcf.c
    2024 index 0edfaf8cd269..a6f085717f94 100644
    2025 --- a/drivers/tty/serial/mcf.c
    2026 +++ b/drivers/tty/serial/mcf.c
    2027 @@ -248,6 +248,12 @@ static void mcf_set_termios(struct uart_port *port, struct ktermios *termios,
    2028 mr1 |= MCFUART_MR1_PARITYNONE;
    2029 }
    2030
    2031 + /*
    2032 + * FIXME: port->read_status_mask and port->ignore_status_mask
    2033 + * need to be initialized based on termios settings for
    2034 + * INPCK, IGNBRK, IGNPAR, PARMRK, BRKINT
    2035 + */
    2036 +
    2037 if (termios->c_cflag & CSTOPB)
    2038 mr2 |= MCFUART_MR2_STOP2;
    2039 else
    2040 diff --git a/drivers/tty/serial/mfd.c b/drivers/tty/serial/mfd.c
    2041 index 52c930fac210..445799dc9846 100644
    2042 --- a/drivers/tty/serial/mfd.c
    2043 +++ b/drivers/tty/serial/mfd.c
    2044 @@ -977,7 +977,7 @@ serial_hsu_set_termios(struct uart_port *port, struct ktermios *termios,
    2045 up->port.read_status_mask = UART_LSR_OE | UART_LSR_THRE | UART_LSR_DR;
    2046 if (termios->c_iflag & INPCK)
    2047 up->port.read_status_mask |= UART_LSR_FE | UART_LSR_PE;
    2048 - if (termios->c_iflag & (BRKINT | PARMRK))
    2049 + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    2050 up->port.read_status_mask |= UART_LSR_BI;
    2051
    2052 /* Characters to ignore */
    2053 diff --git a/drivers/tty/serial/mpsc.c b/drivers/tty/serial/mpsc.c
    2054 index e30a3ca3cea3..759c6a6fa74a 100644
    2055 --- a/drivers/tty/serial/mpsc.c
    2056 +++ b/drivers/tty/serial/mpsc.c
    2057 @@ -1458,7 +1458,7 @@ static void mpsc_set_termios(struct uart_port *port, struct ktermios *termios,
    2058 pi->port.read_status_mask |= SDMA_DESC_CMDSTAT_PE
    2059 | SDMA_DESC_CMDSTAT_FR;
    2060
    2061 - if (termios->c_iflag & (BRKINT | PARMRK))
    2062 + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    2063 pi->port.read_status_mask |= SDMA_DESC_CMDSTAT_BR;
    2064
    2065 /* Characters/events to ignore */
    2066 diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c
    2067 index 053b98eb46c8..7307dc4145ec 100644
    2068 --- a/drivers/tty/serial/msm_serial.c
    2069 +++ b/drivers/tty/serial/msm_serial.c
    2070 @@ -583,7 +583,7 @@ static void msm_set_termios(struct uart_port *port, struct ktermios *termios,
    2071 port->read_status_mask = 0;
    2072 if (termios->c_iflag & INPCK)
    2073 port->read_status_mask |= UART_SR_PAR_FRAME_ERR;
    2074 - if (termios->c_iflag & (BRKINT | PARMRK))
    2075 + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    2076 port->read_status_mask |= UART_SR_RX_BREAK;
    2077
    2078 uart_update_timeout(port, termios->c_cflag, baud);
    2079 diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c
    2080 index aa97fd845b4d..d98f1d4a9bd3 100644
    2081 --- a/drivers/tty/serial/mxs-auart.c
    2082 +++ b/drivers/tty/serial/mxs-auart.c
    2083 @@ -604,7 +604,7 @@ static void mxs_auart_settermios(struct uart_port *u,
    2084
    2085 if (termios->c_iflag & INPCK)
    2086 u->read_status_mask |= AUART_STAT_PERR;
    2087 - if (termios->c_iflag & (BRKINT | PARMRK))
    2088 + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    2089 u->read_status_mask |= AUART_STAT_BERR;
    2090
    2091 /*
    2092 diff --git a/drivers/tty/serial/netx-serial.c b/drivers/tty/serial/netx-serial.c
    2093 index 0a4dd70d29eb..7a6745601d4e 100644
    2094 --- a/drivers/tty/serial/netx-serial.c
    2095 +++ b/drivers/tty/serial/netx-serial.c
    2096 @@ -419,7 +419,7 @@ netx_set_termios(struct uart_port *port, struct ktermios *termios,
    2097 }
    2098
    2099 port->read_status_mask = 0;
    2100 - if (termios->c_iflag & (BRKINT | PARMRK))
    2101 + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    2102 port->read_status_mask |= SR_BE;
    2103 if (termios->c_iflag & INPCK)
    2104 port->read_status_mask |= SR_PE | SR_FE;
    2105 diff --git a/drivers/tty/serial/pmac_zilog.c b/drivers/tty/serial/pmac_zilog.c
    2106 index e9d420ff3931..8193635103ee 100644
    2107 --- a/drivers/tty/serial/pmac_zilog.c
    2108 +++ b/drivers/tty/serial/pmac_zilog.c
    2109 @@ -1092,7 +1092,7 @@ static void pmz_convert_to_zs(struct uart_pmac_port *uap, unsigned int cflag,
    2110 uap->port.read_status_mask = Rx_OVR;
    2111 if (iflag & INPCK)
    2112 uap->port.read_status_mask |= CRC_ERR | PAR_ERR;
    2113 - if (iflag & (BRKINT | PARMRK))
    2114 + if (iflag & (IGNBRK | BRKINT | PARMRK))
    2115 uap->port.read_status_mask |= BRK_ABRT;
    2116
    2117 uap->port.ignore_status_mask = 0;
    2118 diff --git a/drivers/tty/serial/pnx8xxx_uart.c b/drivers/tty/serial/pnx8xxx_uart.c
    2119 index de6c05c63683..2ba24a45c97f 100644
    2120 --- a/drivers/tty/serial/pnx8xxx_uart.c
    2121 +++ b/drivers/tty/serial/pnx8xxx_uart.c
    2122 @@ -477,7 +477,7 @@ pnx8xxx_set_termios(struct uart_port *port, struct ktermios *termios,
    2123 sport->port.read_status_mask |=
    2124 FIFO_TO_SM(PNX8XXX_UART_FIFO_RXFE) |
    2125 FIFO_TO_SM(PNX8XXX_UART_FIFO_RXPAR);
    2126 - if (termios->c_iflag & (BRKINT | PARMRK))
    2127 + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    2128 sport->port.read_status_mask |=
    2129 ISTAT_TO_SM(PNX8XXX_UART_INT_BREAK);
    2130
    2131 diff --git a/drivers/tty/serial/pxa.c b/drivers/tty/serial/pxa.c
    2132 index f9f20f383760..fc3f308cd6c1 100644
    2133 --- a/drivers/tty/serial/pxa.c
    2134 +++ b/drivers/tty/serial/pxa.c
    2135 @@ -492,7 +492,7 @@ serial_pxa_set_termios(struct uart_port *port, struct ktermios *termios,
    2136 up->port.read_status_mask = UART_LSR_OE | UART_LSR_THRE | UART_LSR_DR;
    2137 if (termios->c_iflag & INPCK)
    2138 up->port.read_status_mask |= UART_LSR_FE | UART_LSR_PE;
    2139 - if (termios->c_iflag & (BRKINT | PARMRK))
    2140 + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    2141 up->port.read_status_mask |= UART_LSR_BI;
    2142
    2143 /*
    2144 diff --git a/drivers/tty/serial/sb1250-duart.c b/drivers/tty/serial/sb1250-duart.c
    2145 index a7cdec2962dd..771f361c47ea 100644
    2146 --- a/drivers/tty/serial/sb1250-duart.c
    2147 +++ b/drivers/tty/serial/sb1250-duart.c
    2148 @@ -596,7 +596,7 @@ static void sbd_set_termios(struct uart_port *uport, struct ktermios *termios,
    2149 if (termios->c_iflag & INPCK)
    2150 uport->read_status_mask |= M_DUART_FRM_ERR |
    2151 M_DUART_PARITY_ERR;
    2152 - if (termios->c_iflag & (BRKINT | PARMRK))
    2153 + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    2154 uport->read_status_mask |= M_DUART_RCVD_BRK;
    2155
    2156 uport->ignore_status_mask = 0;
    2157 diff --git a/drivers/tty/serial/sccnxp.c b/drivers/tty/serial/sccnxp.c
    2158 index a447f71538ef..75ea83278ba4 100644
    2159 --- a/drivers/tty/serial/sccnxp.c
    2160 +++ b/drivers/tty/serial/sccnxp.c
    2161 @@ -667,7 +667,7 @@ static void sccnxp_set_termios(struct uart_port *port,
    2162 port->read_status_mask = SR_OVR;
    2163 if (termios->c_iflag & INPCK)
    2164 port->read_status_mask |= SR_PE | SR_FE;
    2165 - if (termios->c_iflag & (BRKINT | PARMRK))
    2166 + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    2167 port->read_status_mask |= SR_BRK;
    2168
    2169 /* Set status ignore mask */
    2170 diff --git a/drivers/tty/serial/serial_ks8695.c b/drivers/tty/serial/serial_ks8695.c
    2171 index e1caa99e3d3b..5c79bdab985d 100644
    2172 --- a/drivers/tty/serial/serial_ks8695.c
    2173 +++ b/drivers/tty/serial/serial_ks8695.c
    2174 @@ -437,7 +437,7 @@ static void ks8695uart_set_termios(struct uart_port *port, struct ktermios *term
    2175 port->read_status_mask = URLS_URROE;
    2176 if (termios->c_iflag & INPCK)
    2177 port->read_status_mask |= (URLS_URFE | URLS_URPE);
    2178 - if (termios->c_iflag & (BRKINT | PARMRK))
    2179 + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    2180 port->read_status_mask |= URLS_URBI;
    2181
    2182 /*
    2183 diff --git a/drivers/tty/serial/serial_txx9.c b/drivers/tty/serial/serial_txx9.c
    2184 index 90a080b1f9ee..cbf501da5df3 100644
    2185 --- a/drivers/tty/serial/serial_txx9.c
    2186 +++ b/drivers/tty/serial/serial_txx9.c
    2187 @@ -702,7 +702,7 @@ serial_txx9_set_termios(struct uart_port *port, struct ktermios *termios,
    2188 TXX9_SIDISR_TDIS | TXX9_SIDISR_RDIS;
    2189 if (termios->c_iflag & INPCK)
    2190 up->port.read_status_mask |= TXX9_SIDISR_UFER | TXX9_SIDISR_UPER;
    2191 - if (termios->c_iflag & (BRKINT | PARMRK))
    2192 + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    2193 up->port.read_status_mask |= TXX9_SIDISR_UBRK;
    2194
    2195 /*
    2196 diff --git a/drivers/tty/serial/sirfsoc_uart.c b/drivers/tty/serial/sirfsoc_uart.c
    2197 index 68b0fd4b9a6a..3146feb15255 100644
    2198 --- a/drivers/tty/serial/sirfsoc_uart.c
    2199 +++ b/drivers/tty/serial/sirfsoc_uart.c
    2200 @@ -907,7 +907,7 @@ static void sirfsoc_uart_set_termios(struct uart_port *port,
    2201 if (termios->c_iflag & INPCK)
    2202 port->read_status_mask |= uint_en->sirfsoc_frm_err_en;
    2203 }
    2204 - if (termios->c_iflag & (BRKINT | PARMRK))
    2205 + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    2206 port->read_status_mask |= uint_en->sirfsoc_rxd_brk_en;
    2207 if (sirfport->uart_reg->uart_type == SIRF_REAL_UART) {
    2208 if (termios->c_iflag & IGNPAR)
    2209 diff --git a/drivers/tty/serial/st-asc.c b/drivers/tty/serial/st-asc.c
    2210 index dd3a96e07026..3e707ba5bab9 100644
    2211 --- a/drivers/tty/serial/st-asc.c
    2212 +++ b/drivers/tty/serial/st-asc.c
    2213 @@ -547,7 +547,7 @@ static void asc_set_termios(struct uart_port *port, struct ktermios *termios,
    2214 ascport->port.read_status_mask = ASC_RXBUF_DUMMY_OE;
    2215 if (termios->c_iflag & INPCK)
    2216 ascport->port.read_status_mask |= ASC_RXBUF_FE | ASC_RXBUF_PE;
    2217 - if (termios->c_iflag & (BRKINT | PARMRK))
    2218 + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    2219 ascport->port.read_status_mask |= ASC_RXBUF_DUMMY_BE;
    2220
    2221 /*
    2222 diff --git a/drivers/tty/serial/sunsab.c b/drivers/tty/serial/sunsab.c
    2223 index 5faa8e905e98..80a58eca785b 100644
    2224 --- a/drivers/tty/serial/sunsab.c
    2225 +++ b/drivers/tty/serial/sunsab.c
    2226 @@ -719,7 +719,7 @@ static void sunsab_convert_to_sab(struct uart_sunsab_port *up, unsigned int cfla
    2227 if (iflag & INPCK)
    2228 up->port.read_status_mask |= (SAB82532_ISR0_PERR |
    2229 SAB82532_ISR0_FERR);
    2230 - if (iflag & (BRKINT | PARMRK))
    2231 + if (iflag & (IGNBRK | BRKINT | PARMRK))
    2232 up->port.read_status_mask |= (SAB82532_ISR1_BRK << 8);
    2233
    2234 /*
    2235 diff --git a/drivers/tty/serial/sunsu.c b/drivers/tty/serial/sunsu.c
    2236 index 9a0f24f83720..5326ae195e5f 100644
    2237 --- a/drivers/tty/serial/sunsu.c
    2238 +++ b/drivers/tty/serial/sunsu.c
    2239 @@ -834,7 +834,7 @@ sunsu_change_speed(struct uart_port *port, unsigned int cflag,
    2240 up->port.read_status_mask = UART_LSR_OE | UART_LSR_THRE | UART_LSR_DR;
    2241 if (iflag & INPCK)
    2242 up->port.read_status_mask |= UART_LSR_FE | UART_LSR_PE;
    2243 - if (iflag & (BRKINT | PARMRK))
    2244 + if (iflag & (IGNBRK | BRKINT | PARMRK))
    2245 up->port.read_status_mask |= UART_LSR_BI;
    2246
    2247 /*
    2248 diff --git a/drivers/tty/serial/sunzilog.c b/drivers/tty/serial/sunzilog.c
    2249 index a2c40ed287d2..a85db8b87156 100644
    2250 --- a/drivers/tty/serial/sunzilog.c
    2251 +++ b/drivers/tty/serial/sunzilog.c
    2252 @@ -915,7 +915,7 @@ sunzilog_convert_to_zs(struct uart_sunzilog_port *up, unsigned int cflag,
    2253 up->port.read_status_mask = Rx_OVR;
    2254 if (iflag & INPCK)
    2255 up->port.read_status_mask |= CRC_ERR | PAR_ERR;
    2256 - if (iflag & (BRKINT | PARMRK))
    2257 + if (iflag & (IGNBRK | BRKINT | PARMRK))
    2258 up->port.read_status_mask |= BRK_ABRT;
    2259
    2260 up->port.ignore_status_mask = 0;
    2261 diff --git a/drivers/tty/serial/ucc_uart.c b/drivers/tty/serial/ucc_uart.c
    2262 index d569ca58bab6..1c52074c38df 100644
    2263 --- a/drivers/tty/serial/ucc_uart.c
    2264 +++ b/drivers/tty/serial/ucc_uart.c
    2265 @@ -936,7 +936,7 @@ static void qe_uart_set_termios(struct uart_port *port,
    2266 port->read_status_mask = BD_SC_EMPTY | BD_SC_OV;
    2267 if (termios->c_iflag & INPCK)
    2268 port->read_status_mask |= BD_SC_FR | BD_SC_PR;
    2269 - if (termios->c_iflag & (BRKINT | PARMRK))
    2270 + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    2271 port->read_status_mask |= BD_SC_BR;
    2272
    2273 /*
    2274 diff --git a/drivers/tty/serial/vr41xx_siu.c b/drivers/tty/serial/vr41xx_siu.c
    2275 index a63c14bc9a24..db0c8a4ab03e 100644
    2276 --- a/drivers/tty/serial/vr41xx_siu.c
    2277 +++ b/drivers/tty/serial/vr41xx_siu.c
    2278 @@ -559,7 +559,7 @@ static void siu_set_termios(struct uart_port *port, struct ktermios *new,
    2279 port->read_status_mask = UART_LSR_THRE | UART_LSR_OE | UART_LSR_DR;
    2280 if (c_iflag & INPCK)
    2281 port->read_status_mask |= UART_LSR_FE | UART_LSR_PE;
    2282 - if (c_iflag & (BRKINT | PARMRK))
    2283 + if (c_iflag & (IGNBRK | BRKINT | PARMRK))
    2284 port->read_status_mask |= UART_LSR_BI;
    2285
    2286 port->ignore_status_mask = 0;
    2287 diff --git a/drivers/tty/serial/zs.c b/drivers/tty/serial/zs.c
    2288 index 6a169877109b..2b65bb7ffb8a 100644
    2289 --- a/drivers/tty/serial/zs.c
    2290 +++ b/drivers/tty/serial/zs.c
    2291 @@ -923,7 +923,7 @@ static void zs_set_termios(struct uart_port *uport, struct ktermios *termios,
    2292 uport->read_status_mask = Rx_OVR;
    2293 if (termios->c_iflag & INPCK)
    2294 uport->read_status_mask |= FRM_ERR | PAR_ERR;
    2295 - if (termios->c_iflag & (BRKINT | PARMRK))
    2296 + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
    2297 uport->read_status_mask |= Rx_BRK;
    2298
    2299 uport->ignore_status_mask = 0;
    2300 diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
    2301 index 7739c64ef259..482c45b777d3 100644
    2302 --- a/drivers/usb/chipidea/udc.c
    2303 +++ b/drivers/usb/chipidea/udc.c
    2304 @@ -1328,6 +1328,7 @@ static int ep_dequeue(struct usb_ep *ep, struct usb_request *req)
    2305 struct ci_hw_ep *hwep = container_of(ep, struct ci_hw_ep, ep);
    2306 struct ci_hw_req *hwreq = container_of(req, struct ci_hw_req, req);
    2307 unsigned long flags;
    2308 + struct td_node *node, *tmpnode;
    2309
    2310 if (ep == NULL || req == NULL || hwreq->req.status != -EALREADY ||
    2311 hwep->ep.desc == NULL || list_empty(&hwreq->queue) ||
    2312 @@ -1338,6 +1339,12 @@ static int ep_dequeue(struct usb_ep *ep, struct usb_request *req)
    2313
    2314 hw_ep_flush(hwep->ci, hwep->num, hwep->dir);
    2315
    2316 + list_for_each_entry_safe(node, tmpnode, &hwreq->tds, td) {
    2317 + dma_pool_free(hwep->td_pool, node->ptr, node->dma);
    2318 + list_del(&node->td);
    2319 + kfree(node);
    2320 + }
    2321 +
    2322 /* pop request */
    2323 list_del_init(&hwreq->queue);
    2324
    2325 diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c
    2326 index 1e12b3ee56fd..ddb54ee4ca73 100644
    2327 --- a/drivers/usb/gadget/f_fs.c
    2328 +++ b/drivers/usb/gadget/f_fs.c
    2329 @@ -1508,11 +1508,13 @@ static int functionfs_bind(struct ffs_data *ffs, struct usb_composite_dev *cdev)
    2330 ffs->ep0req->context = ffs;
    2331
    2332 lang = ffs->stringtabs;
    2333 - for (lang = ffs->stringtabs; *lang; ++lang) {
    2334 - struct usb_string *str = (*lang)->strings;
    2335 - int id = first_id;
    2336 - for (; str->s; ++id, ++str)
    2337 - str->id = id;
    2338 + if (lang) {
    2339 + for (; *lang; ++lang) {
    2340 + struct usb_string *str = (*lang)->strings;
    2341 + int id = first_id;
    2342 + for (; str->s; ++id, ++str)
    2343 + str->id = id;
    2344 + }
    2345 }
    2346
    2347 ffs->gadget = cdev->gadget;
    2348 diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
    2349 index 7a0e3c720c00..d0c65d6faf93 100644
    2350 --- a/drivers/usb/host/xhci-ring.c
    2351 +++ b/drivers/usb/host/xhci-ring.c
    2352 @@ -1611,8 +1611,11 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
    2353 xhci_handle_cmd_reset_ep(xhci, slot_id, cmd_trb, cmd_comp_code);
    2354 break;
    2355 case TRB_RESET_DEV:
    2356 - WARN_ON(slot_id != TRB_TO_SLOT_ID(
    2357 - le32_to_cpu(cmd_trb->generic.field[3])));
    2358 + /* SLOT_ID field in reset device cmd completion event TRB is 0.
    2359 + * Use the SLOT_ID from the command TRB instead (xhci 4.6.11)
    2360 + */
    2361 + slot_id = TRB_TO_SLOT_ID(
    2362 + le32_to_cpu(cmd_trb->generic.field[3]));
    2363 xhci_handle_cmd_reset_dev(xhci, slot_id, event);
    2364 break;
    2365 case TRB_NEC_GET_FW:
    2366 @@ -3696,7 +3699,7 @@ static unsigned int xhci_get_burst_count(struct xhci_hcd *xhci,
    2367 return 0;
    2368
    2369 max_burst = urb->ep->ss_ep_comp.bMaxBurst;
    2370 - return roundup(total_packet_count, max_burst + 1) - 1;
    2371 + return DIV_ROUND_UP(total_packet_count, max_burst + 1) - 1;
    2372 }
    2373
    2374 /*
    2375 diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
    2376 index 300836972faa..3f8e2c18962f 100644
    2377 --- a/drivers/usb/host/xhci.c
    2378 +++ b/drivers/usb/host/xhci.c
    2379 @@ -932,7 +932,7 @@ int xhci_suspend(struct xhci_hcd *xhci)
    2380 */
    2381 int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
    2382 {
    2383 - u32 command, temp = 0;
    2384 + u32 command, temp = 0, status;
    2385 struct usb_hcd *hcd = xhci_to_hcd(xhci);
    2386 struct usb_hcd *secondary_hcd;
    2387 int retval = 0;
    2388 @@ -1050,8 +1050,12 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
    2389
    2390 done:
    2391 if (retval == 0) {
    2392 - usb_hcd_resume_root_hub(hcd);
    2393 - usb_hcd_resume_root_hub(xhci->shared_hcd);
    2394 + /* Resume root hubs only when have pending events. */
    2395 + status = readl(&xhci->op_regs->status);
    2396 + if (status & STS_EINT) {
    2397 + usb_hcd_resume_root_hub(hcd);
    2398 + usb_hcd_resume_root_hub(xhci->shared_hcd);
    2399 + }
    2400 }
    2401
    2402 /*
    2403 diff --git a/drivers/usb/musb/musb_am335x.c b/drivers/usb/musb/musb_am335x.c
    2404 index d2353781bd2d..1e58ed2361cc 100644
    2405 --- a/drivers/usb/musb/musb_am335x.c
    2406 +++ b/drivers/usb/musb/musb_am335x.c
    2407 @@ -19,21 +19,6 @@ err:
    2408 return ret;
    2409 }
    2410
    2411 -static int of_remove_populated_child(struct device *dev, void *d)
    2412 -{
    2413 - struct platform_device *pdev = to_platform_device(dev);
    2414 -
    2415 - of_device_unregister(pdev);
    2416 - return 0;
    2417 -}
    2418 -
    2419 -static int am335x_child_remove(struct platform_device *pdev)
    2420 -{
    2421 - device_for_each_child(&pdev->dev, NULL, of_remove_populated_child);
    2422 - pm_runtime_disable(&pdev->dev);
    2423 - return 0;
    2424 -}
    2425 -
    2426 static const struct of_device_id am335x_child_of_match[] = {
    2427 { .compatible = "ti,am33xx-usb" },
    2428 { },
    2429 @@ -42,13 +27,17 @@ MODULE_DEVICE_TABLE(of, am335x_child_of_match);
    2430
    2431 static struct platform_driver am335x_child_driver = {
    2432 .probe = am335x_child_probe,
    2433 - .remove = am335x_child_remove,
    2434 .driver = {
    2435 .name = "am335x-usb-childs",
    2436 .of_match_table = am335x_child_of_match,
    2437 },
    2438 };
    2439
    2440 -module_platform_driver(am335x_child_driver);
    2441 +static int __init am335x_child_init(void)
    2442 +{
    2443 + return platform_driver_register(&am335x_child_driver);
    2444 +}
    2445 +module_init(am335x_child_init);
    2446 +
    2447 MODULE_DESCRIPTION("AM33xx child devices");
    2448 MODULE_LICENSE("GPL v2");
    2449 diff --git a/drivers/usb/musb/musb_cppi41.c b/drivers/usb/musb/musb_cppi41.c
    2450 index 7b8bbf53127e..5341bb223b7c 100644
    2451 --- a/drivers/usb/musb/musb_cppi41.c
    2452 +++ b/drivers/usb/musb/musb_cppi41.c
    2453 @@ -318,7 +318,7 @@ static void cppi41_dma_callback(void *private_data)
    2454 }
    2455 list_add_tail(&cppi41_channel->tx_check,
    2456 &controller->early_tx_list);
    2457 - if (!hrtimer_active(&controller->early_tx)) {
    2458 + if (!hrtimer_is_queued(&controller->early_tx)) {
    2459 hrtimer_start_range_ns(&controller->early_tx,
    2460 ktime_set(0, 140 * NSEC_PER_USEC),
    2461 40 * NSEC_PER_USEC,
    2462 diff --git a/drivers/usb/musb/ux500.c b/drivers/usb/musb/ux500.c
    2463 index c2e45e632723..f202e5088461 100644
    2464 --- a/drivers/usb/musb/ux500.c
    2465 +++ b/drivers/usb/musb/ux500.c
    2466 @@ -274,7 +274,6 @@ static int ux500_probe(struct platform_device *pdev)
    2467 musb->dev.parent = &pdev->dev;
    2468 musb->dev.dma_mask = &pdev->dev.coherent_dma_mask;
    2469 musb->dev.coherent_dma_mask = pdev->dev.coherent_dma_mask;
    2470 - musb->dev.of_node = pdev->dev.of_node;
    2471
    2472 glue->dev = &pdev->dev;
    2473 glue->musb = musb;
    2474 diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
    2475 index edf3b124583c..115662c16dcc 100644
    2476 --- a/drivers/usb/serial/ftdi_sio.c
    2477 +++ b/drivers/usb/serial/ftdi_sio.c
    2478 @@ -1566,14 +1566,17 @@ static void ftdi_set_max_packet_size(struct usb_serial_port *port)
    2479 struct usb_device *udev = serial->dev;
    2480
    2481 struct usb_interface *interface = serial->interface;
    2482 - struct usb_endpoint_descriptor *ep_desc = &interface->cur_altsetting->endpoint[1].desc;
    2483 + struct usb_endpoint_descriptor *ep_desc;
    2484
    2485 unsigned num_endpoints;
    2486 - int i;
    2487 + unsigned i;
    2488
    2489 num_endpoints = interface->cur_altsetting->desc.bNumEndpoints;
    2490 dev_info(&udev->dev, "Number of endpoints %d\n", num_endpoints);
    2491
    2492 + if (!num_endpoints)
    2493 + return;
    2494 +
    2495 /* NOTE: some customers have programmed FT232R/FT245R devices
    2496 * with an endpoint size of 0 - not good. In this case, we
    2497 * want to override the endpoint descriptor setting and use a
    2498 diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
    2499 index 70ede84f4f6b..e25e8ca09fe2 100644
    2500 --- a/drivers/usb/serial/option.c
    2501 +++ b/drivers/usb/serial/option.c
    2502 @@ -352,6 +352,9 @@ static void option_instat_callback(struct urb *urb);
    2503 /* Zoom */
    2504 #define ZOOM_PRODUCT_4597 0x9607
    2505
    2506 +/* SpeedUp SU9800 usb 3g modem */
    2507 +#define SPEEDUP_PRODUCT_SU9800 0x9800
    2508 +
    2509 /* Haier products */
    2510 #define HAIER_VENDOR_ID 0x201e
    2511 #define HAIER_PRODUCT_CE100 0x2009
    2512 @@ -372,8 +375,12 @@ static void option_instat_callback(struct urb *urb);
    2513 /* Olivetti products */
    2514 #define OLIVETTI_VENDOR_ID 0x0b3c
    2515 #define OLIVETTI_PRODUCT_OLICARD100 0xc000
    2516 +#define OLIVETTI_PRODUCT_OLICARD120 0xc001
    2517 +#define OLIVETTI_PRODUCT_OLICARD140 0xc002
    2518 #define OLIVETTI_PRODUCT_OLICARD145 0xc003
    2519 +#define OLIVETTI_PRODUCT_OLICARD155 0xc004
    2520 #define OLIVETTI_PRODUCT_OLICARD200 0xc005
    2521 +#define OLIVETTI_PRODUCT_OLICARD160 0xc00a
    2522 #define OLIVETTI_PRODUCT_OLICARD500 0xc00b
    2523
    2524 /* Celot products */
    2525 @@ -1577,6 +1584,7 @@ static const struct usb_device_id option_ids[] = {
    2526 { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14),
    2527 .driver_info = (kernel_ulong_t)&four_g_w14_blacklist
    2528 },
    2529 + { USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, SPEEDUP_PRODUCT_SU9800, 0xff) },
    2530 { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) },
    2531 { USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) },
    2532 { USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) },
    2533 @@ -1611,15 +1619,21 @@ static const struct usb_device_id option_ids[] = {
    2534 { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDMNET) },
    2535 { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, /* HC28 enumerates with Siemens or Cinterion VID depending on FW revision */
    2536 { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) },
    2537 -
    2538 - { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) },
    2539 + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100),
    2540 + .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    2541 + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD120),
    2542 + .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    2543 + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD140),
    2544 + .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    2545 { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD145) },
    2546 + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD155),
    2547 + .driver_info = (kernel_ulong_t)&net_intf6_blacklist },
    2548 { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD200),
    2549 - .driver_info = (kernel_ulong_t)&net_intf6_blacklist
    2550 - },
    2551 + .driver_info = (kernel_ulong_t)&net_intf6_blacklist },
    2552 + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD160),
    2553 + .driver_info = (kernel_ulong_t)&net_intf6_blacklist },
    2554 { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD500),
    2555 - .driver_info = (kernel_ulong_t)&net_intf4_blacklist
    2556 - },
    2557 + .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    2558 { USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */
    2559 { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/
    2560 { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM600) },
    2561 diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c
    2562 index 9d38ddc8da49..866b5df36ed1 100644
    2563 --- a/drivers/usb/storage/scsiglue.c
    2564 +++ b/drivers/usb/storage/scsiglue.c
    2565 @@ -256,6 +256,10 @@ static int slave_configure(struct scsi_device *sdev)
    2566 if (us->fflags & US_FL_WRITE_CACHE)
    2567 sdev->wce_default_on = 1;
    2568
    2569 + /* A few buggy USB-ATA bridges don't understand FUA */
    2570 + if (us->fflags & US_FL_BROKEN_FUA)
    2571 + sdev->broken_fua = 1;
    2572 +
    2573 } else {
    2574
    2575 /* Non-disk-type devices don't need to blacklist any pages
    2576 diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
    2577 index 174a447868cd..80a5b366255f 100644
    2578 --- a/drivers/usb/storage/unusual_devs.h
    2579 +++ b/drivers/usb/storage/unusual_devs.h
    2580 @@ -1936,6 +1936,13 @@ UNUSUAL_DEV( 0x14cd, 0x6600, 0x0201, 0x0201,
    2581 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
    2582 US_FL_IGNORE_RESIDUE ),
    2583
    2584 +/* Reported by Michael Büsch <m@bues.ch> */
    2585 +UNUSUAL_DEV( 0x152d, 0x0567, 0x0114, 0x0114,
    2586 + "JMicron",
    2587 + "USB to ATA/ATAPI Bridge",
    2588 + USB_SC_DEVICE, USB_PR_DEVICE, NULL,
    2589 + US_FL_BROKEN_FUA ),
    2590 +
    2591 /* Reported by Alexandre Oliva <oliva@lsd.ic.unicamp.br>
    2592 * JMicron responds to USN and several other SCSI ioctls with a
    2593 * residue that causes subsequent I/O requests to fail. */
    2594 diff --git a/drivers/video/fbdev/fb-puv3.c b/drivers/video/fbdev/fb-puv3.c
    2595 index 6db9ebd042a3..88fa2e70a0bb 100644
    2596 --- a/drivers/video/fbdev/fb-puv3.c
    2597 +++ b/drivers/video/fbdev/fb-puv3.c
    2598 @@ -18,8 +18,10 @@
    2599 #include <linux/fb.h>
    2600 #include <linux/init.h>
    2601 #include <linux/console.h>
    2602 +#include <linux/mm.h>
    2603
    2604 #include <asm/sizes.h>
    2605 +#include <asm/pgtable.h>
    2606 #include <mach/hardware.h>
    2607
    2608 /* Platform_data reserved for unifb registers. */
    2609 diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
    2610 index a62a5bdc0502..10f3c5c8783d 100644
    2611 --- a/fs/btrfs/disk-io.c
    2612 +++ b/fs/btrfs/disk-io.c
    2613 @@ -368,7 +368,8 @@ static int verify_parent_transid(struct extent_io_tree *io_tree,
    2614 out:
    2615 unlock_extent_cached(io_tree, eb->start, eb->start + eb->len - 1,
    2616 &cached_state, GFP_NOFS);
    2617 - btrfs_tree_read_unlock_blocking(eb);
    2618 + if (need_lock)
    2619 + btrfs_tree_read_unlock_blocking(eb);
    2620 return ret;
    2621 }
    2622
    2623 diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c
    2624 index 0227b45ef00a..15e9505aa35f 100644
    2625 --- a/fs/cifs/cifs_unicode.c
    2626 +++ b/fs/cifs/cifs_unicode.c
    2627 @@ -290,7 +290,8 @@ int
    2628 cifsConvertToUTF16(__le16 *target, const char *source, int srclen,
    2629 const struct nls_table *cp, int mapChars)
    2630 {
    2631 - int i, j, charlen;
    2632 + int i, charlen;
    2633 + int j = 0;
    2634 char src_char;
    2635 __le16 dst_char;
    2636 wchar_t tmp;
    2637 @@ -298,12 +299,11 @@ cifsConvertToUTF16(__le16 *target, const char *source, int srclen,
    2638 if (!mapChars)
    2639 return cifs_strtoUTF16(target, source, PATH_MAX, cp);
    2640
    2641 - for (i = 0, j = 0; i < srclen; j++) {
    2642 + for (i = 0; i < srclen; j++) {
    2643 src_char = source[i];
    2644 charlen = 1;
    2645 switch (src_char) {
    2646 case 0:
    2647 - put_unaligned(0, &target[j]);
    2648 goto ctoUTF16_out;
    2649 case ':':
    2650 dst_char = cpu_to_le16(UNI_COLON);
    2651 @@ -350,6 +350,7 @@ cifsConvertToUTF16(__le16 *target, const char *source, int srclen,
    2652 }
    2653
    2654 ctoUTF16_out:
    2655 + put_unaligned(0, &target[j]); /* Null terminate target unicode string */
    2656 return j;
    2657 }
    2658
    2659 diff --git a/fs/cifs/link.c b/fs/cifs/link.c
    2660 index 264ece71bdb2..68559fd557fb 100644
    2661 --- a/fs/cifs/link.c
    2662 +++ b/fs/cifs/link.c
    2663 @@ -374,7 +374,7 @@ cifs_create_mf_symlink(unsigned int xid, struct cifs_tcon *tcon,
    2664 oparms.cifs_sb = cifs_sb;
    2665 oparms.desired_access = GENERIC_WRITE;
    2666 oparms.create_options = create_options;
    2667 - oparms.disposition = FILE_OPEN;
    2668 + oparms.disposition = FILE_CREATE;
    2669 oparms.path = path;
    2670 oparms.fid = &fid;
    2671 oparms.reconnect = false;
    2672 diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c
    2673 index 594009f5f523..e6574d7b6642 100644
    2674 --- a/fs/ext4/indirect.c
    2675 +++ b/fs/ext4/indirect.c
    2676 @@ -389,7 +389,13 @@ static int ext4_alloc_branch(handle_t *handle, struct inode *inode,
    2677 return 0;
    2678 failed:
    2679 for (; i >= 0; i--) {
    2680 - if (i != indirect_blks && branch[i].bh)
    2681 + /*
    2682 + * We want to ext4_forget() only freshly allocated indirect
    2683 + * blocks. Buffer for new_blocks[i-1] is at branch[i].bh and
    2684 + * buffer at branch[0].bh is indirect block / inode already
    2685 + * existing before ext4_alloc_branch() was called.
    2686 + */
    2687 + if (i > 0 && i != indirect_blks && branch[i].bh)
    2688 ext4_forget(handle, 1, inode, branch[i].bh,
    2689 branch[i].bh->b_blocknr);
    2690 ext4_free_blocks(handle, inode, NULL, new_blocks[i],
    2691 @@ -1312,16 +1318,24 @@ static int free_hole_blocks(handle_t *handle, struct inode *inode,
    2692 blk = *i_data;
    2693 if (level > 0) {
    2694 ext4_lblk_t first2;
    2695 + ext4_lblk_t count2;
    2696 +
    2697 bh = sb_bread(inode->i_sb, le32_to_cpu(blk));
    2698 if (!bh) {
    2699 EXT4_ERROR_INODE_BLOCK(inode, le32_to_cpu(blk),
    2700 "Read failure");
    2701 return -EIO;
    2702 }
    2703 - first2 = (first > offset) ? first - offset : 0;
    2704 + if (first > offset) {
    2705 + first2 = first - offset;
    2706 + count2 = count;
    2707 + } else {
    2708 + first2 = 0;
    2709 + count2 = count - (offset - first);
    2710 + }
    2711 ret = free_hole_blocks(handle, inode, bh,
    2712 (__le32 *)bh->b_data, level - 1,
    2713 - first2, count - offset,
    2714 + first2, count2,
    2715 inode->i_sb->s_blocksize >> 2);
    2716 if (ret) {
    2717 brelse(bh);
    2718 diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
    2719 index d543222babf3..95e3720d1452 100644
    2720 --- a/fs/nfsd/nfs4proc.c
    2721 +++ b/fs/nfsd/nfs4proc.c
    2722 @@ -618,15 +618,6 @@ nfsd4_create(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
    2723
    2724 switch (create->cr_type) {
    2725 case NF4LNK:
    2726 - /* ugh! we have to null-terminate the linktext, or
    2727 - * vfs_symlink() will choke. it is always safe to
    2728 - * null-terminate by brute force, since at worst we
    2729 - * will overwrite the first byte of the create namelen
    2730 - * in the XDR buffer, which has already been extracted
    2731 - * during XDR decode.
    2732 - */
    2733 - create->cr_linkname[create->cr_linklen] = 0;
    2734 -
    2735 status = nfsd_symlink(rqstp, &cstate->current_fh,
    2736 create->cr_name, create->cr_namelen,
    2737 create->cr_linkname, create->cr_linklen,
    2738 diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
    2739 index b4c49588eada..3297158241e5 100644
    2740 --- a/fs/nfsd/nfs4xdr.c
    2741 +++ b/fs/nfsd/nfs4xdr.c
    2742 @@ -602,7 +602,18 @@ nfsd4_decode_create(struct nfsd4_compoundargs *argp, struct nfsd4_create *create
    2743 READ_BUF(4);
    2744 READ32(create->cr_linklen);
    2745 READ_BUF(create->cr_linklen);
    2746 - SAVEMEM(create->cr_linkname, create->cr_linklen);
    2747 + /*
    2748 + * The VFS will want a null-terminated string, and
    2749 + * null-terminating in place isn't safe since this might
    2750 + * end on a page boundary:
    2751 + */
    2752 + create->cr_linkname =
    2753 + kmalloc(create->cr_linklen + 1, GFP_KERNEL);
    2754 + if (!create->cr_linkname)
    2755 + return nfserr_jukebox;
    2756 + memcpy(create->cr_linkname, p, create->cr_linklen);
    2757 + create->cr_linkname[create->cr_linklen] = '\0';
    2758 + defer_free(argp, kfree, create->cr_linkname);
    2759 break;
    2760 case NF4BLK:
    2761 case NF4CHR:
    2762 diff --git a/include/drm/i915_powerwell.h b/include/drm/i915_powerwell.h
    2763 index cfdc884405b7..baa6f11b1837 100644
    2764 --- a/include/drm/i915_powerwell.h
    2765 +++ b/include/drm/i915_powerwell.h
    2766 @@ -30,7 +30,8 @@
    2767 #define _I915_POWERWELL_H_
    2768
    2769 /* For use by hda_i915 driver */
    2770 -extern void i915_request_power_well(void);
    2771 -extern void i915_release_power_well(void);
    2772 +extern int i915_request_power_well(void);
    2773 +extern int i915_release_power_well(void);
    2774 +extern int i915_get_cdclk_freq(void);
    2775
    2776 #endif /* _I915_POWERWELL_H_ */
    2777 diff --git a/include/linux/usb_usual.h b/include/linux/usb_usual.h
    2778 index 1a64b26046ed..9b7de1b46437 100644
    2779 --- a/include/linux/usb_usual.h
    2780 +++ b/include/linux/usb_usual.h
    2781 @@ -70,7 +70,9 @@
    2782 US_FLAG(NEEDS_CAP16, 0x00400000) \
    2783 /* cannot handle READ_CAPACITY_10 */ \
    2784 US_FLAG(IGNORE_UAS, 0x00800000) \
    2785 - /* Device advertises UAS but it is broken */
    2786 + /* Device advertises UAS but it is broken */ \
    2787 + US_FLAG(BROKEN_FUA, 0x01000000) \
    2788 + /* Cannot handle FUA in WRITE or READ CDBs */ \
    2789
    2790 #define US_FLAG(name, value) US_FL_##name = value ,
    2791 enum { US_DO_ALL_FLAGS };
    2792 diff --git a/include/scsi/scsi_cmnd.h b/include/scsi/scsi_cmnd.h
    2793 index a100c6e266c7..c95c0774a863 100644
    2794 --- a/include/scsi/scsi_cmnd.h
    2795 +++ b/include/scsi/scsi_cmnd.h
    2796 @@ -309,7 +309,7 @@ static inline void set_driver_byte(struct scsi_cmnd *cmd, char status)
    2797
    2798 static inline unsigned scsi_transfer_length(struct scsi_cmnd *scmd)
    2799 {
    2800 - unsigned int xfer_len = blk_rq_bytes(scmd->request);
    2801 + unsigned int xfer_len = scsi_out(scmd)->length;
    2802 unsigned int prot_op = scsi_get_prot_op(scmd);
    2803 unsigned int sector_size = scmd->device->sector_size;
    2804
    2805 diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
    2806 index 5853c913d2b0..27ab31017f09 100644
    2807 --- a/include/scsi/scsi_device.h
    2808 +++ b/include/scsi/scsi_device.h
    2809 @@ -173,6 +173,7 @@ struct scsi_device {
    2810 unsigned is_visible:1; /* is the device visible in sysfs */
    2811 unsigned wce_default_on:1; /* Cache is ON by default */
    2812 unsigned no_dif:1; /* T10 PI (DIF) should be disabled */
    2813 + unsigned broken_fua:1; /* Don't set FUA bit */
    2814
    2815 atomic_t disk_events_disable_depth; /* disable depth for disk events */
    2816
    2817 diff --git a/include/uapi/linux/usb/functionfs.h b/include/uapi/linux/usb/functionfs.h
    2818 index 2a4b4a72a4f9..24b68c59dcf8 100644
    2819 --- a/include/uapi/linux/usb/functionfs.h
    2820 +++ b/include/uapi/linux/usb/functionfs.h
    2821 @@ -33,6 +33,13 @@ struct usb_endpoint_descriptor_no_audio {
    2822 __u8 bInterval;
    2823 } __attribute__((packed));
    2824
    2825 +/* Legacy format, deprecated as of 3.14. */
    2826 +struct usb_functionfs_descs_head {
    2827 + __le32 magic;
    2828 + __le32 length;
    2829 + __le32 fs_count;
    2830 + __le32 hs_count;
    2831 +} __attribute__((packed, deprecated));
    2832
    2833 /*
    2834 * Descriptors format:
    2835 diff --git a/kernel/sysctl.c b/kernel/sysctl.c
    2836 index 74f5b580fe34..0e0373f51c58 100644
    2837 --- a/kernel/sysctl.c
    2838 +++ b/kernel/sysctl.c
    2839 @@ -136,7 +136,6 @@ static unsigned long dirty_bytes_min = 2 * PAGE_SIZE;
    2840 /* this is needed for the proc_dointvec_minmax for [fs_]overflow UID and GID */
    2841 static int maxolduid = 65535;
    2842 static int minolduid;
    2843 -static int min_percpu_pagelist_fract = 8;
    2844
    2845 static int ngroups_max = NGROUPS_MAX;
    2846 static const int cap_last_cap = CAP_LAST_CAP;
    2847 @@ -1305,7 +1304,7 @@ static struct ctl_table vm_table[] = {
    2848 .maxlen = sizeof(percpu_pagelist_fraction),
    2849 .mode = 0644,
    2850 .proc_handler = percpu_pagelist_fraction_sysctl_handler,
    2851 - .extra1 = &min_percpu_pagelist_fract,
    2852 + .extra1 = &zero,
    2853 },
    2854 #ifdef CONFIG_MMU
    2855 {
    2856 diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
    2857 index e916972c6d87..1848dc6278b7 100644
    2858 --- a/kernel/trace/trace.c
    2859 +++ b/kernel/trace/trace.c
    2860 @@ -1367,7 +1367,6 @@ void tracing_start(void)
    2861
    2862 arch_spin_unlock(&ftrace_max_lock);
    2863
    2864 - ftrace_start();
    2865 out:
    2866 raw_spin_unlock_irqrestore(&global_trace.start_lock, flags);
    2867 }
    2868 @@ -1414,7 +1413,6 @@ void tracing_stop(void)
    2869 struct ring_buffer *buffer;
    2870 unsigned long flags;
    2871
    2872 - ftrace_stop();
    2873 raw_spin_lock_irqsave(&global_trace.start_lock, flags);
    2874 if (global_trace.stop_count++)
    2875 goto out;
    2876 diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
    2877 index c082a7441345..da9d2614e82e 100644
    2878 --- a/kernel/trace/trace_uprobe.c
    2879 +++ b/kernel/trace/trace_uprobe.c
    2880 @@ -893,6 +893,9 @@ probe_event_enable(struct trace_uprobe *tu, struct ftrace_event_file *file,
    2881 int ret;
    2882
    2883 if (file) {
    2884 + if (tu->tp.flags & TP_FLAG_PROFILE)
    2885 + return -EINTR;
    2886 +
    2887 link = kmalloc(sizeof(*link), GFP_KERNEL);
    2888 if (!link)
    2889 return -ENOMEM;
    2890 @@ -901,29 +904,40 @@ probe_event_enable(struct trace_uprobe *tu, struct ftrace_event_file *file,
    2891 list_add_tail_rcu(&link->list, &tu->tp.files);
    2892
    2893 tu->tp.flags |= TP_FLAG_TRACE;
    2894 - } else
    2895 - tu->tp.flags |= TP_FLAG_PROFILE;
    2896 + } else {
    2897 + if (tu->tp.flags & TP_FLAG_TRACE)
    2898 + return -EINTR;
    2899
    2900 - ret = uprobe_buffer_enable();
    2901 - if (ret < 0)
    2902 - return ret;
    2903 + tu->tp.flags |= TP_FLAG_PROFILE;
    2904 + }
    2905
    2906 WARN_ON(!uprobe_filter_is_empty(&tu->filter));
    2907
    2908 if (enabled)
    2909 return 0;
    2910
    2911 + ret = uprobe_buffer_enable();
    2912 + if (ret)
    2913 + goto err_flags;
    2914 +
    2915 tu->consumer.filter = filter;
    2916 ret = uprobe_register(tu->inode, tu->offset, &tu->consumer);
    2917 - if (ret) {
    2918 - if (file) {
    2919 - list_del(&link->list);
    2920 - kfree(link);
    2921 - tu->tp.flags &= ~TP_FLAG_TRACE;
    2922 - } else
    2923 - tu->tp.flags &= ~TP_FLAG_PROFILE;
    2924 - }
    2925 + if (ret)
    2926 + goto err_buffer;
    2927 +
    2928 + return 0;
    2929 +
    2930 + err_buffer:
    2931 + uprobe_buffer_disable();
    2932
    2933 + err_flags:
    2934 + if (file) {
    2935 + list_del(&link->list);
    2936 + kfree(link);
    2937 + tu->tp.flags &= ~TP_FLAG_TRACE;
    2938 + } else {
    2939 + tu->tp.flags &= ~TP_FLAG_PROFILE;
    2940 + }
    2941 return ret;
    2942 }
    2943
    2944 diff --git a/mm/hugetlb.c b/mm/hugetlb.c
    2945 index c82290b9c1fc..a646f1598d58 100644
    2946 --- a/mm/hugetlb.c
    2947 +++ b/mm/hugetlb.c
    2948 @@ -2377,6 +2377,31 @@ static void set_huge_ptep_writable(struct vm_area_struct *vma,
    2949 update_mmu_cache(vma, address, ptep);
    2950 }
    2951
    2952 +static int is_hugetlb_entry_migration(pte_t pte)
    2953 +{
    2954 + swp_entry_t swp;
    2955 +
    2956 + if (huge_pte_none(pte) || pte_present(pte))
    2957 + return 0;
    2958 + swp = pte_to_swp_entry(pte);
    2959 + if (non_swap_entry(swp) && is_migration_entry(swp))
    2960 + return 1;
    2961 + else
    2962 + return 0;
    2963 +}
    2964 +
    2965 +static int is_hugetlb_entry_hwpoisoned(pte_t pte)
    2966 +{
    2967 + swp_entry_t swp;
    2968 +
    2969 + if (huge_pte_none(pte) || pte_present(pte))
    2970 + return 0;
    2971 + swp = pte_to_swp_entry(pte);
    2972 + if (non_swap_entry(swp) && is_hwpoison_entry(swp))
    2973 + return 1;
    2974 + else
    2975 + return 0;
    2976 +}
    2977
    2978 int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
    2979 struct vm_area_struct *vma)
    2980 @@ -2416,10 +2441,26 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
    2981 dst_ptl = huge_pte_lock(h, dst, dst_pte);
    2982 src_ptl = huge_pte_lockptr(h, src, src_pte);
    2983 spin_lock_nested(src_ptl, SINGLE_DEPTH_NESTING);
    2984 - if (!huge_pte_none(huge_ptep_get(src_pte))) {
    2985 + entry = huge_ptep_get(src_pte);
    2986 + if (huge_pte_none(entry)) { /* skip none entry */
    2987 + ;
    2988 + } else if (unlikely(is_hugetlb_entry_migration(entry) ||
    2989 + is_hugetlb_entry_hwpoisoned(entry))) {
    2990 + swp_entry_t swp_entry = pte_to_swp_entry(entry);
    2991 +
    2992 + if (is_write_migration_entry(swp_entry) && cow) {
    2993 + /*
    2994 + * COW mappings require pages in both
    2995 + * parent and child to be set to read.
    2996 + */
    2997 + make_migration_entry_read(&swp_entry);
    2998 + entry = swp_entry_to_pte(swp_entry);
    2999 + set_huge_pte_at(src, addr, src_pte, entry);
    3000 + }
    3001 + set_huge_pte_at(dst, addr, dst_pte, entry);
    3002 + } else {
    3003 if (cow)
    3004 huge_ptep_set_wrprotect(src, addr, src_pte);
    3005 - entry = huge_ptep_get(src_pte);
    3006 ptepage = pte_page(entry);
    3007 get_page(ptepage);
    3008 page_dup_rmap(ptepage);
    3009 @@ -2435,32 +2476,6 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
    3010 return ret;
    3011 }
    3012
    3013 -static int is_hugetlb_entry_migration(pte_t pte)
    3014 -{
    3015 - swp_entry_t swp;
    3016 -
    3017 - if (huge_pte_none(pte) || pte_present(pte))
    3018 - return 0;
    3019 - swp = pte_to_swp_entry(pte);
    3020 - if (non_swap_entry(swp) && is_migration_entry(swp))
    3021 - return 1;
    3022 - else
    3023 - return 0;
    3024 -}
    3025 -
    3026 -static int is_hugetlb_entry_hwpoisoned(pte_t pte)
    3027 -{
    3028 - swp_entry_t swp;
    3029 -
    3030 - if (huge_pte_none(pte) || pte_present(pte))
    3031 - return 0;
    3032 - swp = pte_to_swp_entry(pte);
    3033 - if (non_swap_entry(swp) && is_hwpoison_entry(swp))
    3034 - return 1;
    3035 - else
    3036 - return 0;
    3037 -}
    3038 -
    3039 void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma,
    3040 unsigned long start, unsigned long end,
    3041 struct page *ref_page)
    3042 diff --git a/mm/memory.c b/mm/memory.c
    3043 index 037b812a9531..e302ae1dcce0 100644
    3044 --- a/mm/memory.c
    3045 +++ b/mm/memory.c
    3046 @@ -3920,9 +3920,6 @@ static int __handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
    3047 }
    3048 }
    3049
    3050 - /* THP should already have been handled */
    3051 - BUG_ON(pmd_numa(*pmd));
    3052 -
    3053 /*
    3054 * Use __pte_alloc instead of pte_alloc_map, because we can't
    3055 * run pte_offset_map on the pmd, if an huge pmd could
    3056 diff --git a/mm/mempolicy.c b/mm/mempolicy.c
    3057 index 30cc47f8ffa0..35f9f91278fd 100644
    3058 --- a/mm/mempolicy.c
    3059 +++ b/mm/mempolicy.c
    3060 @@ -653,19 +653,18 @@ static unsigned long change_prot_numa(struct vm_area_struct *vma,
    3061 * @nodes and @flags,) it's isolated and queued to the pagelist which is
    3062 * passed via @private.)
    3063 */
    3064 -static struct vm_area_struct *
    3065 +static int
    3066 queue_pages_range(struct mm_struct *mm, unsigned long start, unsigned long end,
    3067 const nodemask_t *nodes, unsigned long flags, void *private)
    3068 {
    3069 - int err;
    3070 - struct vm_area_struct *first, *vma, *prev;
    3071 -
    3072 + int err = 0;
    3073 + struct vm_area_struct *vma, *prev;
    3074
    3075 - first = find_vma(mm, start);
    3076 - if (!first)
    3077 - return ERR_PTR(-EFAULT);
    3078 + vma = find_vma(mm, start);
    3079 + if (!vma)
    3080 + return -EFAULT;
    3081 prev = NULL;
    3082 - for (vma = first; vma && vma->vm_start < end; vma = vma->vm_next) {
    3083 + for (; vma && vma->vm_start < end; vma = vma->vm_next) {
    3084 unsigned long endvma = vma->vm_end;
    3085
    3086 if (endvma > end)
    3087 @@ -675,9 +674,9 @@ queue_pages_range(struct mm_struct *mm, unsigned long start, unsigned long end,
    3088
    3089 if (!(flags & MPOL_MF_DISCONTIG_OK)) {
    3090 if (!vma->vm_next && vma->vm_end < end)
    3091 - return ERR_PTR(-EFAULT);
    3092 + return -EFAULT;
    3093 if (prev && prev->vm_end < vma->vm_start)
    3094 - return ERR_PTR(-EFAULT);
    3095 + return -EFAULT;
    3096 }
    3097
    3098 if (flags & MPOL_MF_LAZY) {
    3099 @@ -691,15 +690,13 @@ queue_pages_range(struct mm_struct *mm, unsigned long start, unsigned long end,
    3100
    3101 err = queue_pages_pgd_range(vma, start, endvma, nodes,
    3102 flags, private);
    3103 - if (err) {
    3104 - first = ERR_PTR(err);
    3105 + if (err)
    3106 break;
    3107 - }
    3108 }
    3109 next:
    3110 prev = vma;
    3111 }
    3112 - return first;
    3113 + return err;
    3114 }
    3115
    3116 /*
    3117 @@ -1153,16 +1150,17 @@ out:
    3118
    3119 /*
    3120 * Allocate a new page for page migration based on vma policy.
    3121 - * Start assuming that page is mapped by vma pointed to by @private.
    3122 + * Start by assuming the page is mapped by the same vma as contains @start.
    3123 * Search forward from there, if not. N.B., this assumes that the
    3124 * list of pages handed to migrate_pages()--which is how we get here--
    3125 * is in virtual address order.
    3126 */
    3127 -static struct page *new_vma_page(struct page *page, unsigned long private, int **x)
    3128 +static struct page *new_page(struct page *page, unsigned long start, int **x)
    3129 {
    3130 - struct vm_area_struct *vma = (struct vm_area_struct *)private;
    3131 + struct vm_area_struct *vma;
    3132 unsigned long uninitialized_var(address);
    3133
    3134 + vma = find_vma(current->mm, start);
    3135 while (vma) {
    3136 address = page_address_in_vma(page, vma);
    3137 if (address != -EFAULT)
    3138 @@ -1192,7 +1190,7 @@ int do_migrate_pages(struct mm_struct *mm, const nodemask_t *from,
    3139 return -ENOSYS;
    3140 }
    3141
    3142 -static struct page *new_vma_page(struct page *page, unsigned long private, int **x)
    3143 +static struct page *new_page(struct page *page, unsigned long start, int **x)
    3144 {
    3145 return NULL;
    3146 }
    3147 @@ -1202,7 +1200,6 @@ static long do_mbind(unsigned long start, unsigned long len,
    3148 unsigned short mode, unsigned short mode_flags,
    3149 nodemask_t *nmask, unsigned long flags)
    3150 {
    3151 - struct vm_area_struct *vma;
    3152 struct mm_struct *mm = current->mm;
    3153 struct mempolicy *new;
    3154 unsigned long end;
    3155 @@ -1268,11 +1265,9 @@ static long do_mbind(unsigned long start, unsigned long len,
    3156 if (err)
    3157 goto mpol_out;
    3158
    3159 - vma = queue_pages_range(mm, start, end, nmask,
    3160 + err = queue_pages_range(mm, start, end, nmask,
    3161 flags | MPOL_MF_INVERT, &pagelist);
    3162 -
    3163 - err = PTR_ERR(vma); /* maybe ... */
    3164 - if (!IS_ERR(vma))
    3165 + if (!err)
    3166 err = mbind_range(mm, start, end, new);
    3167
    3168 if (!err) {
    3169 @@ -1280,9 +1275,8 @@ static long do_mbind(unsigned long start, unsigned long len,
    3170
    3171 if (!list_empty(&pagelist)) {
    3172 WARN_ON_ONCE(flags & MPOL_MF_LAZY);
    3173 - nr_failed = migrate_pages(&pagelist, new_vma_page,
    3174 - (unsigned long)vma,
    3175 - MIGRATE_SYNC, MR_MEMPOLICY_MBIND);
    3176 + nr_failed = migrate_pages(&pagelist, new_page,
    3177 + start, MIGRATE_SYNC, MR_MEMPOLICY_MBIND);
    3178 if (nr_failed)
    3179 putback_movable_pages(&pagelist);
    3180 }
    3181 diff --git a/mm/nommu.c b/mm/nommu.c
    3182 index 85f8d6698d48..431fd7c277cc 100644
    3183 --- a/mm/nommu.c
    3184 +++ b/mm/nommu.c
    3185 @@ -783,7 +783,7 @@ static void delete_vma_from_mm(struct vm_area_struct *vma)
    3186 for (i = 0; i < VMACACHE_SIZE; i++) {
    3187 /* if the vma is cached, invalidate the entire cache */
    3188 if (curr->vmacache[i] == vma) {
    3189 - vmacache_invalidate(curr->mm);
    3190 + vmacache_invalidate(mm);
    3191 break;
    3192 }
    3193 }
    3194 diff --git a/mm/page_alloc.c b/mm/page_alloc.c
    3195 index 56eb0eb382b1..d64f5f90000c 100644
    3196 --- a/mm/page_alloc.c
    3197 +++ b/mm/page_alloc.c
    3198 @@ -69,6 +69,7 @@
    3199
    3200 /* prevent >1 _updater_ of zone percpu pageset ->high and ->batch fields */
    3201 static DEFINE_MUTEX(pcp_batch_high_lock);
    3202 +#define MIN_PERCPU_PAGELIST_FRACTION (8)
    3203
    3204 #ifdef CONFIG_USE_PERCPU_NUMA_NODE_ID
    3205 DEFINE_PER_CPU(int, numa_node);
    3206 @@ -799,9 +800,21 @@ void __init init_cma_reserved_pageblock(struct page *page)
    3207 set_page_count(p, 0);
    3208 } while (++p, --i);
    3209
    3210 - set_page_refcounted(page);
    3211 set_pageblock_migratetype(page, MIGRATE_CMA);
    3212 - __free_pages(page, pageblock_order);
    3213 +
    3214 + if (pageblock_order >= MAX_ORDER) {
    3215 + i = pageblock_nr_pages;
    3216 + p = page;
    3217 + do {
    3218 + set_page_refcounted(p);
    3219 + __free_pages(p, MAX_ORDER - 1);
    3220 + p += MAX_ORDER_NR_PAGES;
    3221 + } while (i -= MAX_ORDER_NR_PAGES);
    3222 + } else {
    3223 + set_page_refcounted(page);
    3224 + __free_pages(page, pageblock_order);
    3225 + }
    3226 +
    3227 adjust_managed_page_count(page, pageblock_nr_pages);
    3228 }
    3229 #endif
    3230 @@ -4107,7 +4120,7 @@ static void __meminit zone_init_free_lists(struct zone *zone)
    3231 memmap_init_zone((size), (nid), (zone), (start_pfn), MEMMAP_EARLY)
    3232 #endif
    3233
    3234 -static int __meminit zone_batchsize(struct zone *zone)
    3235 +static int zone_batchsize(struct zone *zone)
    3236 {
    3237 #ifdef CONFIG_MMU
    3238 int batch;
    3239 @@ -4223,8 +4236,8 @@ static void pageset_set_high(struct per_cpu_pageset *p,
    3240 pageset_update(&p->pcp, high, batch);
    3241 }
    3242
    3243 -static void __meminit pageset_set_high_and_batch(struct zone *zone,
    3244 - struct per_cpu_pageset *pcp)
    3245 +static void pageset_set_high_and_batch(struct zone *zone,
    3246 + struct per_cpu_pageset *pcp)
    3247 {
    3248 if (percpu_pagelist_fraction)
    3249 pageset_set_high(pcp,
    3250 @@ -5850,23 +5863,38 @@ int percpu_pagelist_fraction_sysctl_handler(ctl_table *table, int write,
    3251 void __user *buffer, size_t *length, loff_t *ppos)
    3252 {
    3253 struct zone *zone;
    3254 - unsigned int cpu;
    3255 + int old_percpu_pagelist_fraction;
    3256 int ret;
    3257
    3258 + mutex_lock(&pcp_batch_high_lock);
    3259 + old_percpu_pagelist_fraction = percpu_pagelist_fraction;
    3260 +
    3261 ret = proc_dointvec_minmax(table, write, buffer, length, ppos);
    3262 - if (!write || (ret < 0))
    3263 - return ret;
    3264 + if (!write || ret < 0)
    3265 + goto out;
    3266 +
    3267 + /* Sanity checking to avoid pcp imbalance */
    3268 + if (percpu_pagelist_fraction &&
    3269 + percpu_pagelist_fraction < MIN_PERCPU_PAGELIST_FRACTION) {
    3270 + percpu_pagelist_fraction = old_percpu_pagelist_fraction;
    3271 + ret = -EINVAL;
    3272 + goto out;
    3273 + }
    3274 +
    3275 + /* No change? */
    3276 + if (percpu_pagelist_fraction == old_percpu_pagelist_fraction)
    3277 + goto out;
    3278
    3279 - mutex_lock(&pcp_batch_high_lock);
    3280 for_each_populated_zone(zone) {
    3281 - unsigned long high;
    3282 - high = zone->managed_pages / percpu_pagelist_fraction;
    3283 + unsigned int cpu;
    3284 +
    3285 for_each_possible_cpu(cpu)
    3286 - pageset_set_high(per_cpu_ptr(zone->pageset, cpu),
    3287 - high);
    3288 + pageset_set_high_and_batch(zone,
    3289 + per_cpu_ptr(zone->pageset, cpu));
    3290 }
    3291 +out:
    3292 mutex_unlock(&pcp_batch_high_lock);
    3293 - return 0;
    3294 + return ret;
    3295 }
    3296
    3297 int hashdist = HASHDIST_DEFAULT;
    3298 diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
    3299 index 521fd4f3985e..ea72cc0de9b7 100644
    3300 --- a/net/bluetooth/hci_conn.c
    3301 +++ b/net/bluetooth/hci_conn.c
    3302 @@ -584,11 +584,6 @@ static void hci_req_add_le_create_conn(struct hci_request *req,
    3303 if (hci_update_random_address(req, false, &own_addr_type))
    3304 return;
    3305
    3306 - /* Save the address type used for this connnection attempt so we able
    3307 - * to retrieve this information if we need it.
    3308 - */
    3309 - conn->src_type = own_addr_type;
    3310 -
    3311 cp.scan_interval = cpu_to_le16(hdev->le_scan_interval);
    3312 cp.scan_window = cpu_to_le16(hdev->le_scan_window);
    3313 bacpy(&cp.peer_addr, &conn->dst);
    3314 @@ -826,7 +821,7 @@ static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
    3315 /* If we're already encrypted set the REAUTH_PEND flag,
    3316 * otherwise set the ENCRYPT_PEND.
    3317 */
    3318 - if (conn->key_type != 0xff)
    3319 + if (conn->link_mode & HCI_LM_ENCRYPT)
    3320 set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
    3321 else
    3322 set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
    3323 diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
    3324 index 0381d55f995d..40357c8e3d27 100644
    3325 --- a/net/bluetooth/hci_event.c
    3326 +++ b/net/bluetooth/hci_event.c
    3327 @@ -48,6 +48,10 @@ static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
    3328 smp_mb__after_clear_bit(); /* wake_up_bit advises about this barrier */
    3329 wake_up_bit(&hdev->flags, HCI_INQUIRY);
    3330
    3331 + hci_dev_lock(hdev);
    3332 + hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
    3333 + hci_dev_unlock(hdev);
    3334 +
    3335 hci_conn_check_pending(hdev);
    3336 }
    3337
    3338 @@ -3503,8 +3507,11 @@ static void hci_user_confirm_request_evt(struct hci_dev *hdev,
    3339
    3340 /* If we're not the initiators request authorization to
    3341 * proceed from user space (mgmt_user_confirm with
    3342 - * confirm_hint set to 1). */
    3343 - if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
    3344 + * confirm_hint set to 1). The exception is if neither
    3345 + * side had MITM in which case we do auto-accept.
    3346 + */
    3347 + if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
    3348 + (loc_mitm || rem_mitm)) {
    3349 BT_DBG("Confirming auto-accept as acceptor");
    3350 confirm_hint = 1;
    3351 goto confirm;
    3352 diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
    3353 index dc4d301d3a72..1c97b7a4f170 100644
    3354 --- a/net/bluetooth/l2cap_core.c
    3355 +++ b/net/bluetooth/l2cap_core.c
    3356 @@ -1657,7 +1657,13 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
    3357 kfree_skb(conn->rx_skb);
    3358
    3359 skb_queue_purge(&conn->pending_rx);
    3360 - flush_work(&conn->pending_rx_work);
    3361 +
    3362 + /* We can not call flush_work(&conn->pending_rx_work) here since we
    3363 + * might block if we are running on a worker from the same workqueue
    3364 + * pending_rx_work is waiting on.
    3365 + */
    3366 + if (work_pending(&conn->pending_rx_work))
    3367 + cancel_work_sync(&conn->pending_rx_work);
    3368
    3369 l2cap_unregister_all_users(conn);
    3370
    3371 diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
    3372 index ade3fb4c23bc..e1378693cc90 100644
    3373 --- a/net/bluetooth/l2cap_sock.c
    3374 +++ b/net/bluetooth/l2cap_sock.c
    3375 @@ -787,11 +787,6 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
    3376
    3377 /*change security for LE channels */
    3378 if (chan->scid == L2CAP_CID_ATT) {
    3379 - if (!conn->hcon->out) {
    3380 - err = -EINVAL;
    3381 - break;
    3382 - }
    3383 -
    3384 if (smp_conn_security(conn->hcon, sec.level))
    3385 break;
    3386 sk->sk_state = BT_CONFIG;
    3387 diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
    3388 index c88b2b671849..a88cb3321361 100644
    3389 --- a/net/bluetooth/mgmt.c
    3390 +++ b/net/bluetooth/mgmt.c
    3391 @@ -1045,6 +1045,43 @@ static void clean_up_hci_complete(struct hci_dev *hdev, u8 status)
    3392 }
    3393 }
    3394
    3395 +static void hci_stop_discovery(struct hci_request *req)
    3396 +{
    3397 + struct hci_dev *hdev = req->hdev;
    3398 + struct hci_cp_remote_name_req_cancel cp;
    3399 + struct inquiry_entry *e;
    3400 +
    3401 + switch (hdev->discovery.state) {
    3402 + case DISCOVERY_FINDING:
    3403 + if (test_bit(HCI_INQUIRY, &hdev->flags)) {
    3404 + hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
    3405 + } else {
    3406 + cancel_delayed_work(&hdev->le_scan_disable);
    3407 + hci_req_add_le_scan_disable(req);
    3408 + }
    3409 +
    3410 + break;
    3411 +
    3412 + case DISCOVERY_RESOLVING:
    3413 + e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
    3414 + NAME_PENDING);
    3415 + if (!e)
    3416 + return;
    3417 +
    3418 + bacpy(&cp.bdaddr, &e->data.bdaddr);
    3419 + hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
    3420 + &cp);
    3421 +
    3422 + break;
    3423 +
    3424 + default:
    3425 + /* Passive scanning */
    3426 + if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
    3427 + hci_req_add_le_scan_disable(req);
    3428 + break;
    3429 + }
    3430 +}
    3431 +
    3432 static int clean_up_hci_state(struct hci_dev *hdev)
    3433 {
    3434 struct hci_request req;
    3435 @@ -1061,9 +1098,7 @@ static int clean_up_hci_state(struct hci_dev *hdev)
    3436 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
    3437 disable_advertising(&req);
    3438
    3439 - if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
    3440 - hci_req_add_le_scan_disable(&req);
    3441 - }
    3442 + hci_stop_discovery(&req);
    3443
    3444 list_for_each_entry(conn, &hdev->conn_hash.list, list) {
    3445 struct hci_cp_disconnect dc;
    3446 @@ -2997,8 +3032,13 @@ static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
    3447 }
    3448
    3449 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
    3450 - /* Continue with pairing via SMP */
    3451 + /* Continue with pairing via SMP. The hdev lock must be
    3452 + * released as SMP may try to recquire it for crypto
    3453 + * purposes.
    3454 + */
    3455 + hci_dev_unlock(hdev);
    3456 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
    3457 + hci_dev_lock(hdev);
    3458
    3459 if (!err)
    3460 err = cmd_complete(sk, hdev->id, mgmt_op,
    3461 @@ -3570,8 +3610,6 @@ static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
    3462 {
    3463 struct mgmt_cp_stop_discovery *mgmt_cp = data;
    3464 struct pending_cmd *cmd;
    3465 - struct hci_cp_remote_name_req_cancel cp;
    3466 - struct inquiry_entry *e;
    3467 struct hci_request req;
    3468 int err;
    3469
    3470 @@ -3601,52 +3639,22 @@ static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
    3471
    3472 hci_req_init(&req, hdev);
    3473
    3474 - switch (hdev->discovery.state) {
    3475 - case DISCOVERY_FINDING:
    3476 - if (test_bit(HCI_INQUIRY, &hdev->flags)) {
    3477 - hci_req_add(&req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
    3478 - } else {
    3479 - cancel_delayed_work(&hdev->le_scan_disable);
    3480 -
    3481 - hci_req_add_le_scan_disable(&req);
    3482 - }
    3483 -
    3484 - break;
    3485 + hci_stop_discovery(&req);
    3486
    3487 - case DISCOVERY_RESOLVING:
    3488 - e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
    3489 - NAME_PENDING);
    3490 - if (!e) {
    3491 - mgmt_pending_remove(cmd);
    3492 - err = cmd_complete(sk, hdev->id,
    3493 - MGMT_OP_STOP_DISCOVERY, 0,
    3494 - &mgmt_cp->type,
    3495 - sizeof(mgmt_cp->type));
    3496 - hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
    3497 - goto unlock;
    3498 - }
    3499 -
    3500 - bacpy(&cp.bdaddr, &e->data.bdaddr);
    3501 - hci_req_add(&req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
    3502 - &cp);
    3503 -
    3504 - break;
    3505 -
    3506 - default:
    3507 - BT_DBG("unknown discovery state %u", hdev->discovery.state);
    3508 -
    3509 - mgmt_pending_remove(cmd);
    3510 - err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
    3511 - MGMT_STATUS_FAILED, &mgmt_cp->type,
    3512 - sizeof(mgmt_cp->type));
    3513 + err = hci_req_run(&req, stop_discovery_complete);
    3514 + if (!err) {
    3515 + hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
    3516 goto unlock;
    3517 }
    3518
    3519 - err = hci_req_run(&req, stop_discovery_complete);
    3520 - if (err < 0)
    3521 - mgmt_pending_remove(cmd);
    3522 - else
    3523 - hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
    3524 + mgmt_pending_remove(cmd);
    3525 +
    3526 + /* If no HCI commands were sent we're done */
    3527 + if (err == -ENODATA) {
    3528 + err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
    3529 + &mgmt_cp->type, sizeof(mgmt_cp->type));
    3530 + hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
    3531 + }
    3532
    3533 unlock:
    3534 hci_dev_unlock(hdev);
    3535 diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
    3536 index 956d127528cb..863425a5886e 100644
    3537 --- a/net/bluetooth/smp.c
    3538 +++ b/net/bluetooth/smp.c
    3539 @@ -533,7 +533,7 @@ static void random_work(struct work_struct *work)
    3540 hci_le_start_enc(hcon, ediv, rand, stk);
    3541 hcon->enc_key_size = smp->enc_key_size;
    3542 } else {
    3543 - u8 stk[16];
    3544 + u8 stk[16], auth;
    3545 __le64 rand = 0;
    3546 __le16 ediv = 0;
    3547
    3548 @@ -545,8 +545,13 @@ static void random_work(struct work_struct *work)
    3549 memset(stk + smp->enc_key_size, 0,
    3550 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
    3551
    3552 + if (hcon->pending_sec_level == BT_SECURITY_HIGH)
    3553 + auth = 1;
    3554 + else
    3555 + auth = 0;
    3556 +
    3557 hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
    3558 - HCI_SMP_STK_SLAVE, 0, stk, smp->enc_key_size,
    3559 + HCI_SMP_STK_SLAVE, auth, stk, smp->enc_key_size,
    3560 ediv, rand);
    3561 }
    3562
    3563 diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
    3564 index 40a648938985..e205ebabfa50 100644
    3565 --- a/net/mac80211/debugfs_netdev.c
    3566 +++ b/net/mac80211/debugfs_netdev.c
    3567 @@ -34,8 +34,7 @@ static ssize_t ieee80211_if_read(
    3568 ssize_t ret = -EINVAL;
    3569
    3570 read_lock(&dev_base_lock);
    3571 - if (sdata->dev->reg_state == NETREG_REGISTERED)
    3572 - ret = (*format)(sdata, buf, sizeof(buf));
    3573 + ret = (*format)(sdata, buf, sizeof(buf));
    3574 read_unlock(&dev_base_lock);
    3575
    3576 if (ret >= 0)
    3577 @@ -62,8 +61,7 @@ static ssize_t ieee80211_if_write(
    3578
    3579 ret = -ENODEV;
    3580 rtnl_lock();
    3581 - if (sdata->dev->reg_state == NETREG_REGISTERED)
    3582 - ret = (*write)(sdata, buf, count);
    3583 + ret = (*write)(sdata, buf, count);
    3584 rtnl_unlock();
    3585
    3586 return ret;
    3587 diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
    3588 index 06d28787945b..53cf876b97b2 100644
    3589 --- a/net/mac80211/ibss.c
    3590 +++ b/net/mac80211/ibss.c
    3591 @@ -1648,6 +1648,7 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
    3592 sdata->u.ibss.control_port = params->control_port;
    3593 sdata->u.ibss.userspace_handles_dfs = params->userspace_handles_dfs;
    3594 sdata->u.ibss.basic_rates = params->basic_rates;
    3595 + sdata->u.ibss.last_scan_completed = jiffies;
    3596
    3597 /* fix basic_rates if channel does not support these rates */
    3598 rate_flags = ieee80211_chandef_rate_flags(&params->chandef);
    3599 diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
    3600 index 847d92f6bef6..8f8c11583630 100644
    3601 --- a/net/mac80211/sta_info.c
    3602 +++ b/net/mac80211/sta_info.c
    3603 @@ -240,6 +240,7 @@ void sta_info_free(struct ieee80211_local *local, struct sta_info *sta)
    3604
    3605 sta_dbg(sta->sdata, "Destroyed STA %pM\n", sta->sta.addr);
    3606
    3607 + kfree(rcu_dereference_raw(sta->sta.rates));
    3608 kfree(sta);
    3609 }
    3610
    3611 diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
    3612 index 58579634427d..70123f48b6c9 100644
    3613 --- a/net/netfilter/nf_conntrack_netlink.c
    3614 +++ b/net/netfilter/nf_conntrack_netlink.c
    3615 @@ -1150,7 +1150,7 @@ static int ctnetlink_done_list(struct netlink_callback *cb)
    3616 static int
    3617 ctnetlink_dump_list(struct sk_buff *skb, struct netlink_callback *cb, bool dying)
    3618 {
    3619 - struct nf_conn *ct, *last = NULL;
    3620 + struct nf_conn *ct, *last;
    3621 struct nf_conntrack_tuple_hash *h;
    3622 struct hlist_nulls_node *n;
    3623 struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
    3624 @@ -1163,8 +1163,7 @@ ctnetlink_dump_list(struct sk_buff *skb, struct netlink_callback *cb, bool dying
    3625 if (cb->args[2])
    3626 return 0;
    3627
    3628 - if (cb->args[0] == nr_cpu_ids)
    3629 - return 0;
    3630 + last = (struct nf_conn *)cb->args[1];
    3631
    3632 for (cpu = cb->args[0]; cpu < nr_cpu_ids; cpu++) {
    3633 struct ct_pcpu *pcpu;
    3634 @@ -1174,7 +1173,6 @@ ctnetlink_dump_list(struct sk_buff *skb, struct netlink_callback *cb, bool dying
    3635
    3636 pcpu = per_cpu_ptr(net->ct.pcpu_lists, cpu);
    3637 spin_lock_bh(&pcpu->lock);
    3638 - last = (struct nf_conn *)cb->args[1];
    3639 list = dying ? &pcpu->dying : &pcpu->unconfirmed;
    3640 restart:
    3641 hlist_nulls_for_each_entry(h, n, list, hnnode) {
    3642 @@ -1193,7 +1191,9 @@ restart:
    3643 ct);
    3644 rcu_read_unlock();
    3645 if (res < 0) {
    3646 - nf_conntrack_get(&ct->ct_general);
    3647 + if (!atomic_inc_not_zero(&ct->ct_general.use))
    3648 + continue;
    3649 + cb->args[0] = cpu;
    3650 cb->args[1] = (unsigned long)ct;
    3651 spin_unlock_bh(&pcpu->lock);
    3652 goto out;
    3653 @@ -1202,10 +1202,10 @@ restart:
    3654 if (cb->args[1]) {
    3655 cb->args[1] = 0;
    3656 goto restart;
    3657 - } else
    3658 - cb->args[2] = 1;
    3659 + }
    3660 spin_unlock_bh(&pcpu->lock);
    3661 }
    3662 + cb->args[2] = 1;
    3663 out:
    3664 if (last)
    3665 nf_ct_put(last);
    3666 diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
    3667 index 52ca952b802c..23247a0d2b69 100644
    3668 --- a/net/netfilter/nf_nat_core.c
    3669 +++ b/net/netfilter/nf_nat_core.c
    3670 @@ -517,6 +517,39 @@ static int nf_nat_proto_remove(struct nf_conn *i, void *data)
    3671 return i->status & IPS_NAT_MASK ? 1 : 0;
    3672 }
    3673
    3674 +static int nf_nat_proto_clean(struct nf_conn *ct, void *data)
    3675 +{
    3676 + struct nf_conn_nat *nat = nfct_nat(ct);
    3677 +
    3678 + if (nf_nat_proto_remove(ct, data))
    3679 + return 1;
    3680 +
    3681 + if (!nat || !nat->ct)
    3682 + return 0;
    3683 +
    3684 + /* This netns is being destroyed, and conntrack has nat null binding.
    3685 + * Remove it from bysource hash, as the table will be freed soon.
    3686 + *
    3687 + * Else, when the conntrack is destoyed, nf_nat_cleanup_conntrack()
    3688 + * will delete entry from already-freed table.
    3689 + */
    3690 + if (!del_timer(&ct->timeout))
    3691 + return 1;
    3692 +
    3693 + spin_lock_bh(&nf_nat_lock);
    3694 + hlist_del_rcu(&nat->bysource);
    3695 + ct->status &= ~IPS_NAT_DONE_MASK;
    3696 + nat->ct = NULL;
    3697 + spin_unlock_bh(&nf_nat_lock);
    3698 +
    3699 + add_timer(&ct->timeout);
    3700 +
    3701 + /* don't delete conntrack. Although that would make things a lot
    3702 + * simpler, we'd end up flushing all conntracks on nat rmmod.
    3703 + */
    3704 + return 0;
    3705 +}
    3706 +
    3707 static void nf_nat_l4proto_clean(u8 l3proto, u8 l4proto)
    3708 {
    3709 struct nf_nat_proto_clean clean = {
    3710 @@ -787,7 +820,7 @@ static void __net_exit nf_nat_net_exit(struct net *net)
    3711 {
    3712 struct nf_nat_proto_clean clean = {};
    3713
    3714 - nf_ct_iterate_cleanup(net, &nf_nat_proto_remove, &clean, 0, 0);
    3715 + nf_ct_iterate_cleanup(net, nf_nat_proto_clean, &clean, 0, 0);
    3716 synchronize_rcu();
    3717 nf_ct_free_hashtable(net->ct.nat_bysource, net->ct.nat_htable_size);
    3718 }
    3719 diff --git a/sound/pci/hda/hda_i915.c b/sound/pci/hda/hda_i915.c
    3720 index 9d07e4edacdb..8b4940ba33d6 100644
    3721 --- a/sound/pci/hda/hda_i915.c
    3722 +++ b/sound/pci/hda/hda_i915.c
    3723 @@ -20,24 +20,71 @@
    3724 #include <linux/module.h>
    3725 #include <sound/core.h>
    3726 #include <drm/i915_powerwell.h>
    3727 +#include "hda_priv.h"
    3728 #include "hda_i915.h"
    3729
    3730 -static void (*get_power)(void);
    3731 -static void (*put_power)(void);
    3732 +/* Intel HSW/BDW display HDA controller Extended Mode registers.
    3733 + * EM4 (M value) and EM5 (N Value) are used to convert CDClk (Core Display
    3734 + * Clock) to 24MHz BCLK: BCLK = CDCLK * M / N
    3735 + * The values will be lost when the display power well is disabled.
    3736 + */
    3737 +#define ICH6_REG_EM4 0x100c
    3738 +#define ICH6_REG_EM5 0x1010
    3739 +
    3740 +static int (*get_power)(void);
    3741 +static int (*put_power)(void);
    3742 +static int (*get_cdclk)(void);
    3743
    3744 -void hda_display_power(bool enable)
    3745 +int hda_display_power(bool enable)
    3746 {
    3747 if (!get_power || !put_power)
    3748 - return;
    3749 + return -ENODEV;
    3750
    3751 pr_debug("HDA display power %s \n",
    3752 enable ? "Enable" : "Disable");
    3753 if (enable)
    3754 - get_power();
    3755 + return get_power();
    3756 else
    3757 - put_power();
    3758 + return put_power();
    3759 +}
    3760 +
    3761 +void haswell_set_bclk(struct azx *chip)
    3762 +{
    3763 + int cdclk_freq;
    3764 + unsigned int bclk_m, bclk_n;
    3765 +
    3766 + if (!get_cdclk)
    3767 + return;
    3768 +
    3769 + cdclk_freq = get_cdclk();
    3770 + switch (cdclk_freq) {
    3771 + case 337500:
    3772 + bclk_m = 16;
    3773 + bclk_n = 225;
    3774 + break;
    3775 +
    3776 + case 450000:
    3777 + default: /* default CDCLK 450MHz */
    3778 + bclk_m = 4;
    3779 + bclk_n = 75;
    3780 + break;
    3781 +
    3782 + case 540000:
    3783 + bclk_m = 4;
    3784 + bclk_n = 90;
    3785 + break;
    3786 +
    3787 + case 675000:
    3788 + bclk_m = 8;
    3789 + bclk_n = 225;
    3790 + break;
    3791 + }
    3792 +
    3793 + azx_writew(chip, EM4, bclk_m);
    3794 + azx_writew(chip, EM5, bclk_n);
    3795 }
    3796
    3797 +
    3798 int hda_i915_init(void)
    3799 {
    3800 int err = 0;
    3801 @@ -55,6 +102,10 @@ int hda_i915_init(void)
    3802 return -ENODEV;
    3803 }
    3804
    3805 + get_cdclk = symbol_request(i915_get_cdclk_freq);
    3806 + if (!get_cdclk) /* may have abnormal BCLK and audio playback rate */
    3807 + pr_warn("hda-i915: get_cdclk symbol get fail\n");
    3808 +
    3809 pr_debug("HDA driver get symbol successfully from i915 module\n");
    3810
    3811 return err;
    3812 @@ -70,6 +121,10 @@ int hda_i915_exit(void)
    3813 symbol_put(i915_release_power_well);
    3814 put_power = NULL;
    3815 }
    3816 + if (get_cdclk) {
    3817 + symbol_put(i915_get_cdclk_freq);
    3818 + get_cdclk = NULL;
    3819 + }
    3820
    3821 return 0;
    3822 }
    3823 diff --git a/sound/pci/hda/hda_i915.h b/sound/pci/hda/hda_i915.h
    3824 index 5a63da2c53e5..e6072c627583 100644
    3825 --- a/sound/pci/hda/hda_i915.h
    3826 +++ b/sound/pci/hda/hda_i915.h
    3827 @@ -17,11 +17,13 @@
    3828 #define __SOUND_HDA_I915_H
    3829
    3830 #ifdef CONFIG_SND_HDA_I915
    3831 -void hda_display_power(bool enable);
    3832 +int hda_display_power(bool enable);
    3833 +void haswell_set_bclk(struct azx *chip);
    3834 int hda_i915_init(void);
    3835 int hda_i915_exit(void);
    3836 #else
    3837 -static inline void hda_display_power(bool enable) {}
    3838 +static inline int hda_display_power(bool enable) { return 0; }
    3839 +static inline void haswell_set_bclk(struct azx *chip) { return; }
    3840 static inline int hda_i915_init(void)
    3841 {
    3842 return -ENODEV;
    3843 diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
    3844 index 0176cf0e01d9..bc36f9cdd9d2 100644
    3845 --- a/sound/pci/hda/hda_intel.c
    3846 +++ b/sound/pci/hda/hda_intel.c
    3847 @@ -62,9 +62,9 @@
    3848 #include <linux/vga_switcheroo.h>
    3849 #include <linux/firmware.h>
    3850 #include "hda_codec.h"
    3851 -#include "hda_i915.h"
    3852 #include "hda_controller.h"
    3853 #include "hda_priv.h"
    3854 +#include "hda_i915.h"
    3855
    3856
    3857 static int index[SNDRV_CARDS] = SNDRV_DEFAULT_IDX;
    3858 @@ -282,21 +282,8 @@ static char *driver_short_names[] = {
    3859 [AZX_DRIVER_GENERIC] = "HD-Audio Generic",
    3860 };
    3861
    3862 -
    3863 -/* Intel HSW/BDW display HDA controller Extended Mode registers.
    3864 - * EM4 (M value) and EM5 (N Value) are used to convert CDClk (Core Display
    3865 - * Clock) to 24MHz BCLK: BCLK = CDCLK * M / N
    3866 - * The values will be lost when the display power well is disabled.
    3867 - */
    3868 -#define ICH6_REG_EM4 0x100c
    3869 -#define ICH6_REG_EM5 0x1010
    3870 -
    3871 struct hda_intel {
    3872 struct azx chip;
    3873 -
    3874 - /* HSW/BDW display HDA controller to restore BCLK from CDCLK */
    3875 - unsigned int bclk_m;
    3876 - unsigned int bclk_n;
    3877 };
    3878
    3879
    3880 @@ -592,22 +579,6 @@ static int param_set_xint(const char *val, const struct kernel_param *kp)
    3881 #define azx_del_card_list(chip) /* NOP */
    3882 #endif /* CONFIG_PM */
    3883
    3884 -static void haswell_save_bclk(struct azx *chip)
    3885 -{
    3886 - struct hda_intel *hda = container_of(chip, struct hda_intel, chip);
    3887 -
    3888 - hda->bclk_m = azx_readw(chip, EM4);
    3889 - hda->bclk_n = azx_readw(chip, EM5);
    3890 -}
    3891 -
    3892 -static void haswell_restore_bclk(struct azx *chip)
    3893 -{
    3894 - struct hda_intel *hda = container_of(chip, struct hda_intel, chip);
    3895 -
    3896 - azx_writew(chip, EM4, hda->bclk_m);
    3897 - azx_writew(chip, EM5, hda->bclk_n);
    3898 -}
    3899 -
    3900 #if defined(CONFIG_PM_SLEEP) || defined(SUPPORT_VGA_SWITCHEROO)
    3901 /*
    3902 * power management
    3903 @@ -635,12 +606,6 @@ static int azx_suspend(struct device *dev)
    3904 chip->irq = -1;
    3905 }
    3906
    3907 - /* Save BCLK M/N values before they become invalid in D3.
    3908 - * Will test if display power well can be released now.
    3909 - */
    3910 - if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL)
    3911 - haswell_save_bclk(chip);
    3912 -
    3913 if (chip->msi)
    3914 pci_disable_msi(chip->pci);
    3915 pci_disable_device(pci);
    3916 @@ -662,7 +627,7 @@ static int azx_resume(struct device *dev)
    3917
    3918 if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL) {
    3919 hda_display_power(true);
    3920 - haswell_restore_bclk(chip);
    3921 + haswell_set_bclk(chip);
    3922 }
    3923 pci_set_power_state(pci, PCI_D0);
    3924 pci_restore_state(pci);
    3925 @@ -707,10 +672,9 @@ static int azx_runtime_suspend(struct device *dev)
    3926 azx_stop_chip(chip);
    3927 azx_enter_link_reset(chip);
    3928 azx_clear_irq_pending(chip);
    3929 - if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL) {
    3930 - haswell_save_bclk(chip);
    3931 + if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL)
    3932 hda_display_power(false);
    3933 - }
    3934 +
    3935 return 0;
    3936 }
    3937
    3938 @@ -730,7 +694,7 @@ static int azx_runtime_resume(struct device *dev)
    3939
    3940 if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL) {
    3941 hda_display_power(true);
    3942 - haswell_restore_bclk(chip);
    3943 + haswell_set_bclk(chip);
    3944 }
    3945
    3946 /* Read STATESTS before controller reset */
    3947 @@ -1426,6 +1390,10 @@ static int azx_first_init(struct azx *chip)
    3948
    3949 /* initialize chip */
    3950 azx_init_pci(chip);
    3951 +
    3952 + if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL)
    3953 + haswell_set_bclk(chip);
    3954 +
    3955 azx_init_chip(chip, (probe_only[dev] & 2) == 0);
    3956
    3957 /* codec detection */
    3958 @@ -1707,8 +1675,13 @@ static int azx_probe_continue(struct azx *chip)
    3959 "Error request power-well from i915\n");
    3960 goto out_free;
    3961 }
    3962 + err = hda_display_power(true);
    3963 + if (err < 0) {
    3964 + dev_err(chip->card->dev,
    3965 + "Cannot turn on display power on i915\n");
    3966 + goto out_free;
    3967 + }
    3968 #endif
    3969 - hda_display_power(true);
    3970 }
    3971
    3972 err = azx_first_init(chip);
    3973 diff --git a/tools/usb/ffs-test.c b/tools/usb/ffs-test.c
    3974 index fe1e66b6ef40..a87e99f37c52 100644
    3975 --- a/tools/usb/ffs-test.c
    3976 +++ b/tools/usb/ffs-test.c
    3977 @@ -116,8 +116,8 @@ static const struct {
    3978 .header = {
    3979 .magic = cpu_to_le32(FUNCTIONFS_DESCRIPTORS_MAGIC),
    3980 .length = cpu_to_le32(sizeof descriptors),
    3981 - .fs_count = 3,
    3982 - .hs_count = 3,
    3983 + .fs_count = cpu_to_le32(3),
    3984 + .hs_count = cpu_to_le32(3),
    3985 },
    3986 .fs_descs = {
    3987 .intf = {