Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-magellan/patches-4.13/0112-4.13.13-all-fixes.patch

    Annotation of /trunk/kernel-magellan/patches-4.13/0112-4.13.13-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3023 - (hide annotations) (download)
    Thu Nov 16 11:09:13 2017 UTC (6 years, 6 months ago) by niro
    File size: 49155 byte(s) 
    -linux-4.13.13
    1 niro 3023 diff --git a/Makefile b/Makefile
    2     index a7c847f495b0..1608a9b71381 100644
    3     --- a/Makefile
    4     +++ b/Makefile
    5     @@ -1,6 +1,6 @@
    6     VERSION = 4
    7     PATCHLEVEL = 13
    8     -SUBLEVEL = 12
    9     +SUBLEVEL = 13
    10     EXTRAVERSION =
    11     NAME = Fearless Coyote
    12    
    13     diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
    14     index 948c648fea00..0fcd82f01388 100644
    15     --- a/arch/arm/kernel/traps.c
    16     +++ b/arch/arm/kernel/traps.c
    17     @@ -154,30 +154,26 @@ static void dump_mem(const char *lvl, const char *str, unsigned long bottom,
    18     set_fs(fs);
    19     }
    20    
    21     -static void dump_instr(const char *lvl, struct pt_regs *regs)
    22     +static void __dump_instr(const char *lvl, struct pt_regs *regs)
    23     {
    24     unsigned long addr = instruction_pointer(regs);
    25     const int thumb = thumb_mode(regs);
    26     const int width = thumb ? 4 : 8;
    27     - mm_segment_t fs;
    28     char str[sizeof("00000000 ") * 5 + 2 + 1], *p = str;
    29     int i;
    30    
    31     /*
    32     - * We need to switch to kernel mode so that we can use __get_user
    33     - * to safely read from kernel space. Note that we now dump the
    34     - * code first, just in case the backtrace kills us.
    35     + * Note that we now dump the code first, just in case the backtrace
    36     + * kills us.
    37     */
    38     - fs = get_fs();
    39     - set_fs(KERNEL_DS);
    40    
    41     for (i = -4; i < 1 + !!thumb; i++) {
    42     unsigned int val, bad;
    43    
    44     if (thumb)
    45     - bad = __get_user(val, &((u16 *)addr)[i]);
    46     + bad = get_user(val, &((u16 *)addr)[i]);
    47     else
    48     - bad = __get_user(val, &((u32 *)addr)[i]);
    49     + bad = get_user(val, &((u32 *)addr)[i]);
    50    
    51     if (!bad)
    52     p += sprintf(p, i == 0 ? "(%0*x) " : "%0*x ",
    53     @@ -188,8 +184,20 @@ static void dump_instr(const char *lvl, struct pt_regs *regs)
    54     }
    55     }
    56     printk("%sCode: %s\n", lvl, str);
    57     +}
    58    
    59     - set_fs(fs);
    60     +static void dump_instr(const char *lvl, struct pt_regs *regs)
    61     +{
    62     + mm_segment_t fs;
    63     +
    64     + if (!user_mode(regs)) {
    65     + fs = get_fs();
    66     + set_fs(KERNEL_DS);
    67     + __dump_instr(lvl, regs);
    68     + set_fs(fs);
    69     + } else {
    70     + __dump_instr(lvl, regs);
    71     + }
    72     }
    73    
    74     #ifdef CONFIG_ARM_UNWIND
    75     diff --git a/arch/mips/ar7/platform.c b/arch/mips/ar7/platform.c
    76     index df7acea3747a..4674f1efbe7a 100644
    77     --- a/arch/mips/ar7/platform.c
    78     +++ b/arch/mips/ar7/platform.c
    79     @@ -575,6 +575,7 @@ static int __init ar7_register_uarts(void)
    80     uart_port.type = PORT_AR7;
    81     uart_port.uartclk = clk_get_rate(bus_clk) / 2;
    82     uart_port.iotype = UPIO_MEM32;
    83     + uart_port.flags = UPF_FIXED_TYPE;
    84     uart_port.regshift = 2;
    85    
    86     uart_port.line = 0;
    87     @@ -653,6 +654,10 @@ static int __init ar7_register_devices(void)
    88     u32 val;
    89     int res;
    90    
    91     + res = ar7_gpio_init();
    92     + if (res)
    93     + pr_warn("unable to register gpios: %d\n", res);
    94     +
    95     res = ar7_register_uarts();
    96     if (res)
    97     pr_err("unable to setup uart(s): %d\n", res);
    98     diff --git a/arch/mips/ar7/prom.c b/arch/mips/ar7/prom.c
    99     index 4fd83336131a..dd53987a690f 100644
    100     --- a/arch/mips/ar7/prom.c
    101     +++ b/arch/mips/ar7/prom.c
    102     @@ -246,8 +246,6 @@ void __init prom_init(void)
    103     ar7_init_cmdline(fw_arg0, (char **)fw_arg1);
    104     ar7_init_env((struct env_var *)fw_arg2);
    105     console_config();
    106     -
    107     - ar7_gpio_init();
    108     }
    109    
    110     #define PORT(offset) (KSEG1ADDR(AR7_REGS_UART0 + (offset * 4)))
    111     diff --git a/arch/mips/include/asm/mips-cm.h b/arch/mips/include/asm/mips-cm.h
    112     index cfdbab015769..163317fd3d7e 100644
    113     --- a/arch/mips/include/asm/mips-cm.h
    114     +++ b/arch/mips/include/asm/mips-cm.h
    115     @@ -240,8 +240,8 @@ BUILD_CM_Cx_R_(tcid_8_priority, 0x80)
    116     #define CM_GCR_BASE_GCRBASE_MSK (_ULCAST_(0x1ffff) << 15)
    117     #define CM_GCR_BASE_CMDEFTGT_SHF 0
    118     #define CM_GCR_BASE_CMDEFTGT_MSK (_ULCAST_(0x3) << 0)
    119     -#define CM_GCR_BASE_CMDEFTGT_DISABLED 0
    120     -#define CM_GCR_BASE_CMDEFTGT_MEM 1
    121     +#define CM_GCR_BASE_CMDEFTGT_MEM 0
    122     +#define CM_GCR_BASE_CMDEFTGT_RESERVED 1
    123     #define CM_GCR_BASE_CMDEFTGT_IOCU0 2
    124     #define CM_GCR_BASE_CMDEFTGT_IOCU1 3
    125    
    126     diff --git a/arch/mips/kernel/smp-bmips.c b/arch/mips/kernel/smp-bmips.c
    127     index 1b070a76fcdd..5e0d87f4958f 100644
    128     --- a/arch/mips/kernel/smp-bmips.c
    129     +++ b/arch/mips/kernel/smp-bmips.c
    130     @@ -589,11 +589,11 @@ void __init bmips_cpu_setup(void)
    131    
    132     /* Flush and enable RAC */
    133     cfg = __raw_readl(cbr + BMIPS_RAC_CONFIG);
    134     - __raw_writel(cfg | 0x100, BMIPS_RAC_CONFIG);
    135     + __raw_writel(cfg | 0x100, cbr + BMIPS_RAC_CONFIG);
    136     __raw_readl(cbr + BMIPS_RAC_CONFIG);
    137    
    138     cfg = __raw_readl(cbr + BMIPS_RAC_CONFIG);
    139     - __raw_writel(cfg | 0xf, BMIPS_RAC_CONFIG);
    140     + __raw_writel(cfg | 0xf, cbr + BMIPS_RAC_CONFIG);
    141     __raw_readl(cbr + BMIPS_RAC_CONFIG);
    142    
    143     cfg = __raw_readl(cbr + BMIPS_RAC_ADDRESS_RANGE);
    144     diff --git a/arch/powerpc/kvm/book3s_64_mmu_hv.c b/arch/powerpc/kvm/book3s_64_mmu_hv.c
    145     index b42812e014c0..1fcc30ff9569 100644
    146     --- a/arch/powerpc/kvm/book3s_64_mmu_hv.c
    147     +++ b/arch/powerpc/kvm/book3s_64_mmu_hv.c
    148     @@ -645,6 +645,16 @@ int kvmppc_book3s_hv_page_fault(struct kvm_run *run, struct kvm_vcpu *vcpu,
    149     hnow_v = hpte_new_to_old_v(hnow_v, hnow_r);
    150     hnow_r = hpte_new_to_old_r(hnow_r);
    151     }
    152     +
    153     + /*
    154     + * If the HPT is being resized, don't update the HPTE,
    155     + * instead let the guest retry after the resize operation is complete.
    156     + * The synchronization for hpte_setup_done test vs. set is provided
    157     + * by the HPTE lock.
    158     + */
    159     + if (!kvm->arch.hpte_setup_done)
    160     + goto out_unlock;
    161     +
    162     if ((hnow_v & ~HPTE_V_HVLOCK) != hpte[0] || hnow_r != hpte[1] ||
    163     rev->guest_rpte != hpte[2])
    164     /* HPTE has been changed under us; let the guest retry */
    165     diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
    166     index 9ecd9aea0b54..c059541743f0 100644
    167     --- a/arch/powerpc/kvm/book3s_hv.c
    168     +++ b/arch/powerpc/kvm/book3s_hv.c
    169     @@ -2688,11 +2688,14 @@ static noinline void kvmppc_run_core(struct kvmppc_vcore *vc)
    170     * Hard-disable interrupts, and check resched flag and signals.
    171     * If we need to reschedule or deliver a signal, clean up
    172     * and return without going into the guest(s).
    173     + * If the hpte_setup_done flag has been cleared, don't go into the
    174     + * guest because that means a HPT resize operation is in progress.
    175     */
    176     local_irq_disable();
    177     hard_irq_disable();
    178     if (lazy_irq_pending() || need_resched() ||
    179     - recheck_signals(&core_info)) {
    180     + recheck_signals(&core_info) ||
    181     + (!kvm_is_radix(vc->kvm) && !vc->kvm->arch.hpte_setup_done)) {
    182     local_irq_enable();
    183     vc->vcore_state = VCORE_INACTIVE;
    184     /* Unlock all except the primary vcore */
    185     @@ -3061,7 +3064,7 @@ static void kvmppc_vcore_blocked(struct kvmppc_vcore *vc)
    186    
    187     static int kvmppc_run_vcpu(struct kvm_run *kvm_run, struct kvm_vcpu *vcpu)
    188     {
    189     - int n_ceded, i;
    190     + int n_ceded, i, r;
    191     struct kvmppc_vcore *vc;
    192     struct kvm_vcpu *v;
    193    
    194     @@ -3115,6 +3118,20 @@ static int kvmppc_run_vcpu(struct kvm_run *kvm_run, struct kvm_vcpu *vcpu)
    195    
    196     while (vcpu->arch.state == KVMPPC_VCPU_RUNNABLE &&
    197     !signal_pending(current)) {
    198     + /* See if the HPT and VRMA are ready to go */
    199     + if (!kvm_is_radix(vcpu->kvm) &&
    200     + !vcpu->kvm->arch.hpte_setup_done) {
    201     + spin_unlock(&vc->lock);
    202     + r = kvmppc_hv_setup_htab_rma(vcpu);
    203     + spin_lock(&vc->lock);
    204     + if (r) {
    205     + kvm_run->exit_reason = KVM_EXIT_FAIL_ENTRY;
    206     + kvm_run->fail_entry.hardware_entry_failure_reason = 0;
    207     + vcpu->arch.ret = r;
    208     + break;
    209     + }
    210     + }
    211     +
    212     if (vc->vcore_state == VCORE_PREEMPT && vc->runner == NULL)
    213     kvmppc_vcore_end_preempt(vc);
    214    
    215     @@ -3232,13 +3249,6 @@ static int kvmppc_vcpu_run_hv(struct kvm_run *run, struct kvm_vcpu *vcpu)
    216     /* Order vcpus_running vs. hpte_setup_done, see kvmppc_alloc_reset_hpt */
    217     smp_mb();
    218    
    219     - /* On the first time here, set up HTAB and VRMA */
    220     - if (!kvm_is_radix(vcpu->kvm) && !vcpu->kvm->arch.hpte_setup_done) {
    221     - r = kvmppc_hv_setup_htab_rma(vcpu);
    222     - if (r)
    223     - goto out;
    224     - }
    225     -
    226     flush_all_to_thread(current);
    227    
    228     /* Save userspace EBB and other register values */
    229     @@ -3286,7 +3296,6 @@ static int kvmppc_vcpu_run_hv(struct kvm_run *run, struct kvm_vcpu *vcpu)
    230     }
    231     mtspr(SPRN_VRSAVE, user_vrsave);
    232    
    233     - out:
    234     vcpu->arch.state = KVMPPC_VCPU_NOTREADY;
    235     atomic_dec(&vcpu->kvm->arch.vcpus_running);
    236     return r;
    237     diff --git a/arch/x86/crypto/sha1-mb/sha1_mb_mgr_flush_avx2.S b/arch/x86/crypto/sha1-mb/sha1_mb_mgr_flush_avx2.S
    238     index 93b945597ecf..7cfba738f104 100644
    239     --- a/arch/x86/crypto/sha1-mb/sha1_mb_mgr_flush_avx2.S
    240     +++ b/arch/x86/crypto/sha1-mb/sha1_mb_mgr_flush_avx2.S
    241     @@ -157,8 +157,8 @@ LABEL skip_ %I
    242     .endr
    243    
    244     # Find min length
    245     - vmovdqa _lens+0*16(state), %xmm0
    246     - vmovdqa _lens+1*16(state), %xmm1
    247     + vmovdqu _lens+0*16(state), %xmm0
    248     + vmovdqu _lens+1*16(state), %xmm1
    249    
    250     vpminud %xmm1, %xmm0, %xmm2 # xmm2 has {D,C,B,A}
    251     vpalignr $8, %xmm2, %xmm3, %xmm3 # xmm3 has {x,x,D,C}
    252     @@ -178,8 +178,8 @@ LABEL skip_ %I
    253     vpsubd %xmm2, %xmm0, %xmm0
    254     vpsubd %xmm2, %xmm1, %xmm1
    255    
    256     - vmovdqa %xmm0, _lens+0*16(state)
    257     - vmovdqa %xmm1, _lens+1*16(state)
    258     + vmovdqu %xmm0, _lens+0*16(state)
    259     + vmovdqu %xmm1, _lens+1*16(state)
    260    
    261     # "state" and "args" are the same address, arg1
    262     # len is arg2
    263     @@ -235,8 +235,8 @@ ENTRY(sha1_mb_mgr_get_comp_job_avx2)
    264     jc .return_null
    265    
    266     # Find min length
    267     - vmovdqa _lens(state), %xmm0
    268     - vmovdqa _lens+1*16(state), %xmm1
    269     + vmovdqu _lens(state), %xmm0
    270     + vmovdqu _lens+1*16(state), %xmm1
    271    
    272     vpminud %xmm1, %xmm0, %xmm2 # xmm2 has {D,C,B,A}
    273     vpalignr $8, %xmm2, %xmm3, %xmm3 # xmm3 has {x,x,D,C}
    274     diff --git a/arch/x86/crypto/sha256-mb/sha256_mb_mgr_flush_avx2.S b/arch/x86/crypto/sha256-mb/sha256_mb_mgr_flush_avx2.S
    275     index 8fe6338bcc84..16c4ccb1f154 100644
    276     --- a/arch/x86/crypto/sha256-mb/sha256_mb_mgr_flush_avx2.S
    277     +++ b/arch/x86/crypto/sha256-mb/sha256_mb_mgr_flush_avx2.S
    278     @@ -155,8 +155,8 @@ LABEL skip_ %I
    279     .endr
    280    
    281     # Find min length
    282     - vmovdqa _lens+0*16(state), %xmm0
    283     - vmovdqa _lens+1*16(state), %xmm1
    284     + vmovdqu _lens+0*16(state), %xmm0
    285     + vmovdqu _lens+1*16(state), %xmm1
    286    
    287     vpminud %xmm1, %xmm0, %xmm2 # xmm2 has {D,C,B,A}
    288     vpalignr $8, %xmm2, %xmm3, %xmm3 # xmm3 has {x,x,D,C}
    289     @@ -176,8 +176,8 @@ LABEL skip_ %I
    290     vpsubd %xmm2, %xmm0, %xmm0
    291     vpsubd %xmm2, %xmm1, %xmm1
    292    
    293     - vmovdqa %xmm0, _lens+0*16(state)
    294     - vmovdqa %xmm1, _lens+1*16(state)
    295     + vmovdqu %xmm0, _lens+0*16(state)
    296     + vmovdqu %xmm1, _lens+1*16(state)
    297    
    298     # "state" and "args" are the same address, arg1
    299     # len is arg2
    300     @@ -234,8 +234,8 @@ ENTRY(sha256_mb_mgr_get_comp_job_avx2)
    301     jc .return_null
    302    
    303     # Find min length
    304     - vmovdqa _lens(state), %xmm0
    305     - vmovdqa _lens+1*16(state), %xmm1
    306     + vmovdqu _lens(state), %xmm0
    307     + vmovdqu _lens+1*16(state), %xmm1
    308    
    309     vpminud %xmm1, %xmm0, %xmm2 # xmm2 has {D,C,B,A}
    310     vpalignr $8, %xmm2, %xmm3, %xmm3 # xmm3 has {x,x,D,C}
    311     diff --git a/arch/x86/kernel/cpu/Makefile b/arch/x86/kernel/cpu/Makefile
    312     index 836877e2da22..cdf82492b770 100644
    313     --- a/arch/x86/kernel/cpu/Makefile
    314     +++ b/arch/x86/kernel/cpu/Makefile
    315     @@ -21,7 +21,7 @@ obj-y += common.o
    316     obj-y += rdrand.o
    317     obj-y += match.o
    318     obj-y += bugs.o
    319     -obj-y += aperfmperf.o
    320     +obj-$(CONFIG_CPU_FREQ) += aperfmperf.o
    321    
    322     obj-$(CONFIG_PROC_FS) += proc.o
    323     obj-$(CONFIG_X86_FEATURE_NAMES) += capflags.o powerflags.o
    324     diff --git a/arch/x86/kernel/cpu/aperfmperf.c b/arch/x86/kernel/cpu/aperfmperf.c
    325     index 957813e0180d..0ee83321a313 100644
    326     --- a/arch/x86/kernel/cpu/aperfmperf.c
    327     +++ b/arch/x86/kernel/cpu/aperfmperf.c
    328     @@ -42,6 +42,10 @@ static void aperfmperf_snapshot_khz(void *dummy)
    329     s64 time_delta = ktime_ms_delta(now, s->time);
    330     unsigned long flags;
    331    
    332     + /* Don't bother re-computing within the cache threshold time. */
    333     + if (time_delta < APERFMPERF_CACHE_THRESHOLD_MS)
    334     + return;
    335     +
    336     local_irq_save(flags);
    337     rdmsrl(MSR_IA32_APERF, aperf);
    338     rdmsrl(MSR_IA32_MPERF, mperf);
    339     @@ -70,7 +74,6 @@ static void aperfmperf_snapshot_khz(void *dummy)
    340    
    341     unsigned int arch_freq_get_on_cpu(int cpu)
    342     {
    343     - s64 time_delta;
    344     unsigned int khz;
    345    
    346     if (!cpu_khz)
    347     @@ -79,12 +82,6 @@ unsigned int arch_freq_get_on_cpu(int cpu)
    348     if (!static_cpu_has(X86_FEATURE_APERFMPERF))
    349     return 0;
    350    
    351     - /* Don't bother re-computing within the cache threshold time. */
    352     - time_delta = ktime_ms_delta(ktime_get(), per_cpu(samples.time, cpu));
    353     - khz = per_cpu(samples.khz, cpu);
    354     - if (khz && time_delta < APERFMPERF_CACHE_THRESHOLD_MS)
    355     - return khz;
    356     -
    357     smp_call_function_single(cpu, aperfmperf_snapshot_khz, NULL, 1);
    358     khz = per_cpu(samples.khz, cpu);
    359     if (khz)
    360     diff --git a/arch/x86/kernel/cpu/proc.c b/arch/x86/kernel/cpu/proc.c
    361     index 510e69596278..6df621ae62a7 100644
    362     --- a/arch/x86/kernel/cpu/proc.c
    363     +++ b/arch/x86/kernel/cpu/proc.c
    364     @@ -77,10 +77,8 @@ static int show_cpuinfo(struct seq_file *m, void *v)
    365     seq_printf(m, "microcode\t: 0x%x\n", c->microcode);
    366    
    367     if (cpu_has(c, X86_FEATURE_TSC)) {
    368     - unsigned int freq = arch_freq_get_on_cpu(cpu);
    369     + unsigned int freq = cpufreq_quick_get(cpu);
    370    
    371     - if (!freq)
    372     - freq = cpufreq_quick_get(cpu);
    373     if (!freq)
    374     freq = cpu_khz;
    375     seq_printf(m, "cpu MHz\t\t: %u.%03u\n",
    376     diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
    377     index 54b9e89d4d6b..893fd8c849e2 100644
    378     --- a/arch/x86/kernel/smpboot.c
    379     +++ b/arch/x86/kernel/smpboot.c
    380     @@ -193,6 +193,12 @@ static void smp_callin(void)
    381     */
    382     smp_store_cpu_info(cpuid);
    383    
    384     + /*
    385     + * The topology information must be up to date before
    386     + * calibrate_delay() and notify_cpu_starting().
    387     + */
    388     + set_cpu_sibling_map(raw_smp_processor_id());
    389     +
    390     /*
    391     * Get our bogomips.
    392     * Update loops_per_jiffy in cpu_data. Previous call to
    393     @@ -203,11 +209,6 @@ static void smp_callin(void)
    394     cpu_data(cpuid).loops_per_jiffy = loops_per_jiffy;
    395     pr_debug("Stack at about %p\n", &cpuid);
    396    
    397     - /*
    398     - * This must be done before setting cpu_online_mask
    399     - * or calling notify_cpu_starting.
    400     - */
    401     - set_cpu_sibling_map(raw_smp_processor_id());
    402     wmb();
    403    
    404     notify_cpu_starting(cpuid);
    405     diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
    406     index bf54309b85da..b2157d4a5338 100644
    407     --- a/arch/x86/kernel/traps.c
    408     +++ b/arch/x86/kernel/traps.c
    409     @@ -221,9 +221,6 @@ do_trap_no_signal(struct task_struct *tsk, int trapnr, char *str,
    410     if (fixup_exception(regs, trapnr))
    411     return 0;
    412    
    413     - if (fixup_bug(regs, trapnr))
    414     - return 0;
    415     -
    416     tsk->thread.error_code = error_code;
    417     tsk->thread.trap_nr = trapnr;
    418     die(str, regs, error_code);
    419     @@ -304,6 +301,13 @@ static void do_error_trap(struct pt_regs *regs, long error_code, char *str,
    420    
    421     RCU_LOCKDEP_WARN(!rcu_is_watching(), "entry code didn't wake RCU");
    422    
    423     + /*
    424     + * WARN*()s end up here; fix them up before we call the
    425     + * notifier chain.
    426     + */
    427     + if (!user_mode(regs) && fixup_bug(regs, trapnr))
    428     + return;
    429     +
    430     if (notify_die(DIE_TRAP, str, regs, error_code, trapnr, signr) !=
    431     NOTIFY_STOP) {
    432     cond_local_irq_enable(regs);
    433     diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
    434     index 796d96bb0821..ad2b925a808e 100644
    435     --- a/arch/x86/kernel/tsc.c
    436     +++ b/arch/x86/kernel/tsc.c
    437     @@ -1346,12 +1346,10 @@ void __init tsc_init(void)
    438     unsigned long calibrate_delay_is_known(void)
    439     {
    440     int sibling, cpu = smp_processor_id();
    441     - struct cpumask *mask = topology_core_cpumask(cpu);
    442     + int constant_tsc = cpu_has(&cpu_data(cpu), X86_FEATURE_CONSTANT_TSC);
    443     + const struct cpumask *mask = topology_core_cpumask(cpu);
    444    
    445     - if (!tsc_disabled && !cpu_has(&cpu_data(cpu), X86_FEATURE_CONSTANT_TSC))
    446     - return 0;
    447     -
    448     - if (!mask)
    449     + if (tsc_disabled || !constant_tsc || !mask)
    450     return 0;
    451    
    452     sibling = cpumask_any_but(mask, cpu);
    453     diff --git a/arch/x86/oprofile/op_model_ppro.c b/arch/x86/oprofile/op_model_ppro.c
    454     index 350f7096baac..7913b6921959 100644
    455     --- a/arch/x86/oprofile/op_model_ppro.c
    456     +++ b/arch/x86/oprofile/op_model_ppro.c
    457     @@ -212,8 +212,8 @@ static void arch_perfmon_setup_counters(void)
    458     eax.full = cpuid_eax(0xa);
    459    
    460     /* Workaround for BIOS bugs in 6/15. Taken from perfmon2 */
    461     - if (eax.split.version_id == 0 && __this_cpu_read(cpu_info.x86) == 6 &&
    462     - __this_cpu_read(cpu_info.x86_model) == 15) {
    463     + if (eax.split.version_id == 0 && boot_cpu_data.x86 == 6 &&
    464     + boot_cpu_data.x86_model == 15) {
    465     eax.split.version_id = 2;
    466     eax.split.num_counters = 2;
    467     eax.split.bit_width = 40;
    468     diff --git a/crypto/ccm.c b/crypto/ccm.c
    469     index 1ce37ae0ce56..0a083342ec8c 100644
    470     --- a/crypto/ccm.c
    471     +++ b/crypto/ccm.c
    472     @@ -363,7 +363,7 @@ static int crypto_ccm_decrypt(struct aead_request *req)
    473     unsigned int cryptlen = req->cryptlen;
    474     u8 *authtag = pctx->auth_tag;
    475     u8 *odata = pctx->odata;
    476     - u8 *iv = req->iv;
    477     + u8 *iv = pctx->idata;
    478     int err;
    479    
    480     cryptlen -= authsize;
    481     @@ -379,6 +379,8 @@ static int crypto_ccm_decrypt(struct aead_request *req)
    482     if (req->src != req->dst)
    483     dst = pctx->dst;
    484    
    485     + memcpy(iv, req->iv, 16);
    486     +
    487     skcipher_request_set_tfm(skreq, ctx->ctr);
    488     skcipher_request_set_callback(skreq, pctx->flags,
    489     crypto_ccm_decrypt_done, req);
    490     diff --git a/drivers/acpi/acpica/evgpeblk.c b/drivers/acpi/acpica/evgpeblk.c
    491     index 9c941947a063..3a3cb8624f41 100644
    492     --- a/drivers/acpi/acpica/evgpeblk.c
    493     +++ b/drivers/acpi/acpica/evgpeblk.c
    494     @@ -440,9 +440,11 @@ acpi_ev_initialize_gpe_block(struct acpi_gpe_xrupt_info *gpe_xrupt_info,
    495     void *ignored)
    496     {
    497     acpi_status status;
    498     + acpi_event_status event_status;
    499     struct acpi_gpe_event_info *gpe_event_info;
    500     u32 gpe_enabled_count;
    501     u32 gpe_index;
    502     + u32 gpe_number;
    503     u32 i;
    504     u32 j;
    505    
    506     @@ -470,30 +472,40 @@ acpi_ev_initialize_gpe_block(struct acpi_gpe_xrupt_info *gpe_xrupt_info,
    507    
    508     gpe_index = (i * ACPI_GPE_REGISTER_WIDTH) + j;
    509     gpe_event_info = &gpe_block->event_info[gpe_index];
    510     + gpe_number = gpe_block->block_base_number + gpe_index;
    511    
    512     /*
    513     * Ignore GPEs that have no corresponding _Lxx/_Exx method
    514     - * and GPEs that are used to wake the system
    515     + * and GPEs that are used for wakeup
    516     */
    517     - if ((ACPI_GPE_DISPATCH_TYPE(gpe_event_info->flags) ==
    518     - ACPI_GPE_DISPATCH_NONE)
    519     - || (ACPI_GPE_DISPATCH_TYPE(gpe_event_info->flags) ==
    520     - ACPI_GPE_DISPATCH_HANDLER)
    521     - || (ACPI_GPE_DISPATCH_TYPE(gpe_event_info->flags) ==
    522     - ACPI_GPE_DISPATCH_RAW_HANDLER)
    523     + if ((ACPI_GPE_DISPATCH_TYPE(gpe_event_info->flags) !=
    524     + ACPI_GPE_DISPATCH_METHOD)
    525     || (gpe_event_info->flags & ACPI_GPE_CAN_WAKE)) {
    526     continue;
    527     }
    528    
    529     + event_status = 0;
    530     + (void)acpi_hw_get_gpe_status(gpe_event_info,
    531     + &event_status);
    532     +
    533     status = acpi_ev_add_gpe_reference(gpe_event_info);
    534     if (ACPI_FAILURE(status)) {
    535     ACPI_EXCEPTION((AE_INFO, status,
    536     "Could not enable GPE 0x%02X",
    537     - gpe_index +
    538     - gpe_block->block_base_number));
    539     + gpe_number));
    540     continue;
    541     }
    542    
    543     + gpe_event_info->flags |= ACPI_GPE_AUTO_ENABLED;
    544     +
    545     + if (event_status & ACPI_EVENT_FLAG_STATUS_SET) {
    546     + ACPI_INFO(("GPE 0x%02X active on init",
    547     + gpe_number));
    548     + (void)acpi_ev_gpe_dispatch(gpe_block->node,
    549     + gpe_event_info,
    550     + gpe_number);
    551     + }
    552     +
    553     gpe_enabled_count++;
    554     }
    555     }
    556     diff --git a/drivers/acpi/acpica/evxfgpe.c b/drivers/acpi/acpica/evxfgpe.c
    557     index 57718a3e029a..67c7c4ce276c 100644
    558     --- a/drivers/acpi/acpica/evxfgpe.c
    559     +++ b/drivers/acpi/acpica/evxfgpe.c
    560     @@ -435,6 +435,14 @@ acpi_setup_gpe_for_wake(acpi_handle wake_device,
    561     */
    562     gpe_event_info->flags =
    563     (ACPI_GPE_DISPATCH_NOTIFY | ACPI_GPE_LEVEL_TRIGGERED);
    564     + } else if (gpe_event_info->flags & ACPI_GPE_AUTO_ENABLED) {
    565     + /*
    566     + * A reference to this GPE has been added during the GPE block
    567     + * initialization, so drop it now to prevent the GPE from being
    568     + * permanently enabled and clear its ACPI_GPE_AUTO_ENABLED flag.
    569     + */
    570     + (void)acpi_ev_remove_gpe_reference(gpe_event_info);
    571     + gpe_event_info->flags &= ~ACPI_GPE_AUTO_ENABLED;
    572     }
    573    
    574     /*
    575     diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
    576     index 70fd5502c284..b7bdf9d0f5c0 100644
    577     --- a/drivers/acpi/scan.c
    578     +++ b/drivers/acpi/scan.c
    579     @@ -2058,6 +2058,9 @@ int __init acpi_scan_init(void)
    580     acpi_get_spcr_uart_addr();
    581     }
    582    
    583     + acpi_gpe_apply_masked_gpes();
    584     + acpi_update_all_gpes();
    585     +
    586     mutex_lock(&acpi_scan_lock);
    587     /*
    588     * Enumerate devices in the ACPI namespace.
    589     @@ -2082,9 +2085,6 @@ int __init acpi_scan_init(void)
    590     }
    591     }
    592    
    593     - acpi_gpe_apply_masked_gpes();
    594     - acpi_update_all_gpes();
    595     -
    596     acpi_scan_initialized = true;
    597    
    598     out:
    599     diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
    600     index fa8243c5c062..59b78e42a58b 100644
    601     --- a/drivers/acpi/sleep.c
    602     +++ b/drivers/acpi/sleep.c
    603     @@ -160,6 +160,14 @@ static int __init init_nvs_nosave(const struct dmi_system_id *d)
    604     return 0;
    605     }
    606    
    607     +static bool acpi_sleep_no_lps0;
    608     +
    609     +static int __init init_no_lps0(const struct dmi_system_id *d)
    610     +{
    611     + acpi_sleep_no_lps0 = true;
    612     + return 0;
    613     +}
    614     +
    615     static struct dmi_system_id acpisleep_dmi_table[] __initdata = {
    616     {
    617     .callback = init_old_suspend_ordering,
    618     @@ -343,6 +351,19 @@ static struct dmi_system_id acpisleep_dmi_table[] __initdata = {
    619     DMI_MATCH(DMI_PRODUCT_NAME, "80E3"),
    620     },
    621     },
    622     + /*
    623     + * https://bugzilla.kernel.org/show_bug.cgi?id=196907
    624     + * Some Dell XPS13 9360 cannot do suspend-to-idle using the Low Power
    625     + * S0 Idle firmware interface.
    626     + */
    627     + {
    628     + .callback = init_no_lps0,
    629     + .ident = "Dell XPS13 9360",
    630     + .matches = {
    631     + DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
    632     + DMI_MATCH(DMI_PRODUCT_NAME, "XPS 13 9360"),
    633     + },
    634     + },
    635     {},
    636     };
    637    
    638     @@ -485,6 +506,7 @@ static void acpi_pm_end(void)
    639     }
    640     #else /* !CONFIG_ACPI_SLEEP */
    641     #define acpi_target_sleep_state ACPI_STATE_S0
    642     +#define acpi_sleep_no_lps0 (false)
    643     static inline void acpi_sleep_dmi_check(void) {}
    644     #endif /* CONFIG_ACPI_SLEEP */
    645    
    646     @@ -702,6 +724,12 @@ static int lps0_device_attach(struct acpi_device *adev,
    647     if (lps0_device_handle)
    648     return 0;
    649    
    650     + if (acpi_sleep_no_lps0) {
    651     + acpi_handle_info(adev->handle,
    652     + "Low Power S0 Idle interface disabled\n");
    653     + return 0;
    654     + }
    655     +
    656     if (!(acpi_gbl_FADT.flags & ACPI_FADT_LOW_POWER_S0))
    657     return 0;
    658    
    659     diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
    660     index b008b6a98098..cf54a1cf8c55 100644
    661     --- a/drivers/block/rbd.c
    662     +++ b/drivers/block/rbd.c
    663     @@ -2692,7 +2692,7 @@ static int rbd_img_obj_parent_read_full(struct rbd_obj_request *obj_request)
    664     * from the parent.
    665     */
    666     page_count = (u32)calc_pages_for(0, length);
    667     - pages = ceph_alloc_page_vector(page_count, GFP_KERNEL);
    668     + pages = ceph_alloc_page_vector(page_count, GFP_NOIO);
    669     if (IS_ERR(pages)) {
    670     result = PTR_ERR(pages);
    671     pages = NULL;
    672     @@ -2827,7 +2827,7 @@ static int rbd_img_obj_exists_submit(struct rbd_obj_request *obj_request)
    673     */
    674     size = sizeof (__le64) + sizeof (__le32) + sizeof (__le32);
    675     page_count = (u32)calc_pages_for(0, size);
    676     - pages = ceph_alloc_page_vector(page_count, GFP_KERNEL);
    677     + pages = ceph_alloc_page_vector(page_count, GFP_NOIO);
    678     if (IS_ERR(pages)) {
    679     ret = PTR_ERR(pages);
    680     goto fail_stat_request;
    681     diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
    682     index 4436d53ae16c..f160a66b7098 100644
    683     --- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
    684     +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
    685     @@ -722,7 +722,7 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
    686     * allocation taken by fbdev
    687     */
    688     if (!(dev_priv->capabilities & SVGA_CAP_3D))
    689     - mem_size *= 2;
    690     + mem_size *= 3;
    691    
    692     dev_priv->max_mob_pages = mem_size * 1024 / PAGE_SIZE;
    693     dev_priv->prim_bb_mem =
    694     diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
    695     index a6b762271a40..47a9696e7874 100644
    696     --- a/drivers/input/mouse/elan_i2c_core.c
    697     +++ b/drivers/input/mouse/elan_i2c_core.c
    698     @@ -1253,6 +1253,7 @@ static const struct acpi_device_id elan_acpi_id[] = {
    699     { "ELAN0605", 0 },
    700     { "ELAN0609", 0 },
    701     { "ELAN060B", 0 },
    702     + { "ELAN060C", 0 },
    703     { "ELAN0611", 0 },
    704     { "ELAN1000", 0 },
    705     { }
    706     diff --git a/drivers/net/can/c_can/c_can_pci.c b/drivers/net/can/c_can/c_can_pci.c
    707     index cf7c18947189..d065c0e2d18e 100644
    708     --- a/drivers/net/can/c_can/c_can_pci.c
    709     +++ b/drivers/net/can/c_can/c_can_pci.c
    710     @@ -178,7 +178,6 @@ static int c_can_pci_probe(struct pci_dev *pdev,
    711     break;
    712     case BOSCH_D_CAN:
    713     priv->regs = reg_map_d_can;
    714     - priv->can.ctrlmode_supported |= CAN_CTRLMODE_3_SAMPLES;
    715     break;
    716     default:
    717     ret = -EINVAL;
    718     diff --git a/drivers/net/can/c_can/c_can_platform.c b/drivers/net/can/c_can/c_can_platform.c
    719     index e36d10520e24..717530eac70c 100644
    720     --- a/drivers/net/can/c_can/c_can_platform.c
    721     +++ b/drivers/net/can/c_can/c_can_platform.c
    722     @@ -320,7 +320,6 @@ static int c_can_plat_probe(struct platform_device *pdev)
    723     break;
    724     case BOSCH_D_CAN:
    725     priv->regs = reg_map_d_can;
    726     - priv->can.ctrlmode_supported |= CAN_CTRLMODE_3_SAMPLES;
    727     priv->read_reg = c_can_plat_read_reg_aligned_to_16bit;
    728     priv->write_reg = c_can_plat_write_reg_aligned_to_16bit;
    729     priv->read_reg32 = d_can_plat_read_reg32;
    730     diff --git a/drivers/net/can/ifi_canfd/ifi_canfd.c b/drivers/net/can/ifi_canfd/ifi_canfd.c
    731     index 4d1fe8d95042..2772d05ff11c 100644
    732     --- a/drivers/net/can/ifi_canfd/ifi_canfd.c
    733     +++ b/drivers/net/can/ifi_canfd/ifi_canfd.c
    734     @@ -670,9 +670,9 @@ static void ifi_canfd_set_bittiming(struct net_device *ndev)
    735     priv->base + IFI_CANFD_FTIME);
    736    
    737     /* Configure transmitter delay */
    738     - tdc = (dbt->brp * (dbt->phase_seg1 + 1)) & IFI_CANFD_TDELAY_MASK;
    739     - writel(IFI_CANFD_TDELAY_EN | IFI_CANFD_TDELAY_ABS | tdc,
    740     - priv->base + IFI_CANFD_TDELAY);
    741     + tdc = dbt->brp * (dbt->prop_seg + dbt->phase_seg1);
    742     + tdc &= IFI_CANFD_TDELAY_MASK;
    743     + writel(IFI_CANFD_TDELAY_EN | tdc, priv->base + IFI_CANFD_TDELAY);
    744     }
    745    
    746     static void ifi_canfd_set_filter(struct net_device *ndev, const u32 id,
    747     diff --git a/drivers/net/can/peak_canfd/peak_pciefd_main.c b/drivers/net/can/peak_canfd/peak_pciefd_main.c
    748     index 51c2d182a33a..b4efd711f824 100644
    749     --- a/drivers/net/can/peak_canfd/peak_pciefd_main.c
    750     +++ b/drivers/net/can/peak_canfd/peak_pciefd_main.c
    751     @@ -29,14 +29,19 @@
    752     #include "peak_canfd_user.h"
    753    
    754     MODULE_AUTHOR("Stephane Grosjean <s.grosjean@peak-system.com>");
    755     -MODULE_DESCRIPTION("Socket-CAN driver for PEAK PCAN PCIe FD family cards");
    756     -MODULE_SUPPORTED_DEVICE("PEAK PCAN PCIe FD CAN cards");
    757     +MODULE_DESCRIPTION("Socket-CAN driver for PEAK PCAN PCIe/M.2 FD family cards");
    758     +MODULE_SUPPORTED_DEVICE("PEAK PCAN PCIe/M.2 FD CAN cards");
    759     MODULE_LICENSE("GPL v2");
    760    
    761     #define PCIEFD_DRV_NAME "peak_pciefd"
    762    
    763     #define PEAK_PCI_VENDOR_ID 0x001c /* The PCI device and vendor IDs */
    764     #define PEAK_PCIEFD_ID 0x0013 /* for PCIe slot cards */
    765     +#define PCAN_CPCIEFD_ID 0x0014 /* for Compact-PCI Serial slot cards */
    766     +#define PCAN_PCIE104FD_ID 0x0017 /* for PCIe-104 Express slot cards */
    767     +#define PCAN_MINIPCIEFD_ID 0x0018 /* for mini-PCIe slot cards */
    768     +#define PCAN_PCIEFD_OEM_ID 0x0019 /* for PCIe slot OEM cards */
    769     +#define PCAN_M2_ID 0x001a /* for M2 slot cards */
    770    
    771     /* PEAK PCIe board access description */
    772     #define PCIEFD_BAR0_SIZE (64 * 1024)
    773     @@ -203,6 +208,11 @@ struct pciefd_board {
    774     /* supported device ids. */
    775     static const struct pci_device_id peak_pciefd_tbl[] = {
    776     {PEAK_PCI_VENDOR_ID, PEAK_PCIEFD_ID, PCI_ANY_ID, PCI_ANY_ID,},
    777     + {PEAK_PCI_VENDOR_ID, PCAN_CPCIEFD_ID, PCI_ANY_ID, PCI_ANY_ID,},
    778     + {PEAK_PCI_VENDOR_ID, PCAN_PCIE104FD_ID, PCI_ANY_ID, PCI_ANY_ID,},
    779     + {PEAK_PCI_VENDOR_ID, PCAN_MINIPCIEFD_ID, PCI_ANY_ID, PCI_ANY_ID,},
    780     + {PEAK_PCI_VENDOR_ID, PCAN_PCIEFD_OEM_ID, PCI_ANY_ID, PCI_ANY_ID,},
    781     + {PEAK_PCI_VENDOR_ID, PCAN_M2_ID, PCI_ANY_ID, PCI_ANY_ID,},
    782     {0,}
    783     };
    784    
    785     diff --git a/drivers/net/can/sun4i_can.c b/drivers/net/can/sun4i_can.c
    786     index b0c80859f746..1ac2090a1721 100644
    787     --- a/drivers/net/can/sun4i_can.c
    788     +++ b/drivers/net/can/sun4i_can.c
    789     @@ -539,6 +539,13 @@ static int sun4i_can_err(struct net_device *dev, u8 isrc, u8 status)
    790     }
    791     stats->rx_over_errors++;
    792     stats->rx_errors++;
    793     +
    794     + /* reset the CAN IP by entering reset mode
    795     + * ignoring timeout error
    796     + */
    797     + set_reset_mode(dev);
    798     + set_normal_mode(dev);
    799     +
    800     /* clear bit */
    801     sun4i_can_write_cmdreg(priv, SUN4I_CMD_CLEAR_OR_FLAG);
    802     }
    803     @@ -653,8 +660,9 @@ static irqreturn_t sun4i_can_interrupt(int irq, void *dev_id)
    804     netif_wake_queue(dev);
    805     can_led_event(dev, CAN_LED_EVENT_TX);
    806     }
    807     - if (isrc & SUN4I_INT_RBUF_VLD) {
    808     - /* receive interrupt */
    809     + if ((isrc & SUN4I_INT_RBUF_VLD) &&
    810     + !(isrc & SUN4I_INT_DATA_OR)) {
    811     + /* receive interrupt - don't read if overrun occurred */
    812     while (status & SUN4I_STA_RBUF_RDY) {
    813     /* RX buffer is not empty */
    814     sun4i_can_rx(dev);
    815     diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h
    816     index 2fcbaec8b368..71eddf645566 100644
    817     --- a/include/acpi/actypes.h
    818     +++ b/include/acpi/actypes.h
    819     @@ -775,7 +775,7 @@ typedef u32 acpi_event_status;
    820     * | | | | +-- Type of dispatch:to method, handler, notify, or none
    821     * | | | +----- Interrupt type: edge or level triggered
    822     * | | +------- Is a Wake GPE
    823     - * | +--------- Is GPE masked by the software GPE masking mechanism
    824     + * | +--------- Has been enabled automatically at init time
    825     * +------------ <Reserved>
    826     */
    827     #define ACPI_GPE_DISPATCH_NONE (u8) 0x00
    828     @@ -791,6 +791,7 @@ typedef u32 acpi_event_status;
    829     #define ACPI_GPE_XRUPT_TYPE_MASK (u8) 0x08
    830    
    831     #define ACPI_GPE_CAN_WAKE (u8) 0x10
    832     +#define ACPI_GPE_AUTO_ENABLED (u8) 0x20
    833    
    834     /*
    835     * Flags for GPE and Lock interfaces
    836     diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
    837     index 48407569585d..a7c2cee39570 100644
    838     --- a/include/net/netfilter/nf_conntrack.h
    839     +++ b/include/net/netfilter/nf_conntrack.h
    840     @@ -17,7 +17,6 @@
    841     #include <linux/bitops.h>
    842     #include <linux/compiler.h>
    843     #include <linux/atomic.h>
    844     -#include <linux/rhashtable.h>
    845    
    846     #include <linux/netfilter/nf_conntrack_tcp.h>
    847     #include <linux/netfilter/nf_conntrack_dccp.h>
    848     @@ -83,7 +82,7 @@ struct nf_conn {
    849     possible_net_t ct_net;
    850    
    851     #if IS_ENABLED(CONFIG_NF_NAT)
    852     - struct rhlist_head nat_bysource;
    853     + struct hlist_node nat_bysource;
    854     #endif
    855     /* all members below initialized via memset */
    856     u8 __nfct_init_offset[0];
    857     diff --git a/include/net/netfilter/nf_nat.h b/include/net/netfilter/nf_nat.h
    858     index 05c82a1a4267..b71701302e61 100644
    859     --- a/include/net/netfilter/nf_nat.h
    860     +++ b/include/net/netfilter/nf_nat.h
    861     @@ -1,6 +1,5 @@
    862     #ifndef _NF_NAT_H
    863     #define _NF_NAT_H
    864     -#include <linux/rhashtable.h>
    865     #include <linux/netfilter_ipv4.h>
    866     #include <linux/netfilter/nf_nat.h>
    867     #include <net/netfilter/nf_conntrack_tuple.h>
    868     diff --git a/include/sound/seq_kernel.h b/include/sound/seq_kernel.h
    869     index feb58d455560..4b9ee3009aa0 100644
    870     --- a/include/sound/seq_kernel.h
    871     +++ b/include/sound/seq_kernel.h
    872     @@ -49,7 +49,8 @@ typedef union snd_seq_timestamp snd_seq_timestamp_t;
    873     #define SNDRV_SEQ_DEFAULT_CLIENT_EVENTS 200
    874    
    875     /* max delivery path length */
    876     -#define SNDRV_SEQ_MAX_HOPS 10
    877     +/* NOTE: this shouldn't be greater than MAX_LOCKDEP_SUBCLASSES */
    878     +#define SNDRV_SEQ_MAX_HOPS 8
    879    
    880     /* max size of event size */
    881     #define SNDRV_SEQ_MAX_EVENT_LEN 0x3fffffff
    882     diff --git a/include/sound/timer.h b/include/sound/timer.h
    883     index c4d76ff056c6..7ae226ab6990 100644
    884     --- a/include/sound/timer.h
    885     +++ b/include/sound/timer.h
    886     @@ -90,6 +90,8 @@ struct snd_timer {
    887     struct list_head ack_list_head;
    888     struct list_head sack_list_head; /* slow ack list head */
    889     struct tasklet_struct task_queue;
    890     + int max_instances; /* upper limit of timer instances */
    891     + int num_instances; /* current number of timer instances */
    892     };
    893    
    894     struct snd_timer_instance {
    895     diff --git a/kernel/workqueue_internal.h b/kernel/workqueue_internal.h
    896     index 8635417c587b..29fa81f0f51a 100644
    897     --- a/kernel/workqueue_internal.h
    898     +++ b/kernel/workqueue_internal.h
    899     @@ -9,6 +9,7 @@
    900    
    901     #include <linux/workqueue.h>
    902     #include <linux/kthread.h>
    903     +#include <linux/preempt.h>
    904    
    905     struct worker_pool;
    906    
    907     @@ -59,7 +60,7 @@ struct worker {
    908     */
    909     static inline struct worker *current_wq_worker(void)
    910     {
    911     - if (current->flags & PF_WQ_WORKER)
    912     + if (in_task() && (current->flags & PF_WQ_WORKER))
    913     return kthread_data(current);
    914     return NULL;
    915     }
    916     diff --git a/lib/asn1_decoder.c b/lib/asn1_decoder.c
    917     index fef5d2e114be..1ef0cec38d78 100644
    918     --- a/lib/asn1_decoder.c
    919     +++ b/lib/asn1_decoder.c
    920     @@ -228,7 +228,7 @@ int asn1_ber_decoder(const struct asn1_decoder *decoder,
    921     hdr = 2;
    922    
    923     /* Extract a tag from the data */
    924     - if (unlikely(dp >= datalen - 1))
    925     + if (unlikely(datalen - dp < 2))
    926     goto data_overrun_error;
    927     tag = data[dp++];
    928     if (unlikely((tag & 0x1f) == ASN1_LONG_TAG))
    929     @@ -274,7 +274,7 @@ int asn1_ber_decoder(const struct asn1_decoder *decoder,
    930     int n = len - 0x80;
    931     if (unlikely(n > 2))
    932     goto length_too_long;
    933     - if (unlikely(dp >= datalen - n))
    934     + if (unlikely(n > datalen - dp))
    935     goto data_overrun_error;
    936     hdr += n;
    937     for (len = 0; n > 0; n--) {
    938     diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
    939     index b1d3740ae36a..2fb80a4bfb34 100644
    940     --- a/net/netfilter/nf_nat_core.c
    941     +++ b/net/netfilter/nf_nat_core.c
    942     @@ -30,19 +30,17 @@
    943     #include <net/netfilter/nf_conntrack_zones.h>
    944     #include <linux/netfilter/nf_nat.h>
    945    
    946     +static DEFINE_SPINLOCK(nf_nat_lock);
    947     +
    948     static DEFINE_MUTEX(nf_nat_proto_mutex);
    949     static const struct nf_nat_l3proto __rcu *nf_nat_l3protos[NFPROTO_NUMPROTO]
    950     __read_mostly;
    951     static const struct nf_nat_l4proto __rcu **nf_nat_l4protos[NFPROTO_NUMPROTO]
    952     __read_mostly;
    953    
    954     -struct nf_nat_conn_key {
    955     - const struct net *net;
    956     - const struct nf_conntrack_tuple *tuple;
    957     - const struct nf_conntrack_zone *zone;
    958     -};
    959     -
    960     -static struct rhltable nf_nat_bysource_table;
    961     +static struct hlist_head *nf_nat_bysource __read_mostly;
    962     +static unsigned int nf_nat_htable_size __read_mostly;
    963     +static unsigned int nf_nat_hash_rnd __read_mostly;
    964    
    965     inline const struct nf_nat_l3proto *
    966     __nf_nat_l3proto_find(u8 family)
    967     @@ -118,17 +116,19 @@ int nf_xfrm_me_harder(struct net *net, struct sk_buff *skb, unsigned int family)
    968     EXPORT_SYMBOL(nf_xfrm_me_harder);
    969     #endif /* CONFIG_XFRM */
    970    
    971     -static u32 nf_nat_bysource_hash(const void *data, u32 len, u32 seed)
    972     +/* We keep an extra hash for each conntrack, for fast searching. */
    973     +static unsigned int
    974     +hash_by_src(const struct net *n, const struct nf_conntrack_tuple *tuple)
    975     {
    976     - const struct nf_conntrack_tuple *t;
    977     - const struct nf_conn *ct = data;
    978     + unsigned int hash;
    979     +
    980     + get_random_once(&nf_nat_hash_rnd, sizeof(nf_nat_hash_rnd));
    981    
    982     - t = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
    983     /* Original src, to ensure we map it consistently if poss. */
    984     + hash = jhash2((u32 *)&tuple->src, sizeof(tuple->src) / sizeof(u32),
    985     + tuple->dst.protonum ^ nf_nat_hash_rnd ^ net_hash_mix(n));
    986    
    987     - seed ^= net_hash_mix(nf_ct_net(ct));
    988     - return jhash2((const u32 *)&t->src, sizeof(t->src) / sizeof(u32),
    989     - t->dst.protonum ^ seed);
    990     + return reciprocal_scale(hash, nf_nat_htable_size);
    991     }
    992    
    993     /* Is this tuple already taken? (not by us) */
    994     @@ -184,28 +184,6 @@ same_src(const struct nf_conn *ct,
    995     t->src.u.all == tuple->src.u.all);
    996     }
    997    
    998     -static int nf_nat_bysource_cmp(struct rhashtable_compare_arg *arg,
    999     - const void *obj)
    1000     -{
    1001     - const struct nf_nat_conn_key *key = arg->key;
    1002     - const struct nf_conn *ct = obj;
    1003     -
    1004     - if (!same_src(ct, key->tuple) ||
    1005     - !net_eq(nf_ct_net(ct), key->net) ||
    1006     - !nf_ct_zone_equal(ct, key->zone, IP_CT_DIR_ORIGINAL))
    1007     - return 1;
    1008     -
    1009     - return 0;
    1010     -}
    1011     -
    1012     -static struct rhashtable_params nf_nat_bysource_params = {
    1013     - .head_offset = offsetof(struct nf_conn, nat_bysource),
    1014     - .obj_hashfn = nf_nat_bysource_hash,
    1015     - .obj_cmpfn = nf_nat_bysource_cmp,
    1016     - .nelem_hint = 256,
    1017     - .min_size = 1024,
    1018     -};
    1019     -
    1020     /* Only called for SRC manip */
    1021     static int
    1022     find_appropriate_src(struct net *net,
    1023     @@ -216,26 +194,22 @@ find_appropriate_src(struct net *net,
    1024     struct nf_conntrack_tuple *result,
    1025     const struct nf_nat_range *range)
    1026     {
    1027     + unsigned int h = hash_by_src(net, tuple);
    1028     const struct nf_conn *ct;
    1029     - struct nf_nat_conn_key key = {
    1030     - .net = net,
    1031     - .tuple = tuple,
    1032     - .zone = zone
    1033     - };
    1034     - struct rhlist_head *hl, *h;
    1035     -
    1036     - hl = rhltable_lookup(&nf_nat_bysource_table, &key,
    1037     - nf_nat_bysource_params);
    1038    
    1039     - rhl_for_each_entry_rcu(ct, h, hl, nat_bysource) {
    1040     - nf_ct_invert_tuplepr(result,
    1041     - &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
    1042     - result->dst = tuple->dst;
    1043     -
    1044     - if (in_range(l3proto, l4proto, result, range))
    1045     - return 1;
    1046     + hlist_for_each_entry_rcu(ct, &nf_nat_bysource[h], nat_bysource) {
    1047     + if (same_src(ct, tuple) &&
    1048     + net_eq(net, nf_ct_net(ct)) &&
    1049     + nf_ct_zone_equal(ct, zone, IP_CT_DIR_ORIGINAL)) {
    1050     + /* Copy source part from reply tuple. */
    1051     + nf_ct_invert_tuplepr(result,
    1052     + &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
    1053     + result->dst = tuple->dst;
    1054     +
    1055     + if (in_range(l3proto, l4proto, result, range))
    1056     + return 1;
    1057     + }
    1058     }
    1059     -
    1060     return 0;
    1061     }
    1062    
    1063     @@ -408,6 +382,7 @@ nf_nat_setup_info(struct nf_conn *ct,
    1064     const struct nf_nat_range *range,
    1065     enum nf_nat_manip_type maniptype)
    1066     {
    1067     + struct net *net = nf_ct_net(ct);
    1068     struct nf_conntrack_tuple curr_tuple, new_tuple;
    1069    
    1070     /* Can't setup nat info for confirmed ct. */
    1071     @@ -447,19 +422,14 @@ nf_nat_setup_info(struct nf_conn *ct,
    1072     }
    1073    
    1074     if (maniptype == NF_NAT_MANIP_SRC) {
    1075     - struct nf_nat_conn_key key = {
    1076     - .net = nf_ct_net(ct),
    1077     - .tuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
    1078     - .zone = nf_ct_zone(ct),
    1079     - };
    1080     - int err;
    1081     -
    1082     - err = rhltable_insert_key(&nf_nat_bysource_table,
    1083     - &key,
    1084     - &ct->nat_bysource,
    1085     - nf_nat_bysource_params);
    1086     - if (err)
    1087     - return NF_DROP;
    1088     + unsigned int srchash;
    1089     +
    1090     + srchash = hash_by_src(net,
    1091     + &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
    1092     + spin_lock_bh(&nf_nat_lock);
    1093     + hlist_add_head_rcu(&ct->nat_bysource,
    1094     + &nf_nat_bysource[srchash]);
    1095     + spin_unlock_bh(&nf_nat_lock);
    1096     }
    1097    
    1098     /* It's done. */
    1099     @@ -568,8 +538,9 @@ static int nf_nat_proto_clean(struct nf_conn *ct, void *data)
    1100     * will delete entry from already-freed table.
    1101     */
    1102     clear_bit(IPS_SRC_NAT_DONE_BIT, &ct->status);
    1103     - rhltable_remove(&nf_nat_bysource_table, &ct->nat_bysource,
    1104     - nf_nat_bysource_params);
    1105     + spin_lock_bh(&nf_nat_lock);
    1106     + hlist_del_rcu(&ct->nat_bysource);
    1107     + spin_unlock_bh(&nf_nat_lock);
    1108    
    1109     /* don't delete conntrack. Although that would make things a lot
    1110     * simpler, we'd end up flushing all conntracks on nat rmmod.
    1111     @@ -697,9 +668,11 @@ EXPORT_SYMBOL_GPL(nf_nat_l3proto_unregister);
    1112     /* No one using conntrack by the time this called. */
    1113     static void nf_nat_cleanup_conntrack(struct nf_conn *ct)
    1114     {
    1115     - if (ct->status & IPS_SRC_NAT_DONE)
    1116     - rhltable_remove(&nf_nat_bysource_table, &ct->nat_bysource,
    1117     - nf_nat_bysource_params);
    1118     + if (ct->status & IPS_SRC_NAT_DONE) {
    1119     + spin_lock_bh(&nf_nat_lock);
    1120     + hlist_del_rcu(&ct->nat_bysource);
    1121     + spin_unlock_bh(&nf_nat_lock);
    1122     + }
    1123     }
    1124    
    1125     static struct nf_ct_ext_type nat_extend __read_mostly = {
    1126     @@ -823,13 +796,16 @@ static int __init nf_nat_init(void)
    1127     {
    1128     int ret;
    1129    
    1130     - ret = rhltable_init(&nf_nat_bysource_table, &nf_nat_bysource_params);
    1131     - if (ret)
    1132     - return ret;
    1133     + /* Leave them the same for the moment. */
    1134     + nf_nat_htable_size = nf_conntrack_htable_size;
    1135     +
    1136     + nf_nat_bysource = nf_ct_alloc_hashtable(&nf_nat_htable_size, 0);
    1137     + if (!nf_nat_bysource)
    1138     + return -ENOMEM;
    1139    
    1140     ret = nf_ct_extend_register(&nat_extend);
    1141     if (ret < 0) {
    1142     - rhltable_destroy(&nf_nat_bysource_table);
    1143     + nf_ct_free_hashtable(nf_nat_bysource, nf_nat_htable_size);
    1144     printk(KERN_ERR "nf_nat_core: Unable to register extension\n");
    1145     return ret;
    1146     }
    1147     @@ -863,8 +839,8 @@ static void __exit nf_nat_cleanup(void)
    1148    
    1149     for (i = 0; i < NFPROTO_NUMPROTO; i++)
    1150     kfree(nf_nat_l4protos[i]);
    1151     -
    1152     - rhltable_destroy(&nf_nat_bysource_table);
    1153     + synchronize_net();
    1154     + nf_ct_free_hashtable(nf_nat_bysource, nf_nat_htable_size);
    1155     }
    1156    
    1157     MODULE_LICENSE("GPL");
    1158     diff --git a/net/netfilter/nft_set_hash.c b/net/netfilter/nft_set_hash.c
    1159     index 0fa01d772c5e..9c0d5a7ce5f9 100644
    1160     --- a/net/netfilter/nft_set_hash.c
    1161     +++ b/net/netfilter/nft_set_hash.c
    1162     @@ -643,7 +643,6 @@ nft_hash_select_ops(const struct nft_ctx *ctx, const struct nft_set_desc *desc,
    1163     {
    1164     if (desc->size) {
    1165     switch (desc->klen) {
    1166     - case 2:
    1167     case 4:
    1168     return &nft_hash_fast_ops;
    1169     default:
    1170     diff --git a/sound/core/hrtimer.c b/sound/core/hrtimer.c
    1171     index 1ac0c423903e..6e47b823bcaa 100644
    1172     --- a/sound/core/hrtimer.c
    1173     +++ b/sound/core/hrtimer.c
    1174     @@ -159,6 +159,7 @@ static int __init snd_hrtimer_init(void)
    1175     timer->hw = hrtimer_hw;
    1176     timer->hw.resolution = resolution;
    1177     timer->hw.ticks = NANO_SEC / resolution;
    1178     + timer->max_instances = 100; /* lower the limit */
    1179    
    1180     err = snd_timer_global_register(timer);
    1181     if (err < 0) {
    1182     diff --git a/sound/core/seq/oss/seq_oss_midi.c b/sound/core/seq/oss/seq_oss_midi.c
    1183     index aaff9ee32695..b30b2139e3f0 100644
    1184     --- a/sound/core/seq/oss/seq_oss_midi.c
    1185     +++ b/sound/core/seq/oss/seq_oss_midi.c
    1186     @@ -612,9 +612,7 @@ send_midi_event(struct seq_oss_devinfo *dp, struct snd_seq_event *ev, struct seq
    1187     if (!dp->timer->running)
    1188     len = snd_seq_oss_timer_start(dp->timer);
    1189     if (ev->type == SNDRV_SEQ_EVENT_SYSEX) {
    1190     - if ((ev->flags & SNDRV_SEQ_EVENT_LENGTH_MASK) == SNDRV_SEQ_EVENT_LENGTH_VARIABLE)
    1191     - snd_seq_oss_readq_puts(dp->readq, mdev->seq_device,
    1192     - ev->data.ext.ptr, ev->data.ext.len);
    1193     + snd_seq_oss_readq_sysex(dp->readq, mdev->seq_device, ev);
    1194     } else {
    1195     len = snd_midi_event_decode(mdev->coder, msg, sizeof(msg), ev);
    1196     if (len > 0)
    1197     diff --git a/sound/core/seq/oss/seq_oss_readq.c b/sound/core/seq/oss/seq_oss_readq.c
    1198     index 046cb586fb2f..06b21226b4e7 100644
    1199     --- a/sound/core/seq/oss/seq_oss_readq.c
    1200     +++ b/sound/core/seq/oss/seq_oss_readq.c
    1201     @@ -117,6 +117,35 @@ snd_seq_oss_readq_puts(struct seq_oss_readq *q, int dev, unsigned char *data, in
    1202     return 0;
    1203     }
    1204    
    1205     +/*
    1206     + * put MIDI sysex bytes; the event buffer may be chained, thus it has
    1207     + * to be expanded via snd_seq_dump_var_event().
    1208     + */
    1209     +struct readq_sysex_ctx {
    1210     + struct seq_oss_readq *readq;
    1211     + int dev;
    1212     +};
    1213     +
    1214     +static int readq_dump_sysex(void *ptr, void *buf, int count)
    1215     +{
    1216     + struct readq_sysex_ctx *ctx = ptr;
    1217     +
    1218     + return snd_seq_oss_readq_puts(ctx->readq, ctx->dev, buf, count);
    1219     +}
    1220     +
    1221     +int snd_seq_oss_readq_sysex(struct seq_oss_readq *q, int dev,
    1222     + struct snd_seq_event *ev)
    1223     +{
    1224     + struct readq_sysex_ctx ctx = {
    1225     + .readq = q,
    1226     + .dev = dev
    1227     + };
    1228     +
    1229     + if ((ev->flags & SNDRV_SEQ_EVENT_LENGTH_MASK) != SNDRV_SEQ_EVENT_LENGTH_VARIABLE)
    1230     + return 0;
    1231     + return snd_seq_dump_var_event(ev, readq_dump_sysex, &ctx);
    1232     +}
    1233     +
    1234     /*
    1235     * copy an event to input queue:
    1236     * return zero if enqueued
    1237     diff --git a/sound/core/seq/oss/seq_oss_readq.h b/sound/core/seq/oss/seq_oss_readq.h
    1238     index f1463f1f449e..8d033ca2d23f 100644
    1239     --- a/sound/core/seq/oss/seq_oss_readq.h
    1240     +++ b/sound/core/seq/oss/seq_oss_readq.h
    1241     @@ -44,6 +44,8 @@ void snd_seq_oss_readq_delete(struct seq_oss_readq *q);
    1242     void snd_seq_oss_readq_clear(struct seq_oss_readq *readq);
    1243     unsigned int snd_seq_oss_readq_poll(struct seq_oss_readq *readq, struct file *file, poll_table *wait);
    1244     int snd_seq_oss_readq_puts(struct seq_oss_readq *readq, int dev, unsigned char *data, int len);
    1245     +int snd_seq_oss_readq_sysex(struct seq_oss_readq *q, int dev,
    1246     + struct snd_seq_event *ev);
    1247     int snd_seq_oss_readq_put_event(struct seq_oss_readq *readq, union evrec *ev);
    1248     int snd_seq_oss_readq_put_timestamp(struct seq_oss_readq *readq, unsigned long curt, int seq_mode);
    1249     int snd_seq_oss_readq_pick(struct seq_oss_readq *q, union evrec *rec);
    1250     diff --git a/sound/core/timer.c b/sound/core/timer.c
    1251     index a9b9a277e00c..c8e4d0da13b4 100644
    1252     --- a/sound/core/timer.c
    1253     +++ b/sound/core/timer.c
    1254     @@ -180,7 +180,7 @@ static void snd_timer_request(struct snd_timer_id *tid)
    1255     *
    1256     * call this with register_mutex down.
    1257     */
    1258     -static void snd_timer_check_slave(struct snd_timer_instance *slave)
    1259     +static int snd_timer_check_slave(struct snd_timer_instance *slave)
    1260     {
    1261     struct snd_timer *timer;
    1262     struct snd_timer_instance *master;
    1263     @@ -190,16 +190,21 @@ static void snd_timer_check_slave(struct snd_timer_instance *slave)
    1264     list_for_each_entry(master, &timer->open_list_head, open_list) {
    1265     if (slave->slave_class == master->slave_class &&
    1266     slave->slave_id == master->slave_id) {
    1267     + if (master->timer->num_instances >=
    1268     + master->timer->max_instances)
    1269     + return -EBUSY;
    1270     list_move_tail(&slave->open_list,
    1271     &master->slave_list_head);
    1272     + master->timer->num_instances++;
    1273     spin_lock_irq(&slave_active_lock);
    1274     slave->master = master;
    1275     slave->timer = master->timer;
    1276     spin_unlock_irq(&slave_active_lock);
    1277     - return;
    1278     + return 0;
    1279     }
    1280     }
    1281     }
    1282     + return 0;
    1283     }
    1284    
    1285     /*
    1286     @@ -208,7 +213,7 @@ static void snd_timer_check_slave(struct snd_timer_instance *slave)
    1287     *
    1288     * call this with register_mutex down.
    1289     */
    1290     -static void snd_timer_check_master(struct snd_timer_instance *master)
    1291     +static int snd_timer_check_master(struct snd_timer_instance *master)
    1292     {
    1293     struct snd_timer_instance *slave, *tmp;
    1294    
    1295     @@ -216,7 +221,11 @@ static void snd_timer_check_master(struct snd_timer_instance *master)
    1296     list_for_each_entry_safe(slave, tmp, &snd_timer_slave_list, open_list) {
    1297     if (slave->slave_class == master->slave_class &&
    1298     slave->slave_id == master->slave_id) {
    1299     + if (master->timer->num_instances >=
    1300     + master->timer->max_instances)
    1301     + return -EBUSY;
    1302     list_move_tail(&slave->open_list, &master->slave_list_head);
    1303     + master->timer->num_instances++;
    1304     spin_lock_irq(&slave_active_lock);
    1305     spin_lock(&master->timer->lock);
    1306     slave->master = master;
    1307     @@ -228,8 +237,11 @@ static void snd_timer_check_master(struct snd_timer_instance *master)
    1308     spin_unlock_irq(&slave_active_lock);
    1309     }
    1310     }
    1311     + return 0;
    1312     }
    1313    
    1314     +static int snd_timer_close_locked(struct snd_timer_instance *timeri);
    1315     +
    1316     /*
    1317     * open a timer instance
    1318     * when opening a master, the slave id must be here given.
    1319     @@ -240,6 +252,7 @@ int snd_timer_open(struct snd_timer_instance **ti,
    1320     {
    1321     struct snd_timer *timer;
    1322     struct snd_timer_instance *timeri = NULL;
    1323     + int err;
    1324    
    1325     if (tid->dev_class == SNDRV_TIMER_CLASS_SLAVE) {
    1326     /* open a slave instance */
    1327     @@ -259,10 +272,14 @@ int snd_timer_open(struct snd_timer_instance **ti,
    1328     timeri->slave_id = tid->device;
    1329     timeri->flags |= SNDRV_TIMER_IFLG_SLAVE;
    1330     list_add_tail(&timeri->open_list, &snd_timer_slave_list);
    1331     - snd_timer_check_slave(timeri);
    1332     + err = snd_timer_check_slave(timeri);
    1333     + if (err < 0) {
    1334     + snd_timer_close_locked(timeri);
    1335     + timeri = NULL;
    1336     + }
    1337     mutex_unlock(&register_mutex);
    1338     *ti = timeri;
    1339     - return 0;
    1340     + return err;
    1341     }
    1342    
    1343     /* open a master instance */
    1344     @@ -288,6 +305,10 @@ int snd_timer_open(struct snd_timer_instance **ti,
    1345     return -EBUSY;
    1346     }
    1347     }
    1348     + if (timer->num_instances >= timer->max_instances) {
    1349     + mutex_unlock(&register_mutex);
    1350     + return -EBUSY;
    1351     + }
    1352     timeri = snd_timer_instance_new(owner, timer);
    1353     if (!timeri) {
    1354     mutex_unlock(&register_mutex);
    1355     @@ -314,25 +335,27 @@ int snd_timer_open(struct snd_timer_instance **ti,
    1356     }
    1357    
    1358     list_add_tail(&timeri->open_list, &timer->open_list_head);
    1359     - snd_timer_check_master(timeri);
    1360     + timer->num_instances++;
    1361     + err = snd_timer_check_master(timeri);
    1362     + if (err < 0) {
    1363     + snd_timer_close_locked(timeri);
    1364     + timeri = NULL;
    1365     + }
    1366     mutex_unlock(&register_mutex);
    1367     *ti = timeri;
    1368     - return 0;
    1369     + return err;
    1370     }
    1371     EXPORT_SYMBOL(snd_timer_open);
    1372    
    1373     /*
    1374     * close a timer instance
    1375     + * call this with register_mutex down.
    1376     */
    1377     -int snd_timer_close(struct snd_timer_instance *timeri)
    1378     +static int snd_timer_close_locked(struct snd_timer_instance *timeri)
    1379     {
    1380     struct snd_timer *timer = NULL;
    1381     struct snd_timer_instance *slave, *tmp;
    1382    
    1383     - if (snd_BUG_ON(!timeri))
    1384     - return -ENXIO;
    1385     -
    1386     - mutex_lock(&register_mutex);
    1387     list_del(&timeri->open_list);
    1388    
    1389     /* force to stop the timer */
    1390     @@ -340,6 +363,7 @@ int snd_timer_close(struct snd_timer_instance *timeri)
    1391    
    1392     timer = timeri->timer;
    1393     if (timer) {
    1394     + timer->num_instances--;
    1395     /* wait, until the active callback is finished */
    1396     spin_lock_irq(&timer->lock);
    1397     while (timeri->flags & SNDRV_TIMER_IFLG_CALLBACK) {
    1398     @@ -355,6 +379,7 @@ int snd_timer_close(struct snd_timer_instance *timeri)
    1399     list_for_each_entry_safe(slave, tmp, &timeri->slave_list_head,
    1400     open_list) {
    1401     list_move_tail(&slave->open_list, &snd_timer_slave_list);
    1402     + timer->num_instances--;
    1403     slave->master = NULL;
    1404     slave->timer = NULL;
    1405     list_del_init(&slave->ack_list);
    1406     @@ -382,9 +407,24 @@ int snd_timer_close(struct snd_timer_instance *timeri)
    1407     module_put(timer->module);
    1408     }
    1409    
    1410     - mutex_unlock(&register_mutex);
    1411     return 0;
    1412     }
    1413     +
    1414     +/*
    1415     + * close a timer instance
    1416     + */
    1417     +int snd_timer_close(struct snd_timer_instance *timeri)
    1418     +{
    1419     + int err;
    1420     +
    1421     + if (snd_BUG_ON(!timeri))
    1422     + return -ENXIO;
    1423     +
    1424     + mutex_lock(&register_mutex);
    1425     + err = snd_timer_close_locked(timeri);
    1426     + mutex_unlock(&register_mutex);
    1427     + return err;
    1428     +}
    1429     EXPORT_SYMBOL(snd_timer_close);
    1430    
    1431     unsigned long snd_timer_resolution(struct snd_timer_instance *timeri)
    1432     @@ -855,6 +895,7 @@ int snd_timer_new(struct snd_card *card, char *id, struct snd_timer_id *tid,
    1433     spin_lock_init(&timer->lock);
    1434     tasklet_init(&timer->task_queue, snd_timer_tasklet,
    1435     (unsigned long)timer);
    1436     + timer->max_instances = 1000; /* default limit per timer */
    1437     if (card != NULL) {
    1438     timer->module = card->module;
    1439     err = snd_device_new(card, SNDRV_DEV_TIMER, timer, &ops);
    1440     diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
    1441     index fe4d06398fc3..c5f0e8d42d22 100644
    1442     --- a/sound/pci/hda/patch_realtek.c
    1443     +++ b/sound/pci/hda/patch_realtek.c
    1444     @@ -6527,6 +6527,11 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
    1445     {0x14, 0x90170110},
    1446     {0x1b, 0x90a70130},
    1447     {0x21, 0x03211020}),
    1448     + SND_HDA_PIN_QUIRK(0x10ec0274, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
    1449     + {0x12, 0xb7a60130},
    1450     + {0x13, 0xb8a61140},
    1451     + {0x16, 0x90170110},
    1452     + {0x21, 0x04211020}),
    1453     SND_HDA_PIN_QUIRK(0x10ec0280, 0x103c, "HP", ALC280_FIXUP_HP_GPIO4,
    1454     {0x12, 0x90a60130},
    1455     {0x14, 0x90170110},
    1456     diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
    1457     index 0e54fe490458..f910c4fd932b 100644
    1458     --- a/sound/usb/quirks.c
    1459     +++ b/sound/usb/quirks.c
    1460     @@ -1373,6 +1373,7 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
    1461     case 0x199:
    1462     return SNDRV_PCM_FMTBIT_DSD_U32_LE;
    1463     case 0x19b:
    1464     + case 0x203:
    1465     return SNDRV_PCM_FMTBIT_DSD_U32_BE;
    1466     default:
    1467     break;