Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel26-alx/patches-3.10/0141-3.10.42-all-fixes.patch

    Contents of /trunk/kernel26-alx/patches-3.10/0141-3.10.42-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 2672 - (show annotations) (download)
    Tue Jul 21 16:46:35 2015 UTC (8 years, 9 months ago) by niro
    File size: 131660 byte(s) 
    -3.10.84-alx-r1
    1 diff --git a/Documentation/i2c/busses/i2c-i801 b/Documentation/i2c/busses/i2c-i801
    2 index d29dea0f3232..babe2ef16139 100644
    3 --- a/Documentation/i2c/busses/i2c-i801
    4 +++ b/Documentation/i2c/busses/i2c-i801
    5 @@ -25,6 +25,8 @@ Supported adapters:
    6 * Intel Avoton (SOC)
    7 * Intel Wellsburg (PCH)
    8 * Intel Coleto Creek (PCH)
    9 + * Intel Wildcat Point-LP (PCH)
    10 + * Intel BayTrail (SOC)
    11 Datasheets: Publicly available at the Intel website
    12
    13 On Intel Patsburg and later chipsets, both the normal host SMBus controller
    14 diff --git a/Documentation/input/elantech.txt b/Documentation/input/elantech.txt
    15 index 5602eb71ad5d..e1ae127ed099 100644
    16 --- a/Documentation/input/elantech.txt
    17 +++ b/Documentation/input/elantech.txt
    18 @@ -504,9 +504,12 @@ byte 5:
    19 * reg_10
    20
    21 bit 7 6 5 4 3 2 1 0
    22 - 0 0 0 0 0 0 0 A
    23 + 0 0 0 0 R F T A
    24
    25 A: 1 = enable absolute tracking
    26 + T: 1 = enable two finger mode auto correct
    27 + F: 1 = disable ABS Position Filter
    28 + R: 1 = enable real hardware resolution
    29
    30 6.2 Native absolute mode 6 byte packet format
    31 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    32 diff --git a/Documentation/ja_JP/HOWTO b/Documentation/ja_JP/HOWTO
    33 index 050d37fe6d40..46ed73593465 100644
    34 --- a/Documentation/ja_JP/HOWTO
    35 +++ b/Documentation/ja_JP/HOWTO
    36 @@ -315,7 +315,7 @@ Andrew Morton が Linux-kernel メーリングリストにカーネルリリー
    37 もし、2.6.x.y カーネルが存在しない場合には、番号が一番大きい 2.6.x が
    38 最新の安定版カーネルです。
    39
    40 -2.6.x.y は "stable" チーム <stable@kernel.org> でメンテされており、必
    41 +2.6.x.y は "stable" チーム <stable@vger.kernel.org> でメンテされており、必
    42 要に応じてリリースされます。通常のリリース期間は 2週間毎ですが、差し迫っ
    43 た問題がなければもう少し長くなることもあります。セキュリティ関連の問題
    44 の場合はこれに対してだいたいの場合、すぐにリリースがされます。
    45 diff --git a/Documentation/ja_JP/stable_kernel_rules.txt b/Documentation/ja_JP/stable_kernel_rules.txt
    46 index 14265837c4ce..9dbda9b5d21e 100644
    47 --- a/Documentation/ja_JP/stable_kernel_rules.txt
    48 +++ b/Documentation/ja_JP/stable_kernel_rules.txt
    49 @@ -50,16 +50,16 @@ linux-2.6.29/Documentation/stable_kernel_rules.txt
    50
    51 -stable ツリーにパッチを送付する手続き-
    52
    53 - - 上記の規則に従っているかを確認した後に、stable@kernel.org にパッチ
    54 + - 上記の規則に従っているかを確認した後に、stable@vger.kernel.org にパッチ
    55 を送る。
    56 - 送信者はパッチがキューに受け付けられた際には ACK を、却下された場合
    57 には NAK を受け取る。この反応は開発者たちのスケジュールによって、数
    58 日かかる場合がある。
    59 - もし受け取られたら、パッチは他の開発者たちと関連するサブシステムの
    60 メンテナーによるレビューのために -stable キューに追加される。
    61 - - パッチに stable@kernel.org のアドレスが付加されているときには、それ
    62 + - パッチに stable@vger.kernel.org のアドレスが付加されているときには、それ
    63 が Linus のツリーに入る時に自動的に stable チームに email される。
    64 - - セキュリティパッチはこのエイリアス (stable@kernel.org) に送られるべ
    65 + - セキュリティパッチはこのエイリアス (stable@vger.kernel.org) に送られるべ
    66 きではなく、代わりに security@kernel.org のアドレスに送られる。
    67
    68 レビューサイクル-
    69 diff --git a/Documentation/zh_CN/HOWTO b/Documentation/zh_CN/HOWTO
    70 index 7fba5aab9ef9..7599eb38b764 100644
    71 --- a/Documentation/zh_CN/HOWTO
    72 +++ b/Documentation/zh_CN/HOWTO
    73 @@ -237,7 +237,7 @@ kernel.org网站的pub/linux/kernel/v2.6/目录下找到它。它的开发遵循
    74 如果没有2.6.x.y版本内核存在，那么最新的2.6.x版本内核就相当于是当前的稳定
    75 版内核。
    76
    77 -2.6.x.y版本由“稳定版”小组（邮件地址<stable@kernel.org>）维护，一般隔周发
    78 +2.6.x.y版本由“稳定版”小组（邮件地址<stable@vger.kernel.org>）维护，一般隔周发
    79 布新版本。
    80
    81 内核源码中的Documentation/stable_kernel_rules.txt文件具体描述了可被稳定
    82 diff --git a/Documentation/zh_CN/stable_kernel_rules.txt b/Documentation/zh_CN/stable_kernel_rules.txt
    83 index b5b9b0ab02fd..26ea5ed7cd9c 100644
    84 --- a/Documentation/zh_CN/stable_kernel_rules.txt
    85 +++ b/Documentation/zh_CN/stable_kernel_rules.txt
    86 @@ -42,7 +42,7 @@ Documentation/stable_kernel_rules.txt 的中文翻译
    87
    88 向稳定版代码树提交补丁的过程：
    89
    90 - - 在确认了补丁符合以上的规则后，将补丁发送到stable@kernel.org。
    91 + - 在确认了补丁符合以上的规则后，将补丁发送到stable@vger.kernel.org。
    92 - 如果补丁被接受到队列里，发送者会收到一个ACK回复，如果没有被接受，收
    93 到的是NAK回复。回复需要几天的时间，这取决于开发者的时间安排。
    94 - 被接受的补丁会被加到稳定版本队列里，等待其他开发者的审查。
    95 diff --git a/Makefile b/Makefile
    96 index 370cc01afb07..4634015fed68 100644
    97 --- a/Makefile
    98 +++ b/Makefile
    99 @@ -1,6 +1,6 @@
    100 VERSION = 3
    101 PATCHLEVEL = 10
    102 -SUBLEVEL = 41
    103 +SUBLEVEL = 42
    104 EXTRAVERSION =
    105 NAME = TOSSUG Baby Fish
    106
    107 diff --git a/arch/arm/boot/dts/imx53.dtsi b/arch/arm/boot/dts/imx53.dtsi
    108 index eb83aa039b8b..e524316998f4 100644
    109 --- a/arch/arm/boot/dts/imx53.dtsi
    110 +++ b/arch/arm/boot/dts/imx53.dtsi
    111 @@ -71,7 +71,7 @@
    112 ipu: ipu@18000000 {
    113 #crtc-cells = <1>;
    114 compatible = "fsl,imx53-ipu";
    115 - reg = <0x18000000 0x080000000>;
    116 + reg = <0x18000000 0x08000000>;
    117 interrupts = <11 10>;
    118 clocks = <&clks 59>, <&clks 110>, <&clks 61>;
    119 clock-names = "bus", "di0", "di1";
    120 diff --git a/arch/arm/kernel/crash_dump.c b/arch/arm/kernel/crash_dump.c
    121 index 90c50d4b43f7..5d1286d51154 100644
    122 --- a/arch/arm/kernel/crash_dump.c
    123 +++ b/arch/arm/kernel/crash_dump.c
    124 @@ -39,7 +39,7 @@ ssize_t copy_oldmem_page(unsigned long pfn, char *buf,
    125 if (!csize)
    126 return 0;
    127
    128 - vaddr = ioremap(pfn << PAGE_SHIFT, PAGE_SIZE);
    129 + vaddr = ioremap(__pfn_to_phys(pfn), PAGE_SIZE);
    130 if (!vaddr)
    131 return -ENOMEM;
    132
    133 diff --git a/arch/metag/include/asm/barrier.h b/arch/metag/include/asm/barrier.h
    134 index c90bfc6bf648..e355a4c10968 100644
    135 --- a/arch/metag/include/asm/barrier.h
    136 +++ b/arch/metag/include/asm/barrier.h
    137 @@ -15,6 +15,7 @@ static inline void wr_fence(void)
    138 volatile int *flushptr = (volatile int *) LINSYSEVENT_WR_FENCE;
    139 barrier();
    140 *flushptr = 0;
    141 + barrier();
    142 }
    143
    144 #else /* CONFIG_METAG_META21 */
    145 @@ -35,6 +36,7 @@ static inline void wr_fence(void)
    146 *flushptr = 0;
    147 *flushptr = 0;
    148 *flushptr = 0;
    149 + barrier();
    150 }
    151
    152 #endif /* !CONFIG_METAG_META21 */
    153 @@ -68,6 +70,7 @@ static inline void fence(void)
    154 volatile int *flushptr = (volatile int *) LINSYSEVENT_WR_ATOMIC_UNLOCK;
    155 barrier();
    156 *flushptr = 0;
    157 + barrier();
    158 }
    159 #define smp_mb() fence()
    160 #define smp_rmb() fence()
    161 diff --git a/arch/metag/include/asm/processor.h b/arch/metag/include/asm/processor.h
    162 index 9b029a7911c3..579e3d93a5ca 100644
    163 --- a/arch/metag/include/asm/processor.h
    164 +++ b/arch/metag/include/asm/processor.h
    165 @@ -22,6 +22,8 @@
    166 /* Add an extra page of padding at the top of the stack for the guard page. */
    167 #define STACK_TOP (TASK_SIZE - PAGE_SIZE)
    168 #define STACK_TOP_MAX STACK_TOP
    169 +/* Maximum virtual space for stack */
    170 +#define STACK_SIZE_MAX (1 << 28) /* 256 MB */
    171
    172 /* This decides where the kernel will search for a free chunk of vm
    173 * space during mmap's.
    174 diff --git a/arch/mips/cavium-octeon/octeon-irq.c b/arch/mips/cavium-octeon/octeon-irq.c
    175 index a22f06a6f7ca..45c1a6caa206 100644
    176 --- a/arch/mips/cavium-octeon/octeon-irq.c
    177 +++ b/arch/mips/cavium-octeon/octeon-irq.c
    178 @@ -635,7 +635,7 @@ static void octeon_irq_cpu_offline_ciu(struct irq_data *data)
    179 cpumask_clear(&new_affinity);
    180 cpumask_set_cpu(cpumask_first(cpu_online_mask), &new_affinity);
    181 }
    182 - __irq_set_affinity_locked(data, &new_affinity);
    183 + irq_set_affinity_locked(data, &new_affinity, false);
    184 }
    185
    186 static int octeon_irq_ciu_set_affinity(struct irq_data *data,
    187 diff --git a/arch/mips/lantiq/dts/easy50712.dts b/arch/mips/lantiq/dts/easy50712.dts
    188 index fac1f5b178eb..143b8a37b5e4 100644
    189 --- a/arch/mips/lantiq/dts/easy50712.dts
    190 +++ b/arch/mips/lantiq/dts/easy50712.dts
    191 @@ -8,6 +8,7 @@
    192 };
    193
    194 memory@0 {
    195 + device_type = "memory";
    196 reg = <0x0 0x2000000>;
    197 };
    198
    199 diff --git a/arch/mips/ralink/dts/mt7620a_eval.dts b/arch/mips/ralink/dts/mt7620a_eval.dts
    200 index 35eb874ab7f1..709f58132f5c 100644
    201 --- a/arch/mips/ralink/dts/mt7620a_eval.dts
    202 +++ b/arch/mips/ralink/dts/mt7620a_eval.dts
    203 @@ -7,6 +7,7 @@
    204 model = "Ralink MT7620A evaluation board";
    205
    206 memory@0 {
    207 + device_type = "memory";
    208 reg = <0x0 0x2000000>;
    209 };
    210
    211 diff --git a/arch/mips/ralink/dts/rt2880_eval.dts b/arch/mips/ralink/dts/rt2880_eval.dts
    212 index 322d7002595b..0a685db093d4 100644
    213 --- a/arch/mips/ralink/dts/rt2880_eval.dts
    214 +++ b/arch/mips/ralink/dts/rt2880_eval.dts
    215 @@ -7,6 +7,7 @@
    216 model = "Ralink RT2880 evaluation board";
    217
    218 memory@0 {
    219 + device_type = "memory";
    220 reg = <0x8000000 0x2000000>;
    221 };
    222
    223 diff --git a/arch/mips/ralink/dts/rt3052_eval.dts b/arch/mips/ralink/dts/rt3052_eval.dts
    224 index 0ac73ea28198..ec9e9a035541 100644
    225 --- a/arch/mips/ralink/dts/rt3052_eval.dts
    226 +++ b/arch/mips/ralink/dts/rt3052_eval.dts
    227 @@ -7,6 +7,7 @@
    228 model = "Ralink RT3052 evaluation board";
    229
    230 memory@0 {
    231 + device_type = "memory";
    232 reg = <0x0 0x2000000>;
    233 };
    234
    235 diff --git a/arch/mips/ralink/dts/rt3883_eval.dts b/arch/mips/ralink/dts/rt3883_eval.dts
    236 index 2fa6b330bf4f..e8df21a5d10d 100644
    237 --- a/arch/mips/ralink/dts/rt3883_eval.dts
    238 +++ b/arch/mips/ralink/dts/rt3883_eval.dts
    239 @@ -7,6 +7,7 @@
    240 model = "Ralink RT3883 evaluation board";
    241
    242 memory@0 {
    243 + device_type = "memory";
    244 reg = <0x0 0x2000000>;
    245 };
    246
    247 diff --git a/arch/parisc/include/asm/processor.h b/arch/parisc/include/asm/processor.h
    248 index cc2290a3cace..c6ee86542fec 100644
    249 --- a/arch/parisc/include/asm/processor.h
    250 +++ b/arch/parisc/include/asm/processor.h
    251 @@ -53,6 +53,8 @@
    252 #define STACK_TOP TASK_SIZE
    253 #define STACK_TOP_MAX DEFAULT_TASK_SIZE
    254
    255 +#define STACK_SIZE_MAX (1 << 30) /* 1 GB */
    256 +
    257 #endif
    258
    259 #ifndef __ASSEMBLY__
    260 diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
    261 index 967fd23ace78..56a4a5d205af 100644
    262 --- a/arch/powerpc/Makefile
    263 +++ b/arch/powerpc/Makefile
    264 @@ -97,7 +97,9 @@ CFLAGS-$(CONFIG_POWER7_CPU) += $(call cc-option,-mcpu=power7)
    265
    266 CFLAGS-$(CONFIG_TUNE_CELL) += $(call cc-option,-mtune=cell)
    267
    268 -KBUILD_CPPFLAGS += -Iarch/$(ARCH)
    269 +asinstr := $(call as-instr,lis 9$(comma)foo@high,-DHAVE_AS_ATHIGH=1)
    270 +
    271 +KBUILD_CPPFLAGS += -Iarch/$(ARCH) $(asinstr)
    272 KBUILD_AFLAGS += -Iarch/$(ARCH)
    273 KBUILD_CFLAGS += -msoft-float -pipe -Iarch/$(ARCH) $(CFLAGS-y)
    274 CPP = $(CC) -E $(KBUILD_CFLAGS)
    275 diff --git a/arch/powerpc/include/asm/ppc_asm.h b/arch/powerpc/include/asm/ppc_asm.h
    276 index 2f1b6c5f8174..22cee04a47fc 100644
    277 --- a/arch/powerpc/include/asm/ppc_asm.h
    278 +++ b/arch/powerpc/include/asm/ppc_asm.h
    279 @@ -390,11 +390,16 @@ n:
    280 * ld rY,ADDROFF(name)(rX)
    281 */
    282 #ifdef __powerpc64__
    283 +#ifdef HAVE_AS_ATHIGH
    284 +#define __AS_ATHIGH high
    285 +#else
    286 +#define __AS_ATHIGH h
    287 +#endif
    288 #define LOAD_REG_IMMEDIATE(reg,expr) \
    289 lis reg,(expr)@highest; \
    290 ori reg,reg,(expr)@higher; \
    291 rldicr reg,reg,32,31; \
    292 - oris reg,reg,(expr)@h; \
    293 + oris reg,reg,(expr)@__AS_ATHIGH; \
    294 ori reg,reg,(expr)@l;
    295
    296 #define LOAD_REG_ADDR(reg,name) \
    297 diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
    298 index 1e1c995ddacc..d55357ee9028 100644
    299 --- a/arch/powerpc/kernel/process.c
    300 +++ b/arch/powerpc/kernel/process.c
    301 @@ -948,6 +948,16 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
    302 flush_altivec_to_thread(src);
    303 flush_vsx_to_thread(src);
    304 flush_spe_to_thread(src);
    305 + /*
    306 + * Flush TM state out so we can copy it. __switch_to_tm() does this
    307 + * flush but it removes the checkpointed state from the current CPU and
    308 + * transitions the CPU out of TM mode. Hence we need to call
    309 + * tm_recheckpoint_new_task() (on the same task) to restore the
    310 + * checkpointed state back and the TM mode.
    311 + */
    312 + __switch_to_tm(src);
    313 + tm_recheckpoint_new_task(src);
    314 +
    315 *dst = *src;
    316 return 0;
    317 }
    318 diff --git a/arch/s390/crypto/aes_s390.c b/arch/s390/crypto/aes_s390.c
    319 index 2a245b55bb71..fd104db9cea1 100644
    320 --- a/arch/s390/crypto/aes_s390.c
    321 +++ b/arch/s390/crypto/aes_s390.c
    322 @@ -818,6 +818,9 @@ static int ctr_aes_crypt(struct blkcipher_desc *desc, long func,
    323 else
    324 memcpy(walk->iv, ctrptr, AES_BLOCK_SIZE);
    325 spin_unlock(&ctrblk_lock);
    326 + } else {
    327 + if (!nbytes)
    328 + memcpy(walk->iv, ctrptr, AES_BLOCK_SIZE);
    329 }
    330 /*
    331 * final block may be < AES_BLOCK_SIZE, copy only nbytes
    332 diff --git a/arch/s390/crypto/des_s390.c b/arch/s390/crypto/des_s390.c
    333 index 2d96e68febb2..f2d6cccddcf8 100644
    334 --- a/arch/s390/crypto/des_s390.c
    335 +++ b/arch/s390/crypto/des_s390.c
    336 @@ -429,6 +429,9 @@ static int ctr_desall_crypt(struct blkcipher_desc *desc, long func,
    337 else
    338 memcpy(walk->iv, ctrptr, DES_BLOCK_SIZE);
    339 spin_unlock(&ctrblk_lock);
    340 + } else {
    341 + if (!nbytes)
    342 + memcpy(walk->iv, ctrptr, DES_BLOCK_SIZE);
    343 }
    344 /* final block may be < DES_BLOCK_SIZE, copy only nbytes */
    345 if (nbytes) {
    346 diff --git a/arch/x86/include/asm/hugetlb.h b/arch/x86/include/asm/hugetlb.h
    347 index a8091216963b..68c05398bba9 100644
    348 --- a/arch/x86/include/asm/hugetlb.h
    349 +++ b/arch/x86/include/asm/hugetlb.h
    350 @@ -52,6 +52,7 @@ static inline pte_t huge_ptep_get_and_clear(struct mm_struct *mm,
    351 static inline void huge_ptep_clear_flush(struct vm_area_struct *vma,
    352 unsigned long addr, pte_t *ptep)
    353 {
    354 + ptep_clear_flush(vma, addr, ptep);
    355 }
    356
    357 static inline int huge_pte_none(pte_t pte)
    358 diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
    359 index af1d14a9ebda..dcbbaa165bde 100644
    360 --- a/arch/x86/kernel/ldt.c
    361 +++ b/arch/x86/kernel/ldt.c
    362 @@ -20,6 +20,8 @@
    363 #include <asm/mmu_context.h>
    364 #include <asm/syscalls.h>
    365
    366 +int sysctl_ldt16 = 0;
    367 +
    368 #ifdef CONFIG_SMP
    369 static void flush_ldt(void *current_mm)
    370 {
    371 @@ -234,7 +236,7 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
    372 * IRET leaking the high bits of the kernel stack address.
    373 */
    374 #ifdef CONFIG_X86_64
    375 - if (!ldt_info.seg_32bit) {
    376 + if (!ldt_info.seg_32bit && !sysctl_ldt16) {
    377 error = -EINVAL;
    378 goto out_unlock;
    379 }
    380 diff --git a/arch/x86/vdso/vdso32-setup.c b/arch/x86/vdso/vdso32-setup.c
    381 index 0faad646f5fd..0f134c7cfc24 100644
    382 --- a/arch/x86/vdso/vdso32-setup.c
    383 +++ b/arch/x86/vdso/vdso32-setup.c
    384 @@ -41,6 +41,7 @@ enum {
    385 #ifdef CONFIG_X86_64
    386 #define vdso_enabled sysctl_vsyscall32
    387 #define arch_setup_additional_pages syscall32_setup_pages
    388 +extern int sysctl_ldt16;
    389 #endif
    390
    391 /*
    392 @@ -380,6 +381,13 @@ static ctl_table abi_table2[] = {
    393 .mode = 0644,
    394 .proc_handler = proc_dointvec
    395 },
    396 + {
    397 + .procname = "ldt16",
    398 + .data = &sysctl_ldt16,
    399 + .maxlen = sizeof(int),
    400 + .mode = 0644,
    401 + .proc_handler = proc_dointvec
    402 + },
    403 {}
    404 };
    405
    406 diff --git a/crypto/crypto_wq.c b/crypto/crypto_wq.c
    407 index adad92a44ba2..2f1b8d12952a 100644
    408 --- a/crypto/crypto_wq.c
    409 +++ b/crypto/crypto_wq.c
    410 @@ -33,7 +33,7 @@ static void __exit crypto_wq_exit(void)
    411 destroy_workqueue(kcrypto_wq);
    412 }
    413
    414 -module_init(crypto_wq_init);
    415 +subsys_initcall(crypto_wq_init);
    416 module_exit(crypto_wq_exit);
    417
    418 MODULE_LICENSE("GPL");
    419 diff --git a/drivers/acpi/blacklist.c b/drivers/acpi/blacklist.c
    420 index cb9629638def..76da257cfc28 100644
    421 --- a/drivers/acpi/blacklist.c
    422 +++ b/drivers/acpi/blacklist.c
    423 @@ -327,6 +327,19 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
    424 DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T500"),
    425 },
    426 },
    427 + /*
    428 + * Without this this EEEpc exports a non working WMI interface, with
    429 + * this it exports a working "good old" eeepc_laptop interface, fixing
    430 + * both brightness control, and rfkill not working.
    431 + */
    432 + {
    433 + .callback = dmi_enable_osi_linux,
    434 + .ident = "Asus EEE PC 1015PX",
    435 + .matches = {
    436 + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer INC."),
    437 + DMI_MATCH(DMI_PRODUCT_NAME, "1015PX"),
    438 + },
    439 + },
    440 {}
    441 };
    442
    443 diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
    444 index 9cf616b5210b..bf00fbcde8ad 100644
    445 --- a/drivers/ata/libata-core.c
    446 +++ b/drivers/ata/libata-core.c
    447 @@ -6300,6 +6300,8 @@ int ata_host_activate(struct ata_host *host, int irq,
    448 static void ata_port_detach(struct ata_port *ap)
    449 {
    450 unsigned long flags;
    451 + struct ata_link *link;
    452 + struct ata_device *dev;
    453
    454 if (!ap->ops->error_handler)
    455 goto skip_eh;
    456 @@ -6319,6 +6321,13 @@ static void ata_port_detach(struct ata_port *ap)
    457 cancel_delayed_work_sync(&ap->hotplug_task);
    458
    459 skip_eh:
    460 + /* clean up zpodd on port removal */
    461 + ata_for_each_link(link, ap, HOST_FIRST) {
    462 + ata_for_each_dev(dev, link, ALL) {
    463 + if (zpodd_dev_enabled(dev))
    464 + zpodd_exit(dev);
    465 + }
    466 + }
    467 if (ap->pmp_link) {
    468 int i;
    469 for (i = 0; i < SATA_PMP_MAX_PORTS; i++)
    470 diff --git a/drivers/ata/pata_at91.c b/drivers/ata/pata_at91.c
    471 index 033f3f4c20ad..fa288597f01b 100644
    472 --- a/drivers/ata/pata_at91.c
    473 +++ b/drivers/ata/pata_at91.c
    474 @@ -408,12 +408,13 @@ static int pata_at91_probe(struct platform_device *pdev)
    475
    476 host->private_data = info;
    477
    478 - return ata_host_activate(host, gpio_is_valid(irq) ? gpio_to_irq(irq) : 0,
    479 - gpio_is_valid(irq) ? ata_sff_interrupt : NULL,
    480 - irq_flags, &pata_at91_sht);
    481 + ret = ata_host_activate(host, gpio_is_valid(irq) ? gpio_to_irq(irq) : 0,
    482 + gpio_is_valid(irq) ? ata_sff_interrupt : NULL,
    483 + irq_flags, &pata_at91_sht);
    484 + if (ret)
    485 + goto err_put;
    486
    487 - if (!ret)
    488 - return 0;
    489 + return 0;
    490
    491 err_put:
    492 clk_put(info->mck);
    493 diff --git a/drivers/base/dd.c b/drivers/base/dd.c
    494 index 06051767393f..8a8d611f2021 100644
    495 --- a/drivers/base/dd.c
    496 +++ b/drivers/base/dd.c
    497 @@ -52,6 +52,7 @@ static DEFINE_MUTEX(deferred_probe_mutex);
    498 static LIST_HEAD(deferred_probe_pending_list);
    499 static LIST_HEAD(deferred_probe_active_list);
    500 static struct workqueue_struct *deferred_wq;
    501 +static atomic_t deferred_trigger_count = ATOMIC_INIT(0);
    502
    503 /**
    504 * deferred_probe_work_func() - Retry probing devices in the active list.
    505 @@ -135,6 +136,17 @@ static bool driver_deferred_probe_enable = false;
    506 * This functions moves all devices from the pending list to the active
    507 * list and schedules the deferred probe workqueue to process them. It
    508 * should be called anytime a driver is successfully bound to a device.
    509 + *
    510 + * Note, there is a race condition in multi-threaded probe. In the case where
    511 + * more than one device is probing at the same time, it is possible for one
    512 + * probe to complete successfully while another is about to defer. If the second
    513 + * depends on the first, then it will get put on the pending list after the
    514 + * trigger event has already occured and will be stuck there.
    515 + *
    516 + * The atomic 'deferred_trigger_count' is used to determine if a successful
    517 + * trigger has occurred in the midst of probing a driver. If the trigger count
    518 + * changes in the midst of a probe, then deferred processing should be triggered
    519 + * again.
    520 */
    521 static void driver_deferred_probe_trigger(void)
    522 {
    523 @@ -147,6 +159,7 @@ static void driver_deferred_probe_trigger(void)
    524 * into the active list so they can be retried by the workqueue
    525 */
    526 mutex_lock(&deferred_probe_mutex);
    527 + atomic_inc(&deferred_trigger_count);
    528 list_splice_tail_init(&deferred_probe_pending_list,
    529 &deferred_probe_active_list);
    530 mutex_unlock(&deferred_probe_mutex);
    531 @@ -265,6 +278,7 @@ static DECLARE_WAIT_QUEUE_HEAD(probe_waitqueue);
    532 static int really_probe(struct device *dev, struct device_driver *drv)
    533 {
    534 int ret = 0;
    535 + int local_trigger_count = atomic_read(&deferred_trigger_count);
    536
    537 atomic_inc(&probe_count);
    538 pr_debug("bus: '%s': %s: probing driver %s with device %s\n",
    539 @@ -310,6 +324,9 @@ probe_failed:
    540 /* Driver requested deferred probing */
    541 dev_info(dev, "Driver %s requests probe deferral\n", drv->name);
    542 driver_deferred_probe_add(dev);
    543 + /* Did a trigger occur while probing? Need to re-trigger if yes */
    544 + if (local_trigger_count != atomic_read(&deferred_trigger_count))
    545 + driver_deferred_probe_trigger();
    546 } else if (ret != -ENODEV && ret != -ENXIO) {
    547 /* driver matched but the probe failed */
    548 printk(KERN_WARNING
    549 diff --git a/drivers/base/topology.c b/drivers/base/topology.c
    550 index ae989c57cd5e..bcd19886fa1a 100644
    551 --- a/drivers/base/topology.c
    552 +++ b/drivers/base/topology.c
    553 @@ -40,8 +40,7 @@
    554 static ssize_t show_##name(struct device *dev, \
    555 struct device_attribute *attr, char *buf) \
    556 { \
    557 - unsigned int cpu = dev->id; \
    558 - return sprintf(buf, "%d\n", topology_##name(cpu)); \
    559 + return sprintf(buf, "%d\n", topology_##name(dev->id)); \
    560 }
    561
    562 #if defined(topology_thread_cpumask) || defined(topology_core_cpumask) || \
    563 diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
    564 index 1735b0d17e29..ddd9a098bc67 100644
    565 --- a/drivers/block/xen-blkfront.c
    566 +++ b/drivers/block/xen-blkfront.c
    567 @@ -104,7 +104,7 @@ struct blkfront_info
    568 struct work_struct work;
    569 struct gnttab_free_callback callback;
    570 struct blk_shadow shadow[BLK_RING_SIZE];
    571 - struct list_head persistent_gnts;
    572 + struct list_head grants;
    573 unsigned int persistent_gnts_c;
    574 unsigned long shadow_free;
    575 unsigned int feature_flush;
    576 @@ -175,15 +175,17 @@ static int fill_grant_buffer(struct blkfront_info *info, int num)
    577 if (!gnt_list_entry)
    578 goto out_of_memory;
    579
    580 - granted_page = alloc_page(GFP_NOIO);
    581 - if (!granted_page) {
    582 - kfree(gnt_list_entry);
    583 - goto out_of_memory;
    584 + if (info->feature_persistent) {
    585 + granted_page = alloc_page(GFP_NOIO);
    586 + if (!granted_page) {
    587 + kfree(gnt_list_entry);
    588 + goto out_of_memory;
    589 + }
    590 + gnt_list_entry->pfn = page_to_pfn(granted_page);
    591 }
    592
    593 - gnt_list_entry->pfn = page_to_pfn(granted_page);
    594 gnt_list_entry->gref = GRANT_INVALID_REF;
    595 - list_add(&gnt_list_entry->node, &info->persistent_gnts);
    596 + list_add(&gnt_list_entry->node, &info->grants);
    597 i++;
    598 }
    599
    600 @@ -191,9 +193,10 @@ static int fill_grant_buffer(struct blkfront_info *info, int num)
    601
    602 out_of_memory:
    603 list_for_each_entry_safe(gnt_list_entry, n,
    604 - &info->persistent_gnts, node) {
    605 + &info->grants, node) {
    606 list_del(&gnt_list_entry->node);
    607 - __free_page(pfn_to_page(gnt_list_entry->pfn));
    608 + if (info->feature_persistent)
    609 + __free_page(pfn_to_page(gnt_list_entry->pfn));
    610 kfree(gnt_list_entry);
    611 i--;
    612 }
    613 @@ -202,14 +205,14 @@ out_of_memory:
    614 }
    615
    616 static struct grant *get_grant(grant_ref_t *gref_head,
    617 + unsigned long pfn,
    618 struct blkfront_info *info)
    619 {
    620 struct grant *gnt_list_entry;
    621 unsigned long buffer_mfn;
    622
    623 - BUG_ON(list_empty(&info->persistent_gnts));
    624 - gnt_list_entry = list_first_entry(&info->persistent_gnts, struct grant,
    625 - node);
    626 + BUG_ON(list_empty(&info->grants));
    627 + gnt_list_entry = list_first_entry(&info->grants, struct grant, node);
    628 list_del(&gnt_list_entry->node);
    629
    630 if (gnt_list_entry->gref != GRANT_INVALID_REF) {
    631 @@ -220,6 +223,10 @@ static struct grant *get_grant(grant_ref_t *gref_head,
    632 /* Assign a gref to this page */
    633 gnt_list_entry->gref = gnttab_claim_grant_reference(gref_head);
    634 BUG_ON(gnt_list_entry->gref == -ENOSPC);
    635 + if (!info->feature_persistent) {
    636 + BUG_ON(!pfn);
    637 + gnt_list_entry->pfn = pfn;
    638 + }
    639 buffer_mfn = pfn_to_mfn(gnt_list_entry->pfn);
    640 gnttab_grant_foreign_access_ref(gnt_list_entry->gref,
    641 info->xbdev->otherend_id,
    642 @@ -430,12 +437,12 @@ static int blkif_queue_request(struct request *req)
    643 fsect = sg->offset >> 9;
    644 lsect = fsect + (sg->length >> 9) - 1;
    645
    646 - gnt_list_entry = get_grant(&gref_head, info);
    647 + gnt_list_entry = get_grant(&gref_head, page_to_pfn(sg_page(sg)), info);
    648 ref = gnt_list_entry->gref;
    649
    650 info->shadow[id].grants_used[i] = gnt_list_entry;
    651
    652 - if (rq_data_dir(req)) {
    653 + if (rq_data_dir(req) && info->feature_persistent) {
    654 char *bvec_data;
    655 void *shared_data;
    656
    657 @@ -828,16 +835,17 @@ static void blkif_free(struct blkfront_info *info, int suspend)
    658 blk_stop_queue(info->rq);
    659
    660 /* Remove all persistent grants */
    661 - if (!list_empty(&info->persistent_gnts)) {
    662 + if (!list_empty(&info->grants)) {
    663 list_for_each_entry_safe(persistent_gnt, n,
    664 - &info->persistent_gnts, node) {
    665 + &info->grants, node) {
    666 list_del(&persistent_gnt->node);
    667 if (persistent_gnt->gref != GRANT_INVALID_REF) {
    668 gnttab_end_foreign_access(persistent_gnt->gref,
    669 0, 0UL);
    670 info->persistent_gnts_c--;
    671 }
    672 - __free_page(pfn_to_page(persistent_gnt->pfn));
    673 + if (info->feature_persistent)
    674 + __free_page(pfn_to_page(persistent_gnt->pfn));
    675 kfree(persistent_gnt);
    676 }
    677 }
    678 @@ -874,7 +882,7 @@ static void blkif_completion(struct blk_shadow *s, struct blkfront_info *info,
    679
    680 nseg = s->req.u.rw.nr_segments;
    681
    682 - if (bret->operation == BLKIF_OP_READ) {
    683 + if (bret->operation == BLKIF_OP_READ && info->feature_persistent) {
    684 /*
    685 * Copy the data received from the backend into the bvec.
    686 * Since bv_offset can be different than 0, and bv_len different
    687 @@ -894,9 +902,30 @@ static void blkif_completion(struct blk_shadow *s, struct blkfront_info *info,
    688 }
    689 }
    690 /* Add the persistent grant into the list of free grants */
    691 - for (i = 0; i < s->req.u.rw.nr_segments; i++) {
    692 - list_add(&s->grants_used[i]->node, &info->persistent_gnts);
    693 - info->persistent_gnts_c++;
    694 + for (i = 0; i < nseg; i++) {
    695 + if (gnttab_query_foreign_access(s->grants_used[i]->gref)) {
    696 + /*
    697 + * If the grant is still mapped by the backend (the
    698 + * backend has chosen to make this grant persistent)
    699 + * we add it at the head of the list, so it will be
    700 + * reused first.
    701 + */
    702 + if (!info->feature_persistent)
    703 + pr_alert_ratelimited("backed has not unmapped grant: %u\n",
    704 + s->grants_used[i]->gref);
    705 + list_add(&s->grants_used[i]->node, &info->grants);
    706 + info->persistent_gnts_c++;
    707 + } else {
    708 + /*
    709 + * If the grant is not mapped by the backend we end the
    710 + * foreign access and add it to the tail of the list,
    711 + * so it will not be picked again unless we run out of
    712 + * persistent grants.
    713 + */
    714 + gnttab_end_foreign_access(s->grants_used[i]->gref, 0, 0UL);
    715 + s->grants_used[i]->gref = GRANT_INVALID_REF;
    716 + list_add_tail(&s->grants_used[i]->node, &info->grants);
    717 + }
    718 }
    719 }
    720
    721 @@ -1034,12 +1063,6 @@ static int setup_blkring(struct xenbus_device *dev,
    722 for (i = 0; i < BLK_RING_SIZE; i++)
    723 sg_init_table(info->shadow[i].sg, BLKIF_MAX_SEGMENTS_PER_REQUEST);
    724
    725 - /* Allocate memory for grants */
    726 - err = fill_grant_buffer(info, BLK_RING_SIZE *
    727 - BLKIF_MAX_SEGMENTS_PER_REQUEST);
    728 - if (err)
    729 - goto fail;
    730 -
    731 err = xenbus_grant_ring(dev, virt_to_mfn(info->ring.sring));
    732 if (err < 0) {
    733 free_page((unsigned long)sring);
    734 @@ -1198,7 +1221,7 @@ static int blkfront_probe(struct xenbus_device *dev,
    735 spin_lock_init(&info->io_lock);
    736 info->xbdev = dev;
    737 info->vdevice = vdevice;
    738 - INIT_LIST_HEAD(&info->persistent_gnts);
    739 + INIT_LIST_HEAD(&info->grants);
    740 info->persistent_gnts_c = 0;
    741 info->connected = BLKIF_STATE_DISCONNECTED;
    742 INIT_WORK(&info->work, blkif_restart_queue);
    743 @@ -1227,7 +1250,8 @@ static int blkif_recover(struct blkfront_info *info)
    744 int i;
    745 struct blkif_request *req;
    746 struct blk_shadow *copy;
    747 - int j;
    748 + unsigned int persistent;
    749 + int j, rc;
    750
    751 /* Stage 1: Make a safe copy of the shadow state. */
    752 copy = kmemdup(info->shadow, sizeof(info->shadow),
    753 @@ -1242,6 +1266,24 @@ static int blkif_recover(struct blkfront_info *info)
    754 info->shadow_free = info->ring.req_prod_pvt;
    755 info->shadow[BLK_RING_SIZE-1].req.u.rw.id = 0x0fffffff;
    756
    757 + /* Check if the backend supports persistent grants */
    758 + rc = xenbus_gather(XBT_NIL, info->xbdev->otherend,
    759 + "feature-persistent", "%u", &persistent,
    760 + NULL);
    761 + if (rc)
    762 + info->feature_persistent = 0;
    763 + else
    764 + info->feature_persistent = persistent;
    765 +
    766 + /* Allocate memory for grants */
    767 + rc = fill_grant_buffer(info, BLK_RING_SIZE *
    768 + BLKIF_MAX_SEGMENTS_PER_REQUEST);
    769 + if (rc) {
    770 + xenbus_dev_fatal(info->xbdev, rc, "setting grant buffer failed");
    771 + kfree(copy);
    772 + return rc;
    773 + }
    774 +
    775 /* Stage 3: Find pending requests and requeue them. */
    776 for (i = 0; i < BLK_RING_SIZE; i++) {
    777 /* Not in use? */
    778 @@ -1306,8 +1348,12 @@ static int blkfront_resume(struct xenbus_device *dev)
    779 blkif_free(info, info->connected == BLKIF_STATE_CONNECTED);
    780
    781 err = talk_to_blkback(dev, info);
    782 - if (info->connected == BLKIF_STATE_SUSPENDED && !err)
    783 - err = blkif_recover(info);
    784 +
    785 + /*
    786 + * We have to wait for the backend to switch to
    787 + * connected state, since we want to read which
    788 + * features it supports.
    789 + */
    790
    791 return err;
    792 }
    793 @@ -1411,9 +1457,16 @@ static void blkfront_connect(struct blkfront_info *info)
    794 sectors);
    795 set_capacity(info->gd, sectors);
    796 revalidate_disk(info->gd);
    797 + return;
    798
    799 - /* fall through */
    800 case BLKIF_STATE_SUSPENDED:
    801 + /*
    802 + * If we are recovering from suspension, we need to wait
    803 + * for the backend to announce it's features before
    804 + * reconnecting, we need to know if the backend supports
    805 + * persistent grants.
    806 + */
    807 + blkif_recover(info);
    808 return;
    809
    810 default:
    811 @@ -1481,6 +1534,14 @@ static void blkfront_connect(struct blkfront_info *info)
    812 else
    813 info->feature_persistent = persistent;
    814
    815 + /* Allocate memory for grants */
    816 + err = fill_grant_buffer(info, BLK_RING_SIZE *
    817 + BLKIF_MAX_SEGMENTS_PER_REQUEST);
    818 + if (err) {
    819 + xenbus_dev_fatal(info->xbdev, err, "setting grant buffer failed");
    820 + return;
    821 + }
    822 +
    823 err = xlvbd_alloc_gendisk(sectors, info, binfo, sector_size);
    824 if (err) {
    825 xenbus_dev_fatal(info->xbdev, err, "xlvbd_add at %s",
    826 diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
    827 index 0a327f4154a2..2acabdaecec8 100644
    828 --- a/drivers/bluetooth/ath3k.c
    829 +++ b/drivers/bluetooth/ath3k.c
    830 @@ -82,6 +82,7 @@ static struct usb_device_id ath3k_table[] = {
    831 { USB_DEVICE(0x04CA, 0x3004) },
    832 { USB_DEVICE(0x04CA, 0x3005) },
    833 { USB_DEVICE(0x04CA, 0x3006) },
    834 + { USB_DEVICE(0x04CA, 0x3007) },
    835 { USB_DEVICE(0x04CA, 0x3008) },
    836 { USB_DEVICE(0x13d3, 0x3362) },
    837 { USB_DEVICE(0x0CF3, 0xE004) },
    838 @@ -124,6 +125,7 @@ static struct usb_device_id ath3k_blist_tbl[] = {
    839 { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
    840 { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
    841 { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
    842 + { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
    843 { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
    844 { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
    845 { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
    846 diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
    847 index 58491f1b2799..45aa8e760124 100644
    848 --- a/drivers/bluetooth/btusb.c
    849 +++ b/drivers/bluetooth/btusb.c
    850 @@ -146,6 +146,7 @@ static struct usb_device_id blacklist_table[] = {
    851 { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
    852 { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
    853 { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
    854 + { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
    855 { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
    856 { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
    857 { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
    858 diff --git a/drivers/bus/mvebu-mbus.c b/drivers/bus/mvebu-mbus.c
    859 index 8740f46b4d0d..5dcc8305abd1 100644
    860 --- a/drivers/bus/mvebu-mbus.c
    861 +++ b/drivers/bus/mvebu-mbus.c
    862 @@ -250,12 +250,6 @@ static int mvebu_mbus_window_conflicts(struct mvebu_mbus_state *mbus,
    863 */
    864 if ((u64)base < wend && end > wbase)
    865 return 0;
    866 -
    867 - /*
    868 - * Check if target/attribute conflicts
    869 - */
    870 - if (target == wtarget && attr == wattr)
    871 - return 0;
    872 }
    873
    874 return 1;
    875 diff --git a/drivers/char/ipmi/ipmi_kcs_sm.c b/drivers/char/ipmi/ipmi_kcs_sm.c
    876 index e53fc24c6af3..e1ddcf938519 100644
    877 --- a/drivers/char/ipmi/ipmi_kcs_sm.c
    878 +++ b/drivers/char/ipmi/ipmi_kcs_sm.c
    879 @@ -251,8 +251,9 @@ static inline int check_obf(struct si_sm_data *kcs, unsigned char status,
    880 if (!GET_STATUS_OBF(status)) {
    881 kcs->obf_timeout -= time;
    882 if (kcs->obf_timeout < 0) {
    883 - start_error_recovery(kcs, "OBF not ready in time");
    884 - return 1;
    885 + kcs->obf_timeout = OBF_RETRY_TIMEOUT;
    886 + start_error_recovery(kcs, "OBF not ready in time");
    887 + return 1;
    888 }
    889 return 0;
    890 }
    891 diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
    892 index af4b23ffc5a6..40b3f756f904 100644
    893 --- a/drivers/char/ipmi/ipmi_si_intf.c
    894 +++ b/drivers/char/ipmi/ipmi_si_intf.c
    895 @@ -244,6 +244,9 @@ struct smi_info {
    896 /* The timer for this si. */
    897 struct timer_list si_timer;
    898
    899 + /* This flag is set, if the timer is running (timer_pending() isn't enough) */
    900 + bool timer_running;
    901 +
    902 /* The time (in jiffies) the last timeout occurred at. */
    903 unsigned long last_timeout_jiffies;
    904
    905 @@ -427,6 +430,13 @@ static void start_clear_flags(struct smi_info *smi_info)
    906 smi_info->si_state = SI_CLEARING_FLAGS;
    907 }
    908
    909 +static void smi_mod_timer(struct smi_info *smi_info, unsigned long new_val)
    910 +{
    911 + smi_info->last_timeout_jiffies = jiffies;
    912 + mod_timer(&smi_info->si_timer, new_val);
    913 + smi_info->timer_running = true;
    914 +}
    915 +
    916 /*
    917 * When we have a situtaion where we run out of memory and cannot
    918 * allocate messages, we just leave them in the BMC and run the system
    919 @@ -439,8 +449,7 @@ static inline void disable_si_irq(struct smi_info *smi_info)
    920 start_disable_irq(smi_info);
    921 smi_info->interrupt_disabled = 1;
    922 if (!atomic_read(&smi_info->stop_operation))
    923 - mod_timer(&smi_info->si_timer,
    924 - jiffies + SI_TIMEOUT_JIFFIES);
    925 + smi_mod_timer(smi_info, jiffies + SI_TIMEOUT_JIFFIES);
    926 }
    927 }
    928
    929 @@ -900,15 +909,7 @@ static void sender(void *send_info,
    930 list_add_tail(&msg->link, &smi_info->xmit_msgs);
    931
    932 if (smi_info->si_state == SI_NORMAL && smi_info->curr_msg == NULL) {
    933 - /*
    934 - * last_timeout_jiffies is updated here to avoid
    935 - * smi_timeout() handler passing very large time_diff
    936 - * value to smi_event_handler() that causes
    937 - * the send command to abort.
    938 - */
    939 - smi_info->last_timeout_jiffies = jiffies;
    940 -
    941 - mod_timer(&smi_info->si_timer, jiffies + SI_TIMEOUT_JIFFIES);
    942 + smi_mod_timer(smi_info, jiffies + SI_TIMEOUT_JIFFIES);
    943
    944 if (smi_info->thread)
    945 wake_up_process(smi_info->thread);
    946 @@ -997,6 +998,17 @@ static int ipmi_thread(void *data)
    947
    948 spin_lock_irqsave(&(smi_info->si_lock), flags);
    949 smi_result = smi_event_handler(smi_info, 0);
    950 +
    951 + /*
    952 + * If the driver is doing something, there is a possible
    953 + * race with the timer. If the timer handler see idle,
    954 + * and the thread here sees something else, the timer
    955 + * handler won't restart the timer even though it is
    956 + * required. So start it here if necessary.
    957 + */
    958 + if (smi_result != SI_SM_IDLE && !smi_info->timer_running)
    959 + smi_mod_timer(smi_info, jiffies + SI_TIMEOUT_JIFFIES);
    960 +
    961 spin_unlock_irqrestore(&(smi_info->si_lock), flags);
    962 busy_wait = ipmi_thread_busy_wait(smi_result, smi_info,
    963 &busy_until);
    964 @@ -1066,10 +1078,6 @@ static void smi_timeout(unsigned long data)
    965 * SI_USEC_PER_JIFFY);
    966 smi_result = smi_event_handler(smi_info, time_diff);
    967
    968 - spin_unlock_irqrestore(&(smi_info->si_lock), flags);
    969 -
    970 - smi_info->last_timeout_jiffies = jiffies_now;
    971 -
    972 if ((smi_info->irq) && (!smi_info->interrupt_disabled)) {
    973 /* Running with interrupts, only do long timeouts. */
    974 timeout = jiffies + SI_TIMEOUT_JIFFIES;
    975 @@ -1091,7 +1099,10 @@ static void smi_timeout(unsigned long data)
    976
    977 do_mod_timer:
    978 if (smi_result != SI_SM_IDLE)
    979 - mod_timer(&(smi_info->si_timer), timeout);
    980 + smi_mod_timer(smi_info, timeout);
    981 + else
    982 + smi_info->timer_running = false;
    983 + spin_unlock_irqrestore(&(smi_info->si_lock), flags);
    984 }
    985
    986 static irqreturn_t si_irq_handler(int irq, void *data)
    987 @@ -1139,8 +1150,7 @@ static int smi_start_processing(void *send_info,
    988
    989 /* Set up the timer that drives the interface. */
    990 setup_timer(&new_smi->si_timer, smi_timeout, (long)new_smi);
    991 - new_smi->last_timeout_jiffies = jiffies;
    992 - mod_timer(&new_smi->si_timer, jiffies + SI_TIMEOUT_JIFFIES);
    993 + smi_mod_timer(new_smi, jiffies + SI_TIMEOUT_JIFFIES);
    994
    995 /*
    996 * Check if the user forcefully enabled the daemon.
    997 diff --git a/drivers/clk/versatile/clk-vexpress-osc.c b/drivers/clk/versatile/clk-vexpress-osc.c
    998 index 256c8be74df8..8b8798bb93f3 100644
    999 --- a/drivers/clk/versatile/clk-vexpress-osc.c
    1000 +++ b/drivers/clk/versatile/clk-vexpress-osc.c
    1001 @@ -102,7 +102,7 @@ void __init vexpress_osc_of_setup(struct device_node *node)
    1002
    1003 osc = kzalloc(sizeof(*osc), GFP_KERNEL);
    1004 if (!osc)
    1005 - goto error;
    1006 + return;
    1007
    1008 osc->func = vexpress_config_func_get_by_node(node);
    1009 if (!osc->func) {
    1010 diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c
    1011 index 662fcc065821..b7960185919d 100644
    1012 --- a/drivers/clocksource/exynos_mct.c
    1013 +++ b/drivers/clocksource/exynos_mct.c
    1014 @@ -429,8 +429,6 @@ static int __cpuinit exynos4_local_timer_setup(struct clock_event_device *evt)
    1015 evt->set_mode = exynos4_tick_set_mode;
    1016 evt->features = CLOCK_EVT_FEAT_PERIODIC | CLOCK_EVT_FEAT_ONESHOT;
    1017 evt->rating = 450;
    1018 - clockevents_config_and_register(evt, clk_rate / (TICK_BASE_CNT + 1),
    1019 - 0xf, 0x7fffffff);
    1020
    1021 exynos4_mct_write(TICK_BASE_CNT, mevt->base + MCT_L_TCNTB_OFFSET);
    1022
    1023 @@ -448,6 +446,8 @@ static int __cpuinit exynos4_local_timer_setup(struct clock_event_device *evt)
    1024 } else {
    1025 enable_percpu_irq(mct_irqs[MCT_L0_IRQ], 0);
    1026 }
    1027 + clockevents_config_and_register(evt, clk_rate / (TICK_BASE_CNT + 1),
    1028 + 0xf, 0x7fffffff);
    1029
    1030 return 0;
    1031 }
    1032 diff --git a/drivers/crypto/caam/error.c b/drivers/crypto/caam/error.c
    1033 index 9f25f5296029..0eabd81e1a90 100644
    1034 --- a/drivers/crypto/caam/error.c
    1035 +++ b/drivers/crypto/caam/error.c
    1036 @@ -16,9 +16,13 @@
    1037 char *tmp; \
    1038 \
    1039 tmp = kmalloc(sizeof(format) + max_alloc, GFP_ATOMIC); \
    1040 - sprintf(tmp, format, param); \
    1041 - strcat(str, tmp); \
    1042 - kfree(tmp); \
    1043 + if (likely(tmp)) { \
    1044 + sprintf(tmp, format, param); \
    1045 + strcat(str, tmp); \
    1046 + kfree(tmp); \
    1047 + } else { \
    1048 + strcat(str, "kmalloc failure in SPRINTFCAT"); \
    1049 + } \
    1050 }
    1051
    1052 static void report_jump_idx(u32 status, char *outstr)
    1053 diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
    1054 index 54ae96f7bec6..8814b0dbfc4f 100644
    1055 --- a/drivers/gpu/drm/i915/intel_display.c
    1056 +++ b/drivers/gpu/drm/i915/intel_display.c
    1057 @@ -9123,15 +9123,6 @@ void intel_modeset_init(struct drm_device *dev)
    1058 intel_disable_fbc(dev);
    1059 }
    1060
    1061 -static void
    1062 -intel_connector_break_all_links(struct intel_connector *connector)
    1063 -{
    1064 - connector->base.dpms = DRM_MODE_DPMS_OFF;
    1065 - connector->base.encoder = NULL;
    1066 - connector->encoder->connectors_active = false;
    1067 - connector->encoder->base.crtc = NULL;
    1068 -}
    1069 -
    1070 static void intel_enable_pipe_a(struct drm_device *dev)
    1071 {
    1072 struct intel_connector *connector;
    1073 @@ -9213,8 +9204,17 @@ static void intel_sanitize_crtc(struct intel_crtc *crtc)
    1074 if (connector->encoder->base.crtc != &crtc->base)
    1075 continue;
    1076
    1077 - intel_connector_break_all_links(connector);
    1078 + connector->base.dpms = DRM_MODE_DPMS_OFF;
    1079 + connector->base.encoder = NULL;
    1080 }
    1081 + /* multiple connectors may have the same encoder:
    1082 + * handle them and break crtc link separately */
    1083 + list_for_each_entry(connector, &dev->mode_config.connector_list,
    1084 + base.head)
    1085 + if (connector->encoder->base.crtc == &crtc->base) {
    1086 + connector->encoder->base.crtc = NULL;
    1087 + connector->encoder->connectors_active = false;
    1088 + }
    1089
    1090 WARN_ON(crtc->active);
    1091 crtc->base.enabled = false;
    1092 @@ -9285,6 +9285,8 @@ static void intel_sanitize_encoder(struct intel_encoder *encoder)
    1093 drm_get_encoder_name(&encoder->base));
    1094 encoder->disable(encoder);
    1095 }
    1096 + encoder->base.crtc = NULL;
    1097 + encoder->connectors_active = false;
    1098
    1099 /* Inconsistent output/port/pipe state happens presumably due to
    1100 * a bug in one of the get_hw_state functions. Or someplace else
    1101 @@ -9295,8 +9297,8 @@ static void intel_sanitize_encoder(struct intel_encoder *encoder)
    1102 base.head) {
    1103 if (connector->encoder != encoder)
    1104 continue;
    1105 -
    1106 - intel_connector_break_all_links(connector);
    1107 + connector->base.dpms = DRM_MODE_DPMS_OFF;
    1108 + connector->base.encoder = NULL;
    1109 }
    1110 }
    1111 /* Enabled encoders without active connectors will be fixed in
    1112 diff --git a/drivers/gpu/drm/nouveau/core/subdev/therm/fan.c b/drivers/gpu/drm/nouveau/core/subdev/therm/fan.c
    1113 index c728380d3d62..ea19acd20784 100644
    1114 --- a/drivers/gpu/drm/nouveau/core/subdev/therm/fan.c
    1115 +++ b/drivers/gpu/drm/nouveau/core/subdev/therm/fan.c
    1116 @@ -54,8 +54,10 @@ nouveau_fan_update(struct nouveau_fan *fan, bool immediate, int target)
    1117
    1118 /* check that we're not already at the target duty cycle */
    1119 duty = fan->get(therm);
    1120 - if (duty == target)
    1121 - goto done;
    1122 + if (duty == target) {
    1123 + spin_unlock_irqrestore(&fan->lock, flags);
    1124 + return 0;
    1125 + }
    1126
    1127 /* smooth out the fanspeed increase/decrease */
    1128 if (!immediate && duty >= 0) {
    1129 @@ -73,8 +75,15 @@ nouveau_fan_update(struct nouveau_fan *fan, bool immediate, int target)
    1130
    1131 nv_debug(therm, "FAN update: %d\n", duty);
    1132 ret = fan->set(therm, duty);
    1133 - if (ret)
    1134 - goto done;
    1135 + if (ret) {
    1136 + spin_unlock_irqrestore(&fan->lock, flags);
    1137 + return ret;
    1138 + }
    1139 +
    1140 + /* fan speed updated, drop the fan lock before grabbing the
    1141 + * alarm-scheduling lock and risking a deadlock
    1142 + */
    1143 + spin_unlock_irqrestore(&fan->lock, flags);
    1144
    1145 /* schedule next fan update, if not at target speed already */
    1146 if (list_empty(&fan->alarm.head) && target != duty) {
    1147 @@ -92,8 +101,6 @@ nouveau_fan_update(struct nouveau_fan *fan, bool immediate, int target)
    1148 ptimer->alarm(ptimer, delay * 1000 * 1000, &fan->alarm);
    1149 }
    1150
    1151 -done:
    1152 - spin_unlock_irqrestore(&fan->lock, flags);
    1153 return ret;
    1154 }
    1155
    1156 diff --git a/drivers/gpu/drm/nouveau/nouveau_acpi.c b/drivers/gpu/drm/nouveau/nouveau_acpi.c
    1157 index d97f20069d3e..5cec3a0c6c85 100644
    1158 --- a/drivers/gpu/drm/nouveau/nouveau_acpi.c
    1159 +++ b/drivers/gpu/drm/nouveau/nouveau_acpi.c
    1160 @@ -372,9 +372,6 @@ bool nouveau_acpi_rom_supported(struct pci_dev *pdev)
    1161 acpi_status status;
    1162 acpi_handle dhandle, rom_handle;
    1163
    1164 - if (!nouveau_dsm_priv.dsm_detected && !nouveau_dsm_priv.optimus_detected)
    1165 - return false;
    1166 -
    1167 dhandle = DEVICE_ACPI_HANDLE(&pdev->dev);
    1168 if (!dhandle)
    1169 return false;
    1170 diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
    1171 index cbb06d7c89b5..8c44ef57864b 100644
    1172 --- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c
    1173 +++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
    1174 @@ -523,6 +523,13 @@ static bool radeon_atpx_detect(void)
    1175 has_atpx |= (radeon_atpx_pci_probe_handle(pdev) == true);
    1176 }
    1177
    1178 + /* some newer PX laptops mark the dGPU as a non-VGA display device */
    1179 + while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_OTHER << 8, pdev)) != NULL) {
    1180 + vga_count++;
    1181 +
    1182 + has_atpx |= (radeon_atpx_pci_probe_handle(pdev) == true);
    1183 + }
    1184 +
    1185 if (has_atpx && vga_count == 2) {
    1186 acpi_get_name(radeon_atpx_priv.atpx.handle, ACPI_FULL_PATHNAME, &buffer);
    1187 printk(KERN_INFO "VGA switcheroo: detected switching method %s handle\n",
    1188 diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c
    1189 index 21d2d5280fc1..5715429279fb 100644
    1190 --- a/drivers/gpu/drm/radeon/radeon_uvd.c
    1191 +++ b/drivers/gpu/drm/radeon/radeon_uvd.c
    1192 @@ -449,6 +449,10 @@ static int radeon_uvd_cs_reloc(struct radeon_cs_parser *p,
    1193 cmd = radeon_get_ib_value(p, p->idx) >> 1;
    1194
    1195 if (cmd < 0x4) {
    1196 + if (end <= start) {
    1197 + DRM_ERROR("invalid reloc offset %X!\n", offset);
    1198 + return -EINVAL;
    1199 + }
    1200 if ((end - start) < buf_sizes[cmd]) {
    1201 DRM_ERROR("buffer to small (%d / %d)!\n",
    1202 (unsigned)(end - start), buf_sizes[cmd]);
    1203 diff --git a/drivers/gpu/host1x/hw/intr_hw.c b/drivers/gpu/host1x/hw/intr_hw.c
    1204 index b592eef1efcb..b083509325e4 100644
    1205 --- a/drivers/gpu/host1x/hw/intr_hw.c
    1206 +++ b/drivers/gpu/host1x/hw/intr_hw.c
    1207 @@ -48,7 +48,7 @@ static irqreturn_t syncpt_thresh_isr(int irq, void *dev_id)
    1208 unsigned long reg;
    1209 int i, id;
    1210
    1211 - for (i = 0; i <= BIT_WORD(host->info->nb_pts); i++) {
    1212 + for (i = 0; i < DIV_ROUND_UP(host->info->nb_pts, 32); i++) {
    1213 reg = host1x_sync_readl(host,
    1214 HOST1X_SYNC_SYNCPT_THRESH_CPU0_INT_STATUS(i));
    1215 for_each_set_bit(id, &reg, BITS_PER_LONG) {
    1216 @@ -65,7 +65,7 @@ static void _host1x_intr_disable_all_syncpt_intrs(struct host1x *host)
    1217 {
    1218 u32 i;
    1219
    1220 - for (i = 0; i <= BIT_WORD(host->info->nb_pts); ++i) {
    1221 + for (i = 0; i < DIV_ROUND_UP(host->info->nb_pts, 32); ++i) {
    1222 host1x_sync_writel(host, 0xffffffffu,
    1223 HOST1X_SYNC_SYNCPT_THRESH_INT_DISABLE(i));
    1224 host1x_sync_writel(host, 0xffffffffu,
    1225 diff --git a/drivers/hv/connection.c b/drivers/hv/connection.c
    1226 index d4fac934b220..fd02cb79a99c 100644
    1227 --- a/drivers/hv/connection.c
    1228 +++ b/drivers/hv/connection.c
    1229 @@ -55,6 +55,9 @@ static __u32 vmbus_get_next_version(__u32 current_version)
    1230 case (VERSION_WIN8):
    1231 return VERSION_WIN7;
    1232
    1233 + case (VERSION_WIN8_1):
    1234 + return VERSION_WIN8;
    1235 +
    1236 case (VERSION_WS2008):
    1237 default:
    1238 return VERSION_INVAL;
    1239 @@ -80,6 +83,9 @@ static int vmbus_negotiate_version(struct vmbus_channel_msginfo *msginfo,
    1240 (void *)((unsigned long)vmbus_connection.monitor_pages +
    1241 PAGE_SIZE));
    1242
    1243 + if (version == VERSION_WIN8_1)
    1244 + msg->target_vcpu = hv_context.vp_index[smp_processor_id()];
    1245 +
    1246 /*
    1247 * Add to list before we send the request since we may
    1248 * receive the response before returning from this routine
    1249 diff --git a/drivers/hwmon/emc1403.c b/drivers/hwmon/emc1403.c
    1250 index 142e1cb8dea7..361f50b221bd 100644
    1251 --- a/drivers/hwmon/emc1403.c
    1252 +++ b/drivers/hwmon/emc1403.c
    1253 @@ -162,7 +162,7 @@ static ssize_t store_hyst(struct device *dev,
    1254 if (retval < 0)
    1255 goto fail;
    1256
    1257 - hyst = val - retval * 1000;
    1258 + hyst = retval * 1000 - val;
    1259 hyst = DIV_ROUND_CLOSEST(hyst, 1000);
    1260 if (hyst < 0 || hyst > 255) {
    1261 retval = -ERANGE;
    1262 @@ -295,7 +295,7 @@ static int emc1403_detect(struct i2c_client *client,
    1263 }
    1264
    1265 id = i2c_smbus_read_byte_data(client, THERMAL_REVISION_REG);
    1266 - if (id != 0x01)
    1267 + if (id < 0x01 || id > 0x04)
    1268 return -ENODEV;
    1269
    1270 return 0;
    1271 diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
    1272 index 49423e913459..d4fe13ee543e 100644
    1273 --- a/drivers/i2c/busses/Kconfig
    1274 +++ b/drivers/i2c/busses/Kconfig
    1275 @@ -109,6 +109,8 @@ config I2C_I801
    1276 Avoton (SOC)
    1277 Wellsburg (PCH)
    1278 Coleto Creek (PCH)
    1279 + Wildcat Point-LP (PCH)
    1280 + BayTrail (SOC)
    1281
    1282 This driver can also be built as a module. If so, the module
    1283 will be called i2c-i801.
    1284 diff --git a/drivers/i2c/busses/i2c-designware-core.c b/drivers/i2c/busses/i2c-designware-core.c
    1285 index c41ca6354fc5..f24a7385260a 100644
    1286 --- a/drivers/i2c/busses/i2c-designware-core.c
    1287 +++ b/drivers/i2c/busses/i2c-designware-core.c
    1288 @@ -380,6 +380,9 @@ static void i2c_dw_xfer_init(struct dw_i2c_dev *dev)
    1289 ic_con &= ~DW_IC_CON_10BITADDR_MASTER;
    1290 dw_writel(dev, ic_con, DW_IC_CON);
    1291
    1292 + /* enforce disabled interrupts (due to HW issues) */
    1293 + i2c_dw_disable_int(dev);
    1294 +
    1295 /* Enable the adapter */
    1296 __i2c_dw_enable(dev, true);
    1297
    1298 diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
    1299 index 4ebceed6bc66..783fa75e13ae 100644
    1300 --- a/drivers/i2c/busses/i2c-i801.c
    1301 +++ b/drivers/i2c/busses/i2c-i801.c
    1302 @@ -59,6 +59,8 @@
    1303 Wellsburg (PCH) MS 0x8d7e 32 hard yes yes yes
    1304 Wellsburg (PCH) MS 0x8d7f 32 hard yes yes yes
    1305 Coleto Creek (PCH) 0x23b0 32 hard yes yes yes
    1306 + Wildcat Point-LP (PCH) 0x9ca2 32 hard yes yes yes
    1307 + BayTrail (SOC) 0x0f12 32 hard yes yes yes
    1308
    1309 Features supported by this driver:
    1310 Software PEC no
    1311 @@ -161,6 +163,7 @@
    1312 STATUS_ERROR_FLAGS)
    1313
    1314 /* Older devices have their ID defined in <linux/pci_ids.h> */
    1315 +#define PCI_DEVICE_ID_INTEL_BAYTRAIL_SMBUS 0x0f12
    1316 #define PCI_DEVICE_ID_INTEL_COUGARPOINT_SMBUS 0x1c22
    1317 #define PCI_DEVICE_ID_INTEL_PATSBURG_SMBUS 0x1d22
    1318 /* Patsburg also has three 'Integrated Device Function' SMBus controllers */
    1319 @@ -178,6 +181,7 @@
    1320 #define PCI_DEVICE_ID_INTEL_WELLSBURG_SMBUS_MS1 0x8d7e
    1321 #define PCI_DEVICE_ID_INTEL_WELLSBURG_SMBUS_MS2 0x8d7f
    1322 #define PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_SMBUS 0x9c22
    1323 +#define PCI_DEVICE_ID_INTEL_WILDCATPOINT_LP_SMBUS 0x9ca2
    1324
    1325 struct i801_mux_config {
    1326 char *gpio_chip;
    1327 @@ -820,6 +824,8 @@ static DEFINE_PCI_DEVICE_TABLE(i801_ids) = {
    1328 { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_WELLSBURG_SMBUS_MS1) },
    1329 { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_WELLSBURG_SMBUS_MS2) },
    1330 { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_COLETOCREEK_SMBUS) },
    1331 + { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_WILDCATPOINT_LP_SMBUS) },
    1332 + { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BAYTRAIL_SMBUS) },
    1333 { 0, }
    1334 };
    1335
    1336 diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
    1337 index 4ba4a95b6b26..8a806f5c40cf 100644
    1338 --- a/drivers/i2c/busses/i2c-rcar.c
    1339 +++ b/drivers/i2c/busses/i2c-rcar.c
    1340 @@ -541,6 +541,12 @@ static int rcar_i2c_master_xfer(struct i2c_adapter *adap,
    1341
    1342 ret = -EINVAL;
    1343 for (i = 0; i < num; i++) {
    1344 + /* This HW can't send STOP after address phase */
    1345 + if (msgs[i].len == 0) {
    1346 + ret = -EOPNOTSUPP;
    1347 + break;
    1348 + }
    1349 +
    1350 /*-------------- spin lock -----------------*/
    1351 spin_lock_irqsave(&priv->lock, flags);
    1352
    1353 @@ -605,7 +611,8 @@ static int rcar_i2c_master_xfer(struct i2c_adapter *adap,
    1354
    1355 static u32 rcar_i2c_func(struct i2c_adapter *adap)
    1356 {
    1357 - return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
    1358 + /* This HW can't do SMBUS_QUICK and NOSTART */
    1359 + return I2C_FUNC_I2C | (I2C_FUNC_SMBUS_EMUL & ~I2C_FUNC_SMBUS_QUICK);
    1360 }
    1361
    1362 static const struct i2c_algorithm rcar_i2c_algo = {
    1363 diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c
    1364 index cab1c91b75a3..a72aad9561b0 100644
    1365 --- a/drivers/i2c/busses/i2c-s3c2410.c
    1366 +++ b/drivers/i2c/busses/i2c-s3c2410.c
    1367 @@ -1204,10 +1204,10 @@ static int s3c24xx_i2c_resume(struct device *dev)
    1368 struct platform_device *pdev = to_platform_device(dev);
    1369 struct s3c24xx_i2c *i2c = platform_get_drvdata(pdev);
    1370
    1371 - i2c->suspended = 0;
    1372 clk_prepare_enable(i2c->clk);
    1373 s3c24xx_i2c_init(i2c);
    1374 clk_disable_unprepare(i2c->clk);
    1375 + i2c->suspended = 0;
    1376
    1377 return 0;
    1378 }
    1379 diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
    1380 index fe4c61e219f3..111ac381b40b 100644
    1381 --- a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
    1382 +++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
    1383 @@ -660,6 +660,7 @@ static int inv_mpu_probe(struct i2c_client *client,
    1384 {
    1385 struct inv_mpu6050_state *st;
    1386 struct iio_dev *indio_dev;
    1387 + struct inv_mpu6050_platform_data *pdata;
    1388 int result;
    1389
    1390 if (!i2c_check_functionality(client->adapter,
    1391 @@ -675,8 +676,10 @@ static int inv_mpu_probe(struct i2c_client *client,
    1392 }
    1393 st = iio_priv(indio_dev);
    1394 st->client = client;
    1395 - st->plat_data = *(struct inv_mpu6050_platform_data
    1396 - *)dev_get_platdata(&client->dev);
    1397 + pdata = (struct inv_mpu6050_platform_data
    1398 + *)dev_get_platdata(&client->dev);
    1399 + if (pdata)
    1400 + st->plat_data = *pdata;
    1401 /* power is turned on inside check chip type*/
    1402 result = inv_check_and_setup_chip(st, id);
    1403 if (result)
    1404 diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
    1405 index ce6c603a3cc9..988e29d18bb4 100644
    1406 --- a/drivers/infiniband/ulp/isert/ib_isert.c
    1407 +++ b/drivers/infiniband/ulp/isert/ib_isert.c
    1408 @@ -27,6 +27,7 @@
    1409 #include <target/target_core_base.h>
    1410 #include <target/target_core_fabric.h>
    1411 #include <target/iscsi/iscsi_transport.h>
    1412 +#include <linux/semaphore.h>
    1413
    1414 #include "isert_proto.h"
    1415 #include "ib_isert.h"
    1416 @@ -459,11 +460,11 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
    1417 goto out_conn_dev;
    1418
    1419 mutex_lock(&isert_np->np_accept_mutex);
    1420 - list_add_tail(&isert_np->np_accept_list, &isert_conn->conn_accept_node);
    1421 + list_add_tail(&isert_conn->conn_accept_node, &isert_np->np_accept_list);
    1422 mutex_unlock(&isert_np->np_accept_mutex);
    1423
    1424 - pr_debug("isert_connect_request() waking up np_accept_wq: %p\n", np);
    1425 - wake_up(&isert_np->np_accept_wq);
    1426 + pr_debug("isert_connect_request() up np_sem np: %p\n", np);
    1427 + up(&isert_np->np_sem);
    1428 return 0;
    1429
    1430 out_conn_dev:
    1431 @@ -2042,7 +2043,7 @@ isert_setup_np(struct iscsi_np *np,
    1432 pr_err("Unable to allocate struct isert_np\n");
    1433 return -ENOMEM;
    1434 }
    1435 - init_waitqueue_head(&isert_np->np_accept_wq);
    1436 + sema_init(&isert_np->np_sem, 0);
    1437 mutex_init(&isert_np->np_accept_mutex);
    1438 INIT_LIST_HEAD(&isert_np->np_accept_list);
    1439 init_completion(&isert_np->np_login_comp);
    1440 @@ -2091,18 +2092,6 @@ out:
    1441 }
    1442
    1443 static int
    1444 -isert_check_accept_queue(struct isert_np *isert_np)
    1445 -{
    1446 - int empty;
    1447 -
    1448 - mutex_lock(&isert_np->np_accept_mutex);
    1449 - empty = list_empty(&isert_np->np_accept_list);
    1450 - mutex_unlock(&isert_np->np_accept_mutex);
    1451 -
    1452 - return empty;
    1453 -}
    1454 -
    1455 -static int
    1456 isert_rdma_accept(struct isert_conn *isert_conn)
    1457 {
    1458 struct rdma_cm_id *cm_id = isert_conn->conn_cm_id;
    1459 @@ -2186,16 +2175,14 @@ isert_accept_np(struct iscsi_np *np, struct iscsi_conn *conn)
    1460 int max_accept = 0, ret;
    1461
    1462 accept_wait:
    1463 - ret = wait_event_interruptible(isert_np->np_accept_wq,
    1464 - !isert_check_accept_queue(isert_np) ||
    1465 - np->np_thread_state == ISCSI_NP_THREAD_RESET);
    1466 + ret = down_interruptible(&isert_np->np_sem);
    1467 if (max_accept > 5)
    1468 return -ENODEV;
    1469
    1470 spin_lock_bh(&np->np_thread_lock);
    1471 if (np->np_thread_state == ISCSI_NP_THREAD_RESET) {
    1472 spin_unlock_bh(&np->np_thread_lock);
    1473 - pr_err("ISCSI_NP_THREAD_RESET for isert_accept_np\n");
    1474 + pr_debug("ISCSI_NP_THREAD_RESET for isert_accept_np\n");
    1475 return -ENODEV;
    1476 }
    1477 spin_unlock_bh(&np->np_thread_lock);
    1478 diff --git a/drivers/infiniband/ulp/isert/ib_isert.h b/drivers/infiniband/ulp/isert/ib_isert.h
    1479 index b9d6cc6917cf..dfe4a2ebef0d 100644
    1480 --- a/drivers/infiniband/ulp/isert/ib_isert.h
    1481 +++ b/drivers/infiniband/ulp/isert/ib_isert.h
    1482 @@ -131,7 +131,7 @@ struct isert_device {
    1483 };
    1484
    1485 struct isert_np {
    1486 - wait_queue_head_t np_accept_wq;
    1487 + struct semaphore np_sem;
    1488 struct rdma_cm_id *np_cm_id;
    1489 struct mutex np_accept_mutex;
    1490 struct list_head np_accept_list;
    1491 diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
    1492 index 2626773ff29b..2dd1d0dd4f7d 100644
    1493 --- a/drivers/input/keyboard/atkbd.c
    1494 +++ b/drivers/input/keyboard/atkbd.c
    1495 @@ -243,6 +243,12 @@ static void (*atkbd_platform_fixup)(struct atkbd *, const void *data);
    1496 static void *atkbd_platform_fixup_data;
    1497 static unsigned int (*atkbd_platform_scancode_fixup)(struct atkbd *, unsigned int);
    1498
    1499 +/*
    1500 + * Certain keyboards to not like ATKBD_CMD_RESET_DIS and stop responding
    1501 + * to many commands until full reset (ATKBD_CMD_RESET_BAT) is performed.
    1502 + */
    1503 +static bool atkbd_skip_deactivate;
    1504 +
    1505 static ssize_t atkbd_attr_show_helper(struct device *dev, char *buf,
    1506 ssize_t (*handler)(struct atkbd *, char *));
    1507 static ssize_t atkbd_attr_set_helper(struct device *dev, const char *buf, size_t count,
    1508 @@ -768,7 +774,8 @@ static int atkbd_probe(struct atkbd *atkbd)
    1509 * Make sure nothing is coming from the keyboard and disturbs our
    1510 * internal state.
    1511 */
    1512 - atkbd_deactivate(atkbd);
    1513 + if (!atkbd_skip_deactivate)
    1514 + atkbd_deactivate(atkbd);
    1515
    1516 return 0;
    1517 }
    1518 @@ -1638,6 +1645,12 @@ static int __init atkbd_setup_scancode_fixup(const struct dmi_system_id *id)
    1519 return 1;
    1520 }
    1521
    1522 +static int __init atkbd_deactivate_fixup(const struct dmi_system_id *id)
    1523 +{
    1524 + atkbd_skip_deactivate = true;
    1525 + return 1;
    1526 +}
    1527 +
    1528 static const struct dmi_system_id atkbd_dmi_quirk_table[] __initconst = {
    1529 {
    1530 .matches = {
    1531 @@ -1775,6 +1788,20 @@ static const struct dmi_system_id atkbd_dmi_quirk_table[] __initconst = {
    1532 .callback = atkbd_setup_scancode_fixup,
    1533 .driver_data = atkbd_oqo_01plus_scancode_fixup,
    1534 },
    1535 + {
    1536 + .matches = {
    1537 + DMI_MATCH(DMI_SYS_VENDOR, "LG Electronics"),
    1538 + DMI_MATCH(DMI_PRODUCT_NAME, "LW25-B7HV"),
    1539 + },
    1540 + .callback = atkbd_deactivate_fixup,
    1541 + },
    1542 + {
    1543 + .matches = {
    1544 + DMI_MATCH(DMI_SYS_VENDOR, "LG Electronics"),
    1545 + DMI_MATCH(DMI_PRODUCT_NAME, "P1-J273B"),
    1546 + },
    1547 + .callback = atkbd_deactivate_fixup,
    1548 + },
    1549 { }
    1550 };
    1551
    1552 diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
    1553 index 1fb1a7b5a754..76f1d37ac0ff 100644
    1554 --- a/drivers/input/mouse/elantech.c
    1555 +++ b/drivers/input/mouse/elantech.c
    1556 @@ -11,6 +11,7 @@
    1557 */
    1558
    1559 #include <linux/delay.h>
    1560 +#include <linux/dmi.h>
    1561 #include <linux/slab.h>
    1562 #include <linux/module.h>
    1563 #include <linux/input.h>
    1564 @@ -801,7 +802,11 @@ static int elantech_set_absolute_mode(struct psmouse *psmouse)
    1565 break;
    1566
    1567 case 3:
    1568 - etd->reg_10 = 0x0b;
    1569 + if (etd->set_hw_resolution)
    1570 + etd->reg_10 = 0x0b;
    1571 + else
    1572 + etd->reg_10 = 0x03;
    1573 +
    1574 if (elantech_write_reg(psmouse, 0x10, etd->reg_10))
    1575 rc = -1;
    1576
    1577 @@ -1301,6 +1306,22 @@ static int elantech_reconnect(struct psmouse *psmouse)
    1578 }
    1579
    1580 /*
    1581 + * Some hw_version 3 models go into error state when we try to set bit 3 of r10
    1582 + */
    1583 +static const struct dmi_system_id no_hw_res_dmi_table[] = {
    1584 +#if defined(CONFIG_DMI) && defined(CONFIG_X86)
    1585 + {
    1586 + /* Gigabyte U2442 */
    1587 + .matches = {
    1588 + DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
    1589 + DMI_MATCH(DMI_PRODUCT_NAME, "U2442"),
    1590 + },
    1591 + },
    1592 +#endif
    1593 + { }
    1594 +};
    1595 +
    1596 +/*
    1597 * determine hardware version and set some properties according to it.
    1598 */
    1599 static int elantech_set_properties(struct elantech_data *etd)
    1600 @@ -1351,6 +1372,9 @@ static int elantech_set_properties(struct elantech_data *etd)
    1601 etd->reports_pressure = true;
    1602 }
    1603
    1604 + /* Enable real hardware resolution on hw_version 3 ? */
    1605 + etd->set_hw_resolution = !dmi_check_system(no_hw_res_dmi_table);
    1606 +
    1607 return 0;
    1608 }
    1609
    1610 diff --git a/drivers/input/mouse/elantech.h b/drivers/input/mouse/elantech.h
    1611 index 46db3be45ac9..c1c15ab6872d 100644
    1612 --- a/drivers/input/mouse/elantech.h
    1613 +++ b/drivers/input/mouse/elantech.h
    1614 @@ -129,6 +129,7 @@ struct elantech_data {
    1615 bool paritycheck;
    1616 bool jumpy_cursor;
    1617 bool reports_pressure;
    1618 + bool set_hw_resolution;
    1619 unsigned char hw_version;
    1620 unsigned int fw_version;
    1621 unsigned int single_finger_reports;
    1622 diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
    1623 index d60c9b7ad1b8..f36f7b88f260 100644
    1624 --- a/drivers/input/mouse/synaptics.c
    1625 +++ b/drivers/input/mouse/synaptics.c
    1626 @@ -1552,7 +1552,7 @@ static const struct dmi_system_id min_max_dmi_table[] __initconst = {
    1627 DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
    1628 DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T540"),
    1629 },
    1630 - .driver_data = (int []){1024, 5056, 2058, 4832},
    1631 + .driver_data = (int []){1024, 5112, 2024, 4832},
    1632 },
    1633 {
    1634 /* Lenovo ThinkPad L540 */
    1635 @@ -1563,6 +1563,14 @@ static const struct dmi_system_id min_max_dmi_table[] __initconst = {
    1636 .driver_data = (int []){1024, 5112, 2024, 4832},
    1637 },
    1638 {
    1639 + /* Lenovo ThinkPad W540 */
    1640 + .matches = {
    1641 + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
    1642 + DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad W540"),
    1643 + },
    1644 + .driver_data = (int []){1024, 5112, 2024, 4832},
    1645 + },
    1646 + {
    1647 /* Lenovo Yoga S1 */
    1648 .matches = {
    1649 DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
    1650 diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
    1651 index a3c338942f10..6f849cbcac6f 100644
    1652 --- a/drivers/iommu/amd_iommu.c
    1653 +++ b/drivers/iommu/amd_iommu.c
    1654 @@ -3959,7 +3959,7 @@ static struct irq_remap_table *get_irq_table(u16 devid, bool ioapic)
    1655 iommu_flush_dte(iommu, devid);
    1656 if (devid != alias) {
    1657 irq_lookup_table[alias] = table;
    1658 - set_dte_irq_entry(devid, table);
    1659 + set_dte_irq_entry(alias, table);
    1660 iommu_flush_dte(iommu, alias);
    1661 }
    1662
    1663 diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
    1664 index 19ceaa60e0f4..4e11218d644e 100644
    1665 --- a/drivers/irqchip/irq-gic.c
    1666 +++ b/drivers/irqchip/irq-gic.c
    1667 @@ -246,10 +246,14 @@ static int gic_set_affinity(struct irq_data *d, const struct cpumask *mask_val,
    1668 bool force)
    1669 {
    1670 void __iomem *reg = gic_dist_base(d) + GIC_DIST_TARGET + (gic_irq(d) & ~3);
    1671 - unsigned int shift = (gic_irq(d) % 4) * 8;
    1672 - unsigned int cpu = cpumask_any_and(mask_val, cpu_online_mask);
    1673 + unsigned int cpu, shift = (gic_irq(d) % 4) * 8;
    1674 u32 val, mask, bit;
    1675
    1676 + if (!force)
    1677 + cpu = cpumask_any_and(mask_val, cpu_online_mask);
    1678 + else
    1679 + cpu = cpumask_first(mask_val);
    1680 +
    1681 if (cpu >= NR_GIC_CPU_IF || cpu >= nr_cpu_ids)
    1682 return -EINVAL;
    1683
    1684 diff --git a/drivers/leds/leds-pwm.c b/drivers/leds/leds-pwm.c
    1685 index faf52c005e8c..5d64b2431415 100644
    1686 --- a/drivers/leds/leds-pwm.c
    1687 +++ b/drivers/leds/leds-pwm.c
    1688 @@ -82,6 +82,15 @@ static inline size_t sizeof_pwm_leds_priv(int num_leds)
    1689 (sizeof(struct led_pwm_data) * num_leds);
    1690 }
    1691
    1692 +static void led_pwm_cleanup(struct led_pwm_priv *priv)
    1693 +{
    1694 + while (priv->num_leds--) {
    1695 + led_classdev_unregister(&priv->leds[priv->num_leds].cdev);
    1696 + if (priv->leds[priv->num_leds].can_sleep)
    1697 + cancel_work_sync(&priv->leds[priv->num_leds].work);
    1698 + }
    1699 +}
    1700 +
    1701 static struct led_pwm_priv *led_pwm_create_of(struct platform_device *pdev)
    1702 {
    1703 struct device_node *node = pdev->dev.of_node;
    1704 @@ -139,8 +148,7 @@ static struct led_pwm_priv *led_pwm_create_of(struct platform_device *pdev)
    1705
    1706 return priv;
    1707 err:
    1708 - while (priv->num_leds--)
    1709 - led_classdev_unregister(&priv->leds[priv->num_leds].cdev);
    1710 + led_pwm_cleanup(priv);
    1711
    1712 return NULL;
    1713 }
    1714 @@ -200,8 +208,8 @@ static int led_pwm_probe(struct platform_device *pdev)
    1715 return 0;
    1716
    1717 err:
    1718 - while (i--)
    1719 - led_classdev_unregister(&priv->leds[i].cdev);
    1720 + priv->num_leds = i;
    1721 + led_pwm_cleanup(priv);
    1722
    1723 return ret;
    1724 }
    1725 @@ -209,13 +217,8 @@ err:
    1726 static int led_pwm_remove(struct platform_device *pdev)
    1727 {
    1728 struct led_pwm_priv *priv = platform_get_drvdata(pdev);
    1729 - int i;
    1730
    1731 - for (i = 0; i < priv->num_leds; i++) {
    1732 - led_classdev_unregister(&priv->leds[i].cdev);
    1733 - if (priv->leds[i].can_sleep)
    1734 - cancel_work_sync(&priv->leds[i].work);
    1735 - }
    1736 + led_pwm_cleanup(priv);
    1737
    1738 return 0;
    1739 }
    1740 diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
    1741 index 6d2d41ae9e32..5177ba54559b 100644
    1742 --- a/drivers/md/dm-crypt.c
    1743 +++ b/drivers/md/dm-crypt.c
    1744 @@ -18,7 +18,6 @@
    1745 #include <linux/crypto.h>
    1746 #include <linux/workqueue.h>
    1747 #include <linux/backing-dev.h>
    1748 -#include <linux/percpu.h>
    1749 #include <linux/atomic.h>
    1750 #include <linux/scatterlist.h>
    1751 #include <asm/page.h>
    1752 @@ -44,6 +43,7 @@ struct convert_context {
    1753 unsigned int idx_out;
    1754 sector_t cc_sector;
    1755 atomic_t cc_pending;
    1756 + struct ablkcipher_request *req;
    1757 };
    1758
    1759 /*
    1760 @@ -105,15 +105,7 @@ struct iv_lmk_private {
    1761 enum flags { DM_CRYPT_SUSPENDED, DM_CRYPT_KEY_VALID };
    1762
    1763 /*
    1764 - * Duplicated per-CPU state for cipher.
    1765 - */
    1766 -struct crypt_cpu {
    1767 - struct ablkcipher_request *req;
    1768 -};
    1769 -
    1770 -/*
    1771 - * The fields in here must be read only after initialization,
    1772 - * changing state should be in crypt_cpu.
    1773 + * The fields in here must be read only after initialization.
    1774 */
    1775 struct crypt_config {
    1776 struct dm_dev *dev;
    1777 @@ -143,12 +135,6 @@ struct crypt_config {
    1778 sector_t iv_offset;
    1779 unsigned int iv_size;
    1780
    1781 - /*
    1782 - * Duplicated per cpu state. Access through
    1783 - * per_cpu_ptr() only.
    1784 - */
    1785 - struct crypt_cpu __percpu *cpu;
    1786 -
    1787 /* ESSIV: struct crypto_cipher *essiv_tfm */
    1788 void *iv_private;
    1789 struct crypto_ablkcipher **tfms;
    1790 @@ -184,11 +170,6 @@ static void clone_init(struct dm_crypt_io *, struct bio *);
    1791 static void kcryptd_queue_crypt(struct dm_crypt_io *io);
    1792 static u8 *iv_of_dmreq(struct crypt_config *cc, struct dm_crypt_request *dmreq);
    1793
    1794 -static struct crypt_cpu *this_crypt_config(struct crypt_config *cc)
    1795 -{
    1796 - return this_cpu_ptr(cc->cpu);
    1797 -}
    1798 -
    1799 /*
    1800 * Use this to access cipher attributes that are the same for each CPU.
    1801 */
    1802 @@ -738,16 +719,15 @@ static void kcryptd_async_done(struct crypto_async_request *async_req,
    1803 static void crypt_alloc_req(struct crypt_config *cc,
    1804 struct convert_context *ctx)
    1805 {
    1806 - struct crypt_cpu *this_cc = this_crypt_config(cc);
    1807 unsigned key_index = ctx->cc_sector & (cc->tfms_count - 1);
    1808
    1809 - if (!this_cc->req)
    1810 - this_cc->req = mempool_alloc(cc->req_pool, GFP_NOIO);
    1811 + if (!ctx->req)
    1812 + ctx->req = mempool_alloc(cc->req_pool, GFP_NOIO);
    1813
    1814 - ablkcipher_request_set_tfm(this_cc->req, cc->tfms[key_index]);
    1815 - ablkcipher_request_set_callback(this_cc->req,
    1816 + ablkcipher_request_set_tfm(ctx->req, cc->tfms[key_index]);
    1817 + ablkcipher_request_set_callback(ctx->req,
    1818 CRYPTO_TFM_REQ_MAY_BACKLOG | CRYPTO_TFM_REQ_MAY_SLEEP,
    1819 - kcryptd_async_done, dmreq_of_req(cc, this_cc->req));
    1820 + kcryptd_async_done, dmreq_of_req(cc, ctx->req));
    1821 }
    1822
    1823 /*
    1824 @@ -756,7 +736,6 @@ static void crypt_alloc_req(struct crypt_config *cc,
    1825 static int crypt_convert(struct crypt_config *cc,
    1826 struct convert_context *ctx)
    1827 {
    1828 - struct crypt_cpu *this_cc = this_crypt_config(cc);
    1829 int r;
    1830
    1831 atomic_set(&ctx->cc_pending, 1);
    1832 @@ -768,7 +747,7 @@ static int crypt_convert(struct crypt_config *cc,
    1833
    1834 atomic_inc(&ctx->cc_pending);
    1835
    1836 - r = crypt_convert_block(cc, ctx, this_cc->req);
    1837 + r = crypt_convert_block(cc, ctx, ctx->req);
    1838
    1839 switch (r) {
    1840 /* async */
    1841 @@ -777,7 +756,7 @@ static int crypt_convert(struct crypt_config *cc,
    1842 INIT_COMPLETION(ctx->restart);
    1843 /* fall through*/
    1844 case -EINPROGRESS:
    1845 - this_cc->req = NULL;
    1846 + ctx->req = NULL;
    1847 ctx->cc_sector++;
    1848 continue;
    1849
    1850 @@ -876,6 +855,7 @@ static struct dm_crypt_io *crypt_io_alloc(struct crypt_config *cc,
    1851 io->sector = sector;
    1852 io->error = 0;
    1853 io->base_io = NULL;
    1854 + io->ctx.req = NULL;
    1855 atomic_set(&io->io_pending, 0);
    1856
    1857 return io;
    1858 @@ -901,6 +881,8 @@ static void crypt_dec_pending(struct dm_crypt_io *io)
    1859 if (!atomic_dec_and_test(&io->io_pending))
    1860 return;
    1861
    1862 + if (io->ctx.req)
    1863 + mempool_free(io->ctx.req, cc->req_pool);
    1864 mempool_free(io, cc->io_pool);
    1865
    1866 if (likely(!base_io))
    1867 @@ -1326,8 +1308,6 @@ static int crypt_wipe_key(struct crypt_config *cc)
    1868 static void crypt_dtr(struct dm_target *ti)
    1869 {
    1870 struct crypt_config *cc = ti->private;
    1871 - struct crypt_cpu *cpu_cc;
    1872 - int cpu;
    1873
    1874 ti->private = NULL;
    1875
    1876 @@ -1339,13 +1319,6 @@ static void crypt_dtr(struct dm_target *ti)
    1877 if (cc->crypt_queue)
    1878 destroy_workqueue(cc->crypt_queue);
    1879
    1880 - if (cc->cpu)
    1881 - for_each_possible_cpu(cpu) {
    1882 - cpu_cc = per_cpu_ptr(cc->cpu, cpu);
    1883 - if (cpu_cc->req)
    1884 - mempool_free(cpu_cc->req, cc->req_pool);
    1885 - }
    1886 -
    1887 crypt_free_tfms(cc);
    1888
    1889 if (cc->bs)
    1890 @@ -1364,9 +1337,6 @@ static void crypt_dtr(struct dm_target *ti)
    1891 if (cc->dev)
    1892 dm_put_device(ti, cc->dev);
    1893
    1894 - if (cc->cpu)
    1895 - free_percpu(cc->cpu);
    1896 -
    1897 kzfree(cc->cipher);
    1898 kzfree(cc->cipher_string);
    1899
    1900 @@ -1421,13 +1391,6 @@ static int crypt_ctr_cipher(struct dm_target *ti,
    1901 if (tmp)
    1902 DMWARN("Ignoring unexpected additional cipher options");
    1903
    1904 - cc->cpu = __alloc_percpu(sizeof(*(cc->cpu)),
    1905 - __alignof__(struct crypt_cpu));
    1906 - if (!cc->cpu) {
    1907 - ti->error = "Cannot allocate per cpu state";
    1908 - goto bad_mem;
    1909 - }
    1910 -
    1911 /*
    1912 * For compatibility with the original dm-crypt mapping format, if
    1913 * only the cipher name is supplied, use cbc-plain.
    1914 diff --git a/drivers/md/md.c b/drivers/md/md.c
    1915 index a2dda416c9cb..00a99fe797d4 100644
    1916 --- a/drivers/md/md.c
    1917 +++ b/drivers/md/md.c
    1918 @@ -8481,7 +8481,8 @@ static int md_notify_reboot(struct notifier_block *this,
    1919 if (mddev_trylock(mddev)) {
    1920 if (mddev->pers)
    1921 __md_stop_writes(mddev);
    1922 - mddev->safemode = 2;
    1923 + if (mddev->persistent)
    1924 + mddev->safemode = 2;
    1925 mddev_unlock(mddev);
    1926 }
    1927 need_delay = 1;
    1928 diff --git a/drivers/media/i2c/ov7670.c b/drivers/media/i2c/ov7670.c
    1929 index 617ad3fff4aa..3ead3a83f04a 100644
    1930 --- a/drivers/media/i2c/ov7670.c
    1931 +++ b/drivers/media/i2c/ov7670.c
    1932 @@ -1110,7 +1110,7 @@ static int ov7670_enum_framesizes(struct v4l2_subdev *sd,
    1933 * windows that fall outside that.
    1934 */
    1935 for (i = 0; i < n_win_sizes; i++) {
    1936 - struct ov7670_win_size *win = &info->devtype->win_sizes[index];
    1937 + struct ov7670_win_size *win = &info->devtype->win_sizes[i];
    1938 if (info->min_width && win->width < info->min_width)
    1939 continue;
    1940 if (info->min_height && win->height < info->min_height)
    1941 diff --git a/drivers/media/media-device.c b/drivers/media/media-device.c
    1942 index 1957c0df08fd..79715f9feb0a 100644
    1943 --- a/drivers/media/media-device.c
    1944 +++ b/drivers/media/media-device.c
    1945 @@ -93,6 +93,7 @@ static long media_device_enum_entities(struct media_device *mdev,
    1946 struct media_entity *ent;
    1947 struct media_entity_desc u_ent;
    1948
    1949 + memset(&u_ent, 0, sizeof(u_ent));
    1950 if (copy_from_user(&u_ent.id, &uent->id, sizeof(u_ent.id)))
    1951 return -EFAULT;
    1952
    1953 diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c
    1954 index 1d7dbd5c0fba..3e8ef11f67aa 100644
    1955 --- a/drivers/media/platform/omap3isp/isp.c
    1956 +++ b/drivers/media/platform/omap3isp/isp.c
    1957 @@ -2249,6 +2249,7 @@ static int isp_probe(struct platform_device *pdev)
    1958 ret = iommu_attach_device(isp->domain, &pdev->dev);
    1959 if (ret) {
    1960 dev_err(&pdev->dev, "can't attach iommu device: %d\n", ret);
    1961 + ret = -EPROBE_DEFER;
    1962 goto free_domain;
    1963 }
    1964
    1965 @@ -2287,6 +2288,7 @@ detach_dev:
    1966 iommu_detach_device(isp->domain, &pdev->dev);
    1967 free_domain:
    1968 iommu_domain_free(isp->domain);
    1969 + isp->domain = NULL;
    1970 error_isp:
    1971 isp_xclk_cleanup(isp);
    1972 omap3isp_put(isp);
    1973 diff --git a/drivers/media/tuners/fc2580.c b/drivers/media/tuners/fc2580.c
    1974 index 3aecaf465094..f0c9c42867de 100644
    1975 --- a/drivers/media/tuners/fc2580.c
    1976 +++ b/drivers/media/tuners/fc2580.c
    1977 @@ -195,7 +195,7 @@ static int fc2580_set_params(struct dvb_frontend *fe)
    1978
    1979 f_ref = 2UL * priv->cfg->clock / r_val;
    1980 n_val = div_u64_rem(f_vco, f_ref, &k_val);
    1981 - k_val_reg = 1UL * k_val * (1 << 20) / f_ref;
    1982 + k_val_reg = div_u64(1ULL * k_val * (1 << 20), f_ref);
    1983
    1984 ret = fc2580_wr_reg(priv, 0x18, r18_val | ((k_val_reg >> 16) & 0xff));
    1985 if (ret < 0)
    1986 @@ -348,8 +348,8 @@ static int fc2580_set_params(struct dvb_frontend *fe)
    1987 if (ret < 0)
    1988 goto err;
    1989
    1990 - ret = fc2580_wr_reg(priv, 0x37, 1UL * priv->cfg->clock * \
    1991 - fc2580_if_filter_lut[i].mul / 1000000000);
    1992 + ret = fc2580_wr_reg(priv, 0x37, div_u64(1ULL * priv->cfg->clock *
    1993 + fc2580_if_filter_lut[i].mul, 1000000000));
    1994 if (ret < 0)
    1995 goto err;
    1996
    1997 diff --git a/drivers/media/tuners/fc2580_priv.h b/drivers/media/tuners/fc2580_priv.h
    1998 index be38a9e637e0..646c99452136 100644
    1999 --- a/drivers/media/tuners/fc2580_priv.h
    2000 +++ b/drivers/media/tuners/fc2580_priv.h
    2001 @@ -22,6 +22,7 @@
    2002 #define FC2580_PRIV_H
    2003
    2004 #include "fc2580.h"
    2005 +#include <linux/math64.h>
    2006
    2007 struct fc2580_reg_val {
    2008 u8 reg;
    2009 diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
    2010 index f56b729581e7..e2b0a0969ebb 100644
    2011 --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
    2012 +++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
    2013 @@ -178,6 +178,9 @@ struct v4l2_create_buffers32 {
    2014
    2015 static int __get_v4l2_format32(struct v4l2_format *kp, struct v4l2_format32 __user *up)
    2016 {
    2017 + if (get_user(kp->type, &up->type))
    2018 + return -EFAULT;
    2019 +
    2020 switch (kp->type) {
    2021 case V4L2_BUF_TYPE_VIDEO_CAPTURE:
    2022 case V4L2_BUF_TYPE_VIDEO_OUTPUT:
    2023 @@ -204,17 +207,16 @@ static int __get_v4l2_format32(struct v4l2_format *kp, struct v4l2_format32 __us
    2024
    2025 static int get_v4l2_format32(struct v4l2_format *kp, struct v4l2_format32 __user *up)
    2026 {
    2027 - if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_format32)) ||
    2028 - get_user(kp->type, &up->type))
    2029 - return -EFAULT;
    2030 + if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_format32)))
    2031 + return -EFAULT;
    2032 return __get_v4l2_format32(kp, up);
    2033 }
    2034
    2035 static int get_v4l2_create32(struct v4l2_create_buffers *kp, struct v4l2_create_buffers32 __user *up)
    2036 {
    2037 if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_create_buffers32)) ||
    2038 - copy_from_user(kp, up, offsetof(struct v4l2_create_buffers32, format.fmt)))
    2039 - return -EFAULT;
    2040 + copy_from_user(kp, up, offsetof(struct v4l2_create_buffers32, format)))
    2041 + return -EFAULT;
    2042 return __get_v4l2_format32(&kp->format, &up->format);
    2043 }
    2044
    2045 diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
    2046 index e752f5d4995d..0c9b2f1c6939 100644
    2047 --- a/drivers/net/wireless/ath/ath9k/xmit.c
    2048 +++ b/drivers/net/wireless/ath/ath9k/xmit.c
    2049 @@ -1255,14 +1255,16 @@ void ath_tx_aggr_sleep(struct ieee80211_sta *sta, struct ath_softc *sc,
    2050 for (tidno = 0, tid = &an->tid[tidno];
    2051 tidno < IEEE80211_NUM_TIDS; tidno++, tid++) {
    2052
    2053 - if (!tid->sched)
    2054 - continue;
    2055 -
    2056 ac = tid->ac;
    2057 txq = ac->txq;
    2058
    2059 ath_txq_lock(sc, txq);
    2060
    2061 + if (!tid->sched) {
    2062 + ath_txq_unlock(sc, txq);
    2063 + continue;
    2064 + }
    2065 +
    2066 buffered = !skb_queue_empty(&tid->buf_q);
    2067
    2068 tid->sched = false;
    2069 diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
    2070 index 3a6544710c8a..8e8543cfe489 100644
    2071 --- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
    2072 +++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
    2073 @@ -426,6 +426,12 @@ static int brcms_ops_start(struct ieee80211_hw *hw)
    2074 bool blocked;
    2075 int err;
    2076
    2077 + if (!wl->ucode.bcm43xx_bomminor) {
    2078 + err = brcms_request_fw(wl, wl->wlc->hw->d11core);
    2079 + if (err)
    2080 + return -ENOENT;
    2081 + }
    2082 +
    2083 ieee80211_wake_queues(hw);
    2084 spin_lock_bh(&wl->lock);
    2085 blocked = brcms_rfkill_set_hw_state(wl);
    2086 @@ -433,14 +439,6 @@ static int brcms_ops_start(struct ieee80211_hw *hw)
    2087 if (!blocked)
    2088 wiphy_rfkill_stop_polling(wl->pub->ieee_hw->wiphy);
    2089
    2090 - if (!wl->ucode.bcm43xx_bomminor) {
    2091 - err = brcms_request_fw(wl, wl->wlc->hw->d11core);
    2092 - if (err) {
    2093 - brcms_remove(wl->wlc->hw->d11core);
    2094 - return -ENOENT;
    2095 - }
    2096 - }
    2097 -
    2098 spin_lock_bh(&wl->lock);
    2099 /* avoid acknowledging frames before a non-monitor device is added */
    2100 wl->mute_tx = true;
    2101 diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
    2102 index f8cff1f0b6b7..2b724fc4e306 100644
    2103 --- a/drivers/net/wireless/rt2x00/rt2x00mac.c
    2104 +++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
    2105 @@ -623,20 +623,18 @@ void rt2x00mac_bss_info_changed(struct ieee80211_hw *hw,
    2106 bss_conf->bssid);
    2107
    2108 /*
    2109 - * Update the beacon. This is only required on USB devices. PCI
    2110 - * devices fetch beacons periodically.
    2111 - */
    2112 - if (changes & BSS_CHANGED_BEACON && rt2x00_is_usb(rt2x00dev))
    2113 - rt2x00queue_update_beacon(rt2x00dev, vif);
    2114 -
    2115 - /*
    2116 * Start/stop beaconing.
    2117 */
    2118 if (changes & BSS_CHANGED_BEACON_ENABLED) {
    2119 if (!bss_conf->enable_beacon && intf->enable_beacon) {
    2120 - rt2x00queue_clear_beacon(rt2x00dev, vif);
    2121 rt2x00dev->intf_beaconing--;
    2122 intf->enable_beacon = false;
    2123 + /*
    2124 + * Clear beacon in the H/W for this vif. This is needed
    2125 + * to disable beaconing on this particular interface
    2126 + * and keep it running on other interfaces.
    2127 + */
    2128 + rt2x00queue_clear_beacon(rt2x00dev, vif);
    2129
    2130 if (rt2x00dev->intf_beaconing == 0) {
    2131 /*
    2132 @@ -647,11 +645,15 @@ void rt2x00mac_bss_info_changed(struct ieee80211_hw *hw,
    2133 rt2x00queue_stop_queue(rt2x00dev->bcn);
    2134 mutex_unlock(&intf->beacon_skb_mutex);
    2135 }
    2136 -
    2137 -
    2138 } else if (bss_conf->enable_beacon && !intf->enable_beacon) {
    2139 rt2x00dev->intf_beaconing++;
    2140 intf->enable_beacon = true;
    2141 + /*
    2142 + * Upload beacon to the H/W. This is only required on
    2143 + * USB devices. PCI devices fetch beacons periodically.
    2144 + */
    2145 + if (rt2x00_is_usb(rt2x00dev))
    2146 + rt2x00queue_update_beacon(rt2x00dev, vif);
    2147
    2148 if (rt2x00dev->intf_beaconing == 1) {
    2149 /*
    2150 diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
    2151 index 324aa581938e..c3f2b55501ae 100644
    2152 --- a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
    2153 +++ b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
    2154 @@ -1001,7 +1001,7 @@ int rtl92cu_hw_init(struct ieee80211_hw *hw)
    2155 err = _rtl92cu_init_mac(hw);
    2156 if (err) {
    2157 RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "init mac failed!\n");
    2158 - return err;
    2159 + goto exit;
    2160 }
    2161 err = rtl92c_download_fw(hw);
    2162 if (err) {
    2163 diff --git a/drivers/pci/hotplug/shpchp_ctrl.c b/drivers/pci/hotplug/shpchp_ctrl.c
    2164 index 58499277903a..6efc2ec5e4db 100644
    2165 --- a/drivers/pci/hotplug/shpchp_ctrl.c
    2166 +++ b/drivers/pci/hotplug/shpchp_ctrl.c
    2167 @@ -282,8 +282,8 @@ static int board_added(struct slot *p_slot)
    2168 return WRONG_BUS_FREQUENCY;
    2169 }
    2170
    2171 - bsp = ctrl->pci_dev->bus->cur_bus_speed;
    2172 - msp = ctrl->pci_dev->bus->max_bus_speed;
    2173 + bsp = ctrl->pci_dev->subordinate->cur_bus_speed;
    2174 + msp = ctrl->pci_dev->subordinate->max_bus_speed;
    2175
    2176 /* Check if there are other slots or devices on the same bus */
    2177 if (!list_empty(&ctrl->pci_dev->subordinate->devices))
    2178 diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
    2179 index 660b109487ae..8032917b6636 100644
    2180 --- a/drivers/target/target_core_device.c
    2181 +++ b/drivers/target/target_core_device.c
    2182 @@ -796,10 +796,10 @@ int se_dev_set_emulate_write_cache(struct se_device *dev, int flag)
    2183 pr_err("emulate_write_cache not supported for pSCSI\n");
    2184 return -EINVAL;
    2185 }
    2186 - if (dev->transport->get_write_cache) {
    2187 - pr_warn("emulate_write_cache cannot be changed when underlying"
    2188 - " HW reports WriteCacheEnabled, ignoring request\n");
    2189 - return 0;
    2190 + if (flag &&
    2191 + dev->transport->get_write_cache) {
    2192 + pr_err("emulate_write_cache not supported for this device\n");
    2193 + return -EINVAL;
    2194 }
    2195
    2196 dev->dev_attrib.emulate_write_cache = flag;
    2197 diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
    2198 index b167665b7de2..d8c06a3d391e 100644
    2199 --- a/drivers/tty/serial/8250/8250_core.c
    2200 +++ b/drivers/tty/serial/8250/8250_core.c
    2201 @@ -1520,7 +1520,7 @@ int serial8250_handle_irq(struct uart_port *port, unsigned int iir)
    2202 status = serial8250_rx_chars(up, status);
    2203 }
    2204 serial8250_modem_status(up);
    2205 - if (status & UART_LSR_THRE)
    2206 + if (!up->dma && (status & UART_LSR_THRE))
    2207 serial8250_tx_chars(up);
    2208
    2209 spin_unlock_irqrestore(&port->lock, flags);
    2210 diff --git a/drivers/tty/serial/8250/8250_dma.c b/drivers/tty/serial/8250/8250_dma.c
    2211 index 7046769608d4..ab9096dc3849 100644
    2212 --- a/drivers/tty/serial/8250/8250_dma.c
    2213 +++ b/drivers/tty/serial/8250/8250_dma.c
    2214 @@ -20,12 +20,15 @@ static void __dma_tx_complete(void *param)
    2215 struct uart_8250_port *p = param;
    2216 struct uart_8250_dma *dma = p->dma;
    2217 struct circ_buf *xmit = &p->port.state->xmit;
    2218 -
    2219 - dma->tx_running = 0;
    2220 + unsigned long flags;
    2221
    2222 dma_sync_single_for_cpu(dma->txchan->device->dev, dma->tx_addr,
    2223 UART_XMIT_SIZE, DMA_TO_DEVICE);
    2224
    2225 + spin_lock_irqsave(&p->port.lock, flags);
    2226 +
    2227 + dma->tx_running = 0;
    2228 +
    2229 xmit->tail += dma->tx_size;
    2230 xmit->tail &= UART_XMIT_SIZE - 1;
    2231 p->port.icount.tx += dma->tx_size;
    2232 @@ -35,6 +38,8 @@ static void __dma_tx_complete(void *param)
    2233
    2234 if (!uart_circ_empty(xmit) && !uart_tx_stopped(&p->port))
    2235 serial8250_tx_dma(p);
    2236 +
    2237 + spin_unlock_irqrestore(&p->port.lock, flags);
    2238 }
    2239
    2240 static void __dma_rx_complete(void *param)
    2241 diff --git a/drivers/usb/gadget/at91_udc.c b/drivers/usb/gadget/at91_udc.c
    2242 index 073b938f9135..55e96131753e 100644
    2243 --- a/drivers/usb/gadget/at91_udc.c
    2244 +++ b/drivers/usb/gadget/at91_udc.c
    2245 @@ -1703,16 +1703,6 @@ static int at91udc_probe(struct platform_device *pdev)
    2246 return -ENODEV;
    2247 }
    2248
    2249 - if (pdev->num_resources != 2) {
    2250 - DBG("invalid num_resources\n");
    2251 - return -ENODEV;
    2252 - }
    2253 - if ((pdev->resource[0].flags != IORESOURCE_MEM)
    2254 - || (pdev->resource[1].flags != IORESOURCE_IRQ)) {
    2255 - DBG("invalid resource type\n");
    2256 - return -ENODEV;
    2257 - }
    2258 -
    2259 res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
    2260 if (!res)
    2261 return -ENXIO;
    2262 diff --git a/drivers/usb/host/ehci-fsl.c b/drivers/usb/host/ehci-fsl.c
    2263 index 3c0a49a298dd..bfcf38383f74 100644
    2264 --- a/drivers/usb/host/ehci-fsl.c
    2265 +++ b/drivers/usb/host/ehci-fsl.c
    2266 @@ -261,7 +261,8 @@ static int ehci_fsl_setup_phy(struct usb_hcd *hcd,
    2267 break;
    2268 }
    2269
    2270 - if (pdata->have_sysif_regs && pdata->controller_ver &&
    2271 + if (pdata->have_sysif_regs &&
    2272 + pdata->controller_ver > FSL_USB_VER_1_6 &&
    2273 (phy_mode == FSL_USB2_PHY_ULPI)) {
    2274 /* check PHY_CLK_VALID to get phy clk valid */
    2275 if (!spin_event_timeout(in_be32(non_ehci + FSL_SOC_USB_CTRL) &
    2276 diff --git a/drivers/usb/host/ohci-hub.c b/drivers/usb/host/ohci-hub.c
    2277 index 60ff4220e8b4..cd908066fde9 100644
    2278 --- a/drivers/usb/host/ohci-hub.c
    2279 +++ b/drivers/usb/host/ohci-hub.c
    2280 @@ -90,6 +90,24 @@ __acquires(ohci->lock)
    2281 dl_done_list (ohci);
    2282 finish_unlinks (ohci, ohci_frame_no(ohci));
    2283
    2284 + /*
    2285 + * Some controllers don't handle "global" suspend properly if
    2286 + * there are unsuspended ports. For these controllers, put all
    2287 + * the enabled ports into suspend before suspending the root hub.
    2288 + */
    2289 + if (ohci->flags & OHCI_QUIRK_GLOBAL_SUSPEND) {
    2290 + __hc32 __iomem *portstat = ohci->regs->roothub.portstatus;
    2291 + int i;
    2292 + unsigned temp;
    2293 +
    2294 + for (i = 0; i < ohci->num_ports; (++i, ++portstat)) {
    2295 + temp = ohci_readl(ohci, portstat);
    2296 + if ((temp & (RH_PS_PES | RH_PS_PSS)) ==
    2297 + RH_PS_PES)
    2298 + ohci_writel(ohci, RH_PS_PSS, portstat);
    2299 + }
    2300 + }
    2301 +
    2302 /* maybe resume can wake root hub */
    2303 if (ohci_to_hcd(ohci)->self.root_hub->do_remote_wakeup || autostop) {
    2304 ohci->hc_control |= OHCI_CTRL_RWE;
    2305 diff --git a/drivers/usb/host/ohci-pci.c b/drivers/usb/host/ohci-pci.c
    2306 index ef6782bd1fa9..67af8eef6537 100644
    2307 --- a/drivers/usb/host/ohci-pci.c
    2308 +++ b/drivers/usb/host/ohci-pci.c
    2309 @@ -172,6 +172,7 @@ static int ohci_quirk_amd700(struct usb_hcd *hcd)
    2310 pci_dev_put(amd_smbus_dev);
    2311 amd_smbus_dev = NULL;
    2312
    2313 + ohci->flags |= OHCI_QUIRK_GLOBAL_SUSPEND;
    2314 return 0;
    2315 }
    2316
    2317 diff --git a/drivers/usb/host/ohci.h b/drivers/usb/host/ohci.h
    2318 index d3299143d9e2..f2521f3185d2 100644
    2319 --- a/drivers/usb/host/ohci.h
    2320 +++ b/drivers/usb/host/ohci.h
    2321 @@ -405,6 +405,8 @@ struct ohci_hcd {
    2322 #define OHCI_QUIRK_HUB_POWER 0x100 /* distrust firmware power/oc setup */
    2323 #define OHCI_QUIRK_AMD_PLL 0x200 /* AMD PLL quirk*/
    2324 #define OHCI_QUIRK_AMD_PREFETCH 0x400 /* pre-fetch for ISO transfer */
    2325 +#define OHCI_QUIRK_GLOBAL_SUSPEND 0x800 /* must suspend ports */
    2326 +
    2327 // there are also chip quirks/bugs in init logic
    2328
    2329 struct work_struct nec_work; /* Worker for NEC quirk */
    2330 diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
    2331 index 7ed681a714a5..6c0a542e8ec1 100644
    2332 --- a/drivers/usb/serial/qcserial.c
    2333 +++ b/drivers/usb/serial/qcserial.c
    2334 @@ -151,6 +151,21 @@ static const struct usb_device_id id_table[] = {
    2335 {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9051, 0)}, /* Netgear AirCard 340U Device Management */
    2336 {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9051, 2)}, /* Netgear AirCard 340U NMEA */
    2337 {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9051, 3)}, /* Netgear AirCard 340U Modem */
    2338 + {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a2, 0)}, /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card Device Management */
    2339 + {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a2, 2)}, /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card NMEA */
    2340 + {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a2, 3)}, /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card Modem */
    2341 + {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a3, 0)}, /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card Device Management */
    2342 + {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a3, 2)}, /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card NMEA */
    2343 + {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a3, 3)}, /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card Modem */
    2344 + {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a4, 0)}, /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card Device Management */
    2345 + {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a4, 2)}, /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card NMEA */
    2346 + {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a4, 3)}, /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card Modem */
    2347 + {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a8, 0)}, /* Dell Wireless 5808 Gobi(TM) 4G LTE Mobile Broadband Card Device Management */
    2348 + {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a8, 2)}, /* Dell Wireless 5808 Gobi(TM) 4G LTE Mobile Broadband Card NMEA */
    2349 + {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a8, 3)}, /* Dell Wireless 5808 Gobi(TM) 4G LTE Mobile Broadband Card Modem */
    2350 + {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a9, 0)}, /* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card Device Management */
    2351 + {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a9, 2)}, /* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card NMEA */
    2352 + {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a9, 3)}, /* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card Modem */
    2353
    2354 { } /* Terminating entry */
    2355 };
    2356 diff --git a/drivers/usb/storage/shuttle_usbat.c b/drivers/usb/storage/shuttle_usbat.c
    2357 index 4ef2a80728f7..008d805c3d21 100644
    2358 --- a/drivers/usb/storage/shuttle_usbat.c
    2359 +++ b/drivers/usb/storage/shuttle_usbat.c
    2360 @@ -1851,7 +1851,7 @@ static int usbat_probe(struct usb_interface *intf,
    2361 us->transport_name = "Shuttle USBAT";
    2362 us->transport = usbat_flash_transport;
    2363 us->transport_reset = usb_stor_CB_reset;
    2364 - us->max_lun = 1;
    2365 + us->max_lun = 0;
    2366
    2367 result = usb_stor_probe2(us);
    2368 return result;
    2369 diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
    2370 index adbeb255616a..042c83b01046 100644
    2371 --- a/drivers/usb/storage/unusual_devs.h
    2372 +++ b/drivers/usb/storage/unusual_devs.h
    2373 @@ -234,6 +234,20 @@ UNUSUAL_DEV( 0x0421, 0x0495, 0x0370, 0x0370,
    2374 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
    2375 US_FL_MAX_SECTORS_64 ),
    2376
    2377 +/* Reported by Daniele Forsi <dforsi@gmail.com> */
    2378 +UNUSUAL_DEV( 0x0421, 0x04b9, 0x0350, 0x0350,
    2379 + "Nokia",
    2380 + "5300",
    2381 + USB_SC_DEVICE, USB_PR_DEVICE, NULL,
    2382 + US_FL_MAX_SECTORS_64 ),
    2383 +
    2384 +/* Patch submitted by Victor A. Santos <victoraur.santos@gmail.com> */
    2385 +UNUSUAL_DEV( 0x0421, 0x05af, 0x0742, 0x0742,
    2386 + "Nokia",
    2387 + "305",
    2388 + USB_SC_DEVICE, USB_PR_DEVICE, NULL,
    2389 + US_FL_MAX_SECTORS_64),
    2390 +
    2391 /* Patch submitted by Mikhail Zolotaryov <lebon@lebon.org.ua> */
    2392 UNUSUAL_DEV( 0x0421, 0x06aa, 0x1110, 0x1110,
    2393 "Nokia",
    2394 diff --git a/fs/exec.c b/fs/exec.c
    2395 index bb60cda5ee30..dd6aa61c8548 100644
    2396 --- a/fs/exec.c
    2397 +++ b/fs/exec.c
    2398 @@ -654,10 +654,10 @@ int setup_arg_pages(struct linux_binprm *bprm,
    2399 unsigned long rlim_stack;
    2400
    2401 #ifdef CONFIG_STACK_GROWSUP
    2402 - /* Limit stack size to 1GB */
    2403 + /* Limit stack size */
    2404 stack_base = rlimit_max(RLIMIT_STACK);
    2405 - if (stack_base > (1 << 30))
    2406 - stack_base = 1 << 30;
    2407 + if (stack_base > STACK_SIZE_MAX)
    2408 + stack_base = STACK_SIZE_MAX;
    2409
    2410 /* Make sure we didn't let the argument array grow too large. */
    2411 if (vma->vm_end - vma->vm_start > stack_base)
    2412 diff --git a/fs/nfsd/nfs4acl.c b/fs/nfsd/nfs4acl.c
    2413 index 8a50b3c18093..e15bcbd5043c 100644
    2414 --- a/fs/nfsd/nfs4acl.c
    2415 +++ b/fs/nfsd/nfs4acl.c
    2416 @@ -385,8 +385,10 @@ sort_pacl(struct posix_acl *pacl)
    2417 * by uid/gid. */
    2418 int i, j;
    2419
    2420 - if (pacl->a_count <= 4)
    2421 - return; /* no users or groups */
    2422 + /* no users or groups */
    2423 + if (!pacl || pacl->a_count <= 4)
    2424 + return;
    2425 +
    2426 i = 1;
    2427 while (pacl->a_entries[i].e_tag == ACL_USER)
    2428 i++;
    2429 @@ -513,13 +515,12 @@ posix_state_to_acl(struct posix_acl_state *state, unsigned int flags)
    2430
    2431 /*
    2432 * ACLs with no ACEs are treated differently in the inheritable
    2433 - * and effective cases: when there are no inheritable ACEs, we
    2434 - * set a zero-length default posix acl:
    2435 + * and effective cases: when there are no inheritable ACEs,
    2436 + * calls ->set_acl with a NULL ACL structure.
    2437 */
    2438 - if (state->empty && (flags & NFS4_ACL_TYPE_DEFAULT)) {
    2439 - pacl = posix_acl_alloc(0, GFP_KERNEL);
    2440 - return pacl ? pacl : ERR_PTR(-ENOMEM);
    2441 - }
    2442 + if (state->empty && (flags & NFS4_ACL_TYPE_DEFAULT))
    2443 + return NULL;
    2444 +
    2445 /*
    2446 * When there are no effective ACEs, the following will end
    2447 * up setting a 3-element effective posix ACL with all
    2448 diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
    2449 index 442509285ca9..ae6a50b7a617 100644
    2450 --- a/fs/nfsd/nfs4state.c
    2451 +++ b/fs/nfsd/nfs4state.c
    2452 @@ -1081,6 +1081,18 @@ static struct nfs4_client *alloc_client(struct xdr_netobj name)
    2453 return NULL;
    2454 }
    2455 clp->cl_name.len = name.len;
    2456 + INIT_LIST_HEAD(&clp->cl_sessions);
    2457 + idr_init(&clp->cl_stateids);
    2458 + atomic_set(&clp->cl_refcount, 0);
    2459 + clp->cl_cb_state = NFSD4_CB_UNKNOWN;
    2460 + INIT_LIST_HEAD(&clp->cl_idhash);
    2461 + INIT_LIST_HEAD(&clp->cl_openowners);
    2462 + INIT_LIST_HEAD(&clp->cl_delegations);
    2463 + INIT_LIST_HEAD(&clp->cl_lru);
    2464 + INIT_LIST_HEAD(&clp->cl_callbacks);
    2465 + INIT_LIST_HEAD(&clp->cl_revoked);
    2466 + spin_lock_init(&clp->cl_lock);
    2467 + rpc_init_wait_queue(&clp->cl_cb_waitq, "Backchannel slot table");
    2468 return clp;
    2469 }
    2470
    2471 @@ -1098,6 +1110,7 @@ free_client(struct nfs4_client *clp)
    2472 WARN_ON_ONCE(atomic_read(&ses->se_ref));
    2473 free_session(ses);
    2474 }
    2475 + rpc_destroy_wait_queue(&clp->cl_cb_waitq);
    2476 free_svc_cred(&clp->cl_cred);
    2477 kfree(clp->cl_name.data);
    2478 idr_destroy(&clp->cl_stateids);
    2479 @@ -1315,7 +1328,6 @@ static struct nfs4_client *create_client(struct xdr_netobj name,
    2480 if (clp == NULL)
    2481 return NULL;
    2482
    2483 - INIT_LIST_HEAD(&clp->cl_sessions);
    2484 ret = copy_cred(&clp->cl_cred, &rqstp->rq_cred);
    2485 if (ret) {
    2486 spin_lock(&nn->client_lock);
    2487 @@ -1323,20 +1335,9 @@ static struct nfs4_client *create_client(struct xdr_netobj name,
    2488 spin_unlock(&nn->client_lock);
    2489 return NULL;
    2490 }
    2491 - idr_init(&clp->cl_stateids);
    2492 - atomic_set(&clp->cl_refcount, 0);
    2493 - clp->cl_cb_state = NFSD4_CB_UNKNOWN;
    2494 - INIT_LIST_HEAD(&clp->cl_idhash);
    2495 - INIT_LIST_HEAD(&clp->cl_openowners);
    2496 - INIT_LIST_HEAD(&clp->cl_delegations);
    2497 - INIT_LIST_HEAD(&clp->cl_lru);
    2498 - INIT_LIST_HEAD(&clp->cl_callbacks);
    2499 - INIT_LIST_HEAD(&clp->cl_revoked);
    2500 - spin_lock_init(&clp->cl_lock);
    2501 nfsd4_init_callback(&clp->cl_cb_null);
    2502 clp->cl_time = get_seconds();
    2503 clear_bit(0, &clp->cl_cb_slot_busy);
    2504 - rpc_init_wait_queue(&clp->cl_cb_waitq, "Backchannel slot table");
    2505 copy_verf(clp, verf);
    2506 rpc_copy_addr((struct sockaddr *) &clp->cl_addr, sa);
    2507 gen_confirm(clp);
    2508 @@ -3598,9 +3599,16 @@ out:
    2509 static __be32
    2510 nfsd4_free_lock_stateid(struct nfs4_ol_stateid *stp)
    2511 {
    2512 - if (check_for_locks(stp->st_file, lockowner(stp->st_stateowner)))
    2513 + struct nfs4_lockowner *lo = lockowner(stp->st_stateowner);
    2514 +
    2515 + if (check_for_locks(stp->st_file, lo))
    2516 return nfserr_locks_held;
    2517 - release_lock_stateid(stp);
    2518 + /*
    2519 + * Currently there's a 1-1 lock stateid<->lockowner
    2520 + * correspondance, and we have to delete the lockowner when we
    2521 + * delete the lock stateid:
    2522 + */
    2523 + unhash_lockowner(lo);
    2524 return nfs_ok;
    2525 }
    2526
    2527 @@ -4044,6 +4052,10 @@ static bool same_lockowner_ino(struct nfs4_lockowner *lo, struct inode *inode, c
    2528
    2529 if (!same_owner_str(&lo->lo_owner, owner, clid))
    2530 return false;
    2531 + if (list_empty(&lo->lo_owner.so_stateids)) {
    2532 + WARN_ON_ONCE(1);
    2533 + return false;
    2534 + }
    2535 lst = list_first_entry(&lo->lo_owner.so_stateids,
    2536 struct nfs4_ol_stateid, st_perstateowner);
    2537 return lst->st_file->fi_inode == inode;
    2538 diff --git a/fs/posix_acl.c b/fs/posix_acl.c
    2539 index 8bd2135b7f82..3542f1f814e2 100644
    2540 --- a/fs/posix_acl.c
    2541 +++ b/fs/posix_acl.c
    2542 @@ -158,6 +158,12 @@ posix_acl_equiv_mode(const struct posix_acl *acl, umode_t *mode_p)
    2543 umode_t mode = 0;
    2544 int not_equiv = 0;
    2545
    2546 + /*
    2547 + * A null ACL can always be presented as mode bits.
    2548 + */
    2549 + if (!acl)
    2550 + return 0;
    2551 +
    2552 FOREACH_ACL_ENTRY(pa, acl, pe) {
    2553 switch (pa->e_tag) {
    2554 case ACL_USER_OBJ:
    2555 diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h
    2556 index 99d0fbcbaf79..7a13848d635c 100644
    2557 --- a/include/linux/ftrace.h
    2558 +++ b/include/linux/ftrace.h
    2559 @@ -524,6 +524,7 @@ static inline int ftrace_modify_call(struct dyn_ftrace *rec, unsigned long old_a
    2560 extern int ftrace_arch_read_dyn_info(char *buf, int size);
    2561
    2562 extern int skip_trace(unsigned long ip);
    2563 +extern void ftrace_module_init(struct module *mod);
    2564
    2565 extern void ftrace_disable_daemon(void);
    2566 extern void ftrace_enable_daemon(void);
    2567 @@ -533,6 +534,7 @@ static inline int ftrace_force_update(void) { return 0; }
    2568 static inline void ftrace_disable_daemon(void) { }
    2569 static inline void ftrace_enable_daemon(void) { }
    2570 static inline void ftrace_release_mod(struct module *mod) {}
    2571 +static inline void ftrace_module_init(struct module *mod) {}
    2572 static inline int register_ftrace_command(struct ftrace_func_command *cmd)
    2573 {
    2574 return -EINVAL;
    2575 diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h
    2576 index c2559847d7ee..422eac8538fd 100644
    2577 --- a/include/linux/hyperv.h
    2578 +++ b/include/linux/hyperv.h
    2579 @@ -483,15 +483,18 @@ hv_get_ringbuffer_availbytes(struct hv_ring_buffer_info *rbi,
    2580 * 0 . 13 (Windows Server 2008)
    2581 * 1 . 1 (Windows 7)
    2582 * 2 . 4 (Windows 8)
    2583 + * 3 . 0 (Windows 8 R2)
    2584 */
    2585
    2586 #define VERSION_WS2008 ((0 << 16) | (13))
    2587 #define VERSION_WIN7 ((1 << 16) | (1))
    2588 #define VERSION_WIN8 ((2 << 16) | (4))
    2589 +#define VERSION_WIN8_1 ((3 << 16) | (0))
    2590 +
    2591
    2592 #define VERSION_INVAL -1
    2593
    2594 -#define VERSION_CURRENT VERSION_WIN8
    2595 +#define VERSION_CURRENT VERSION_WIN8_1
    2596
    2597 /* Make maximum size of pipe payload of 16K */
    2598 #define MAX_PIPE_DATA_PAYLOAD (sizeof(u8) * 16384)
    2599 @@ -894,7 +897,7 @@ struct vmbus_channel_relid_released {
    2600 struct vmbus_channel_initiate_contact {
    2601 struct vmbus_channel_message_header header;
    2602 u32 vmbus_version_requested;
    2603 - u32 padding2;
    2604 + u32 target_vcpu; /* The VCPU the host should respond to */
    2605 u64 interrupt_page;
    2606 u64 monitor_page1;
    2607 u64 monitor_page2;
    2608 diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h
    2609 index 5fa5afeeb759..6de0f2c14ec0 100644
    2610 --- a/include/linux/interrupt.h
    2611 +++ b/include/linux/interrupt.h
    2612 @@ -239,7 +239,40 @@ static inline int check_wakeup_irqs(void) { return 0; }
    2613
    2614 extern cpumask_var_t irq_default_affinity;
    2615
    2616 -extern int irq_set_affinity(unsigned int irq, const struct cpumask *cpumask);
    2617 +/* Internal implementation. Use the helpers below */
    2618 +extern int __irq_set_affinity(unsigned int irq, const struct cpumask *cpumask,
    2619 + bool force);
    2620 +
    2621 +/**
    2622 + * irq_set_affinity - Set the irq affinity of a given irq
    2623 + * @irq: Interrupt to set affinity
    2624 + * @mask: cpumask
    2625 + *
    2626 + * Fails if cpumask does not contain an online CPU
    2627 + */
    2628 +static inline int
    2629 +irq_set_affinity(unsigned int irq, const struct cpumask *cpumask)
    2630 +{
    2631 + return __irq_set_affinity(irq, cpumask, false);
    2632 +}
    2633 +
    2634 +/**
    2635 + * irq_force_affinity - Force the irq affinity of a given irq
    2636 + * @irq: Interrupt to set affinity
    2637 + * @mask: cpumask
    2638 + *
    2639 + * Same as irq_set_affinity, but without checking the mask against
    2640 + * online cpus.
    2641 + *
    2642 + * Solely for low level cpu hotplug code, where we need to make per
    2643 + * cpu interrupts affine before the cpu becomes online.
    2644 + */
    2645 +static inline int
    2646 +irq_force_affinity(unsigned int irq, const struct cpumask *cpumask)
    2647 +{
    2648 + return __irq_set_affinity(irq, cpumask, true);
    2649 +}
    2650 +
    2651 extern int irq_can_set_affinity(unsigned int irq);
    2652 extern int irq_select_affinity(unsigned int irq);
    2653
    2654 @@ -275,6 +308,11 @@ static inline int irq_set_affinity(unsigned int irq, const struct cpumask *m)
    2655 return -EINVAL;
    2656 }
    2657
    2658 +static inline int irq_force_affinity(unsigned int irq, const struct cpumask *cpumask)
    2659 +{
    2660 + return 0;
    2661 +}
    2662 +
    2663 static inline int irq_can_set_affinity(unsigned int irq)
    2664 {
    2665 return 0;
    2666 diff --git a/include/linux/irq.h b/include/linux/irq.h
    2667 index bc4e06611958..d591bfe1475b 100644
    2668 --- a/include/linux/irq.h
    2669 +++ b/include/linux/irq.h
    2670 @@ -375,7 +375,8 @@ extern void remove_percpu_irq(unsigned int irq, struct irqaction *act);
    2671
    2672 extern void irq_cpu_online(void);
    2673 extern void irq_cpu_offline(void);
    2674 -extern int __irq_set_affinity_locked(struct irq_data *data, const struct cpumask *cpumask);
    2675 +extern int irq_set_affinity_locked(struct irq_data *data,
    2676 + const struct cpumask *cpumask, bool force);
    2677
    2678 #ifdef CONFIG_GENERIC_HARDIRQS
    2679
    2680 diff --git a/include/trace/events/module.h b/include/trace/events/module.h
    2681 index 161932737416..ca298c7157ae 100644
    2682 --- a/include/trace/events/module.h
    2683 +++ b/include/trace/events/module.h
    2684 @@ -78,7 +78,7 @@ DECLARE_EVENT_CLASS(module_refcnt,
    2685
    2686 TP_fast_assign(
    2687 __entry->ip = ip;
    2688 - __entry->refcnt = __this_cpu_read(mod->refptr->incs) + __this_cpu_read(mod->refptr->decs);
    2689 + __entry->refcnt = __this_cpu_read(mod->refptr->incs) - __this_cpu_read(mod->refptr->decs);
    2690 __assign_str(name, mod->name);
    2691 ),
    2692
    2693 diff --git a/include/uapi/drm/tegra_drm.h b/include/uapi/drm/tegra_drm.h
    2694 index 6e132a2f7420..86b1f9942d0a 100644
    2695 --- a/include/uapi/drm/tegra_drm.h
    2696 +++ b/include/uapi/drm/tegra_drm.h
    2697 @@ -103,7 +103,6 @@ struct drm_tegra_submit {
    2698 __u32 num_waitchks;
    2699 __u32 waitchk_mask;
    2700 __u32 timeout;
    2701 - __u32 pad;
    2702 __u64 syncpts;
    2703 __u64 cmdbufs;
    2704 __u64 relocs;
    2705 diff --git a/kernel/futex.c b/kernel/futex.c
    2706 index 3bc18bf48d0c..625a4e659e7a 100644
    2707 --- a/kernel/futex.c
    2708 +++ b/kernel/futex.c
    2709 @@ -592,6 +592,55 @@ void exit_pi_state_list(struct task_struct *curr)
    2710 raw_spin_unlock_irq(&curr->pi_lock);
    2711 }
    2712
    2713 +/*
    2714 + * We need to check the following states:
    2715 + *
    2716 + * Waiter | pi_state | pi->owner | uTID | uODIED | ?
    2717 + *
    2718 + * [1] NULL | --- | --- | 0 | 0/1 | Valid
    2719 + * [2] NULL | --- | --- | >0 | 0/1 | Valid
    2720 + *
    2721 + * [3] Found | NULL | -- | Any | 0/1 | Invalid
    2722 + *
    2723 + * [4] Found | Found | NULL | 0 | 1 | Valid
    2724 + * [5] Found | Found | NULL | >0 | 1 | Invalid
    2725 + *
    2726 + * [6] Found | Found | task | 0 | 1 | Valid
    2727 + *
    2728 + * [7] Found | Found | NULL | Any | 0 | Invalid
    2729 + *
    2730 + * [8] Found | Found | task | ==taskTID | 0/1 | Valid
    2731 + * [9] Found | Found | task | 0 | 0 | Invalid
    2732 + * [10] Found | Found | task | !=taskTID | 0/1 | Invalid
    2733 + *
    2734 + * [1] Indicates that the kernel can acquire the futex atomically. We
    2735 + * came came here due to a stale FUTEX_WAITERS/FUTEX_OWNER_DIED bit.
    2736 + *
    2737 + * [2] Valid, if TID does not belong to a kernel thread. If no matching
    2738 + * thread is found then it indicates that the owner TID has died.
    2739 + *
    2740 + * [3] Invalid. The waiter is queued on a non PI futex
    2741 + *
    2742 + * [4] Valid state after exit_robust_list(), which sets the user space
    2743 + * value to FUTEX_WAITERS | FUTEX_OWNER_DIED.
    2744 + *
    2745 + * [5] The user space value got manipulated between exit_robust_list()
    2746 + * and exit_pi_state_list()
    2747 + *
    2748 + * [6] Valid state after exit_pi_state_list() which sets the new owner in
    2749 + * the pi_state but cannot access the user space value.
    2750 + *
    2751 + * [7] pi_state->owner can only be NULL when the OWNER_DIED bit is set.
    2752 + *
    2753 + * [8] Owner and user space value match
    2754 + *
    2755 + * [9] There is no transient state which sets the user space TID to 0
    2756 + * except exit_robust_list(), but this is indicated by the
    2757 + * FUTEX_OWNER_DIED bit. See [4]
    2758 + *
    2759 + * [10] There is no transient state which leaves owner and user space
    2760 + * TID out of sync.
    2761 + */
    2762 static int
    2763 lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
    2764 union futex_key *key, struct futex_pi_state **ps)
    2765 @@ -607,12 +656,13 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
    2766 plist_for_each_entry_safe(this, next, head, list) {
    2767 if (match_futex(&this->key, key)) {
    2768 /*
    2769 - * Another waiter already exists - bump up
    2770 - * the refcount and return its pi_state:
    2771 + * Sanity check the waiter before increasing
    2772 + * the refcount and attaching to it.
    2773 */
    2774 pi_state = this->pi_state;
    2775 /*
    2776 - * Userspace might have messed up non-PI and PI futexes
    2777 + * Userspace might have messed up non-PI and
    2778 + * PI futexes [3]
    2779 */
    2780 if (unlikely(!pi_state))
    2781 return -EINVAL;
    2782 @@ -620,34 +670,70 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
    2783 WARN_ON(!atomic_read(&pi_state->refcount));
    2784
    2785 /*
    2786 - * When pi_state->owner is NULL then the owner died
    2787 - * and another waiter is on the fly. pi_state->owner
    2788 - * is fixed up by the task which acquires
    2789 - * pi_state->rt_mutex.
    2790 - *
    2791 - * We do not check for pid == 0 which can happen when
    2792 - * the owner died and robust_list_exit() cleared the
    2793 - * TID.
    2794 + * Handle the owner died case:
    2795 */
    2796 - if (pid && pi_state->owner) {
    2797 + if (uval & FUTEX_OWNER_DIED) {
    2798 + /*
    2799 + * exit_pi_state_list sets owner to NULL and
    2800 + * wakes the topmost waiter. The task which
    2801 + * acquires the pi_state->rt_mutex will fixup
    2802 + * owner.
    2803 + */
    2804 + if (!pi_state->owner) {
    2805 + /*
    2806 + * No pi state owner, but the user
    2807 + * space TID is not 0. Inconsistent
    2808 + * state. [5]
    2809 + */
    2810 + if (pid)
    2811 + return -EINVAL;
    2812 + /*
    2813 + * Take a ref on the state and
    2814 + * return. [4]
    2815 + */
    2816 + goto out_state;
    2817 + }
    2818 +
    2819 /*
    2820 - * Bail out if user space manipulated the
    2821 - * futex value.
    2822 + * If TID is 0, then either the dying owner
    2823 + * has not yet executed exit_pi_state_list()
    2824 + * or some waiter acquired the rtmutex in the
    2825 + * pi state, but did not yet fixup the TID in
    2826 + * user space.
    2827 + *
    2828 + * Take a ref on the state and return. [6]
    2829 */
    2830 - if (pid != task_pid_vnr(pi_state->owner))
    2831 + if (!pid)
    2832 + goto out_state;
    2833 + } else {
    2834 + /*
    2835 + * If the owner died bit is not set,
    2836 + * then the pi_state must have an
    2837 + * owner. [7]
    2838 + */
    2839 + if (!pi_state->owner)
    2840 return -EINVAL;
    2841 }
    2842
    2843 + /*
    2844 + * Bail out if user space manipulated the
    2845 + * futex value. If pi state exists then the
    2846 + * owner TID must be the same as the user
    2847 + * space TID. [9/10]
    2848 + */
    2849 + if (pid != task_pid_vnr(pi_state->owner))
    2850 + return -EINVAL;
    2851 +
    2852 + out_state:
    2853 atomic_inc(&pi_state->refcount);
    2854 *ps = pi_state;
    2855 -
    2856 return 0;
    2857 }
    2858 }
    2859
    2860 /*
    2861 * We are the first waiter - try to look up the real owner and attach
    2862 - * the new pi_state to it, but bail out when TID = 0
    2863 + * the new pi_state to it, but bail out when TID = 0 [1]
    2864 */
    2865 if (!pid)
    2866 return -ESRCH;
    2867 @@ -655,6 +741,11 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
    2868 if (!p)
    2869 return -ESRCH;
    2870
    2871 + if (!p->mm) {
    2872 + put_task_struct(p);
    2873 + return -EPERM;
    2874 + }
    2875 +
    2876 /*
    2877 * We need to look at the task state flags to figure out,
    2878 * whether the task is exiting. To protect against the do_exit
    2879 @@ -675,6 +766,9 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
    2880 return ret;
    2881 }
    2882
    2883 + /*
    2884 + * No existing pi state. First waiter. [2]
    2885 + */
    2886 pi_state = alloc_pi_state();
    2887
    2888 /*
    2889 @@ -746,10 +840,18 @@ retry:
    2890 return -EDEADLK;
    2891
    2892 /*
    2893 - * Surprise - we got the lock. Just return to userspace:
    2894 + * Surprise - we got the lock, but we do not trust user space at all.
    2895 */
    2896 - if (unlikely(!curval))
    2897 - return 1;
    2898 + if (unlikely(!curval)) {
    2899 + /*
    2900 + * We verify whether there is kernel state for this
    2901 + * futex. If not, we can safely assume, that the 0 ->
    2902 + * TID transition is correct. If state exists, we do
    2903 + * not bother to fixup the user space state as it was
    2904 + * corrupted already.
    2905 + */
    2906 + return futex_top_waiter(hb, key) ? -EINVAL : 1;
    2907 + }
    2908
    2909 uval = curval;
    2910
    2911 @@ -879,6 +981,7 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this)
    2912 struct task_struct *new_owner;
    2913 struct futex_pi_state *pi_state = this->pi_state;
    2914 u32 uninitialized_var(curval), newval;
    2915 + int ret = 0;
    2916
    2917 if (!pi_state)
    2918 return -EINVAL;
    2919 @@ -902,23 +1005,19 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this)
    2920 new_owner = this->task;
    2921
    2922 /*
    2923 - * We pass it to the next owner. (The WAITERS bit is always
    2924 - * kept enabled while there is PI state around. We must also
    2925 - * preserve the owner died bit.)
    2926 + * We pass it to the next owner. The WAITERS bit is always
    2927 + * kept enabled while there is PI state around. We cleanup the
    2928 + * owner died bit, because we are the owner.
    2929 */
    2930 - if (!(uval & FUTEX_OWNER_DIED)) {
    2931 - int ret = 0;
    2932 + newval = FUTEX_WAITERS | task_pid_vnr(new_owner);
    2933
    2934 - newval = FUTEX_WAITERS | task_pid_vnr(new_owner);
    2935 -
    2936 - if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval))
    2937 - ret = -EFAULT;
    2938 - else if (curval != uval)
    2939 - ret = -EINVAL;
    2940 - if (ret) {
    2941 - raw_spin_unlock(&pi_state->pi_mutex.wait_lock);
    2942 - return ret;
    2943 - }
    2944 + if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval))
    2945 + ret = -EFAULT;
    2946 + else if (curval != uval)
    2947 + ret = -EINVAL;
    2948 + if (ret) {
    2949 + raw_spin_unlock(&pi_state->pi_mutex.wait_lock);
    2950 + return ret;
    2951 }
    2952
    2953 raw_spin_lock_irq(&pi_state->owner->pi_lock);
    2954 @@ -1197,7 +1296,7 @@ void requeue_pi_wake_futex(struct futex_q *q, union futex_key *key,
    2955 *
    2956 * Return:
    2957 * 0 - failed to acquire the lock atomically;
    2958 - * 1 - acquired the lock;
    2959 + * >0 - acquired the lock, return value is vpid of the top_waiter
    2960 * <0 - error
    2961 */
    2962 static int futex_proxy_trylock_atomic(u32 __user *pifutex,
    2963 @@ -1208,7 +1307,7 @@ static int futex_proxy_trylock_atomic(u32 __user *pifutex,
    2964 {
    2965 struct futex_q *top_waiter = NULL;
    2966 u32 curval;
    2967 - int ret;
    2968 + int ret, vpid;
    2969
    2970 if (get_futex_value_locked(&curval, pifutex))
    2971 return -EFAULT;
    2972 @@ -1236,11 +1335,13 @@ static int futex_proxy_trylock_atomic(u32 __user *pifutex,
    2973 * the contended case or if set_waiters is 1. The pi_state is returned
    2974 * in ps in contended cases.
    2975 */
    2976 + vpid = task_pid_vnr(top_waiter->task);
    2977 ret = futex_lock_pi_atomic(pifutex, hb2, key2, ps, top_waiter->task,
    2978 set_waiters);
    2979 - if (ret == 1)
    2980 + if (ret == 1) {
    2981 requeue_pi_wake_futex(top_waiter, key2, hb2);
    2982 -
    2983 + return vpid;
    2984 + }
    2985 return ret;
    2986 }
    2987
    2988 @@ -1272,10 +1373,16 @@ static int futex_requeue(u32 __user *uaddr1, unsigned int flags,
    2989 struct futex_hash_bucket *hb1, *hb2;
    2990 struct plist_head *head1;
    2991 struct futex_q *this, *next;
    2992 - u32 curval2;
    2993
    2994 if (requeue_pi) {
    2995 /*
    2996 + * Requeue PI only works on two distinct uaddrs. This
    2997 + * check is only valid for private futexes. See below.
    2998 + */
    2999 + if (uaddr1 == uaddr2)
    3000 + return -EINVAL;
    3001 +
    3002 + /*
    3003 * requeue_pi requires a pi_state, try to allocate it now
    3004 * without any locks in case it fails.
    3005 */
    3006 @@ -1313,6 +1420,15 @@ retry:
    3007 if (unlikely(ret != 0))
    3008 goto out_put_key1;
    3009
    3010 + /*
    3011 + * The check above which compares uaddrs is not sufficient for
    3012 + * shared futexes. We need to compare the keys:
    3013 + */
    3014 + if (requeue_pi && match_futex(&key1, &key2)) {
    3015 + ret = -EINVAL;
    3016 + goto out_put_keys;
    3017 + }
    3018 +
    3019 hb1 = hash_futex(&key1);
    3020 hb2 = hash_futex(&key2);
    3021
    3022 @@ -1358,16 +1474,25 @@ retry_private:
    3023 * At this point the top_waiter has either taken uaddr2 or is
    3024 * waiting on it. If the former, then the pi_state will not
    3025 * exist yet, look it up one more time to ensure we have a
    3026 - * reference to it.
    3027 + * reference to it. If the lock was taken, ret contains the
    3028 + * vpid of the top waiter task.
    3029 */
    3030 - if (ret == 1) {
    3031 + if (ret > 0) {
    3032 WARN_ON(pi_state);
    3033 drop_count++;
    3034 task_count++;
    3035 - ret = get_futex_value_locked(&curval2, uaddr2);
    3036 - if (!ret)
    3037 - ret = lookup_pi_state(curval2, hb2, &key2,
    3038 - &pi_state);
    3039 + /*
    3040 + * If we acquired the lock, then the user
    3041 + * space value of uaddr2 should be vpid. It
    3042 + * cannot be changed by the top waiter as it
    3043 + * is blocked on hb2 lock if it tries to do
    3044 + * so. If something fiddled with it behind our
    3045 + * back the pi state lookup might unearth
    3046 + * it. So we rather use the known value than
    3047 + * rereading and handing potential crap to
    3048 + * lookup_pi_state.
    3049 + */
    3050 + ret = lookup_pi_state(ret, hb2, &key2, &pi_state);
    3051 }
    3052
    3053 switch (ret) {
    3054 @@ -2137,9 +2262,10 @@ retry:
    3055 /*
    3056 * To avoid races, try to do the TID -> 0 atomic transition
    3057 * again. If it succeeds then we can return without waking
    3058 - * anyone else up:
    3059 + * anyone else up. We only try this if neither the waiters nor
    3060 + * the owner died bit are set.
    3061 */
    3062 - if (!(uval & FUTEX_OWNER_DIED) &&
    3063 + if (!(uval & ~FUTEX_TID_MASK) &&
    3064 cmpxchg_futex_value_locked(&uval, uaddr, vpid, 0))
    3065 goto pi_faulted;
    3066 /*
    3067 @@ -2171,11 +2297,9 @@ retry:
    3068 /*
    3069 * No waiters - kernel unlocks the futex:
    3070 */
    3071 - if (!(uval & FUTEX_OWNER_DIED)) {
    3072 - ret = unlock_futex_pi(uaddr, uval);
    3073 - if (ret == -EFAULT)
    3074 - goto pi_faulted;
    3075 - }
    3076 + ret = unlock_futex_pi(uaddr, uval);
    3077 + if (ret == -EFAULT)
    3078 + goto pi_faulted;
    3079
    3080 out_unlock:
    3081 spin_unlock(&hb->lock);
    3082 @@ -2334,6 +2458,15 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
    3083 if (ret)
    3084 goto out_key2;
    3085
    3086 + /*
    3087 + * The check above which compares uaddrs is not sufficient for
    3088 + * shared futexes. We need to compare the keys:
    3089 + */
    3090 + if (match_futex(&q.key, &key2)) {
    3091 + ret = -EINVAL;
    3092 + goto out_put_keys;
    3093 + }
    3094 +
    3095 /* Queue the futex_q, drop the hb lock, wait for wakeup. */
    3096 futex_wait_queue_me(hb, &q, to);
    3097
    3098 diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
    3099 index 2288fbdada16..aadf4b7a607c 100644
    3100 --- a/kernel/hrtimer.c
    3101 +++ b/kernel/hrtimer.c
    3102 @@ -245,6 +245,11 @@ again:
    3103 goto again;
    3104 }
    3105 timer->base = new_base;
    3106 + } else {
    3107 + if (cpu != this_cpu && hrtimer_check_target(timer, new_base)) {
    3108 + cpu = this_cpu;
    3109 + goto again;
    3110 + }
    3111 }
    3112 return new_base;
    3113 }
    3114 @@ -580,6 +585,23 @@ hrtimer_force_reprogram(struct hrtimer_cpu_base *cpu_base, int skip_equal)
    3115
    3116 cpu_base->expires_next.tv64 = expires_next.tv64;
    3117
    3118 + /*
    3119 + * If a hang was detected in the last timer interrupt then we
    3120 + * leave the hang delay active in the hardware. We want the
    3121 + * system to make progress. That also prevents the following
    3122 + * scenario:
    3123 + * T1 expires 50ms from now
    3124 + * T2 expires 5s from now
    3125 + *
    3126 + * T1 is removed, so this code is called and would reprogram
    3127 + * the hardware to 5s from now. Any hrtimer_start after that
    3128 + * will not reprogram the hardware due to hang_detected being
    3129 + * set. So we'd effectivly block all timers until the T2 event
    3130 + * fires.
    3131 + */
    3132 + if (cpu_base->hang_detected)
    3133 + return;
    3134 +
    3135 if (cpu_base->expires_next.tv64 != KTIME_MAX)
    3136 tick_program_event(cpu_base->expires_next, 1);
    3137 }
    3138 @@ -977,11 +999,8 @@ int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim,
    3139 /* Remove an active timer from the queue: */
    3140 ret = remove_hrtimer(timer, base);
    3141
    3142 - /* Switch the timer base, if necessary: */
    3143 - new_base = switch_hrtimer_base(timer, base, mode & HRTIMER_MODE_PINNED);
    3144 -
    3145 if (mode & HRTIMER_MODE_REL) {
    3146 - tim = ktime_add_safe(tim, new_base->get_time());
    3147 + tim = ktime_add_safe(tim, base->get_time());
    3148 /*
    3149 * CONFIG_TIME_LOW_RES is a temporary way for architectures
    3150 * to signal that they simply return xtime in
    3151 @@ -996,6 +1015,9 @@ int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim,
    3152
    3153 hrtimer_set_expires_range_ns(timer, tim, delta_ns);
    3154
    3155 + /* Switch the timer base, if necessary: */
    3156 + new_base = switch_hrtimer_base(timer, base, mode & HRTIMER_MODE_PINNED);
    3157 +
    3158 timer_stats_hrtimer_set_start_info(timer);
    3159
    3160 leftmost = enqueue_hrtimer(timer, new_base);
    3161 diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
    3162 index 9bd5c8a6c8ee..8815abfdf2cb 100644
    3163 --- a/kernel/irq/manage.c
    3164 +++ b/kernel/irq/manage.c
    3165 @@ -150,7 +150,7 @@ int irq_do_set_affinity(struct irq_data *data, const struct cpumask *mask,
    3166 struct irq_chip *chip = irq_data_get_irq_chip(data);
    3167 int ret;
    3168
    3169 - ret = chip->irq_set_affinity(data, mask, false);
    3170 + ret = chip->irq_set_affinity(data, mask, force);
    3171 switch (ret) {
    3172 case IRQ_SET_MASK_OK:
    3173 cpumask_copy(data->affinity, mask);
    3174 @@ -162,7 +162,8 @@ int irq_do_set_affinity(struct irq_data *data, const struct cpumask *mask,
    3175 return ret;
    3176 }
    3177
    3178 -int __irq_set_affinity_locked(struct irq_data *data, const struct cpumask *mask)
    3179 +int irq_set_affinity_locked(struct irq_data *data, const struct cpumask *mask,
    3180 + bool force)
    3181 {
    3182 struct irq_chip *chip = irq_data_get_irq_chip(data);
    3183 struct irq_desc *desc = irq_data_to_desc(data);
    3184 @@ -172,7 +173,7 @@ int __irq_set_affinity_locked(struct irq_data *data, const struct cpumask *mask)
    3185 return -EINVAL;
    3186
    3187 if (irq_can_move_pcntxt(data)) {
    3188 - ret = irq_do_set_affinity(data, mask, false);
    3189 + ret = irq_do_set_affinity(data, mask, force);
    3190 } else {
    3191 irqd_set_move_pending(data);
    3192 irq_copy_pending(desc, mask);
    3193 @@ -187,13 +188,7 @@ int __irq_set_affinity_locked(struct irq_data *data, const struct cpumask *mask)
    3194 return ret;
    3195 }
    3196
    3197 -/**
    3198 - * irq_set_affinity - Set the irq affinity of a given irq
    3199 - * @irq: Interrupt to set affinity
    3200 - * @mask: cpumask
    3201 - *
    3202 - */
    3203 -int irq_set_affinity(unsigned int irq, const struct cpumask *mask)
    3204 +int __irq_set_affinity(unsigned int irq, const struct cpumask *mask, bool force)
    3205 {
    3206 struct irq_desc *desc = irq_to_desc(irq);
    3207 unsigned long flags;
    3208 @@ -203,7 +198,7 @@ int irq_set_affinity(unsigned int irq, const struct cpumask *mask)
    3209 return -EINVAL;
    3210
    3211 raw_spin_lock_irqsave(&desc->lock, flags);
    3212 - ret = __irq_set_affinity_locked(irq_desc_get_irq_data(desc), mask);
    3213 + ret = irq_set_affinity_locked(irq_desc_get_irq_data(desc), mask, force);
    3214 raw_spin_unlock_irqrestore(&desc->lock, flags);
    3215 return ret;
    3216 }
    3217 diff --git a/kernel/module.c b/kernel/module.c
    3218 index fa53db8aadeb..10a3af821d28 100644
    3219 --- a/kernel/module.c
    3220 +++ b/kernel/module.c
    3221 @@ -3279,6 +3279,9 @@ static int load_module(struct load_info *info, const char __user *uargs,
    3222
    3223 dynamic_debug_setup(info->debug, info->num_debug);
    3224
    3225 + /* Ftrace init must be called in the MODULE_STATE_UNFORMED state */
    3226 + ftrace_module_init(mod);
    3227 +
    3228 /* Finally it's fully formed, ready to start executing. */
    3229 err = complete_formation(mod, info);
    3230 if (err)
    3231 diff --git a/kernel/timer.c b/kernel/timer.c
    3232 index 15bc1b41021d..20f45ea6f5a4 100644
    3233 --- a/kernel/timer.c
    3234 +++ b/kernel/timer.c
    3235 @@ -822,7 +822,7 @@ unsigned long apply_slack(struct timer_list *timer, unsigned long expires)
    3236
    3237 bit = find_last_bit(&mask, BITS_PER_LONG);
    3238
    3239 - mask = (1 << bit) - 1;
    3240 + mask = (1UL << bit) - 1;
    3241
    3242 expires_limit = expires_limit & ~(mask);
    3243
    3244 diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
    3245 index 4b93b8412252..797d3b91a30b 100644
    3246 --- a/kernel/trace/ftrace.c
    3247 +++ b/kernel/trace/ftrace.c
    3248 @@ -4222,16 +4222,11 @@ static void ftrace_init_module(struct module *mod,
    3249 ftrace_process_locs(mod, start, end);
    3250 }
    3251
    3252 -static int ftrace_module_notify_enter(struct notifier_block *self,
    3253 - unsigned long val, void *data)
    3254 +void ftrace_module_init(struct module *mod)
    3255 {
    3256 - struct module *mod = data;
    3257 -
    3258 - if (val == MODULE_STATE_COMING)
    3259 - ftrace_init_module(mod, mod->ftrace_callsites,
    3260 - mod->ftrace_callsites +
    3261 - mod->num_ftrace_callsites);
    3262 - return 0;
    3263 + ftrace_init_module(mod, mod->ftrace_callsites,
    3264 + mod->ftrace_callsites +
    3265 + mod->num_ftrace_callsites);
    3266 }
    3267
    3268 static int ftrace_module_notify_exit(struct notifier_block *self,
    3269 @@ -4245,11 +4240,6 @@ static int ftrace_module_notify_exit(struct notifier_block *self,
    3270 return 0;
    3271 }
    3272 #else
    3273 -static int ftrace_module_notify_enter(struct notifier_block *self,
    3274 - unsigned long val, void *data)
    3275 -{
    3276 - return 0;
    3277 -}
    3278 static int ftrace_module_notify_exit(struct notifier_block *self,
    3279 unsigned long val, void *data)
    3280 {
    3281 @@ -4257,11 +4247,6 @@ static int ftrace_module_notify_exit(struct notifier_block *self,
    3282 }
    3283 #endif /* CONFIG_MODULES */
    3284
    3285 -struct notifier_block ftrace_module_enter_nb = {
    3286 - .notifier_call = ftrace_module_notify_enter,
    3287 - .priority = INT_MAX, /* Run before anything that can use kprobes */
    3288 -};
    3289 -
    3290 struct notifier_block ftrace_module_exit_nb = {
    3291 .notifier_call = ftrace_module_notify_exit,
    3292 .priority = INT_MIN, /* Run after anything that can remove kprobes */
    3293 @@ -4298,10 +4283,6 @@ void __init ftrace_init(void)
    3294 __start_mcount_loc,
    3295 __stop_mcount_loc);
    3296
    3297 - ret = register_module_notifier(&ftrace_module_enter_nb);
    3298 - if (ret)
    3299 - pr_warning("Failed to register trace ftrace module enter notifier\n");
    3300 -
    3301 ret = register_module_notifier(&ftrace_module_exit_nb);
    3302 if (ret)
    3303 pr_warning("Failed to register trace ftrace module exit notifier\n");
    3304 diff --git a/kernel/workqueue.c b/kernel/workqueue.c
    3305 index db7a6ac7c0a8..652f36dd40de 100644
    3306 --- a/kernel/workqueue.c
    3307 +++ b/kernel/workqueue.c
    3308 @@ -1881,6 +1881,12 @@ static void send_mayday(struct work_struct *work)
    3309
    3310 /* mayday mayday mayday */
    3311 if (list_empty(&pwq->mayday_node)) {
    3312 + /*
    3313 + * If @pwq is for an unbound wq, its base ref may be put at
    3314 + * any time due to an attribute change. Pin @pwq until the
    3315 + * rescuer is done with it.
    3316 + */
    3317 + get_pwq(pwq);
    3318 list_add_tail(&pwq->mayday_node, &wq->maydays);
    3319 wake_up_process(wq->rescuer->task);
    3320 }
    3321 @@ -2356,6 +2362,7 @@ static int rescuer_thread(void *__rescuer)
    3322 struct worker *rescuer = __rescuer;
    3323 struct workqueue_struct *wq = rescuer->rescue_wq;
    3324 struct list_head *scheduled = &rescuer->scheduled;
    3325 + bool should_stop;
    3326
    3327 set_user_nice(current, RESCUER_NICE_LEVEL);
    3328
    3329 @@ -2367,11 +2374,15 @@ static int rescuer_thread(void *__rescuer)
    3330 repeat:
    3331 set_current_state(TASK_INTERRUPTIBLE);
    3332
    3333 - if (kthread_should_stop()) {
    3334 - __set_current_state(TASK_RUNNING);
    3335 - rescuer->task->flags &= ~PF_WQ_WORKER;
    3336 - return 0;
    3337 - }
    3338 + /*
    3339 + * By the time the rescuer is requested to stop, the workqueue
    3340 + * shouldn't have any work pending, but @wq->maydays may still have
    3341 + * pwq(s) queued. This can happen by non-rescuer workers consuming
    3342 + * all the work items before the rescuer got to them. Go through
    3343 + * @wq->maydays processing before acting on should_stop so that the
    3344 + * list is always empty on exit.
    3345 + */
    3346 + should_stop = kthread_should_stop();
    3347
    3348 /* see whether any pwq is asking for help */
    3349 spin_lock_irq(&wq_mayday_lock);
    3350 @@ -2403,6 +2414,12 @@ repeat:
    3351 process_scheduled_works(rescuer);
    3352
    3353 /*
    3354 + * Put the reference grabbed by send_mayday(). @pool won't
    3355 + * go away while we're holding its lock.
    3356 + */
    3357 + put_pwq(pwq);
    3358 +
    3359 + /*
    3360 * Leave this pool. If keep_working() is %true, notify a
    3361 * regular worker; otherwise, we end up with 0 concurrency
    3362 * and stalling the execution.
    3363 @@ -2417,6 +2434,12 @@ repeat:
    3364
    3365 spin_unlock_irq(&wq_mayday_lock);
    3366
    3367 + if (should_stop) {
    3368 + __set_current_state(TASK_RUNNING);
    3369 + rescuer->task->flags &= ~PF_WQ_WORKER;
    3370 + return 0;
    3371 + }
    3372 +
    3373 /* rescuers should never participate in concurrency management */
    3374 WARN_ON_ONCE(!(rescuer->flags & WORKER_NOT_RUNNING));
    3375 schedule();
    3376 @@ -4043,7 +4066,8 @@ static void wq_update_unbound_numa(struct workqueue_struct *wq, int cpu,
    3377 if (!pwq) {
    3378 pr_warning("workqueue: allocation failed while updating NUMA affinity of \"%s\"\n",
    3379 wq->name);
    3380 - goto out_unlock;
    3381 + mutex_lock(&wq->mutex);
    3382 + goto use_dfl_pwq;
    3383 }
    3384
    3385 /*
    3386 diff --git a/mm/memory-failure.c b/mm/memory-failure.c
    3387 index 59c62fa75c5a..4254eb021583 100644
    3388 --- a/mm/memory-failure.c
    3389 +++ b/mm/memory-failure.c
    3390 @@ -1083,15 +1083,16 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
    3391 return 0;
    3392 } else if (PageHuge(hpage)) {
    3393 /*
    3394 - * Check "just unpoisoned", "filter hit", and
    3395 - * "race with other subpage."
    3396 + * Check "filter hit" and "race with other subpage."
    3397 */
    3398 lock_page(hpage);
    3399 - if (!PageHWPoison(hpage)
    3400 - || (hwpoison_filter(p) && TestClearPageHWPoison(p))
    3401 - || (p != hpage && TestSetPageHWPoison(hpage))) {
    3402 - atomic_long_sub(nr_pages, &num_poisoned_pages);
    3403 - return 0;
    3404 + if (PageHWPoison(hpage)) {
    3405 + if ((hwpoison_filter(p) && TestClearPageHWPoison(p))
    3406 + || (p != hpage && TestSetPageHWPoison(hpage))) {
    3407 + atomic_long_sub(nr_pages, &num_poisoned_pages);
    3408 + unlock_page(hpage);
    3409 + return 0;
    3410 + }
    3411 }
    3412 set_page_hwpoison_huge_page(hpage);
    3413 res = dequeue_hwpoisoned_huge_page(hpage);
    3414 diff --git a/mm/memory.c b/mm/memory.c
    3415 index 4b60011907d7..ebe0f285c0e7 100644
    3416 --- a/mm/memory.c
    3417 +++ b/mm/memory.c
    3418 @@ -1937,12 +1937,17 @@ int fixup_user_fault(struct task_struct *tsk, struct mm_struct *mm,
    3419 unsigned long address, unsigned int fault_flags)
    3420 {
    3421 struct vm_area_struct *vma;
    3422 + vm_flags_t vm_flags;
    3423 int ret;
    3424
    3425 vma = find_extend_vma(mm, address);
    3426 if (!vma || address < vma->vm_start)
    3427 return -EFAULT;
    3428
    3429 + vm_flags = (fault_flags & FAULT_FLAG_WRITE) ? VM_WRITE : VM_READ;
    3430 + if (!(vm_flags & vma->vm_flags))
    3431 + return -EFAULT;
    3432 +
    3433 ret = handle_mm_fault(mm, vma, address, fault_flags);
    3434 if (ret & VM_FAULT_ERROR) {
    3435 if (ret & VM_FAULT_OOM)
    3436 diff --git a/mm/mremap.c b/mm/mremap.c
    3437 index 463a25705ac6..2201d060c31b 100644
    3438 --- a/mm/mremap.c
    3439 +++ b/mm/mremap.c
    3440 @@ -175,10 +175,17 @@ unsigned long move_page_tables(struct vm_area_struct *vma,
    3441 break;
    3442 if (pmd_trans_huge(*old_pmd)) {
    3443 int err = 0;
    3444 - if (extent == HPAGE_PMD_SIZE)
    3445 + if (extent == HPAGE_PMD_SIZE) {
    3446 + VM_BUG_ON(vma->vm_file || !vma->anon_vma);
    3447 + /* See comment in move_ptes() */
    3448 + if (need_rmap_locks)
    3449 + anon_vma_lock_write(vma->anon_vma);
    3450 err = move_huge_pmd(vma, new_vma, old_addr,
    3451 new_addr, old_end,
    3452 old_pmd, new_pmd);
    3453 + if (need_rmap_locks)
    3454 + anon_vma_unlock_write(vma->anon_vma);
    3455 + }
    3456 if (err > 0) {
    3457 need_flush = true;
    3458 continue;
    3459 diff --git a/mm/percpu.c b/mm/percpu.c
    3460 index 8c8e08f3a692..25e2ea52db82 100644
    3461 --- a/mm/percpu.c
    3462 +++ b/mm/percpu.c
    3463 @@ -612,7 +612,7 @@ static struct pcpu_chunk *pcpu_alloc_chunk(void)
    3464 chunk->map = pcpu_mem_zalloc(PCPU_DFL_MAP_ALLOC *
    3465 sizeof(chunk->map[0]));
    3466 if (!chunk->map) {
    3467 - kfree(chunk);
    3468 + pcpu_mem_free(chunk, pcpu_chunk_struct_size);
    3469 return NULL;
    3470 }
    3471
    3472 diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
    3473 index 6c7f36379722..4c51c055d00f 100644
    3474 --- a/net/bluetooth/hci_conn.c
    3475 +++ b/net/bluetooth/hci_conn.c
    3476 @@ -652,14 +652,17 @@ static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
    3477 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
    3478 struct hci_cp_auth_requested cp;
    3479
    3480 - /* encrypt must be pending if auth is also pending */
    3481 - set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
    3482 -
    3483 cp.handle = cpu_to_le16(conn->handle);
    3484 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
    3485 sizeof(cp), &cp);
    3486 +
    3487 + /* If we're already encrypted set the REAUTH_PEND flag,
    3488 + * otherwise set the ENCRYPT_PEND.
    3489 + */
    3490 if (conn->key_type != 0xff)
    3491 set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
    3492 + else
    3493 + set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
    3494 }
    3495
    3496 return 0;
    3497 diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
    3498 index cfca44f8d048..ab2ec7c414cb 100644
    3499 --- a/net/bluetooth/hci_event.c
    3500 +++ b/net/bluetooth/hci_event.c
    3501 @@ -3051,6 +3051,12 @@ static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
    3502 if (!conn)
    3503 goto unlock;
    3504
    3505 + /* For BR/EDR the necessary steps are taken through the
    3506 + * auth_complete event.
    3507 + */
    3508 + if (conn->type != LE_LINK)
    3509 + goto unlock;
    3510 +
    3511 if (!ev->status)
    3512 conn->sec_level = conn->pending_sec_level;
    3513
    3514 diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
    3515 index eb0a46a49bd4..b9d7df175700 100644
    3516 --- a/net/ceph/messenger.c
    3517 +++ b/net/ceph/messenger.c
    3518 @@ -556,7 +556,7 @@ static int ceph_tcp_sendmsg(struct socket *sock, struct kvec *iov,
    3519 return r;
    3520 }
    3521
    3522 -static int ceph_tcp_sendpage(struct socket *sock, struct page *page,
    3523 +static int __ceph_tcp_sendpage(struct socket *sock, struct page *page,
    3524 int offset, size_t size, bool more)
    3525 {
    3526 int flags = MSG_DONTWAIT | MSG_NOSIGNAL | (more ? MSG_MORE : MSG_EOR);
    3527 @@ -569,6 +569,24 @@ static int ceph_tcp_sendpage(struct socket *sock, struct page *page,
    3528 return ret;
    3529 }
    3530
    3531 +static int ceph_tcp_sendpage(struct socket *sock, struct page *page,
    3532 + int offset, size_t size, bool more)
    3533 +{
    3534 + int ret;
    3535 + struct kvec iov;
    3536 +
    3537 + /* sendpage cannot properly handle pages with page_count == 0,
    3538 + * we need to fallback to sendmsg if that's the case */
    3539 + if (page_count(page) >= 1)
    3540 + return __ceph_tcp_sendpage(sock, page, offset, size, more);
    3541 +
    3542 + iov.iov_base = kmap(page) + offset;
    3543 + iov.iov_len = size;
    3544 + ret = ceph_tcp_sendmsg(sock, &iov, 1, size, more);
    3545 + kunmap(page);
    3546 +
    3547 + return ret;
    3548 +}
    3549
    3550 /*
    3551 * Shutdown/close the socket for the given connection.
    3552 diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
    3553 index 92ef04c72c51..845563b81a0f 100644
    3554 --- a/net/mac80211/ieee80211_i.h
    3555 +++ b/net/mac80211/ieee80211_i.h
    3556 @@ -311,6 +311,7 @@ struct ieee80211_roc_work {
    3557
    3558 bool started, abort, hw_begun, notified;
    3559 bool to_be_freed;
    3560 + bool on_channel;
    3561
    3562 unsigned long hw_start_time;
    3563
    3564 @@ -1270,6 +1271,7 @@ void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata);
    3565 void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata);
    3566 void ieee80211_mgd_conn_tx_status(struct ieee80211_sub_if_data *sdata,
    3567 __le16 fc, bool acked);
    3568 +void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata);
    3569 void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata);
    3570
    3571 /* IBSS code */
    3572 diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
    3573 index 49bc2246bd86..fc94937cd7b3 100644
    3574 --- a/net/mac80211/mlme.c
    3575 +++ b/net/mac80211/mlme.c
    3576 @@ -3754,6 +3754,32 @@ static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
    3577 }
    3578
    3579 #ifdef CONFIG_PM
    3580 +void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata)
    3581 +{
    3582 + struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
    3583 + u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
    3584 +
    3585 + mutex_lock(&ifmgd->mtx);
    3586 +
    3587 + if (ifmgd->auth_data) {
    3588 + /*
    3589 + * If we are trying to authenticate while suspending, cfg80211
    3590 + * won't know and won't actually abort those attempts, thus we
    3591 + * need to do that ourselves.
    3592 + */
    3593 + ieee80211_send_deauth_disassoc(sdata,
    3594 + ifmgd->auth_data->bss->bssid,
    3595 + IEEE80211_STYPE_DEAUTH,
    3596 + WLAN_REASON_DEAUTH_LEAVING,
    3597 + false, frame_buf);
    3598 + ieee80211_destroy_auth_data(sdata, false);
    3599 + cfg80211_send_deauth(sdata->dev, frame_buf,
    3600 + IEEE80211_DEAUTH_FRAME_LEN);
    3601 + }
    3602 +
    3603 + mutex_unlock(&ifmgd->mtx);
    3604 +}
    3605 +
    3606 void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
    3607 {
    3608 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
    3609 diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
    3610 index 11d3f227e11e..0427a58b4397 100644
    3611 --- a/net/mac80211/offchannel.c
    3612 +++ b/net/mac80211/offchannel.c
    3613 @@ -333,7 +333,7 @@ void ieee80211_sw_roc_work(struct work_struct *work)
    3614 container_of(work, struct ieee80211_roc_work, work.work);
    3615 struct ieee80211_sub_if_data *sdata = roc->sdata;
    3616 struct ieee80211_local *local = sdata->local;
    3617 - bool started;
    3618 + bool started, on_channel;
    3619
    3620 mutex_lock(&local->mtx);
    3621
    3622 @@ -354,14 +354,24 @@ void ieee80211_sw_roc_work(struct work_struct *work)
    3623 if (!roc->started) {
    3624 struct ieee80211_roc_work *dep;
    3625
    3626 - /* start this ROC */
    3627 - ieee80211_offchannel_stop_vifs(local);
    3628 + WARN_ON(local->use_chanctx);
    3629 +
    3630 + /* If actually operating on the desired channel (with at least
    3631 + * 20 MHz channel width) don't stop all the operations but still
    3632 + * treat it as though the ROC operation started properly, so
    3633 + * other ROC operations won't interfere with this one.
    3634 + */
    3635 + roc->on_channel = roc->chan == local->_oper_chandef.chan;
    3636
    3637 - /* switch channel etc */
    3638 + /* start this ROC */
    3639 ieee80211_recalc_idle(local);
    3640
    3641 - local->tmp_channel = roc->chan;
    3642 - ieee80211_hw_config(local, 0);
    3643 + if (!roc->on_channel) {
    3644 + ieee80211_offchannel_stop_vifs(local);
    3645 +
    3646 + local->tmp_channel = roc->chan;
    3647 + ieee80211_hw_config(local, 0);
    3648 + }
    3649
    3650 /* tell userspace or send frame */
    3651 ieee80211_handle_roc_started(roc);
    3652 @@ -380,9 +390,10 @@ void ieee80211_sw_roc_work(struct work_struct *work)
    3653 finish:
    3654 list_del(&roc->list);
    3655 started = roc->started;
    3656 + on_channel = roc->on_channel;
    3657 ieee80211_roc_notify_destroy(roc, !roc->abort);
    3658
    3659 - if (started) {
    3660 + if (started && !on_channel) {
    3661 ieee80211_flush_queues(local, NULL);
    3662
    3663 local->tmp_channel = NULL;
    3664 diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
    3665 index 340126204343..efb510e6f206 100644
    3666 --- a/net/mac80211/pm.c
    3667 +++ b/net/mac80211/pm.c
    3668 @@ -101,10 +101,18 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
    3669
    3670 /* remove all interfaces that were created in the driver */
    3671 list_for_each_entry(sdata, &local->interfaces, list) {
    3672 - if (!ieee80211_sdata_running(sdata) ||
    3673 - sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
    3674 - sdata->vif.type == NL80211_IFTYPE_MONITOR)
    3675 + if (!ieee80211_sdata_running(sdata))
    3676 continue;
    3677 + switch (sdata->vif.type) {
    3678 + case NL80211_IFTYPE_AP_VLAN:
    3679 + case NL80211_IFTYPE_MONITOR:
    3680 + continue;
    3681 + case NL80211_IFTYPE_STATION:
    3682 + ieee80211_mgd_quiesce(sdata);
    3683 + break;
    3684 + default:
    3685 + break;
    3686 + }
    3687
    3688 drv_remove_interface(local, sdata);
    3689 }
    3690 diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
    3691 index 5f055d7ee85b..1800db643a16 100644
    3692 --- a/sound/pci/hda/hda_intel.c
    3693 +++ b/sound/pci/hda/hda_intel.c
    3694 @@ -3856,6 +3856,9 @@ static DEFINE_PCI_DEVICE_TABLE(azx_ids) = {
    3695 /* Lynx Point */
    3696 { PCI_DEVICE(0x8086, 0x8c20),
    3697 .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
    3698 + /* 9 Series */
    3699 + { PCI_DEVICE(0x8086, 0x8ca0),
    3700 + .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
    3701 /* Wellsburg */
    3702 { PCI_DEVICE(0x8086, 0x8d20),
    3703 .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
    3704 diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
    3705 index e3cd86514cea..1ae1f8bd9c36 100644
    3706 --- a/sound/soc/codecs/wm8962.c
    3707 +++ b/sound/soc/codecs/wm8962.c
    3708 @@ -153,6 +153,7 @@ static struct reg_default wm8962_reg[] = {
    3709 { 40, 0x0000 }, /* R40 - SPKOUTL volume */
    3710 { 41, 0x0000 }, /* R41 - SPKOUTR volume */
    3711
    3712 + { 49, 0x0010 }, /* R49 - Class D Control 1 */
    3713 { 51, 0x0003 }, /* R51 - Class D Control 2 */
    3714
    3715 { 56, 0x0506 }, /* R56 - Clocking 4 */
    3716 @@ -794,7 +795,6 @@ static bool wm8962_volatile_register(struct device *dev, unsigned int reg)
    3717 case WM8962_ALC2:
    3718 case WM8962_THERMAL_SHUTDOWN_STATUS:
    3719 case WM8962_ADDITIONAL_CONTROL_4:
    3720 - case WM8962_CLASS_D_CONTROL_1:
    3721 case WM8962_DC_SERVO_6:
    3722 case WM8962_INTERRUPT_STATUS_1:
    3723 case WM8962_INTERRUPT_STATUS_2:
    3724 @@ -2901,13 +2901,22 @@ static int wm8962_set_fll(struct snd_soc_codec *codec, int fll_id, int source,
    3725 static int wm8962_mute(struct snd_soc_dai *dai, int mute)
    3726 {
    3727 struct snd_soc_codec *codec = dai->codec;
    3728 - int val;
    3729 + int val, ret;
    3730
    3731 if (mute)
    3732 - val = WM8962_DAC_MUTE;
    3733 + val = WM8962_DAC_MUTE | WM8962_DAC_MUTE_ALT;
    3734 else
    3735 val = 0;
    3736
    3737 + /**
    3738 + * The DAC mute bit is mirrored in two registers, update both to keep
    3739 + * the register cache consistent.
    3740 + */
    3741 + ret = snd_soc_update_bits(codec, WM8962_CLASS_D_CONTROL_1,
    3742 + WM8962_DAC_MUTE_ALT, val);
    3743 + if (ret < 0)
    3744 + return ret;
    3745 +
    3746 return snd_soc_update_bits(codec, WM8962_ADC_DAC_CONTROL_1,
    3747 WM8962_DAC_MUTE, val);
    3748 }
    3749 diff --git a/sound/soc/codecs/wm8962.h b/sound/soc/codecs/wm8962.h
    3750 index a1a5d5294c19..910aafd09d21 100644
    3751 --- a/sound/soc/codecs/wm8962.h
    3752 +++ b/sound/soc/codecs/wm8962.h
    3753 @@ -1954,6 +1954,10 @@
    3754 #define WM8962_SPKOUTL_ENA_MASK 0x0040 /* SPKOUTL_ENA */
    3755 #define WM8962_SPKOUTL_ENA_SHIFT 6 /* SPKOUTL_ENA */
    3756 #define WM8962_SPKOUTL_ENA_WIDTH 1 /* SPKOUTL_ENA */
    3757 +#define WM8962_DAC_MUTE_ALT 0x0010 /* DAC_MUTE */
    3758 +#define WM8962_DAC_MUTE_ALT_MASK 0x0010 /* DAC_MUTE */
    3759 +#define WM8962_DAC_MUTE_ALT_SHIFT 4 /* DAC_MUTE */
    3760 +#define WM8962_DAC_MUTE_ALT_WIDTH 1 /* DAC_MUTE */
    3761 #define WM8962_SPKOUTL_PGA_MUTE 0x0002 /* SPKOUTL_PGA_MUTE */
    3762 #define WM8962_SPKOUTL_PGA_MUTE_MASK 0x0002 /* SPKOUTL_PGA_MUTE */
    3763 #define WM8962_SPKOUTL_PGA_MUTE_SHIFT 1 /* SPKOUTL_PGA_MUTE */
    3764 diff --git a/sound/usb/card.h b/sound/usb/card.h
    3765 index bf2889a2cae5..82c2d80c8228 100644
    3766 --- a/sound/usb/card.h
    3767 +++ b/sound/usb/card.h
    3768 @@ -90,6 +90,7 @@ struct snd_usb_endpoint {
    3769 unsigned int curframesize; /* current packet size in frames (for capture) */
    3770 unsigned int syncmaxsize; /* sync endpoint packet size */
    3771 unsigned int fill_max:1; /* fill max packet size always */
    3772 + unsigned int udh01_fb_quirk:1; /* corrupted feedback data */
    3773 unsigned int datainterval; /* log_2 of data packet interval */
    3774 unsigned int syncinterval; /* P for adaptive mode, 0 otherwise */
    3775 unsigned char silence_value;
    3776 diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
    3777 index 659950e5b94f..308c02b2a597 100644
    3778 --- a/sound/usb/endpoint.c
    3779 +++ b/sound/usb/endpoint.c
    3780 @@ -467,6 +467,10 @@ struct snd_usb_endpoint *snd_usb_add_endpoint(struct snd_usb_audio *chip,
    3781 ep->syncinterval = 3;
    3782
    3783 ep->syncmaxsize = le16_to_cpu(get_endpoint(alts, 1)->wMaxPacketSize);
    3784 +
    3785 + if (chip->usb_id == USB_ID(0x0644, 0x8038) /* TEAC UD-H01 */ &&
    3786 + ep->syncmaxsize == 4)
    3787 + ep->udh01_fb_quirk = 1;
    3788 }
    3789
    3790 list_add_tail(&ep->list, &chip->ep_list);
    3791 @@ -1075,7 +1079,16 @@ void snd_usb_handle_sync_urb(struct snd_usb_endpoint *ep,
    3792 if (f == 0)
    3793 return;
    3794
    3795 - if (unlikely(ep->freqshift == INT_MIN)) {
    3796 + if (unlikely(sender->udh01_fb_quirk)) {
    3797 + /*
    3798 + * The TEAC UD-H01 firmware sometimes changes the feedback value
    3799 + * by +/- 0x1.0000.
    3800 + */
    3801 + if (f < ep->freqn - 0x8000)
    3802 + f += 0x10000;
    3803 + else if (f > ep->freqn + 0x8000)
    3804 + f -= 0x10000;
    3805 + } else if (unlikely(ep->freqshift == INT_MIN)) {
    3806 /*
    3807 * The first time we see a feedback value, determine its format
    3808 * by shifting it left or right until it matches the nominal