Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-magellan/patches-3.7/0104-3.7.5-all-fixes.patch

    Contents of /trunk/kernel-magellan/patches-3.7/0104-3.7.5-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 2041 - (show annotations) (download)
    Mon Jan 28 08:11:35 2013 UTC (11 years, 3 months ago) by niro
    File size: 64127 byte(s) 
    linux-3.7.5
    1 diff --git a/Makefile b/Makefile
    2 index f9196bc..ecf87b1 100644
    3 --- a/Makefile
    4 +++ b/Makefile
    5 @@ -169,7 +169,7 @@ SUBARCH := $(shell uname -m | sed -e s/i.86/i386/ -e s/sun4u/sparc64/ \
    6 -e s/arm.*/arm/ -e s/sa110/arm/ \
    7 -e s/s390x/s390/ -e s/parisc64/parisc/ \
    8 -e s/ppc.*/powerpc/ -e s/mips.*/mips/ \
    9 - -e s/sh[234].*/sh/ )
    10 + -e s/sh[234].*/sh/ -e s/aarch64.*/arm64/ )
    11
    12 # Cross compiling and selecting different set of gcc/bin-utils
    13 # ---------------------------------------------------------------------------
    14 diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h
    15 index 07fea29..fe32c0e 100644
    16 --- a/arch/arm64/include/asm/elf.h
    17 +++ b/arch/arm64/include/asm/elf.h
    18 @@ -26,7 +26,10 @@
    19
    20 typedef unsigned long elf_greg_t;
    21
    22 -#define ELF_NGREG (sizeof (struct pt_regs) / sizeof(elf_greg_t))
    23 +#define ELF_NGREG (sizeof(struct user_pt_regs) / sizeof(elf_greg_t))
    24 +#define ELF_CORE_COPY_REGS(dest, regs) \
    25 + *(struct user_pt_regs *)&(dest) = (regs)->user_regs;
    26 +
    27 typedef elf_greg_t elf_gregset_t[ELF_NGREG];
    28 typedef struct user_fpsimd_state elf_fpregset_t;
    29
    30 diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
    31 index 4a3374e..d18b2b8 100644
    32 --- a/arch/x86/kernel/cpu/perf_event.c
    33 +++ b/arch/x86/kernel/cpu/perf_event.c
    34 @@ -340,9 +340,6 @@ int x86_setup_perfctr(struct perf_event *event)
    35 /* BTS is currently only allowed for user-mode. */
    36 if (!attr->exclude_kernel)
    37 return -EOPNOTSUPP;
    38 -
    39 - if (!attr->exclude_guest)
    40 - return -EOPNOTSUPP;
    41 }
    42
    43 hwc->config |= config;
    44 @@ -385,9 +382,6 @@ int x86_pmu_hw_config(struct perf_event *event)
    45 if (event->attr.precise_ip) {
    46 int precise = 0;
    47
    48 - if (!event->attr.exclude_guest)
    49 - return -EOPNOTSUPP;
    50 -
    51 /* Support for constant skid */
    52 if (x86_pmu.pebs_active && !x86_pmu.pebs_broken) {
    53 precise++;
    54 diff --git a/arch/x86/kernel/step.c b/arch/x86/kernel/step.c
    55 index cd3b243..9b4d51d 100644
    56 --- a/arch/x86/kernel/step.c
    57 +++ b/arch/x86/kernel/step.c
    58 @@ -165,10 +165,11 @@ void set_task_blockstep(struct task_struct *task, bool on)
    59 * Ensure irq/preemption can't change debugctl in between.
    60 * Note also that both TIF_BLOCKSTEP and debugctl should
    61 * be changed atomically wrt preemption.
    62 - * FIXME: this means that set/clear TIF_BLOCKSTEP is simply
    63 - * wrong if task != current, SIGKILL can wakeup the stopped
    64 - * tracee and set/clear can play with the running task, this
    65 - * can confuse the next __switch_to_xtra().
    66 + *
    67 + * NOTE: this means that set/clear TIF_BLOCKSTEP is only safe if
    68 + * task is current or it can't be running, otherwise we can race
    69 + * with __switch_to_xtra(). We rely on ptrace_freeze_traced() but
    70 + * PTRACE_KILL is not safe.
    71 */
    72 local_irq_disable();
    73 debugctl = get_debugctlmsr();
    74 diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
    75 index e8086c7..53dc256 100644
    76 --- a/drivers/acpi/processor_idle.c
    77 +++ b/drivers/acpi/processor_idle.c
    78 @@ -1009,6 +1009,9 @@ static int acpi_processor_setup_cpuidle_cx(struct acpi_processor *pr)
    79 return -EINVAL;
    80 }
    81
    82 + if (!dev)
    83 + return -EINVAL;
    84 +
    85 dev->cpu = pr->id;
    86
    87 if (max_cstate == 0)
    88 @@ -1200,6 +1203,7 @@ int acpi_processor_cst_has_changed(struct acpi_processor *pr)
    89 }
    90
    91 /* Populate Updated C-state information */
    92 + acpi_processor_get_power_info(pr);
    93 acpi_processor_setup_cpuidle_states(pr);
    94
    95 /* Enable all cpuidle devices */
    96 diff --git a/drivers/acpi/processor_perflib.c b/drivers/acpi/processor_perflib.c
    97 index 836bfe0..53e7ac9 100644
    98 --- a/drivers/acpi/processor_perflib.c
    99 +++ b/drivers/acpi/processor_perflib.c
    100 @@ -340,6 +340,13 @@ static void amd_fixup_frequency(struct acpi_processor_px *px, int i)
    101 if ((boot_cpu_data.x86 == 0x10 && boot_cpu_data.x86_model < 10)
    102 || boot_cpu_data.x86 == 0x11) {
    103 rdmsr(MSR_AMD_PSTATE_DEF_BASE + index, lo, hi);
    104 + /*
    105 + * MSR C001_0064+:
    106 + * Bit 63: PstateEn. Read-write. If set, the P-state is valid.
    107 + */
    108 + if (!(hi & BIT(31)))
    109 + return;
    110 +
    111 fid = lo & 0x3f;
    112 did = (lo >> 6) & 7;
    113 if (boot_cpu_data.x86 == 0x10)
    114 diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
    115 index 7862d17..4979127 100644
    116 --- a/drivers/ata/ahci.c
    117 +++ b/drivers/ata/ahci.c
    118 @@ -53,6 +53,7 @@
    119
    120 enum {
    121 AHCI_PCI_BAR_STA2X11 = 0,
    122 + AHCI_PCI_BAR_ENMOTUS = 2,
    123 AHCI_PCI_BAR_STANDARD = 5,
    124 };
    125
    126 @@ -410,6 +411,9 @@ static const struct pci_device_id ahci_pci_tbl[] = {
    127 { PCI_VDEVICE(ASMEDIA, 0x0611), board_ahci }, /* ASM1061 */
    128 { PCI_VDEVICE(ASMEDIA, 0x0612), board_ahci }, /* ASM1062 */
    129
    130 + /* Enmotus */
    131 + { PCI_DEVICE(0x1c44, 0x8000), board_ahci },
    132 +
    133 /* Generic, PCI class code for AHCI */
    134 { PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
    135 PCI_CLASS_STORAGE_SATA_AHCI, 0xffffff, board_ahci },
    136 @@ -1098,9 +1102,11 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
    137 dev_info(&pdev->dev,
    138 "PDC42819 can only drive SATA devices with this driver\n");
    139
    140 - /* The Connext uses non-standard BAR */
    141 + /* Both Connext and Enmotus devices use non-standard BARs */
    142 if (pdev->vendor == PCI_VENDOR_ID_STMICRO && pdev->device == 0xCC06)
    143 ahci_pci_bar = AHCI_PCI_BAR_STA2X11;
    144 + else if (pdev->vendor == 0x1c44 && pdev->device == 0x8000)
    145 + ahci_pci_bar = AHCI_PCI_BAR_ENMOTUS;
    146
    147 /* acquire resources */
    148 rc = pcim_enable_device(pdev);
    149 diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
    150 index 4201e53..1d40fe8 100644
    151 --- a/drivers/ata/libahci.c
    152 +++ b/drivers/ata/libahci.c
    153 @@ -1951,13 +1951,13 @@ static void ahci_set_aggressive_devslp(struct ata_port *ap, bool sleep)
    154 /* Use the nominal value 10 ms if the read MDAT is zero,
    155 * the nominal value of DETO is 20 ms.
    156 */
    157 - if (dev->sata_settings[ATA_LOG_DEVSLP_VALID] &
    158 + if (dev->devslp_timing[ATA_LOG_DEVSLP_VALID] &
    159 ATA_LOG_DEVSLP_VALID_MASK) {
    160 - mdat = dev->sata_settings[ATA_LOG_DEVSLP_MDAT] &
    161 + mdat = dev->devslp_timing[ATA_LOG_DEVSLP_MDAT] &
    162 ATA_LOG_DEVSLP_MDAT_MASK;
    163 if (!mdat)
    164 mdat = 10;
    165 - deto = dev->sata_settings[ATA_LOG_DEVSLP_DETO];
    166 + deto = dev->devslp_timing[ATA_LOG_DEVSLP_DETO];
    167 if (!deto)
    168 deto = 20;
    169 } else {
    170 diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
    171 index 586362e..c8ac4fe 100644
    172 --- a/drivers/ata/libata-core.c
    173 +++ b/drivers/ata/libata-core.c
    174 @@ -2324,24 +2324,28 @@ int ata_dev_configure(struct ata_device *dev)
    175 }
    176 }
    177
    178 - /* check and mark DevSlp capability */
    179 - if (ata_id_has_devslp(dev->id))
    180 - dev->flags |= ATA_DFLAG_DEVSLP;
    181 -
    182 - /* Obtain SATA Settings page from Identify Device Data Log,
    183 - * which contains DevSlp timing variables etc.
    184 - * Exclude old devices with ata_id_has_ncq()
    185 + /* Check and mark DevSlp capability. Get DevSlp timing variables
    186 + * from SATA Settings page of Identify Device Data Log.
    187 */
    188 - if (ata_id_has_ncq(dev->id)) {
    189 + if (ata_id_has_devslp(dev->id)) {
    190 + u8 sata_setting[ATA_SECT_SIZE];
    191 + int i, j;
    192 +
    193 + dev->flags |= ATA_DFLAG_DEVSLP;
    194 err_mask = ata_read_log_page(dev,
    195 ATA_LOG_SATA_ID_DEV_DATA,
    196 ATA_LOG_SATA_SETTINGS,
    197 - dev->sata_settings,
    198 + sata_setting,
    199 1);
    200 if (err_mask)
    201 ata_dev_dbg(dev,
    202 "failed to get Identify Device Data, Emask 0x%x\n",
    203 err_mask);
    204 + else
    205 + for (i = 0; i < ATA_LOG_DEVSLP_SIZE; i++) {
    206 + j = ATA_LOG_DEVSLP_OFFSET + i;
    207 + dev->devslp_timing[i] = sata_setting[j];
    208 + }
    209 }
    210
    211 dev->cdb_len = 16;
    212 diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
    213 index bf039b0..bcf4437 100644
    214 --- a/drivers/ata/libata-eh.c
    215 +++ b/drivers/ata/libata-eh.c
    216 @@ -2094,7 +2094,7 @@ static unsigned int ata_eh_speed_down(struct ata_device *dev,
    217 */
    218 static inline int ata_eh_worth_retry(struct ata_queued_cmd *qc)
    219 {
    220 - if (qc->flags & AC_ERR_MEDIA)
    221 + if (qc->err_mask & AC_ERR_MEDIA)
    222 return 0; /* don't retry media errors */
    223 if (qc->flags & ATA_QCFLAG_IO)
    224 return 1; /* otherwise retry anything from fs stack */
    225 diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
    226 index 0bdde8f..07a18e2 100644
    227 --- a/drivers/block/virtio_blk.c
    228 +++ b/drivers/block/virtio_blk.c
    229 @@ -889,6 +889,7 @@ static void __devexit virtblk_remove(struct virtio_device *vdev)
    230 {
    231 struct virtio_blk *vblk = vdev->priv;
    232 int index = vblk->index;
    233 + int refc;
    234
    235 /* Prevent config work handler from accessing the device. */
    236 mutex_lock(&vblk->config_lock);
    237 @@ -903,11 +904,15 @@ static void __devexit virtblk_remove(struct virtio_device *vdev)
    238
    239 flush_work(&vblk->config_work);
    240
    241 + refc = atomic_read(&disk_to_dev(vblk->disk)->kobj.kref.refcount);
    242 put_disk(vblk->disk);
    243 mempool_destroy(vblk->pool);
    244 vdev->config->del_vqs(vdev);
    245 kfree(vblk);
    246 - ida_simple_remove(&vd_index_ida, index);
    247 +
    248 + /* Only free device id if we don't have any users */
    249 + if (refc == 1)
    250 + ida_simple_remove(&vd_index_ida, index);
    251 }
    252
    253 #ifdef CONFIG_PM
    254 diff --git a/drivers/cpufreq/Kconfig.x86 b/drivers/cpufreq/Kconfig.x86
    255 index 934854a..7227cd7 100644
    256 --- a/drivers/cpufreq/Kconfig.x86
    257 +++ b/drivers/cpufreq/Kconfig.x86
    258 @@ -106,7 +106,7 @@ config X86_POWERNOW_K7_ACPI
    259 config X86_POWERNOW_K8
    260 tristate "AMD Opteron/Athlon64 PowerNow!"
    261 select CPU_FREQ_TABLE
    262 - depends on ACPI && ACPI_PROCESSOR
    263 + depends on ACPI && ACPI_PROCESSOR && X86_ACPI_CPUFREQ
    264 help
    265 This adds the CPUFreq driver for K8/early Opteron/Athlon64 processors.
    266 Support for K10 and newer processors is now in acpi-cpufreq.
    267 diff --git a/drivers/cpufreq/acpi-cpufreq.c b/drivers/cpufreq/acpi-cpufreq.c
    268 index 0d048f6..7b0d49d 100644
    269 --- a/drivers/cpufreq/acpi-cpufreq.c
    270 +++ b/drivers/cpufreq/acpi-cpufreq.c
    271 @@ -1030,4 +1030,11 @@ MODULE_PARM_DESC(acpi_pstate_strict,
    272 late_initcall(acpi_cpufreq_init);
    273 module_exit(acpi_cpufreq_exit);
    274
    275 +static const struct x86_cpu_id acpi_cpufreq_ids[] = {
    276 + X86_FEATURE_MATCH(X86_FEATURE_ACPI),
    277 + X86_FEATURE_MATCH(X86_FEATURE_HW_PSTATE),
    278 + {}
    279 +};
    280 +MODULE_DEVICE_TABLE(x86cpu, acpi_cpufreq_ids);
    281 +
    282 MODULE_ALIAS("acpi");
    283 diff --git a/drivers/dma/ioat/dma_v3.c b/drivers/dma/ioat/dma_v3.c
    284 index f7f1dc6..ed0e8b7 100644
    285 --- a/drivers/dma/ioat/dma_v3.c
    286 +++ b/drivers/dma/ioat/dma_v3.c
    287 @@ -951,7 +951,7 @@ static int __devinit ioat_xor_val_self_test(struct ioatdma_device *device)
    288 goto free_resources;
    289 }
    290 }
    291 - dma_sync_single_for_device(dev, dest_dma, PAGE_SIZE, DMA_TO_DEVICE);
    292 + dma_sync_single_for_device(dev, dest_dma, PAGE_SIZE, DMA_FROM_DEVICE);
    293
    294 /* skip validate if the capability is not present */
    295 if (!dma_has_cap(DMA_XOR_VAL, dma_chan->device->cap_mask))
    296 diff --git a/drivers/dma/tegra20-apb-dma.c b/drivers/dma/tegra20-apb-dma.c
    297 index 528c62d..3cf2ca8 100644
    298 --- a/drivers/dma/tegra20-apb-dma.c
    299 +++ b/drivers/dma/tegra20-apb-dma.c
    300 @@ -266,6 +266,7 @@ static struct tegra_dma_desc *tegra_dma_desc_get(
    301 if (async_tx_test_ack(&dma_desc->txd)) {
    302 list_del(&dma_desc->node);
    303 spin_unlock_irqrestore(&tdc->lock, flags);
    304 + dma_desc->txd.flags = 0;
    305 return dma_desc;
    306 }
    307 }
    308 @@ -1050,7 +1051,9 @@ struct dma_async_tx_descriptor *tegra_dma_prep_dma_cyclic(
    309 TEGRA_APBDMA_AHBSEQ_WRAP_SHIFT;
    310 ahb_seq |= TEGRA_APBDMA_AHBSEQ_BUS_WIDTH_32;
    311
    312 - csr |= TEGRA_APBDMA_CSR_FLOW | TEGRA_APBDMA_CSR_IE_EOC;
    313 + csr |= TEGRA_APBDMA_CSR_FLOW;
    314 + if (flags & DMA_PREP_INTERRUPT)
    315 + csr |= TEGRA_APBDMA_CSR_IE_EOC;
    316 csr |= tdc->dma_sconfig.slave_id << TEGRA_APBDMA_CSR_REQ_SEL_SHIFT;
    317
    318 apb_seq |= TEGRA_APBDMA_APBSEQ_WRAP_WORD_1;
    319 @@ -1095,7 +1098,8 @@ struct dma_async_tx_descriptor *tegra_dma_prep_dma_cyclic(
    320 mem += len;
    321 }
    322 sg_req->last_sg = true;
    323 - dma_desc->txd.flags = 0;
    324 + if (flags & DMA_CTRL_ACK)
    325 + dma_desc->txd.flags = DMA_CTRL_ACK;
    326
    327 /*
    328 * Make sure that mode should not be conflicting with currently
    329 diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
    330 index b298158..fd3ae62 100644
    331 --- a/drivers/firmware/dmi_scan.c
    332 +++ b/drivers/firmware/dmi_scan.c
    333 @@ -16,6 +16,7 @@
    334 */
    335 static char dmi_empty_string[] = " ";
    336
    337 +static u16 __initdata dmi_ver;
    338 /*
    339 * Catch too early calls to dmi_check_system():
    340 */
    341 @@ -118,12 +119,12 @@ static int __init dmi_walk_early(void (*decode)(const struct dmi_header *,
    342 return 0;
    343 }
    344
    345 -static int __init dmi_checksum(const u8 *buf)
    346 +static int __init dmi_checksum(const u8 *buf, u8 len)
    347 {
    348 u8 sum = 0;
    349 int a;
    350
    351 - for (a = 0; a < 15; a++)
    352 + for (a = 0; a < len; a++)
    353 sum += buf[a];
    354
    355 return sum == 0;
    356 @@ -161,8 +162,10 @@ static void __init dmi_save_uuid(const struct dmi_header *dm, int slot, int inde
    357 return;
    358
    359 for (i = 0; i < 16 && (is_ff || is_00); i++) {
    360 - if(d[i] != 0x00) is_ff = 0;
    361 - if(d[i] != 0xFF) is_00 = 0;
    362 + if (d[i] != 0x00)
    363 + is_00 = 0;
    364 + if (d[i] != 0xFF)
    365 + is_ff = 0;
    366 }
    367
    368 if (is_ff || is_00)
    369 @@ -172,7 +175,15 @@ static void __init dmi_save_uuid(const struct dmi_header *dm, int slot, int inde
    370 if (!s)
    371 return;
    372
    373 - sprintf(s, "%pUB", d);
    374 + /*
    375 + * As of version 2.6 of the SMBIOS specification, the first 3 fields of
    376 + * the UUID are supposed to be little-endian encoded. The specification
    377 + * says that this is the defacto standard.
    378 + */
    379 + if (dmi_ver >= 0x0206)
    380 + sprintf(s, "%pUL", d);
    381 + else
    382 + sprintf(s, "%pUB", d);
    383
    384 dmi_ident[slot] = s;
    385 }
    386 @@ -404,29 +415,57 @@ static int __init dmi_present(const char __iomem *p)
    387 u8 buf[15];
    388
    389 memcpy_fromio(buf, p, 15);
    390 - if ((memcmp(buf, "_DMI_", 5) == 0) && dmi_checksum(buf)) {
    391 + if (dmi_checksum(buf, 15)) {
    392 dmi_num = (buf[13] << 8) | buf[12];
    393 dmi_len = (buf[7] << 8) | buf[6];
    394 dmi_base = (buf[11] << 24) | (buf[10] << 16) |
    395 (buf[9] << 8) | buf[8];
    396
    397 - /*
    398 - * DMI version 0.0 means that the real version is taken from
    399 - * the SMBIOS version, which we don't know at this point.
    400 - */
    401 - if (buf[14] != 0)
    402 - printk(KERN_INFO "DMI %d.%d present.\n",
    403 - buf[14] >> 4, buf[14] & 0xF);
    404 - else
    405 - printk(KERN_INFO "DMI present.\n");
    406 if (dmi_walk_early(dmi_decode) == 0) {
    407 + if (dmi_ver)
    408 + pr_info("SMBIOS %d.%d present.\n",
    409 + dmi_ver >> 8, dmi_ver & 0xFF);
    410 + else {
    411 + dmi_ver = (buf[14] & 0xF0) << 4 |
    412 + (buf[14] & 0x0F);
    413 + pr_info("Legacy DMI %d.%d present.\n",
    414 + dmi_ver >> 8, dmi_ver & 0xFF);
    415 + }
    416 dmi_dump_ids();
    417 return 0;
    418 }
    419 }
    420 + dmi_ver = 0;
    421 return 1;
    422 }
    423
    424 +static int __init smbios_present(const char __iomem *p)
    425 +{
    426 + u8 buf[32];
    427 + int offset = 0;
    428 +
    429 + memcpy_fromio(buf, p, 32);
    430 + if ((buf[5] < 32) && dmi_checksum(buf, buf[5])) {
    431 + dmi_ver = (buf[6] << 8) + buf[7];
    432 +
    433 + /* Some BIOS report weird SMBIOS version, fix that up */
    434 + switch (dmi_ver) {
    435 + case 0x021F:
    436 + case 0x0221:
    437 + pr_debug("SMBIOS version fixup(2.%d->2.%d)\n",
    438 + dmi_ver & 0xFF, 3);
    439 + dmi_ver = 0x0203;
    440 + break;
    441 + case 0x0233:
    442 + pr_debug("SMBIOS version fixup(2.%d->2.%d)\n", 51, 6);
    443 + dmi_ver = 0x0206;
    444 + break;
    445 + }
    446 + offset = 16;
    447 + }
    448 + return dmi_present(buf + offset);
    449 +}
    450 +
    451 void __init dmi_scan_machine(void)
    452 {
    453 char __iomem *p, *q;
    454 @@ -444,7 +483,7 @@ void __init dmi_scan_machine(void)
    455 if (p == NULL)
    456 goto error;
    457
    458 - rc = dmi_present(p + 0x10); /* offset of _DMI_ string */
    459 + rc = smbios_present(p);
    460 dmi_iounmap(p, 32);
    461 if (!rc) {
    462 dmi_available = 1;
    463 @@ -462,7 +501,12 @@ void __init dmi_scan_machine(void)
    464 goto error;
    465
    466 for (q = p; q < p + 0x10000; q += 16) {
    467 - rc = dmi_present(q);
    468 + if (memcmp(q, "_SM_", 4) == 0 && q - p <= 0xFFE0)
    469 + rc = smbios_present(q);
    470 + else if (memcmp(q, "_DMI_", 5) == 0)
    471 + rc = dmi_present(q);
    472 + else
    473 + continue;
    474 if (!rc) {
    475 dmi_available = 1;
    476 dmi_iounmap(p, 0x10000);
    477 diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
    478 index 3eea143..67036e9 100644
    479 --- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
    480 +++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
    481 @@ -548,6 +548,8 @@ i915_gem_execbuffer_relocate_slow(struct drm_device *dev,
    482 total = 0;
    483 for (i = 0; i < count; i++) {
    484 struct drm_i915_gem_relocation_entry __user *user_relocs;
    485 + u64 invalid_offset = (u64)-1;
    486 + int j;
    487
    488 user_relocs = (void __user *)(uintptr_t)exec[i].relocs_ptr;
    489
    490 @@ -558,6 +560,25 @@ i915_gem_execbuffer_relocate_slow(struct drm_device *dev,
    491 goto err;
    492 }
    493
    494 + /* As we do not update the known relocation offsets after
    495 + * relocating (due to the complexities in lock handling),
    496 + * we need to mark them as invalid now so that we force the
    497 + * relocation processing next time. Just in case the target
    498 + * object is evicted and then rebound into its old
    499 + * presumed_offset before the next execbuffer - if that
    500 + * happened we would make the mistake of assuming that the
    501 + * relocations were valid.
    502 + */
    503 + for (j = 0; j < exec[i].relocation_count; j++) {
    504 + if (copy_to_user(&user_relocs[j].presumed_offset,
    505 + &invalid_offset,
    506 + sizeof(invalid_offset))) {
    507 + ret = -EFAULT;
    508 + mutex_lock(&dev->struct_mutex);
    509 + goto err;
    510 + }
    511 + }
    512 +
    513 reloc_offset[i] = total;
    514 total += exec[i].relocation_count;
    515 }
    516 diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
    517 index 09ae4b0..ecec134 100644
    518 --- a/drivers/gpu/drm/i915/i915_reg.h
    519 +++ b/drivers/gpu/drm/i915/i915_reg.h
    520 @@ -514,6 +514,7 @@
    521 * the enables for writing to the corresponding low bit.
    522 */
    523 #define _3D_CHICKEN 0x02084
    524 +#define _3D_CHICKEN_HIZ_PLANE_DISABLE_MSAA_4X_SNB (1 << 10)
    525 #define _3D_CHICKEN2 0x0208c
    526 /* Disables pipelining of read flushes past the SF-WIZ interface.
    527 * Required on all Ironlake steppings according to the B-Spec, but the
    528 diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
    529 index eaaff3c..e87fa47 100644
    530 --- a/drivers/gpu/drm/i915/intel_pm.c
    531 +++ b/drivers/gpu/drm/i915/intel_pm.c
    532 @@ -3412,6 +3412,10 @@ static void gen6_init_clock_gating(struct drm_device *dev)
    533 I915_READ(ILK_DISPLAY_CHICKEN2) |
    534 ILK_ELPIN_409_SELECT);
    535
    536 + /* WaDisableHiZPlanesWhenMSAAEnabled */
    537 + I915_WRITE(_3D_CHICKEN,
    538 + _MASKED_BIT_ENABLE(_3D_CHICKEN_HIZ_PLANE_DISABLE_MSAA_4X_SNB));
    539 +
    540 I915_WRITE(WM3_LP_ILK, 0);
    541 I915_WRITE(WM2_LP_ILK, 0);
    542 I915_WRITE(WM1_LP_ILK, 0);
    543 diff --git a/drivers/i2c/busses/i2c-mxs.c b/drivers/i2c/busses/i2c-mxs.c
    544 index 0670da7..a6fad94 100644
    545 --- a/drivers/i2c/busses/i2c-mxs.c
    546 +++ b/drivers/i2c/busses/i2c-mxs.c
    547 @@ -127,7 +127,7 @@ struct mxs_i2c_dev {
    548 struct device *dev;
    549 void __iomem *regs;
    550 struct completion cmd_complete;
    551 - u32 cmd_err;
    552 + int cmd_err;
    553 struct i2c_adapter adapter;
    554 const struct mxs_i2c_speed_config *speed;
    555
    556 diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
    557 index b0f6b4c..e0fbe77 100644
    558 --- a/drivers/idle/intel_idle.c
    559 +++ b/drivers/idle/intel_idle.c
    560 @@ -460,8 +460,6 @@ static int intel_idle_probe(void)
    561 else
    562 on_each_cpu(__setup_broadcast_timer, (void *)true, 1);
    563
    564 - register_cpu_notifier(&cpu_hotplug_notifier);
    565 -
    566 pr_debug(PREFIX "v" INTEL_IDLE_VERSION
    567 " model 0x%X\n", boot_cpu_data.x86_model);
    568
    569 @@ -624,6 +622,7 @@ static int __init intel_idle_init(void)
    570 return retval;
    571 }
    572 }
    573 + register_cpu_notifier(&cpu_hotplug_notifier);
    574
    575 return 0;
    576 }
    577 diff --git a/drivers/media/usb/gspca/kinect.c b/drivers/media/usb/gspca/kinect.c
    578 index 40ad668..3773a8a7 100644
    579 --- a/drivers/media/usb/gspca/kinect.c
    580 +++ b/drivers/media/usb/gspca/kinect.c
    581 @@ -381,6 +381,7 @@ static const struct sd_desc sd_desc = {
    582 /* -- module initialisation -- */
    583 static const struct usb_device_id device_table[] = {
    584 {USB_DEVICE(0x045e, 0x02ae)},
    585 + {USB_DEVICE(0x045e, 0x02bf)},
    586 {}
    587 };
    588
    589 diff --git a/drivers/misc/ti-st/st_kim.c b/drivers/misc/ti-st/st_kim.c
    590 index 04a8199..988da4d 100644
    591 --- a/drivers/misc/ti-st/st_kim.c
    592 +++ b/drivers/misc/ti-st/st_kim.c
    593 @@ -468,6 +468,11 @@ long st_kim_start(void *kim_data)
    594 if (pdata->chip_enable)
    595 pdata->chip_enable(kim_gdata);
    596
    597 + /* Configure BT nShutdown to HIGH state */
    598 + gpio_set_value(kim_gdata->nshutdown, GPIO_LOW);
    599 + mdelay(5); /* FIXME: a proper toggle */
    600 + gpio_set_value(kim_gdata->nshutdown, GPIO_HIGH);
    601 + mdelay(100);
    602 /* re-initialize the completion */
    603 INIT_COMPLETION(kim_gdata->ldisc_installed);
    604 /* send notification to UIM */
    605 @@ -509,7 +514,8 @@ long st_kim_start(void *kim_data)
    606 * (b) upon failure to either install ldisc or download firmware.
    607 * The function is responsible to (a) notify UIM about un-installation,
    608 * (b) flush UART if the ldisc was installed.
    609 - * (c) invoke platform's chip disabling routine.
    610 + * (c) reset BT_EN - pull down nshutdown at the end.
    611 + * (d) invoke platform's chip disabling routine.
    612 */
    613 long st_kim_stop(void *kim_data)
    614 {
    615 @@ -541,6 +547,13 @@ long st_kim_stop(void *kim_data)
    616 err = -ETIMEDOUT;
    617 }
    618
    619 + /* By default configure BT nShutdown to LOW state */
    620 + gpio_set_value(kim_gdata->nshutdown, GPIO_LOW);
    621 + mdelay(1);
    622 + gpio_set_value(kim_gdata->nshutdown, GPIO_HIGH);
    623 + mdelay(1);
    624 + gpio_set_value(kim_gdata->nshutdown, GPIO_LOW);
    625 +
    626 /* platform specific disable */
    627 if (pdata->chip_disable)
    628 pdata->chip_disable(kim_gdata);
    629 @@ -732,6 +745,20 @@ static int kim_probe(struct platform_device *pdev)
    630 /* refer to itself */
    631 kim_gdata->core_data->kim_data = kim_gdata;
    632
    633 + /* Claim the chip enable nShutdown gpio from the system */
    634 + kim_gdata->nshutdown = pdata->nshutdown_gpio;
    635 + status = gpio_request(kim_gdata->nshutdown, "kim");
    636 + if (unlikely(status)) {
    637 + pr_err(" gpio %ld request failed ", kim_gdata->nshutdown);
    638 + return status;
    639 + }
    640 +
    641 + /* Configure nShutdown GPIO as output=0 */
    642 + status = gpio_direction_output(kim_gdata->nshutdown, 0);
    643 + if (unlikely(status)) {
    644 + pr_err(" unable to configure gpio %ld", kim_gdata->nshutdown);
    645 + return status;
    646 + }
    647 /* get reference of pdev for request_firmware
    648 */
    649 kim_gdata->kim_pdev = pdev;
    650 @@ -767,10 +794,18 @@ static int kim_probe(struct platform_device *pdev)
    651
    652 static int kim_remove(struct platform_device *pdev)
    653 {
    654 + /* free the GPIOs requested */
    655 + struct ti_st_plat_data *pdata = pdev->dev.platform_data;
    656 struct kim_data_s *kim_gdata;
    657
    658 kim_gdata = dev_get_drvdata(&pdev->dev);
    659
    660 + /* Free the Bluetooth/FM/GPIO
    661 + * nShutdown gpio from the system
    662 + */
    663 + gpio_free(pdata->nshutdown_gpio);
    664 + pr_info("nshutdown GPIO Freed");
    665 +
    666 debugfs_remove_recursive(kim_debugfs_dir);
    667 sysfs_remove_group(&pdev->dev.kobj, &uim_attr_grp);
    668 pr_info("sysfs entries removed");
    669 diff --git a/drivers/pci/hotplug/pciehp.h b/drivers/pci/hotplug/pciehp.h
    670 index 26ffd3e..2c113de 100644
    671 --- a/drivers/pci/hotplug/pciehp.h
    672 +++ b/drivers/pci/hotplug/pciehp.h
    673 @@ -44,7 +44,6 @@ extern bool pciehp_poll_mode;
    674 extern int pciehp_poll_time;
    675 extern bool pciehp_debug;
    676 extern bool pciehp_force;
    677 -extern struct workqueue_struct *pciehp_wq;
    678
    679 #define dbg(format, arg...) \
    680 do { \
    681 @@ -78,6 +77,7 @@ struct slot {
    682 struct hotplug_slot *hotplug_slot;
    683 struct delayed_work work; /* work for button event */
    684 struct mutex lock;
    685 + struct workqueue_struct *wq;
    686 };
    687
    688 struct event_info {
    689 diff --git a/drivers/pci/hotplug/pciehp_core.c b/drivers/pci/hotplug/pciehp_core.c
    690 index 916bf4f..939bd1d 100644
    691 --- a/drivers/pci/hotplug/pciehp_core.c
    692 +++ b/drivers/pci/hotplug/pciehp_core.c
    693 @@ -42,7 +42,6 @@ bool pciehp_debug;
    694 bool pciehp_poll_mode;
    695 int pciehp_poll_time;
    696 bool pciehp_force;
    697 -struct workqueue_struct *pciehp_wq;
    698
    699 #define DRIVER_VERSION "0.4"
    700 #define DRIVER_AUTHOR "Dan Zink <dan.zink@compaq.com>, Greg Kroah-Hartman <greg@kroah.com>, Dely Sy <dely.l.sy@intel.com>"
    701 @@ -340,18 +339,13 @@ static int __init pcied_init(void)
    702 {
    703 int retval = 0;
    704
    705 - pciehp_wq = alloc_workqueue("pciehp", 0, 0);
    706 - if (!pciehp_wq)
    707 - return -ENOMEM;
    708 -
    709 pciehp_firmware_init();
    710 retval = pcie_port_service_register(&hpdriver_portdrv);
    711 dbg("pcie_port_service_register = %d\n", retval);
    712 info(DRIVER_DESC " version: " DRIVER_VERSION "\n");
    713 - if (retval) {
    714 - destroy_workqueue(pciehp_wq);
    715 + if (retval)
    716 dbg("Failure to register service\n");
    717 - }
    718 +
    719 return retval;
    720 }
    721
    722 @@ -359,7 +353,6 @@ static void __exit pcied_cleanup(void)
    723 {
    724 dbg("unload_pciehpd()\n");
    725 pcie_port_service_unregister(&hpdriver_portdrv);
    726 - destroy_workqueue(pciehp_wq);
    727 info(DRIVER_DESC " version: " DRIVER_VERSION " unloaded\n");
    728 }
    729
    730 diff --git a/drivers/pci/hotplug/pciehp_ctrl.c b/drivers/pci/hotplug/pciehp_ctrl.c
    731 index 27f4429..38f0186 100644
    732 --- a/drivers/pci/hotplug/pciehp_ctrl.c
    733 +++ b/drivers/pci/hotplug/pciehp_ctrl.c
    734 @@ -49,7 +49,7 @@ static int queue_interrupt_event(struct slot *p_slot, u32 event_type)
    735 info->p_slot = p_slot;
    736 INIT_WORK(&info->work, interrupt_event_handler);
    737
    738 - queue_work(pciehp_wq, &info->work);
    739 + queue_work(p_slot->wq, &info->work);
    740
    741 return 0;
    742 }
    743 @@ -344,7 +344,7 @@ void pciehp_queue_pushbutton_work(struct work_struct *work)
    744 kfree(info);
    745 goto out;
    746 }
    747 - queue_work(pciehp_wq, &info->work);
    748 + queue_work(p_slot->wq, &info->work);
    749 out:
    750 mutex_unlock(&p_slot->lock);
    751 }
    752 @@ -377,7 +377,7 @@ static void handle_button_press_event(struct slot *p_slot)
    753 if (ATTN_LED(ctrl))
    754 pciehp_set_attention_status(p_slot, 0);
    755
    756 - queue_delayed_work(pciehp_wq, &p_slot->work, 5*HZ);
    757 + queue_delayed_work(p_slot->wq, &p_slot->work, 5*HZ);
    758 break;
    759 case BLINKINGOFF_STATE:
    760 case BLINKINGON_STATE:
    761 @@ -439,7 +439,7 @@ static void handle_surprise_event(struct slot *p_slot)
    762 else
    763 p_slot->state = POWERON_STATE;
    764
    765 - queue_work(pciehp_wq, &info->work);
    766 + queue_work(p_slot->wq, &info->work);
    767 }
    768
    769 static void interrupt_event_handler(struct work_struct *work)
    770 diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c
    771 index 13b2eaf..5127f3f 100644
    772 --- a/drivers/pci/hotplug/pciehp_hpc.c
    773 +++ b/drivers/pci/hotplug/pciehp_hpc.c
    774 @@ -773,23 +773,32 @@ static void pcie_shutdown_notification(struct controller *ctrl)
    775 static int pcie_init_slot(struct controller *ctrl)
    776 {
    777 struct slot *slot;
    778 + char name[32];
    779
    780 slot = kzalloc(sizeof(*slot), GFP_KERNEL);
    781 if (!slot)
    782 return -ENOMEM;
    783
    784 + snprintf(name, sizeof(name), "pciehp-%u", PSN(ctrl));
    785 + slot->wq = alloc_workqueue(name, 0, 0);
    786 + if (!slot->wq)
    787 + goto abort;
    788 +
    789 slot->ctrl = ctrl;
    790 mutex_init(&slot->lock);
    791 INIT_DELAYED_WORK(&slot->work, pciehp_queue_pushbutton_work);
    792 ctrl->slot = slot;
    793 return 0;
    794 +abort:
    795 + kfree(slot);
    796 + return -ENOMEM;
    797 }
    798
    799 static void pcie_cleanup_slot(struct controller *ctrl)
    800 {
    801 struct slot *slot = ctrl->slot;
    802 cancel_delayed_work(&slot->work);
    803 - flush_workqueue(pciehp_wq);
    804 + destroy_workqueue(slot->wq);
    805 kfree(slot);
    806 }
    807
    808 diff --git a/drivers/pci/hotplug/shpchp.h b/drivers/pci/hotplug/shpchp.h
    809 index ca64932..b849f995 100644
    810 --- a/drivers/pci/hotplug/shpchp.h
    811 +++ b/drivers/pci/hotplug/shpchp.h
    812 @@ -46,8 +46,6 @@
    813 extern bool shpchp_poll_mode;
    814 extern int shpchp_poll_time;
    815 extern bool shpchp_debug;
    816 -extern struct workqueue_struct *shpchp_wq;
    817 -extern struct workqueue_struct *shpchp_ordered_wq;
    818
    819 #define dbg(format, arg...) \
    820 do { \
    821 @@ -91,6 +89,7 @@ struct slot {
    822 struct list_head slot_list;
    823 struct delayed_work work; /* work for button event */
    824 struct mutex lock;
    825 + struct workqueue_struct *wq;
    826 u8 hp_slot;
    827 };
    828
    829 diff --git a/drivers/pci/hotplug/shpchp_core.c b/drivers/pci/hotplug/shpchp_core.c
    830 index b6de307..ea15fdc 100644
    831 --- a/drivers/pci/hotplug/shpchp_core.c
    832 +++ b/drivers/pci/hotplug/shpchp_core.c
    833 @@ -39,8 +39,6 @@
    834 bool shpchp_debug;
    835 bool shpchp_poll_mode;
    836 int shpchp_poll_time;
    837 -struct workqueue_struct *shpchp_wq;
    838 -struct workqueue_struct *shpchp_ordered_wq;
    839
    840 #define DRIVER_VERSION "0.4"
    841 #define DRIVER_AUTHOR "Dan Zink <dan.zink@compaq.com>, Greg Kroah-Hartman <greg@kroah.com>, Dely Sy <dely.l.sy@intel.com>"
    842 @@ -129,6 +127,14 @@ static int init_slots(struct controller *ctrl)
    843 slot->device = ctrl->slot_device_offset + i;
    844 slot->hpc_ops = ctrl->hpc_ops;
    845 slot->number = ctrl->first_slot + (ctrl->slot_num_inc * i);
    846 +
    847 + snprintf(name, sizeof(name), "shpchp-%d", slot->number);
    848 + slot->wq = alloc_workqueue(name, 0, 0);
    849 + if (!slot->wq) {
    850 + retval = -ENOMEM;
    851 + goto error_info;
    852 + }
    853 +
    854 mutex_init(&slot->lock);
    855 INIT_DELAYED_WORK(&slot->work, shpchp_queue_pushbutton_work);
    856
    857 @@ -148,7 +154,7 @@ static int init_slots(struct controller *ctrl)
    858 if (retval) {
    859 ctrl_err(ctrl, "pci_hp_register failed with error %d\n",
    860 retval);
    861 - goto error_info;
    862 + goto error_slotwq;
    863 }
    864
    865 get_power_status(hotplug_slot, &info->power_status);
    866 @@ -160,6 +166,8 @@ static int init_slots(struct controller *ctrl)
    867 }
    868
    869 return 0;
    870 +error_slotwq:
    871 + destroy_workqueue(slot->wq);
    872 error_info:
    873 kfree(info);
    874 error_hpslot:
    875 @@ -180,8 +188,7 @@ void cleanup_slots(struct controller *ctrl)
    876 slot = list_entry(tmp, struct slot, slot_list);
    877 list_del(&slot->slot_list);
    878 cancel_delayed_work(&slot->work);
    879 - flush_workqueue(shpchp_wq);
    880 - flush_workqueue(shpchp_ordered_wq);
    881 + destroy_workqueue(slot->wq);
    882 pci_hp_deregister(slot->hotplug_slot);
    883 }
    884 }
    885 @@ -364,25 +371,11 @@ static struct pci_driver shpc_driver = {
    886
    887 static int __init shpcd_init(void)
    888 {
    889 - int retval = 0;
    890 -
    891 - shpchp_wq = alloc_ordered_workqueue("shpchp", 0);
    892 - if (!shpchp_wq)
    893 - return -ENOMEM;
    894 -
    895 - shpchp_ordered_wq = alloc_ordered_workqueue("shpchp_ordered", 0);
    896 - if (!shpchp_ordered_wq) {
    897 - destroy_workqueue(shpchp_wq);
    898 - return -ENOMEM;
    899 - }
    900 + int retval;
    901
    902 retval = pci_register_driver(&shpc_driver);
    903 dbg("%s: pci_register_driver = %d\n", __func__, retval);
    904 info(DRIVER_DESC " version: " DRIVER_VERSION "\n");
    905 - if (retval) {
    906 - destroy_workqueue(shpchp_ordered_wq);
    907 - destroy_workqueue(shpchp_wq);
    908 - }
    909 return retval;
    910 }
    911
    912 @@ -390,8 +383,6 @@ static void __exit shpcd_cleanup(void)
    913 {
    914 dbg("unload_shpchpd()\n");
    915 pci_unregister_driver(&shpc_driver);
    916 - destroy_workqueue(shpchp_ordered_wq);
    917 - destroy_workqueue(shpchp_wq);
    918 info(DRIVER_DESC " version: " DRIVER_VERSION " unloaded\n");
    919 }
    920
    921 diff --git a/drivers/pci/hotplug/shpchp_ctrl.c b/drivers/pci/hotplug/shpchp_ctrl.c
    922 index f9b5a52..5849927 100644
    923 --- a/drivers/pci/hotplug/shpchp_ctrl.c
    924 +++ b/drivers/pci/hotplug/shpchp_ctrl.c
    925 @@ -51,7 +51,7 @@ static int queue_interrupt_event(struct slot *p_slot, u32 event_type)
    926 info->p_slot = p_slot;
    927 INIT_WORK(&info->work, interrupt_event_handler);
    928
    929 - queue_work(shpchp_wq, &info->work);
    930 + queue_work(p_slot->wq, &info->work);
    931
    932 return 0;
    933 }
    934 @@ -453,7 +453,7 @@ void shpchp_queue_pushbutton_work(struct work_struct *work)
    935 kfree(info);
    936 goto out;
    937 }
    938 - queue_work(shpchp_ordered_wq, &info->work);
    939 + queue_work(p_slot->wq, &info->work);
    940 out:
    941 mutex_unlock(&p_slot->lock);
    942 }
    943 @@ -501,7 +501,7 @@ static void handle_button_press_event(struct slot *p_slot)
    944 p_slot->hpc_ops->green_led_blink(p_slot);
    945 p_slot->hpc_ops->set_attention_status(p_slot, 0);
    946
    947 - queue_delayed_work(shpchp_wq, &p_slot->work, 5*HZ);
    948 + queue_delayed_work(p_slot->wq, &p_slot->work, 5*HZ);
    949 break;
    950 case BLINKINGOFF_STATE:
    951 case BLINKINGON_STATE:
    952 diff --git a/drivers/pci/pcie/aer/aerdrv_core.c b/drivers/pci/pcie/aer/aerdrv_core.c
    953 index af4e31c..43caf53 100644
    954 --- a/drivers/pci/pcie/aer/aerdrv_core.c
    955 +++ b/drivers/pci/pcie/aer/aerdrv_core.c
    956 @@ -616,6 +616,7 @@ static void aer_recover_work_func(struct work_struct *work)
    957 continue;
    958 }
    959 do_recovery(pdev, entry.severity);
    960 + pci_dev_put(pdev);
    961 }
    962 }
    963 #endif
    964 diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
    965 index 213753b..449f257 100644
    966 --- a/drivers/pci/pcie/aspm.c
    967 +++ b/drivers/pci/pcie/aspm.c
    968 @@ -773,6 +773,9 @@ void pcie_clear_aspm(struct pci_bus *bus)
    969 {
    970 struct pci_dev *child;
    971
    972 + if (aspm_force)
    973 + return;
    974 +
    975 /*
    976 * Clear any ASPM setup that the firmware has carried out on this bus
    977 */
    978 diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
    979 index 352bc77..a45e12a 100644
    980 --- a/drivers/scsi/sd.c
    981 +++ b/drivers/scsi/sd.c
    982 @@ -3116,10 +3116,6 @@ static int __init init_sd(void)
    983 if (err)
    984 goto err_out;
    985
    986 - err = scsi_register_driver(&sd_template.gendrv);
    987 - if (err)
    988 - goto err_out_class;
    989 -
    990 sd_cdb_cache = kmem_cache_create("sd_ext_cdb", SD_EXT_CDB_SIZE,
    991 0, 0, NULL);
    992 if (!sd_cdb_cache) {
    993 @@ -3133,8 +3129,15 @@ static int __init init_sd(void)
    994 goto err_out_cache;
    995 }
    996
    997 + err = scsi_register_driver(&sd_template.gendrv);
    998 + if (err)
    999 + goto err_out_driver;
    1000 +
    1001 return 0;
    1002
    1003 +err_out_driver:
    1004 + mempool_destroy(sd_cdb_pool);
    1005 +
    1006 err_out_cache:
    1007 kmem_cache_destroy(sd_cdb_cache);
    1008
    1009 @@ -3157,10 +3160,10 @@ static void __exit exit_sd(void)
    1010
    1011 SCSI_LOG_HLQUEUE(3, printk("exit_sd: exiting sd driver\n"));
    1012
    1013 + scsi_unregister_driver(&sd_template.gendrv);
    1014 mempool_destroy(sd_cdb_pool);
    1015 kmem_cache_destroy(sd_cdb_cache);
    1016
    1017 - scsi_unregister_driver(&sd_template.gendrv);
    1018 class_unregister(&sd_disk_class);
    1019
    1020 for (i = 0; i < SD_MAJORS; i++)
    1021 diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
    1022 index 7b7dedd..57f0859 100644
    1023 --- a/drivers/usb/dwc3/gadget.c
    1024 +++ b/drivers/usb/dwc3/gadget.c
    1025 @@ -1605,6 +1605,7 @@ static int __devinit dwc3_gadget_init_endpoints(struct dwc3 *dwc)
    1026
    1027 if (epnum == 0 || epnum == 1) {
    1028 dep->endpoint.maxpacket = 512;
    1029 + dep->endpoint.maxburst = 1;
    1030 dep->endpoint.ops = &dwc3_gadget_ep0_ops;
    1031 if (!epnum)
    1032 dwc->gadget.ep0 = &dep->endpoint;
    1033 diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c
    1034 index 64c4ec1..7c52ed4 100644
    1035 --- a/drivers/usb/gadget/f_fs.c
    1036 +++ b/drivers/usb/gadget/f_fs.c
    1037 @@ -1153,15 +1153,15 @@ static int ffs_fs_parse_opts(struct ffs_sb_fill_data *data, char *opts)
    1038 pr_err("%s: unmapped value: %lu\n", opts, value);
    1039 return -EINVAL;
    1040 }
    1041 - }
    1042 - else if (!memcmp(opts, "gid", 3))
    1043 + } else if (!memcmp(opts, "gid", 3)) {
    1044 data->perms.gid = make_kgid(current_user_ns(), value);
    1045 if (!gid_valid(data->perms.gid)) {
    1046 pr_err("%s: unmapped value: %lu\n", opts, value);
    1047 return -EINVAL;
    1048 }
    1049 - else
    1050 + } else {
    1051 goto invalid;
    1052 + }
    1053 break;
    1054
    1055 default:
    1056 diff --git a/drivers/usb/host/uhci-hcd.c b/drivers/usb/host/uhci-hcd.c
    1057 index 4b9e9ab..4f64d24 100644
    1058 --- a/drivers/usb/host/uhci-hcd.c
    1059 +++ b/drivers/usb/host/uhci-hcd.c
    1060 @@ -447,6 +447,10 @@ static irqreturn_t uhci_irq(struct usb_hcd *hcd)
    1061 return IRQ_NONE;
    1062 uhci_writew(uhci, status, USBSTS); /* Clear it */
    1063
    1064 + spin_lock(&uhci->lock);
    1065 + if (unlikely(!uhci->is_initialized)) /* not yet configured */
    1066 + goto done;
    1067 +
    1068 if (status & ~(USBSTS_USBINT | USBSTS_ERROR | USBSTS_RD)) {
    1069 if (status & USBSTS_HSE)
    1070 dev_err(uhci_dev(uhci), "host system error, "
    1071 @@ -455,7 +459,6 @@ static irqreturn_t uhci_irq(struct usb_hcd *hcd)
    1072 dev_err(uhci_dev(uhci), "host controller process "
    1073 "error, something bad happened!\n");
    1074 if (status & USBSTS_HCH) {
    1075 - spin_lock(&uhci->lock);
    1076 if (uhci->rh_state >= UHCI_RH_RUNNING) {
    1077 dev_err(uhci_dev(uhci),
    1078 "host controller halted, "
    1079 @@ -473,15 +476,15 @@ static irqreturn_t uhci_irq(struct usb_hcd *hcd)
    1080 * pending unlinks */
    1081 mod_timer(&hcd->rh_timer, jiffies);
    1082 }
    1083 - spin_unlock(&uhci->lock);
    1084 }
    1085 }
    1086
    1087 - if (status & USBSTS_RD)
    1088 + if (status & USBSTS_RD) {
    1089 + spin_unlock(&uhci->lock);
    1090 usb_hcd_poll_rh_status(hcd);
    1091 - else {
    1092 - spin_lock(&uhci->lock);
    1093 + } else {
    1094 uhci_scan_schedule(uhci);
    1095 + done:
    1096 spin_unlock(&uhci->lock);
    1097 }
    1098
    1099 @@ -662,9 +665,9 @@ static int uhci_start(struct usb_hcd *hcd)
    1100 */
    1101 mb();
    1102
    1103 + spin_lock_irq(&uhci->lock);
    1104 configure_hc(uhci);
    1105 uhci->is_initialized = 1;
    1106 - spin_lock_irq(&uhci->lock);
    1107 start_rh(uhci);
    1108 spin_unlock_irq(&uhci->lock);
    1109 return 0;
    1110 diff --git a/drivers/usb/musb/cppi_dma.c b/drivers/usb/musb/cppi_dma.c
    1111 index 3a6c2fd..3d37b5d 100644
    1112 --- a/drivers/usb/musb/cppi_dma.c
    1113 +++ b/drivers/usb/musb/cppi_dma.c
    1114 @@ -105,7 +105,7 @@ static void cppi_reset_tx(struct cppi_tx_stateram __iomem *tx, u32 ptr)
    1115 musb_writel(&tx->tx_complete, 0, ptr);
    1116 }
    1117
    1118 -static void __init cppi_pool_init(struct cppi *cppi, struct cppi_channel *c)
    1119 +static void cppi_pool_init(struct cppi *cppi, struct cppi_channel *c)
    1120 {
    1121 int j;
    1122
    1123 @@ -150,7 +150,7 @@ static void cppi_pool_free(struct cppi_channel *c)
    1124 c->last_processed = NULL;
    1125 }
    1126
    1127 -static int __init cppi_controller_start(struct dma_controller *c)
    1128 +static int cppi_controller_start(struct dma_controller *c)
    1129 {
    1130 struct cppi *controller;
    1131 void __iomem *tibase;
    1132 diff --git a/drivers/vfio/pci/vfio_pci_rdwr.c b/drivers/vfio/pci/vfio_pci_rdwr.c
    1133 index 4362d9e..f72323e 100644
    1134 --- a/drivers/vfio/pci/vfio_pci_rdwr.c
    1135 +++ b/drivers/vfio/pci/vfio_pci_rdwr.c
    1136 @@ -240,17 +240,17 @@ ssize_t vfio_pci_mem_readwrite(struct vfio_pci_device *vdev, char __user *buf,
    1137 filled = 1;
    1138 } else {
    1139 /* Drop writes, fill reads with FF */
    1140 + filled = min((size_t)(x_end - pos), count);
    1141 if (!iswrite) {
    1142 char val = 0xFF;
    1143 size_t i;
    1144
    1145 - for (i = 0; i < x_end - pos; i++) {
    1146 + for (i = 0; i < filled; i++) {
    1147 if (put_user(val, buf + i))
    1148 goto out;
    1149 }
    1150 }
    1151
    1152 - filled = x_end - pos;
    1153 }
    1154
    1155 count -= filled;
    1156 diff --git a/include/linux/ata.h b/include/linux/ata.h
    1157 index 408da95..8f7a3d6 100644
    1158 --- a/include/linux/ata.h
    1159 +++ b/include/linux/ata.h
    1160 @@ -297,10 +297,12 @@ enum {
    1161 ATA_LOG_SATA_NCQ = 0x10,
    1162 ATA_LOG_SATA_ID_DEV_DATA = 0x30,
    1163 ATA_LOG_SATA_SETTINGS = 0x08,
    1164 - ATA_LOG_DEVSLP_MDAT = 0x30,
    1165 + ATA_LOG_DEVSLP_OFFSET = 0x30,
    1166 + ATA_LOG_DEVSLP_SIZE = 0x08,
    1167 + ATA_LOG_DEVSLP_MDAT = 0x00,
    1168 ATA_LOG_DEVSLP_MDAT_MASK = 0x1F,
    1169 - ATA_LOG_DEVSLP_DETO = 0x31,
    1170 - ATA_LOG_DEVSLP_VALID = 0x37,
    1171 + ATA_LOG_DEVSLP_DETO = 0x01,
    1172 + ATA_LOG_DEVSLP_VALID = 0x07,
    1173 ATA_LOG_DEVSLP_VALID_MASK = 0x80,
    1174
    1175 /* READ/WRITE LONG (obsolete) */
    1176 diff --git a/include/linux/libata.h b/include/linux/libata.h
    1177 index e931c9a..1e36c63 100644
    1178 --- a/include/linux/libata.h
    1179 +++ b/include/linux/libata.h
    1180 @@ -652,8 +652,8 @@ struct ata_device {
    1181 u32 gscr[SATA_PMP_GSCR_DWORDS]; /* PMP GSCR block */
    1182 };
    1183
    1184 - /* Identify Device Data Log (30h), SATA Settings (page 08h) */
    1185 - u8 sata_settings[ATA_SECT_SIZE];
    1186 + /* DEVSLP Timing Variables from Identify Device Data Log */
    1187 + u8 devslp_timing[ATA_LOG_DEVSLP_SIZE];
    1188
    1189 /* error history */
    1190 int spdn_cnt;
    1191 diff --git a/include/linux/module.h b/include/linux/module.h
    1192 index 7760c6d..1375ee3 100644
    1193 --- a/include/linux/module.h
    1194 +++ b/include/linux/module.h
    1195 @@ -199,11 +199,11 @@ struct module_use {
    1196 struct module *source, *target;
    1197 };
    1198
    1199 -enum module_state
    1200 -{
    1201 - MODULE_STATE_LIVE,
    1202 - MODULE_STATE_COMING,
    1203 - MODULE_STATE_GOING,
    1204 +enum module_state {
    1205 + MODULE_STATE_LIVE, /* Normal state. */
    1206 + MODULE_STATE_COMING, /* Full formed, running module_init. */
    1207 + MODULE_STATE_GOING, /* Going away. */
    1208 + MODULE_STATE_UNFORMED, /* Still setting it up. */
    1209 };
    1210
    1211 /**
    1212 diff --git a/include/linux/sched.h b/include/linux/sched.h
    1213 index 0dd42a0..3e63925 100644
    1214 --- a/include/linux/sched.h
    1215 +++ b/include/linux/sched.h
    1216 @@ -2654,7 +2654,16 @@ static inline void thread_group_cputime_init(struct signal_struct *sig)
    1217 extern void recalc_sigpending_and_wake(struct task_struct *t);
    1218 extern void recalc_sigpending(void);
    1219
    1220 -extern void signal_wake_up(struct task_struct *t, int resume_stopped);
    1221 +extern void signal_wake_up_state(struct task_struct *t, unsigned int state);
    1222 +
    1223 +static inline void signal_wake_up(struct task_struct *t, bool resume)
    1224 +{
    1225 + signal_wake_up_state(t, resume ? TASK_WAKEKILL : 0);
    1226 +}
    1227 +static inline void ptrace_signal_wake_up(struct task_struct *t, bool resume)
    1228 +{
    1229 + signal_wake_up_state(t, resume ? __TASK_TRACED : 0);
    1230 +}
    1231
    1232 /*
    1233 * Wrappers for p->thread_info->cpu access. No-op on UP.
    1234 diff --git a/init/do_mounts_initrd.c b/init/do_mounts_initrd.c
    1235 index 5e4ded5..f9acf71 100644
    1236 --- a/init/do_mounts_initrd.c
    1237 +++ b/init/do_mounts_initrd.c
    1238 @@ -36,6 +36,10 @@ __setup("noinitrd", no_initrd);
    1239 static int init_linuxrc(struct subprocess_info *info, struct cred *new)
    1240 {
    1241 sys_unshare(CLONE_FS | CLONE_FILES);
    1242 + /* stdin/stdout/stderr for /linuxrc */
    1243 + sys_open("/dev/console", O_RDWR, 0);
    1244 + sys_dup(0);
    1245 + sys_dup(0);
    1246 /* move initrd over / and chdir/chroot in initrd root */
    1247 sys_chdir("/root");
    1248 sys_mount(".", "/", NULL, MS_MOVE, NULL);
    1249 diff --git a/init/main.c b/init/main.c
    1250 index e33e09d..cd147a9 100644
    1251 --- a/init/main.c
    1252 +++ b/init/main.c
    1253 @@ -800,7 +800,7 @@ static int run_init_process(const char *init_filename)
    1254 return kernel_execve(init_filename, argv_init, envp_init);
    1255 }
    1256
    1257 -static void __init kernel_init_freeable(void);
    1258 +static noinline void __init kernel_init_freeable(void);
    1259
    1260 static int __ref kernel_init(void *unused)
    1261 {
    1262 @@ -844,7 +844,7 @@ static int __ref kernel_init(void *unused)
    1263 "See Linux Documentation/init.txt for guidance.");
    1264 }
    1265
    1266 -static void __init kernel_init_freeable(void)
    1267 +static noinline void __init kernel_init_freeable(void)
    1268 {
    1269 /*
    1270 * Wait until kthreadd is all set-up.
    1271 diff --git a/kernel/async.c b/kernel/async.c
    1272 index 9d31183..8f9f5cf 100644
    1273 --- a/kernel/async.c
    1274 +++ b/kernel/async.c
    1275 @@ -86,18 +86,27 @@ static atomic_t entry_count;
    1276 */
    1277 static async_cookie_t __lowest_in_progress(struct async_domain *running)
    1278 {
    1279 + async_cookie_t first_running = next_cookie; /* infinity value */
    1280 + async_cookie_t first_pending = next_cookie; /* ditto */
    1281 struct async_entry *entry;
    1282
    1283 + /*
    1284 + * Both running and pending lists are sorted but not disjoint.
    1285 + * Take the first cookies from both and return the min.
    1286 + */
    1287 if (!list_empty(&running->domain)) {
    1288 entry = list_first_entry(&running->domain, typeof(*entry), list);
    1289 - return entry->cookie;
    1290 + first_running = entry->cookie;
    1291 }
    1292
    1293 - list_for_each_entry(entry, &async_pending, list)
    1294 - if (entry->running == running)
    1295 - return entry->cookie;
    1296 + list_for_each_entry(entry, &async_pending, list) {
    1297 + if (entry->running == running) {
    1298 + first_pending = entry->cookie;
    1299 + break;
    1300 + }
    1301 + }
    1302
    1303 - return next_cookie; /* "infinity" value */
    1304 + return min(first_running, first_pending);
    1305 }
    1306
    1307 static async_cookie_t lowest_in_progress(struct async_domain *running)
    1308 @@ -118,13 +127,17 @@ static void async_run_entry_fn(struct work_struct *work)
    1309 {
    1310 struct async_entry *entry =
    1311 container_of(work, struct async_entry, work);
    1312 + struct async_entry *pos;
    1313 unsigned long flags;
    1314 ktime_t uninitialized_var(calltime), delta, rettime;
    1315 struct async_domain *running = entry->running;
    1316
    1317 - /* 1) move self to the running queue */
    1318 + /* 1) move self to the running queue, make sure it stays sorted */
    1319 spin_lock_irqsave(&async_lock, flags);
    1320 - list_move_tail(&entry->list, &running->domain);
    1321 + list_for_each_entry_reverse(pos, &running->domain, list)
    1322 + if (entry->cookie < pos->cookie)
    1323 + break;
    1324 + list_move_tail(&entry->list, &pos->list);
    1325 spin_unlock_irqrestore(&async_lock, flags);
    1326
    1327 /* 2) run (and print duration) */
    1328 diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
    1329 index 4d5f8d5..8875254 100644
    1330 --- a/kernel/debug/kdb/kdb_main.c
    1331 +++ b/kernel/debug/kdb/kdb_main.c
    1332 @@ -1970,6 +1970,8 @@ static int kdb_lsmod(int argc, const char **argv)
    1333
    1334 kdb_printf("Module Size modstruct Used by\n");
    1335 list_for_each_entry(mod, kdb_modules, list) {
    1336 + if (mod->state == MODULE_STATE_UNFORMED)
    1337 + continue;
    1338
    1339 kdb_printf("%-20s%8u 0x%p ", mod->name,
    1340 mod->core_size, (void *)mod);
    1341 diff --git a/kernel/module.c b/kernel/module.c
    1342 index 6e48c3a..3e544f4 100644
    1343 --- a/kernel/module.c
    1344 +++ b/kernel/module.c
    1345 @@ -185,6 +185,7 @@ struct load_info {
    1346 ongoing or failed initialization etc. */
    1347 static inline int strong_try_module_get(struct module *mod)
    1348 {
    1349 + BUG_ON(mod && mod->state == MODULE_STATE_UNFORMED);
    1350 if (mod && mod->state == MODULE_STATE_COMING)
    1351 return -EBUSY;
    1352 if (try_module_get(mod))
    1353 @@ -340,6 +341,9 @@ bool each_symbol_section(bool (*fn)(const struct symsearch *arr,
    1354 #endif
    1355 };
    1356
    1357 + if (mod->state == MODULE_STATE_UNFORMED)
    1358 + continue;
    1359 +
    1360 if (each_symbol_in_section(arr, ARRAY_SIZE(arr), mod, fn, data))
    1361 return true;
    1362 }
    1363 @@ -450,16 +454,24 @@ const struct kernel_symbol *find_symbol(const char *name,
    1364 EXPORT_SYMBOL_GPL(find_symbol);
    1365
    1366 /* Search for module by name: must hold module_mutex. */
    1367 -struct module *find_module(const char *name)
    1368 +static struct module *find_module_all(const char *name,
    1369 + bool even_unformed)
    1370 {
    1371 struct module *mod;
    1372
    1373 list_for_each_entry(mod, &modules, list) {
    1374 + if (!even_unformed && mod->state == MODULE_STATE_UNFORMED)
    1375 + continue;
    1376 if (strcmp(mod->name, name) == 0)
    1377 return mod;
    1378 }
    1379 return NULL;
    1380 }
    1381 +
    1382 +struct module *find_module(const char *name)
    1383 +{
    1384 + return find_module_all(name, false);
    1385 +}
    1386 EXPORT_SYMBOL_GPL(find_module);
    1387
    1388 #ifdef CONFIG_SMP
    1389 @@ -525,6 +537,8 @@ bool is_module_percpu_address(unsigned long addr)
    1390 preempt_disable();
    1391
    1392 list_for_each_entry_rcu(mod, &modules, list) {
    1393 + if (mod->state == MODULE_STATE_UNFORMED)
    1394 + continue;
    1395 if (!mod->percpu_size)
    1396 continue;
    1397 for_each_possible_cpu(cpu) {
    1398 @@ -1048,6 +1062,8 @@ static ssize_t show_initstate(struct module_attribute *mattr,
    1399 case MODULE_STATE_GOING:
    1400 state = "going";
    1401 break;
    1402 + default:
    1403 + BUG();
    1404 }
    1405 return sprintf(buffer, "%s\n", state);
    1406 }
    1407 @@ -1786,6 +1802,8 @@ void set_all_modules_text_rw(void)
    1408
    1409 mutex_lock(&module_mutex);
    1410 list_for_each_entry_rcu(mod, &modules, list) {
    1411 + if (mod->state == MODULE_STATE_UNFORMED)
    1412 + continue;
    1413 if ((mod->module_core) && (mod->core_text_size)) {
    1414 set_page_attributes(mod->module_core,
    1415 mod->module_core + mod->core_text_size,
    1416 @@ -1807,6 +1825,8 @@ void set_all_modules_text_ro(void)
    1417
    1418 mutex_lock(&module_mutex);
    1419 list_for_each_entry_rcu(mod, &modules, list) {
    1420 + if (mod->state == MODULE_STATE_UNFORMED)
    1421 + continue;
    1422 if ((mod->module_core) && (mod->core_text_size)) {
    1423 set_page_attributes(mod->module_core,
    1424 mod->module_core + mod->core_text_size,
    1425 @@ -2938,8 +2958,9 @@ static bool finished_loading(const char *name)
    1426 bool ret;
    1427
    1428 mutex_lock(&module_mutex);
    1429 - mod = find_module(name);
    1430 - ret = !mod || mod->state != MODULE_STATE_COMING;
    1431 + mod = find_module_all(name, true);
    1432 + ret = !mod || mod->state == MODULE_STATE_LIVE
    1433 + || mod->state == MODULE_STATE_GOING;
    1434 mutex_unlock(&module_mutex);
    1435
    1436 return ret;
    1437 @@ -2970,6 +2991,32 @@ static struct module *load_module(void __user *umod,
    1438 goto free_copy;
    1439 }
    1440
    1441 + /*
    1442 + * We try to place it in the list now to make sure it's unique
    1443 + * before we dedicate too many resources. In particular,
    1444 + * temporary percpu memory exhaustion.
    1445 + */
    1446 + mod->state = MODULE_STATE_UNFORMED;
    1447 +again:
    1448 + mutex_lock(&module_mutex);
    1449 + if ((old = find_module_all(mod->name, true)) != NULL) {
    1450 + if (old->state == MODULE_STATE_COMING
    1451 + || old->state == MODULE_STATE_UNFORMED) {
    1452 + /* Wait in case it fails to load. */
    1453 + mutex_unlock(&module_mutex);
    1454 + err = wait_event_interruptible(module_wq,
    1455 + finished_loading(mod->name));
    1456 + if (err)
    1457 + goto free_module;
    1458 + goto again;
    1459 + }
    1460 + err = -EEXIST;
    1461 + mutex_unlock(&module_mutex);
    1462 + goto free_module;
    1463 + }
    1464 + list_add_rcu(&mod->list, &modules);
    1465 + mutex_unlock(&module_mutex);
    1466 +
    1467 #ifdef CONFIG_MODULE_SIG
    1468 mod->sig_ok = info.sig_ok;
    1469 if (!mod->sig_ok)
    1470 @@ -2979,7 +3026,7 @@ static struct module *load_module(void __user *umod,
    1471 /* Now module is in final location, initialize linked lists, etc. */
    1472 err = module_unload_init(mod);
    1473 if (err)
    1474 - goto free_module;
    1475 + goto unlink_mod;
    1476
    1477 /* Now we've got everything in the final locations, we can
    1478 * find optional sections. */
    1479 @@ -3014,54 +3061,33 @@ static struct module *load_module(void __user *umod,
    1480 goto free_arch_cleanup;
    1481 }
    1482
    1483 - /* Mark state as coming so strong_try_module_get() ignores us. */
    1484 - mod->state = MODULE_STATE_COMING;
    1485 -
    1486 - /* Now sew it into the lists so we can get lockdep and oops
    1487 - * info during argument parsing. No one should access us, since
    1488 - * strong_try_module_get() will fail.
    1489 - * lockdep/oops can run asynchronous, so use the RCU list insertion
    1490 - * function to insert in a way safe to concurrent readers.
    1491 - * The mutex protects against concurrent writers.
    1492 - */
    1493 -again:
    1494 - mutex_lock(&module_mutex);
    1495 - if ((old = find_module(mod->name)) != NULL) {
    1496 - if (old->state == MODULE_STATE_COMING) {
    1497 - /* Wait in case it fails to load. */
    1498 - mutex_unlock(&module_mutex);
    1499 - err = wait_event_interruptible(module_wq,
    1500 - finished_loading(mod->name));
    1501 - if (err)
    1502 - goto free_arch_cleanup;
    1503 - goto again;
    1504 - }
    1505 - err = -EEXIST;
    1506 - goto unlock;
    1507 - }
    1508 -
    1509 - /* This has to be done once we're sure module name is unique. */
    1510 dynamic_debug_setup(info.debug, info.num_debug);
    1511
    1512 - /* Find duplicate symbols */
    1513 + mutex_lock(&module_mutex);
    1514 + /* Find duplicate symbols (must be called under lock). */
    1515 err = verify_export_symbols(mod);
    1516 if (err < 0)
    1517 - goto ddebug;
    1518 + goto ddebug_cleanup;
    1519
    1520 + /* This relies on module_mutex for list integrity. */
    1521 module_bug_finalize(info.hdr, info.sechdrs, mod);
    1522 - list_add_rcu(&mod->list, &modules);
    1523 +
    1524 + /* Mark state as coming so strong_try_module_get() ignores us,
    1525 + * but kallsyms etc. can see us. */
    1526 + mod->state = MODULE_STATE_COMING;
    1527 +
    1528 mutex_unlock(&module_mutex);
    1529
    1530 /* Module is ready to execute: parsing args may do that. */
    1531 err = parse_args(mod->name, mod->args, mod->kp, mod->num_kp,
    1532 -32768, 32767, &ddebug_dyndbg_module_param_cb);
    1533 if (err < 0)
    1534 - goto unlink;
    1535 + goto bug_cleanup;
    1536
    1537 /* Link in to syfs. */
    1538 err = mod_sysfs_setup(mod, &info, mod->kp, mod->num_kp);
    1539 if (err < 0)
    1540 - goto unlink;
    1541 + goto bug_cleanup;
    1542
    1543 /* Get rid of temporary copy. */
    1544 free_copy(&info);
    1545 @@ -3070,16 +3096,13 @@ again:
    1546 trace_module_load(mod);
    1547 return mod;
    1548
    1549 - unlink:
    1550 + bug_cleanup:
    1551 + /* module_bug_cleanup needs module_mutex protection */
    1552 mutex_lock(&module_mutex);
    1553 - /* Unlink carefully: kallsyms could be walking list. */
    1554 - list_del_rcu(&mod->list);
    1555 module_bug_cleanup(mod);
    1556 - wake_up_all(&module_wq);
    1557 - ddebug:
    1558 - dynamic_debug_remove(info.debug);
    1559 - unlock:
    1560 + ddebug_cleanup:
    1561 mutex_unlock(&module_mutex);
    1562 + dynamic_debug_remove(info.debug);
    1563 synchronize_sched();
    1564 kfree(mod->args);
    1565 free_arch_cleanup:
    1566 @@ -3088,6 +3111,12 @@ again:
    1567 free_modinfo(mod);
    1568 free_unload:
    1569 module_unload_free(mod);
    1570 + unlink_mod:
    1571 + mutex_lock(&module_mutex);
    1572 + /* Unlink carefully: kallsyms could be walking list. */
    1573 + list_del_rcu(&mod->list);
    1574 + wake_up_all(&module_wq);
    1575 + mutex_unlock(&module_mutex);
    1576 free_module:
    1577 module_deallocate(mod, &info);
    1578 free_copy:
    1579 @@ -3264,6 +3293,8 @@ const char *module_address_lookup(unsigned long addr,
    1580
    1581 preempt_disable();
    1582 list_for_each_entry_rcu(mod, &modules, list) {
    1583 + if (mod->state == MODULE_STATE_UNFORMED)
    1584 + continue;
    1585 if (within_module_init(addr, mod) ||
    1586 within_module_core(addr, mod)) {
    1587 if (modname)
    1588 @@ -3287,6 +3318,8 @@ int lookup_module_symbol_name(unsigned long addr, char *symname)
    1589
    1590 preempt_disable();
    1591 list_for_each_entry_rcu(mod, &modules, list) {
    1592 + if (mod->state == MODULE_STATE_UNFORMED)
    1593 + continue;
    1594 if (within_module_init(addr, mod) ||
    1595 within_module_core(addr, mod)) {
    1596 const char *sym;
    1597 @@ -3311,6 +3344,8 @@ int lookup_module_symbol_attrs(unsigned long addr, unsigned long *size,
    1598
    1599 preempt_disable();
    1600 list_for_each_entry_rcu(mod, &modules, list) {
    1601 + if (mod->state == MODULE_STATE_UNFORMED)
    1602 + continue;
    1603 if (within_module_init(addr, mod) ||
    1604 within_module_core(addr, mod)) {
    1605 const char *sym;
    1606 @@ -3338,6 +3373,8 @@ int module_get_kallsym(unsigned int symnum, unsigned long *value, char *type,
    1607
    1608 preempt_disable();
    1609 list_for_each_entry_rcu(mod, &modules, list) {
    1610 + if (mod->state == MODULE_STATE_UNFORMED)
    1611 + continue;
    1612 if (symnum < mod->num_symtab) {
    1613 *value = mod->symtab[symnum].st_value;
    1614 *type = mod->symtab[symnum].st_info;
    1615 @@ -3380,9 +3417,12 @@ unsigned long module_kallsyms_lookup_name(const char *name)
    1616 ret = mod_find_symname(mod, colon+1);
    1617 *colon = ':';
    1618 } else {
    1619 - list_for_each_entry_rcu(mod, &modules, list)
    1620 + list_for_each_entry_rcu(mod, &modules, list) {
    1621 + if (mod->state == MODULE_STATE_UNFORMED)
    1622 + continue;
    1623 if ((ret = mod_find_symname(mod, name)) != 0)
    1624 break;
    1625 + }
    1626 }
    1627 preempt_enable();
    1628 return ret;
    1629 @@ -3397,6 +3437,8 @@ int module_kallsyms_on_each_symbol(int (*fn)(void *, const char *,
    1630 int ret;
    1631
    1632 list_for_each_entry(mod, &modules, list) {
    1633 + if (mod->state == MODULE_STATE_UNFORMED)
    1634 + continue;
    1635 for (i = 0; i < mod->num_symtab; i++) {
    1636 ret = fn(data, mod->strtab + mod->symtab[i].st_name,
    1637 mod, mod->symtab[i].st_value);
    1638 @@ -3412,6 +3454,7 @@ static char *module_flags(struct module *mod, char *buf)
    1639 {
    1640 int bx = 0;
    1641
    1642 + BUG_ON(mod->state == MODULE_STATE_UNFORMED);
    1643 if (mod->taints ||
    1644 mod->state == MODULE_STATE_GOING ||
    1645 mod->state == MODULE_STATE_COMING) {
    1646 @@ -3453,6 +3496,10 @@ static int m_show(struct seq_file *m, void *p)
    1647 struct module *mod = list_entry(p, struct module, list);
    1648 char buf[8];
    1649
    1650 + /* We always ignore unformed modules. */
    1651 + if (mod->state == MODULE_STATE_UNFORMED)
    1652 + return 0;
    1653 +
    1654 seq_printf(m, "%s %u",
    1655 mod->name, mod->init_size + mod->core_size);
    1656 print_unload_info(m, mod);
    1657 @@ -3513,6 +3560,8 @@ const struct exception_table_entry *search_module_extables(unsigned long addr)
    1658
    1659 preempt_disable();
    1660 list_for_each_entry_rcu(mod, &modules, list) {
    1661 + if (mod->state == MODULE_STATE_UNFORMED)
    1662 + continue;
    1663 if (mod->num_exentries == 0)
    1664 continue;
    1665
    1666 @@ -3561,10 +3610,13 @@ struct module *__module_address(unsigned long addr)
    1667 if (addr < module_addr_min || addr > module_addr_max)
    1668 return NULL;
    1669
    1670 - list_for_each_entry_rcu(mod, &modules, list)
    1671 + list_for_each_entry_rcu(mod, &modules, list) {
    1672 + if (mod->state == MODULE_STATE_UNFORMED)
    1673 + continue;
    1674 if (within_module_core(addr, mod)
    1675 || within_module_init(addr, mod))
    1676 return mod;
    1677 + }
    1678 return NULL;
    1679 }
    1680 EXPORT_SYMBOL_GPL(__module_address);
    1681 @@ -3617,8 +3669,11 @@ void print_modules(void)
    1682 printk(KERN_DEFAULT "Modules linked in:");
    1683 /* Most callers should already have preempt disabled, but make sure */
    1684 preempt_disable();
    1685 - list_for_each_entry_rcu(mod, &modules, list)
    1686 + list_for_each_entry_rcu(mod, &modules, list) {
    1687 + if (mod->state == MODULE_STATE_UNFORMED)
    1688 + continue;
    1689 printk(" %s%s", mod->name, module_flags(mod, buf));
    1690 + }
    1691 preempt_enable();
    1692 if (last_unloaded_module[0])
    1693 printk(" [last unloaded: %s]", last_unloaded_module);
    1694 diff --git a/kernel/ptrace.c b/kernel/ptrace.c
    1695 index 1f5e55d..fbea91d 100644
    1696 --- a/kernel/ptrace.c
    1697 +++ b/kernel/ptrace.c
    1698 @@ -117,11 +117,45 @@ void __ptrace_unlink(struct task_struct *child)
    1699 * TASK_KILLABLE sleeps.
    1700 */
    1701 if (child->jobctl & JOBCTL_STOP_PENDING || task_is_traced(child))
    1702 - signal_wake_up(child, task_is_traced(child));
    1703 + ptrace_signal_wake_up(child, true);
    1704
    1705 spin_unlock(&child->sighand->siglock);
    1706 }
    1707
    1708 +/* Ensure that nothing can wake it up, even SIGKILL */
    1709 +static bool ptrace_freeze_traced(struct task_struct *task)
    1710 +{
    1711 + bool ret = false;
    1712 +
    1713 + /* Lockless, nobody but us can set this flag */
    1714 + if (task->jobctl & JOBCTL_LISTENING)
    1715 + return ret;
    1716 +
    1717 + spin_lock_irq(&task->sighand->siglock);
    1718 + if (task_is_traced(task) && !__fatal_signal_pending(task)) {
    1719 + task->state = __TASK_TRACED;
    1720 + ret = true;
    1721 + }
    1722 + spin_unlock_irq(&task->sighand->siglock);
    1723 +
    1724 + return ret;
    1725 +}
    1726 +
    1727 +static void ptrace_unfreeze_traced(struct task_struct *task)
    1728 +{
    1729 + if (task->state != __TASK_TRACED)
    1730 + return;
    1731 +
    1732 + WARN_ON(!task->ptrace || task->parent != current);
    1733 +
    1734 + spin_lock_irq(&task->sighand->siglock);
    1735 + if (__fatal_signal_pending(task))
    1736 + wake_up_state(task, __TASK_TRACED);
    1737 + else
    1738 + task->state = TASK_TRACED;
    1739 + spin_unlock_irq(&task->sighand->siglock);
    1740 +}
    1741 +
    1742 /**
    1743 * ptrace_check_attach - check whether ptracee is ready for ptrace operation
    1744 * @child: ptracee to check for
    1745 @@ -151,24 +185,29 @@ int ptrace_check_attach(struct task_struct *child, bool ignore_state)
    1746 * be changed by us so it's not changing right after this.
    1747 */
    1748 read_lock(&tasklist_lock);
    1749 - if ((child->ptrace & PT_PTRACED) && child->parent == current) {
    1750 + if (child->ptrace && child->parent == current) {
    1751 + WARN_ON(child->state == __TASK_TRACED);
    1752 /*
    1753 * child->sighand can't be NULL, release_task()
    1754 * does ptrace_unlink() before __exit_signal().
    1755 */
    1756 - spin_lock_irq(&child->sighand->siglock);
    1757 - WARN_ON_ONCE(task_is_stopped(child));
    1758 - if (ignore_state || (task_is_traced(child) &&
    1759 - !(child->jobctl & JOBCTL_LISTENING)))
    1760 + if (ignore_state || ptrace_freeze_traced(child))
    1761 ret = 0;
    1762 - spin_unlock_irq(&child->sighand->siglock);
    1763 }
    1764 read_unlock(&tasklist_lock);
    1765
    1766 - if (!ret && !ignore_state)
    1767 - ret = wait_task_inactive(child, TASK_TRACED) ? 0 : -ESRCH;
    1768 + if (!ret && !ignore_state) {
    1769 + if (!wait_task_inactive(child, __TASK_TRACED)) {
    1770 + /*
    1771 + * This can only happen if may_ptrace_stop() fails and
    1772 + * ptrace_stop() changes ->state back to TASK_RUNNING,
    1773 + * so we should not worry about leaking __TASK_TRACED.
    1774 + */
    1775 + WARN_ON(child->state == __TASK_TRACED);
    1776 + ret = -ESRCH;
    1777 + }
    1778 + }
    1779
    1780 - /* All systems go.. */
    1781 return ret;
    1782 }
    1783
    1784 @@ -311,7 +350,7 @@ static int ptrace_attach(struct task_struct *task, long request,
    1785 */
    1786 if (task_is_stopped(task) &&
    1787 task_set_jobctl_pending(task, JOBCTL_TRAP_STOP | JOBCTL_TRAPPING))
    1788 - signal_wake_up(task, 1);
    1789 + signal_wake_up_state(task, __TASK_STOPPED);
    1790
    1791 spin_unlock(&task->sighand->siglock);
    1792
    1793 @@ -728,7 +767,7 @@ int ptrace_request(struct task_struct *child, long request,
    1794 * tracee into STOP.
    1795 */
    1796 if (likely(task_set_jobctl_pending(child, JOBCTL_TRAP_STOP)))
    1797 - signal_wake_up(child, child->jobctl & JOBCTL_LISTENING);
    1798 + ptrace_signal_wake_up(child, child->jobctl & JOBCTL_LISTENING);
    1799
    1800 unlock_task_sighand(child, &flags);
    1801 ret = 0;
    1802 @@ -754,7 +793,7 @@ int ptrace_request(struct task_struct *child, long request,
    1803 * start of this trap and now. Trigger re-trap.
    1804 */
    1805 if (child->jobctl & JOBCTL_TRAP_NOTIFY)
    1806 - signal_wake_up(child, true);
    1807 + ptrace_signal_wake_up(child, true);
    1808 ret = 0;
    1809 }
    1810 unlock_task_sighand(child, &flags);
    1811 @@ -891,6 +930,8 @@ SYSCALL_DEFINE4(ptrace, long, request, long, pid, unsigned long, addr,
    1812 goto out_put_task_struct;
    1813
    1814 ret = arch_ptrace(child, request, addr, data);
    1815 + if (ret || request != PTRACE_DETACH)
    1816 + ptrace_unfreeze_traced(child);
    1817
    1818 out_put_task_struct:
    1819 put_task_struct(child);
    1820 @@ -1030,8 +1071,11 @@ asmlinkage long compat_sys_ptrace(compat_long_t request, compat_long_t pid,
    1821
    1822 ret = ptrace_check_attach(child, request == PTRACE_KILL ||
    1823 request == PTRACE_INTERRUPT);
    1824 - if (!ret)
    1825 + if (!ret) {
    1826 ret = compat_arch_ptrace(child, request, addr, data);
    1827 + if (ret || request != PTRACE_DETACH)
    1828 + ptrace_unfreeze_traced(child);
    1829 + }
    1830
    1831 out_put_task_struct:
    1832 put_task_struct(child);
    1833 diff --git a/kernel/sched/core.c b/kernel/sched/core.c
    1834 index 2d8927f..c529d00 100644
    1835 --- a/kernel/sched/core.c
    1836 +++ b/kernel/sched/core.c
    1837 @@ -1497,7 +1497,8 @@ out:
    1838 */
    1839 int wake_up_process(struct task_struct *p)
    1840 {
    1841 - return try_to_wake_up(p, TASK_ALL, 0);
    1842 + WARN_ON(task_is_stopped_or_traced(p));
    1843 + return try_to_wake_up(p, TASK_NORMAL, 0);
    1844 }
    1845 EXPORT_SYMBOL(wake_up_process);
    1846
    1847 diff --git a/kernel/signal.c b/kernel/signal.c
    1848 index e4d4014..57dde52 100644
    1849 --- a/kernel/signal.c
    1850 +++ b/kernel/signal.c
    1851 @@ -679,23 +679,17 @@ int dequeue_signal(struct task_struct *tsk, sigset_t *mask, siginfo_t *info)
    1852 * No need to set need_resched since signal event passing
    1853 * goes through ->blocked
    1854 */
    1855 -void signal_wake_up(struct task_struct *t, int resume)
    1856 +void signal_wake_up_state(struct task_struct *t, unsigned int state)
    1857 {
    1858 - unsigned int mask;
    1859 -
    1860 set_tsk_thread_flag(t, TIF_SIGPENDING);
    1861 -
    1862 /*
    1863 - * For SIGKILL, we want to wake it up in the stopped/traced/killable
    1864 + * TASK_WAKEKILL also means wake it up in the stopped/traced/killable
    1865 * case. We don't check t->state here because there is a race with it
    1866 * executing another processor and just now entering stopped state.
    1867 * By using wake_up_state, we ensure the process will wake up and
    1868 * handle its death signal.
    1869 */
    1870 - mask = TASK_INTERRUPTIBLE;
    1871 - if (resume)
    1872 - mask |= TASK_WAKEKILL;
    1873 - if (!wake_up_state(t, mask))
    1874 + if (!wake_up_state(t, state | TASK_INTERRUPTIBLE))
    1875 kick_process(t);
    1876 }
    1877
    1878 @@ -843,7 +837,7 @@ static void ptrace_trap_notify(struct task_struct *t)
    1879 assert_spin_locked(&t->sighand->siglock);
    1880
    1881 task_set_jobctl_pending(t, JOBCTL_TRAP_NOTIFY);
    1882 - signal_wake_up(t, t->jobctl & JOBCTL_LISTENING);
    1883 + ptrace_signal_wake_up(t, t->jobctl & JOBCTL_LISTENING);
    1884 }
    1885
    1886 /*
    1887 @@ -1798,6 +1792,10 @@ static inline int may_ptrace_stop(void)
    1888 * If SIGKILL was already sent before the caller unlocked
    1889 * ->siglock we must see ->core_state != NULL. Otherwise it
    1890 * is safe to enter schedule().
    1891 + *
    1892 + * This is almost outdated, a task with the pending SIGKILL can't
    1893 + * block in TASK_TRACED. But PTRACE_EVENT_EXIT can be reported
    1894 + * after SIGKILL was already dequeued.
    1895 */
    1896 if (unlikely(current->mm->core_state) &&
    1897 unlikely(current->mm == current->parent->mm))
    1898 @@ -1923,6 +1921,7 @@ static void ptrace_stop(int exit_code, int why, int clear_code, siginfo_t *info)
    1899 if (gstop_done)
    1900 do_notify_parent_cldstop(current, false, why);
    1901
    1902 + /* tasklist protects us from ptrace_freeze_traced() */
    1903 __set_current_state(TASK_RUNNING);
    1904 if (clear_code)
    1905 current->exit_code = 0;
    1906 diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
    1907 index 51b7159..356bc2f 100644
    1908 --- a/kernel/trace/ftrace.c
    1909 +++ b/kernel/trace/ftrace.c
    1910 @@ -3998,7 +3998,7 @@ static int ftrace_module_notify(struct notifier_block *self,
    1911
    1912 struct notifier_block ftrace_module_nb = {
    1913 .notifier_call = ftrace_module_notify,
    1914 - .priority = 0,
    1915 + .priority = INT_MAX, /* Run before anything that can use kprobes */
    1916 };
    1917
    1918 extern unsigned long __start_mcount_loc[];
    1919 diff --git a/lib/bug.c b/lib/bug.c
    1920 index a28c141..d0cdf14 100644
    1921 --- a/lib/bug.c
    1922 +++ b/lib/bug.c
    1923 @@ -55,6 +55,7 @@ static inline unsigned long bug_addr(const struct bug_entry *bug)
    1924 }
    1925
    1926 #ifdef CONFIG_MODULES
    1927 +/* Updates are protected by module mutex */
    1928 static LIST_HEAD(module_bug_list);
    1929
    1930 static const struct bug_entry *module_find_bug(unsigned long bugaddr)
    1931 diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/evm_crypto.c
    1932 index dfb2691..7dd538e 100644
    1933 --- a/security/integrity/evm/evm_crypto.c
    1934 +++ b/security/integrity/evm/evm_crypto.c
    1935 @@ -205,9 +205,9 @@ int evm_update_evmxattr(struct dentry *dentry, const char *xattr_name,
    1936 rc = __vfs_setxattr_noperm(dentry, XATTR_NAME_EVM,
    1937 &xattr_data,
    1938 sizeof(xattr_data), 0);
    1939 - }
    1940 - else if (rc == -ENODATA)
    1941 + } else if (rc == -ENODATA && inode->i_op->removexattr) {
    1942 rc = inode->i_op->removexattr(dentry, XATTR_NAME_EVM);
    1943 + }
    1944 return rc;
    1945 }
    1946
    1947 diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
    1948 index 8799cf1..63a6801 100644
    1949 --- a/sound/pci/hda/patch_conexant.c
    1950 +++ b/sound/pci/hda/patch_conexant.c
    1951 @@ -4580,6 +4580,12 @@ static const struct hda_codec_preset snd_hda_preset_conexant[] = {
    1952 .patch = patch_conexant_auto },
    1953 { .id = 0x14f15111, .name = "CX20753/4",
    1954 .patch = patch_conexant_auto },
    1955 + { .id = 0x14f15113, .name = "CX20755",
    1956 + .patch = patch_conexant_auto },
    1957 + { .id = 0x14f15114, .name = "CX20756",
    1958 + .patch = patch_conexant_auto },
    1959 + { .id = 0x14f15115, .name = "CX20757",
    1960 + .patch = patch_conexant_auto },
    1961 {} /* terminator */
    1962 };
    1963
    1964 @@ -4603,6 +4609,9 @@ MODULE_ALIAS("snd-hda-codec-id:14f150b9");
    1965 MODULE_ALIAS("snd-hda-codec-id:14f1510f");
    1966 MODULE_ALIAS("snd-hda-codec-id:14f15110");
    1967 MODULE_ALIAS("snd-hda-codec-id:14f15111");
    1968 +MODULE_ALIAS("snd-hda-codec-id:14f15113");
    1969 +MODULE_ALIAS("snd-hda-codec-id:14f15114");
    1970 +MODULE_ALIAS("snd-hda-codec-id:14f15115");
    1971
    1972 MODULE_LICENSE("GPL");
    1973 MODULE_DESCRIPTION("Conexant HD-audio codec");
    1974 diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
    1975 index 4bbabdc..bbaf67c 100644
    1976 --- a/sound/pci/hda/patch_realtek.c
    1977 +++ b/sound/pci/hda/patch_realtek.c
    1978 @@ -6211,6 +6211,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
    1979 SND_PCI_QUIRK(0x1025, 0x0349, "Acer AOD260", ALC269_FIXUP_INV_DMIC),
    1980 SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_MIC2_MUTE_LED),
    1981 SND_PCI_QUIRK(0x103c, 0x1972, "HP Pavilion 17", ALC269_FIXUP_MIC1_MUTE_LED),
    1982 + SND_PCI_QUIRK(0x103c, 0x1977, "HP Pavilion 14", ALC269_FIXUP_MIC1_MUTE_LED),
    1983 SND_PCI_QUIRK(0x1043, 0x1427, "Asus Zenbook UX31E", ALC269VB_FIXUP_DMIC),
    1984 SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_DMIC),
    1985 SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW),
    1986 diff --git a/tools/perf/Makefile b/tools/perf/Makefile
    1987 index 0a619af..627849f 100644
    1988 --- a/tools/perf/Makefile
    1989 +++ b/tools/perf/Makefile
    1990 @@ -58,7 +58,7 @@ ARCH ?= $(shell echo $(uname_M) | sed -e s/i.86/i386/ -e s/sun4u/sparc64/ \
    1991 -e s/arm.*/arm/ -e s/sa110/arm/ \
    1992 -e s/s390x/s390/ -e s/parisc64/parisc/ \
    1993 -e s/ppc.*/powerpc/ -e s/mips.*/mips/ \
    1994 - -e s/sh[234].*/sh/ )
    1995 + -e s/sh[234].*/sh/ -e s/aarch64.*/arm64/ )
    1996 NO_PERF_REGS := 1
    1997
    1998 CC = $(CROSS_COMPILE)gcc