From a45f941e5e8bdde1f5ec38951b20717d7c89436a Mon Sep 17 00:00:00 2001 From: Igor Pecovnik Date: Tue, 14 Jun 2016 11:06:04 +0200 Subject: [PATCH] Kernel 3.10 upstram patch. Marvell Armada and Odroid C1 legacy kernels --- .../marvell-default/patch-3.10.101-102.patch | 4381 +++++++++++++++++ .../odroidc1-default/patch-3.10.101-102.patch | 4381 +++++++++++++++++ 2 files changed, 8762 insertions(+) create mode 100644 patch/kernel/marvell-default/patch-3.10.101-102.patch create mode 100644 patch/kernel/odroidc1-default/patch-3.10.101-102.patch diff --git a/patch/kernel/marvell-default/patch-3.10.101-102.patch b/patch/kernel/marvell-default/patch-3.10.101-102.patch new file mode 100644 index 000000000..af1472cd2 --- /dev/null +++ b/patch/kernel/marvell-default/patch-3.10.101-102.patch @@ -0,0 +1,4381 @@ +diff --git a/MAINTAINERS b/MAINTAINERS +index 48c748080c96..29d7d74a8d04 100644 +--- a/MAINTAINERS ++++ b/MAINTAINERS +@@ -3032,8 +3032,8 @@ F: Documentation/x86/efi-stub.txt + F: arch/ia64/kernel/efi.c + F: arch/x86/boot/compressed/eboot.[ch] + F: arch/x86/include/asm/efi.h +-F: arch/x86/platform/efi/* +-F: drivers/firmware/efi/* ++F: arch/x86/platform/efi/ ++F: drivers/firmware/efi/ + F: include/linux/efi*.h + + EFI VARIABLE FILESYSTEM +diff --git a/Makefile b/Makefile +index 4be9e643cef0..868093c16ae0 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 10 +-SUBLEVEL = 101 ++SUBLEVEL = 102 + EXTRAVERSION = + NAME = TOSSUG Baby Fish + +diff --git a/arch/arm/mach-omap2/cpuidle34xx.c b/arch/arm/mach-omap2/cpuidle34xx.c +index e18709d3b95d..38e1bdcaf015 100644 +--- a/arch/arm/mach-omap2/cpuidle34xx.c ++++ b/arch/arm/mach-omap2/cpuidle34xx.c +@@ -34,6 +34,7 @@ + #include "pm.h" + #include "control.h" + #include "common.h" ++#include "soc.h" + + /* Mach specific information to be recorded in the C-state driver_data */ + struct omap3_idle_statedata { +@@ -322,6 +323,69 @@ static struct cpuidle_driver omap3_idle_driver = { + .safe_state_index = 0, + }; + ++/* ++ * Numbers based on measurements made in October 2009 for PM optimized kernel ++ * with CPU freq enabled on device Nokia N900. Assumes OPP2 (main idle OPP, ++ * and worst case latencies). ++ */ ++static struct cpuidle_driver omap3430_idle_driver = { ++ .name = "omap3430_idle", ++ .owner = THIS_MODULE, ++ .states = { ++ { ++ .enter = omap3_enter_idle_bm, ++ .exit_latency = 110 + 162, ++ .target_residency = 5, ++ .name = "C1", ++ .desc = "MPU ON + CORE ON", ++ }, ++ { ++ .enter = omap3_enter_idle_bm, ++ .exit_latency = 106 + 180, ++ .target_residency = 309, ++ .name = "C2", ++ .desc = "MPU ON + CORE ON", ++ }, ++ { ++ .enter = omap3_enter_idle_bm, ++ .exit_latency = 107 + 410, ++ .target_residency = 46057, ++ .name = "C3", ++ .desc = "MPU RET + CORE ON", ++ }, ++ { ++ .enter = omap3_enter_idle_bm, ++ .exit_latency = 121 + 3374, ++ .target_residency = 46057, ++ .name = "C4", ++ .desc = "MPU OFF + CORE ON", ++ }, ++ { ++ .enter = omap3_enter_idle_bm, ++ .exit_latency = 855 + 1146, ++ .target_residency = 46057, ++ .name = "C5", ++ .desc = "MPU RET + CORE RET", ++ }, ++ { ++ .enter = omap3_enter_idle_bm, ++ .exit_latency = 7580 + 4134, ++ .target_residency = 484329, ++ .name = "C6", ++ .desc = "MPU OFF + CORE RET", ++ }, ++ { ++ .enter = omap3_enter_idle_bm, ++ .exit_latency = 7505 + 15274, ++ .target_residency = 484329, ++ .name = "C7", ++ .desc = "MPU OFF + CORE OFF", ++ }, ++ }, ++ .state_count = ARRAY_SIZE(omap3_idle_data), ++ .safe_state_index = 0, ++}; ++ + /* Public functions */ + + /** +@@ -340,5 +404,8 @@ int __init omap3_idle_init(void) + if (!mpu_pd || !core_pd || !per_pd || !cam_pd) + return -ENODEV; + +- return cpuidle_register(&omap3_idle_driver, NULL); ++ if (cpu_is_omap3430()) ++ return cpuidle_register(&omap3430_idle_driver, NULL); ++ else ++ return cpuidle_register(&omap3_idle_driver, NULL); + } +diff --git a/arch/arm/mach-omap2/sleep34xx.S b/arch/arm/mach-omap2/sleep34xx.S +index d1dedc8195ed..eafd120b53f1 100644 +--- a/arch/arm/mach-omap2/sleep34xx.S ++++ b/arch/arm/mach-omap2/sleep34xx.S +@@ -203,23 +203,8 @@ save_context_wfi: + */ + ldr r1, kernel_flush + blx r1 +- /* +- * The kernel doesn't interwork: v7_flush_dcache_all in particluar will +- * always return in Thumb state when CONFIG_THUMB2_KERNEL is enabled. +- * This sequence switches back to ARM. Note that .align may insert a +- * nop: bx pc needs to be word-aligned in order to work. +- */ +- THUMB( .thumb ) +- THUMB( .align ) +- THUMB( bx pc ) +- THUMB( nop ) +- .arm +- + b omap3_do_wfi +- +-/* +- * Local variables +- */ ++ENDPROC(omap34xx_cpu_suspend) + omap3_do_wfi_sram_addr: + .word omap3_do_wfi_sram + kernel_flush: +@@ -364,10 +349,7 @@ exit_nonoff_modes: + * =================================== + */ + ldmfd sp!, {r4 - r11, pc} @ restore regs and return +- +-/* +- * Local variables +- */ ++ENDPROC(omap3_do_wfi) + sdrc_power: + .word SDRC_POWER_V + cm_idlest1_core: +diff --git a/arch/arm/mach-socfpga/headsmp.S b/arch/arm/mach-socfpga/headsmp.S +index 9004bfb1756e..a6f5519072cc 100644 +--- a/arch/arm/mach-socfpga/headsmp.S ++++ b/arch/arm/mach-socfpga/headsmp.S +@@ -12,6 +12,7 @@ + + __CPUINIT + .arch armv7-a ++ .arm + + ENTRY(secondary_trampoline) + movw r2, #:lower16:cpu1start_addr +diff --git a/arch/parisc/kernel/parisc_ksyms.c b/arch/parisc/kernel/parisc_ksyms.c +index 568b2c61ea02..3cad8aadc69e 100644 +--- a/arch/parisc/kernel/parisc_ksyms.c ++++ b/arch/parisc/kernel/parisc_ksyms.c +@@ -47,11 +47,11 @@ EXPORT_SYMBOL(__cmpxchg_u64); + EXPORT_SYMBOL(lclear_user); + EXPORT_SYMBOL(lstrnlen_user); + +-/* Global fixups */ +-extern void fixup_get_user_skip_1(void); +-extern void fixup_get_user_skip_2(void); +-extern void fixup_put_user_skip_1(void); +-extern void fixup_put_user_skip_2(void); ++/* Global fixups - defined as int to avoid creation of function pointers */ ++extern int fixup_get_user_skip_1; ++extern int fixup_get_user_skip_2; ++extern int fixup_put_user_skip_1; ++extern int fixup_put_user_skip_2; + EXPORT_SYMBOL(fixup_get_user_skip_1); + EXPORT_SYMBOL(fixup_get_user_skip_2); + EXPORT_SYMBOL(fixup_put_user_skip_1); +diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c +index b3f87a3b4bce..0c329b2c5df4 100644 +--- a/arch/parisc/kernel/traps.c ++++ b/arch/parisc/kernel/traps.c +@@ -811,6 +811,9 @@ void notrace handle_interruption(int code, struct pt_regs *regs) + + if (fault_space == 0 && !in_atomic()) + { ++ /* Clean up and return if in exception table. */ ++ if (fixup_exception(regs)) ++ return; + pdc_chassis_send_status(PDC_CHASSIS_DIRECT_PANIC); + parisc_terminate("Kernel Fault", regs, code, fault_address); + } +diff --git a/arch/powerpc/include/uapi/asm/cputable.h b/arch/powerpc/include/uapi/asm/cputable.h +index de2c0e4ee1aa..67de80a8e178 100644 +--- a/arch/powerpc/include/uapi/asm/cputable.h ++++ b/arch/powerpc/include/uapi/asm/cputable.h +@@ -31,6 +31,7 @@ + #define PPC_FEATURE_PSERIES_PERFMON_COMPAT \ + 0x00000040 + ++/* Reserved - do not use 0x00000004 */ + #define PPC_FEATURE_TRUE_LE 0x00000002 + #define PPC_FEATURE_PPC_LE 0x00000001 + +diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c +index 8b6f7a99cce2..e8c45b7438e7 100644 +--- a/arch/powerpc/kernel/prom.c ++++ b/arch/powerpc/kernel/prom.c +@@ -159,7 +159,7 @@ static struct ibm_pa_feature { + {CPU_FTR_NOEXECUTE, 0, 0, 0, 6, 0}, + {CPU_FTR_NODSISRALIGN, 0, 0, 1, 1, 1}, + {0, MMU_FTR_CI_LARGE_PAGE, 0, 1, 2, 0}, +- {CPU_FTR_REAL_LE, PPC_FEATURE_TRUE_LE, 5, 0, 0}, ++ {CPU_FTR_REAL_LE, 0, PPC_FEATURE_TRUE_LE, 5, 0, 0}, + }; + + static void __init scan_features(unsigned long node, unsigned char *ftrs, +diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h +index 98b68c2f1a1c..b76c1bf6125d 100644 +--- a/arch/x86/include/asm/kvm_host.h ++++ b/arch/x86/include/asm/kvm_host.h +@@ -59,7 +59,7 @@ + (~(unsigned long)(X86_CR4_VME | X86_CR4_PVI | X86_CR4_TSD | X86_CR4_DE\ + | X86_CR4_PSE | X86_CR4_PAE | X86_CR4_MCE \ + | X86_CR4_PGE | X86_CR4_PCE | X86_CR4_OSFXSR | X86_CR4_PCIDE \ +- | X86_CR4_OSXSAVE | X86_CR4_SMEP | X86_CR4_RDWRGSFS \ ++ | X86_CR4_OSXSAVE | X86_CR4_SMEP | X86_CR4_FSGSBASE \ + | X86_CR4_OSXMMEXCPT | X86_CR4_VMXE)) + + #define CR8_RESERVED_BITS (~(unsigned long)X86_CR8_TPR) +diff --git a/arch/x86/include/asm/xen/hypervisor.h b/arch/x86/include/asm/xen/hypervisor.h +index 125f344f06a9..8ac93f05a8ea 100644 +--- a/arch/x86/include/asm/xen/hypervisor.h ++++ b/arch/x86/include/asm/xen/hypervisor.h +@@ -71,4 +71,6 @@ static inline bool xen_x2apic_para_available(void) + } + #endif + ++extern void xen_set_iopl_mask(unsigned mask); ++ + #endif /* _ASM_X86_XEN_HYPERVISOR_H */ +diff --git a/arch/x86/include/uapi/asm/processor-flags.h b/arch/x86/include/uapi/asm/processor-flags.h +index b16e6d28f149..180a0c3c224d 100644 +--- a/arch/x86/include/uapi/asm/processor-flags.h ++++ b/arch/x86/include/uapi/asm/processor-flags.h +@@ -2,75 +2,129 @@ + #define _UAPI_ASM_X86_PROCESSOR_FLAGS_H + /* Various flags defined: can be included from assembler. */ + ++#include ++ + /* + * EFLAGS bits + */ +-#define X86_EFLAGS_CF 0x00000001 /* Carry Flag */ +-#define X86_EFLAGS_FIXED 0x00000002 /* Bit 1 - always on */ +-#define X86_EFLAGS_PF 0x00000004 /* Parity Flag */ +-#define X86_EFLAGS_AF 0x00000010 /* Auxiliary carry Flag */ +-#define X86_EFLAGS_ZF 0x00000040 /* Zero Flag */ +-#define X86_EFLAGS_SF 0x00000080 /* Sign Flag */ +-#define X86_EFLAGS_TF 0x00000100 /* Trap Flag */ +-#define X86_EFLAGS_IF 0x00000200 /* Interrupt Flag */ +-#define X86_EFLAGS_DF 0x00000400 /* Direction Flag */ +-#define X86_EFLAGS_OF 0x00000800 /* Overflow Flag */ +-#define X86_EFLAGS_IOPL 0x00003000 /* IOPL mask */ +-#define X86_EFLAGS_NT 0x00004000 /* Nested Task */ +-#define X86_EFLAGS_RF 0x00010000 /* Resume Flag */ +-#define X86_EFLAGS_VM 0x00020000 /* Virtual Mode */ +-#define X86_EFLAGS_AC 0x00040000 /* Alignment Check */ +-#define X86_EFLAGS_VIF 0x00080000 /* Virtual Interrupt Flag */ +-#define X86_EFLAGS_VIP 0x00100000 /* Virtual Interrupt Pending */ +-#define X86_EFLAGS_ID 0x00200000 /* CPUID detection flag */ ++#define X86_EFLAGS_CF_BIT 0 /* Carry Flag */ ++#define X86_EFLAGS_CF _BITUL(X86_EFLAGS_CF_BIT) ++#define X86_EFLAGS_FIXED_BIT 1 /* Bit 1 - always on */ ++#define X86_EFLAGS_FIXED _BITUL(X86_EFLAGS_FIXED_BIT) ++#define X86_EFLAGS_PF_BIT 2 /* Parity Flag */ ++#define X86_EFLAGS_PF _BITUL(X86_EFLAGS_PF_BIT) ++#define X86_EFLAGS_AF_BIT 4 /* Auxiliary carry Flag */ ++#define X86_EFLAGS_AF _BITUL(X86_EFLAGS_AF_BIT) ++#define X86_EFLAGS_ZF_BIT 6 /* Zero Flag */ ++#define X86_EFLAGS_ZF _BITUL(X86_EFLAGS_ZF_BIT) ++#define X86_EFLAGS_SF_BIT 7 /* Sign Flag */ ++#define X86_EFLAGS_SF _BITUL(X86_EFLAGS_SF_BIT) ++#define X86_EFLAGS_TF_BIT 8 /* Trap Flag */ ++#define X86_EFLAGS_TF _BITUL(X86_EFLAGS_TF_BIT) ++#define X86_EFLAGS_IF_BIT 9 /* Interrupt Flag */ ++#define X86_EFLAGS_IF _BITUL(X86_EFLAGS_IF_BIT) ++#define X86_EFLAGS_DF_BIT 10 /* Direction Flag */ ++#define X86_EFLAGS_DF _BITUL(X86_EFLAGS_DF_BIT) ++#define X86_EFLAGS_OF_BIT 11 /* Overflow Flag */ ++#define X86_EFLAGS_OF _BITUL(X86_EFLAGS_OF_BIT) ++#define X86_EFLAGS_IOPL_BIT 12 /* I/O Privilege Level (2 bits) */ ++#define X86_EFLAGS_IOPL (_AC(3,UL) << X86_EFLAGS_IOPL_BIT) ++#define X86_EFLAGS_NT_BIT 14 /* Nested Task */ ++#define X86_EFLAGS_NT _BITUL(X86_EFLAGS_NT_BIT) ++#define X86_EFLAGS_RF_BIT 16 /* Resume Flag */ ++#define X86_EFLAGS_RF _BITUL(X86_EFLAGS_RF_BIT) ++#define X86_EFLAGS_VM_BIT 17 /* Virtual Mode */ ++#define X86_EFLAGS_VM _BITUL(X86_EFLAGS_VM_BIT) ++#define X86_EFLAGS_AC_BIT 18 /* Alignment Check/Access Control */ ++#define X86_EFLAGS_AC _BITUL(X86_EFLAGS_AC_BIT) ++#define X86_EFLAGS_AC_BIT 18 /* Alignment Check/Access Control */ ++#define X86_EFLAGS_AC _BITUL(X86_EFLAGS_AC_BIT) ++#define X86_EFLAGS_VIF_BIT 19 /* Virtual Interrupt Flag */ ++#define X86_EFLAGS_VIF _BITUL(X86_EFLAGS_VIF_BIT) ++#define X86_EFLAGS_VIP_BIT 20 /* Virtual Interrupt Pending */ ++#define X86_EFLAGS_VIP _BITUL(X86_EFLAGS_VIP_BIT) ++#define X86_EFLAGS_ID_BIT 21 /* CPUID detection */ ++#define X86_EFLAGS_ID _BITUL(X86_EFLAGS_ID_BIT) + + /* + * Basic CPU control in CR0 + */ +-#define X86_CR0_PE 0x00000001 /* Protection Enable */ +-#define X86_CR0_MP 0x00000002 /* Monitor Coprocessor */ +-#define X86_CR0_EM 0x00000004 /* Emulation */ +-#define X86_CR0_TS 0x00000008 /* Task Switched */ +-#define X86_CR0_ET 0x00000010 /* Extension Type */ +-#define X86_CR0_NE 0x00000020 /* Numeric Error */ +-#define X86_CR0_WP 0x00010000 /* Write Protect */ +-#define X86_CR0_AM 0x00040000 /* Alignment Mask */ +-#define X86_CR0_NW 0x20000000 /* Not Write-through */ +-#define X86_CR0_CD 0x40000000 /* Cache Disable */ +-#define X86_CR0_PG 0x80000000 /* Paging */ ++#define X86_CR0_PE_BIT 0 /* Protection Enable */ ++#define X86_CR0_PE _BITUL(X86_CR0_PE_BIT) ++#define X86_CR0_MP_BIT 1 /* Monitor Coprocessor */ ++#define X86_CR0_MP _BITUL(X86_CR0_MP_BIT) ++#define X86_CR0_EM_BIT 2 /* Emulation */ ++#define X86_CR0_EM _BITUL(X86_CR0_EM_BIT) ++#define X86_CR0_TS_BIT 3 /* Task Switched */ ++#define X86_CR0_TS _BITUL(X86_CR0_TS_BIT) ++#define X86_CR0_ET_BIT 4 /* Extension Type */ ++#define X86_CR0_ET _BITUL(X86_CR0_ET_BIT) ++#define X86_CR0_NE_BIT 5 /* Numeric Error */ ++#define X86_CR0_NE _BITUL(X86_CR0_NE_BIT) ++#define X86_CR0_WP_BIT 16 /* Write Protect */ ++#define X86_CR0_WP _BITUL(X86_CR0_WP_BIT) ++#define X86_CR0_AM_BIT 18 /* Alignment Mask */ ++#define X86_CR0_AM _BITUL(X86_CR0_AM_BIT) ++#define X86_CR0_NW_BIT 29 /* Not Write-through */ ++#define X86_CR0_NW _BITUL(X86_CR0_NW_BIT) ++#define X86_CR0_CD_BIT 30 /* Cache Disable */ ++#define X86_CR0_CD _BITUL(X86_CR0_CD_BIT) ++#define X86_CR0_PG_BIT 31 /* Paging */ ++#define X86_CR0_PG _BITUL(X86_CR0_PG_BIT) + + /* + * Paging options in CR3 + */ +-#define X86_CR3_PWT 0x00000008 /* Page Write Through */ +-#define X86_CR3_PCD 0x00000010 /* Page Cache Disable */ +-#define X86_CR3_PCID_MASK 0x00000fff /* PCID Mask */ ++#define X86_CR3_PWT_BIT 3 /* Page Write Through */ ++#define X86_CR3_PWT _BITUL(X86_CR3_PWT_BIT) ++#define X86_CR3_PCD_BIT 4 /* Page Cache Disable */ ++#define X86_CR3_PCD _BITUL(X86_CR3_PCD_BIT) ++#define X86_CR3_PCID_MASK _AC(0x00000fff,UL) /* PCID Mask */ + + /* + * Intel CPU features in CR4 + */ +-#define X86_CR4_VME 0x00000001 /* enable vm86 extensions */ +-#define X86_CR4_PVI 0x00000002 /* virtual interrupts flag enable */ +-#define X86_CR4_TSD 0x00000004 /* disable time stamp at ipl 3 */ +-#define X86_CR4_DE 0x00000008 /* enable debugging extensions */ +-#define X86_CR4_PSE 0x00000010 /* enable page size extensions */ +-#define X86_CR4_PAE 0x00000020 /* enable physical address extensions */ +-#define X86_CR4_MCE 0x00000040 /* Machine check enable */ +-#define X86_CR4_PGE 0x00000080 /* enable global pages */ +-#define X86_CR4_PCE 0x00000100 /* enable performance counters at ipl 3 */ +-#define X86_CR4_OSFXSR 0x00000200 /* enable fast FPU save and restore */ +-#define X86_CR4_OSXMMEXCPT 0x00000400 /* enable unmasked SSE exceptions */ +-#define X86_CR4_VMXE 0x00002000 /* enable VMX virtualization */ +-#define X86_CR4_RDWRGSFS 0x00010000 /* enable RDWRGSFS support */ +-#define X86_CR4_PCIDE 0x00020000 /* enable PCID support */ +-#define X86_CR4_OSXSAVE 0x00040000 /* enable xsave and xrestore */ +-#define X86_CR4_SMEP 0x00100000 /* enable SMEP support */ +-#define X86_CR4_SMAP 0x00200000 /* enable SMAP support */ ++#define X86_CR4_VME_BIT 0 /* enable vm86 extensions */ ++#define X86_CR4_VME _BITUL(X86_CR4_VME_BIT) ++#define X86_CR4_PVI_BIT 1 /* virtual interrupts flag enable */ ++#define X86_CR4_PVI _BITUL(X86_CR4_PVI_BIT) ++#define X86_CR4_TSD_BIT 2 /* disable time stamp at ipl 3 */ ++#define X86_CR4_TSD _BITUL(X86_CR4_TSD_BIT) ++#define X86_CR4_DE_BIT 3 /* enable debugging extensions */ ++#define X86_CR4_DE _BITUL(X86_CR4_DE_BIT) ++#define X86_CR4_PSE_BIT 4 /* enable page size extensions */ ++#define X86_CR4_PSE _BITUL(X86_CR4_PSE_BIT) ++#define X86_CR4_PAE_BIT 5 /* enable physical address extensions */ ++#define X86_CR4_PAE _BITUL(X86_CR4_PAE_BIT) ++#define X86_CR4_MCE_BIT 6 /* Machine check enable */ ++#define X86_CR4_MCE _BITUL(X86_CR4_MCE_BIT) ++#define X86_CR4_PGE_BIT 7 /* enable global pages */ ++#define X86_CR4_PGE _BITUL(X86_CR4_PGE_BIT) ++#define X86_CR4_PCE_BIT 8 /* enable performance counters at ipl 3 */ ++#define X86_CR4_PCE _BITUL(X86_CR4_PCE_BIT) ++#define X86_CR4_OSFXSR_BIT 9 /* enable fast FPU save and restore */ ++#define X86_CR4_OSFXSR _BITUL(X86_CR4_OSFXSR_BIT) ++#define X86_CR4_OSXMMEXCPT_BIT 10 /* enable unmasked SSE exceptions */ ++#define X86_CR4_OSXMMEXCPT _BITUL(X86_CR4_OSXMMEXCPT_BIT) ++#define X86_CR4_VMXE_BIT 13 /* enable VMX virtualization */ ++#define X86_CR4_VMXE _BITUL(X86_CR4_VMXE_BIT) ++#define X86_CR4_SMXE_BIT 14 /* enable safer mode (TXT) */ ++#define X86_CR4_SMXE _BITUL(X86_CR4_SMXE_BIT) ++#define X86_CR4_FSGSBASE_BIT 16 /* enable RDWRFSGS support */ ++#define X86_CR4_FSGSBASE _BITUL(X86_CR4_FSGSBASE_BIT) ++#define X86_CR4_PCIDE_BIT 17 /* enable PCID support */ ++#define X86_CR4_PCIDE _BITUL(X86_CR4_PCIDE_BIT) ++#define X86_CR4_OSXSAVE_BIT 18 /* enable xsave and xrestore */ ++#define X86_CR4_OSXSAVE _BITUL(X86_CR4_OSXSAVE_BIT) ++#define X86_CR4_SMEP_BIT 20 /* enable SMEP support */ ++#define X86_CR4_SMEP _BITUL(X86_CR4_SMEP_BIT) ++#define X86_CR4_SMAP_BIT 21 /* enable SMAP support */ ++#define X86_CR4_SMAP _BITUL(X86_CR4_SMAP_BIT) + + /* + * x86-64 Task Priority Register, CR8 + */ +-#define X86_CR8_TPR 0x0000000F /* task priority register */ ++#define X86_CR8_TPR _AC(0x0000000f,UL) /* task priority register */ + + /* + * AMD and Transmeta use MSRs for configuration; see +diff --git a/arch/x86/kernel/cpu/perf_event.h b/arch/x86/kernel/cpu/perf_event.h +index ba9aadfa683b..5fd0bbe1aeb0 100644 +--- a/arch/x86/kernel/cpu/perf_event.h ++++ b/arch/x86/kernel/cpu/perf_event.h +@@ -665,6 +665,8 @@ void intel_pmu_lbr_init_atom(void); + + void intel_pmu_lbr_init_snb(void); + ++void intel_pmu_pebs_data_source_nhm(void); ++ + int intel_pmu_setup_lbr_filter(struct perf_event *event); + + int p4_pmu_init(void); +diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c +index 6d6bb6f4fd43..ac057583282a 100644 +--- a/arch/x86/kernel/cpu/perf_event_intel.c ++++ b/arch/x86/kernel/cpu/perf_event_intel.c +@@ -2088,6 +2088,7 @@ __init int intel_pmu_init(void) + intel_perfmon_event_map[PERF_COUNT_HW_STALLED_CYCLES_BACKEND] = + X86_CONFIG(.event=0xb1, .umask=0x3f, .inv=1, .cmask=1); + ++ intel_pmu_pebs_data_source_nhm(); + x86_add_quirk(intel_nehalem_quirk); + + pr_cont("Nehalem events, "); +@@ -2133,6 +2134,7 @@ __init int intel_pmu_init(void) + intel_perfmon_event_map[PERF_COUNT_HW_STALLED_CYCLES_BACKEND] = + X86_CONFIG(.event=0xb1, .umask=0x3f, .inv=1, .cmask=1); + ++ intel_pmu_pebs_data_source_nhm(); + pr_cont("Westmere events, "); + break; + +diff --git a/arch/x86/kernel/cpu/perf_event_intel_ds.c b/arch/x86/kernel/cpu/perf_event_intel_ds.c +index 60250f687052..17b090a298b4 100644 +--- a/arch/x86/kernel/cpu/perf_event_intel_ds.c ++++ b/arch/x86/kernel/cpu/perf_event_intel_ds.c +@@ -50,7 +50,8 @@ union intel_x86_pebs_dse { + #define OP_LH (P(OP, LOAD) | P(LVL, HIT)) + #define SNOOP_NONE_MISS (P(SNOOP, NONE) | P(SNOOP, MISS)) + +-static const u64 pebs_data_source[] = { ++/* Version for Sandy Bridge and later */ ++static u64 pebs_data_source[] = { + P(OP, LOAD) | P(LVL, MISS) | P(LVL, L3) | P(SNOOP, NA),/* 0x00:ukn L3 */ + OP_LH | P(LVL, L1) | P(SNOOP, NONE), /* 0x01: L1 local */ + OP_LH | P(LVL, LFB) | P(SNOOP, NONE), /* 0x02: LFB hit */ +@@ -69,6 +70,14 @@ static const u64 pebs_data_source[] = { + OP_LH | P(LVL, UNC) | P(SNOOP, NONE), /* 0x0f: uncached */ + }; + ++/* Patch up minor differences in the bits */ ++void __init intel_pmu_pebs_data_source_nhm(void) ++{ ++ pebs_data_source[0x05] = OP_LH | P(LVL, L3) | P(SNOOP, HIT); ++ pebs_data_source[0x06] = OP_LH | P(LVL, L3) | P(SNOOP, HITM); ++ pebs_data_source[0x07] = OP_LH | P(LVL, L3) | P(SNOOP, HITM); ++} ++ + static u64 precise_store_data(u64 status) + { + union intel_x86_pebs_dse dse; +diff --git a/arch/x86/kernel/ioport.c b/arch/x86/kernel/ioport.c +index 4ddaf66ea35f..792621a32457 100644 +--- a/arch/x86/kernel/ioport.c ++++ b/arch/x86/kernel/ioport.c +@@ -96,9 +96,14 @@ asmlinkage long sys_ioperm(unsigned long from, unsigned long num, int turn_on) + SYSCALL_DEFINE1(iopl, unsigned int, level) + { + struct pt_regs *regs = current_pt_regs(); +- unsigned int old = (regs->flags >> 12) & 3; + struct thread_struct *t = ¤t->thread; + ++ /* ++ * Careful: the IOPL bits in regs->flags are undefined under Xen PV ++ * and changing them has no effect. ++ */ ++ unsigned int old = t->iopl >> X86_EFLAGS_IOPL_BIT; ++ + if (level > 3) + return -EINVAL; + /* Trying to gain more privileges? */ +@@ -106,8 +111,9 @@ SYSCALL_DEFINE1(iopl, unsigned int, level) + if (!capable(CAP_SYS_RAWIO)) + return -EPERM; + } +- regs->flags = (regs->flags & ~X86_EFLAGS_IOPL) | (level << 12); +- t->iopl = level << 12; ++ regs->flags = (regs->flags & ~X86_EFLAGS_IOPL) | ++ (level << X86_EFLAGS_IOPL_BIT); ++ t->iopl = level << X86_EFLAGS_IOPL_BIT; + set_iopl_mask(t->iopl); + + return 0; +diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c +index 7099ab1e075b..580001c2b69a 100644 +--- a/arch/x86/kernel/process_64.c ++++ b/arch/x86/kernel/process_64.c +@@ -49,6 +49,7 @@ + #include + #include + #include ++#include + + asmlinkage extern void ret_from_fork(void); + +@@ -412,6 +413,17 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p) + task_thread_info(prev_p)->flags & _TIF_WORK_CTXSW_PREV)) + __switch_to_xtra(prev_p, next_p, tss); + ++#ifdef CONFIG_XEN ++ /* ++ * On Xen PV, IOPL bits in pt_regs->flags have no effect, and ++ * current_pt_regs()->flags may not match the current task's ++ * intended IOPL. We need to switch it manually. ++ */ ++ if (unlikely(xen_pv_domain() && ++ prev->iopl != next->iopl)) ++ xen_set_iopl_mask(next->iopl); ++#endif ++ + return prev_p; + } + +diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c +index 1406ffde3e35..b0a706d063cb 100644 +--- a/arch/x86/kvm/i8254.c ++++ b/arch/x86/kvm/i8254.c +@@ -244,7 +244,7 @@ static void kvm_pit_ack_irq(struct kvm_irq_ack_notifier *kian) + * PIC is being reset. Handle it gracefully here + */ + atomic_inc(&ps->pending); +- else if (value > 0) ++ else if (value > 0 && ps->reinject) + /* in this case, we had multiple outstanding pit interrupts + * that we needed to inject. Reinject + */ +@@ -287,7 +287,9 @@ static void pit_do_work(struct kthread_work *work) + * last one has been acked. + */ + spin_lock(&ps->inject_lock); +- if (ps->irq_ack) { ++ if (!ps->reinject) ++ inject = 1; ++ else if (ps->irq_ack) { + ps->irq_ack = 0; + inject = 1; + } +@@ -316,10 +318,10 @@ static enum hrtimer_restart pit_timer_fn(struct hrtimer *data) + struct kvm_kpit_state *ps = container_of(data, struct kvm_kpit_state, timer); + struct kvm_pit *pt = ps->kvm->arch.vpit; + +- if (ps->reinject || !atomic_read(&ps->pending)) { ++ if (ps->reinject) + atomic_inc(&ps->pending); +- queue_kthread_work(&pt->worker, &pt->expired); +- } ++ ++ queue_kthread_work(&pt->worker, &pt->expired); + + if (ps->is_periodic) { + hrtimer_add_expires_ns(&ps->timer, ps->period); +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 7f2b6dec4b2b..3c0b085b4336 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -626,7 +626,7 @@ int kvm_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4) + if (!guest_cpuid_has_smep(vcpu) && (cr4 & X86_CR4_SMEP)) + return 1; + +- if (!guest_cpuid_has_fsgsbase(vcpu) && (cr4 & X86_CR4_RDWRGSFS)) ++ if (!guest_cpuid_has_fsgsbase(vcpu) && (cr4 & X86_CR4_FSGSBASE)) + return 1; + + if (is_long_mode(vcpu)) { +diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c +index 91cbe75a91d5..34511cf6baad 100644 +--- a/arch/x86/xen/enlighten.c ++++ b/arch/x86/xen/enlighten.c +@@ -952,7 +952,7 @@ static void xen_load_sp0(struct tss_struct *tss, + xen_mc_issue(PARAVIRT_LAZY_CPU); + } + +-static void xen_set_iopl_mask(unsigned mask) ++void xen_set_iopl_mask(unsigned mask) + { + struct physdev_set_iopl set_iopl; + +diff --git a/arch/xtensa/kernel/head.S b/arch/xtensa/kernel/head.S +index 7d740ebbe198..bb12d778f64f 100644 +--- a/arch/xtensa/kernel/head.S ++++ b/arch/xtensa/kernel/head.S +@@ -118,7 +118,7 @@ ENTRY(_startup) + wsr a0, icountlevel + + .set _index, 0 +- .rept XCHAL_NUM_DBREAK - 1 ++ .rept XCHAL_NUM_DBREAK + wsr a0, SREG_DBREAKC + _index + .set _index, _index + 1 + .endr +diff --git a/arch/xtensa/platforms/iss/console.c b/arch/xtensa/platforms/iss/console.c +index 70cb408bc20d..92d785fefb6d 100644 +--- a/arch/xtensa/platforms/iss/console.c ++++ b/arch/xtensa/platforms/iss/console.c +@@ -100,21 +100,23 @@ static void rs_poll(unsigned long priv) + { + struct tty_port *port = (struct tty_port *)priv; + int i = 0; ++ int rd = 1; + unsigned char c; + + spin_lock(&timer_lock); + + while (simc_poll(0)) { +- simc_read(0, &c, 1); ++ rd = simc_read(0, &c, 1); ++ if (rd <= 0) ++ break; + tty_insert_flip_char(port, c, TTY_NORMAL); + i++; + } + + if (i) + tty_flip_buffer_push(port); +- +- +- mod_timer(&serial_timer, jiffies + SERIAL_TIMER_VALUE); ++ if (rd) ++ mod_timer(&serial_timer, jiffies + SERIAL_TIMER_VALUE); + spin_unlock(&timer_lock); + } + +diff --git a/crypto/ahash.c b/crypto/ahash.c +index 857ae2b2a2a2..bcd5efc7eb4c 100644 +--- a/crypto/ahash.c ++++ b/crypto/ahash.c +@@ -64,8 +64,9 @@ static int hash_walk_new_entry(struct crypto_hash_walk *walk) + struct scatterlist *sg; + + sg = walk->sg; +- walk->pg = sg_page(sg); + walk->offset = sg->offset; ++ walk->pg = sg_page(walk->sg) + (walk->offset >> PAGE_SHIFT); ++ walk->offset = offset_in_page(walk->offset); + walk->entrylen = sg->length; + + if (walk->entrylen > walk->total) +diff --git a/crypto/gcm.c b/crypto/gcm.c +index b4c252066f7b..cd97cdd8cabe 100644 +--- a/crypto/gcm.c ++++ b/crypto/gcm.c +@@ -1173,6 +1173,9 @@ static struct aead_request *crypto_rfc4543_crypt(struct aead_request *req, + aead_request_set_tfm(subreq, ctx->child); + aead_request_set_callback(subreq, req->base.flags, crypto_rfc4543_done, + req); ++ if (!enc) ++ aead_request_set_callback(subreq, req->base.flags, ++ req->base.complete, req->base.data); + aead_request_set_crypt(subreq, cipher, cipher, enc ? 0 : authsize, iv); + aead_request_set_assoc(subreq, assoc, assoclen); + +diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c +index a9ffd44c18fe..2184259c386b 100644 +--- a/drivers/acpi/acpica/dsmethod.c ++++ b/drivers/acpi/acpica/dsmethod.c +@@ -267,6 +267,9 @@ acpi_ds_begin_method_execution(struct acpi_namespace_node *method_node, + obj_desc->method.mutex->mutex. + original_sync_level = + obj_desc->method.mutex->mutex.sync_level; ++ ++ obj_desc->method.mutex->mutex.thread_id = ++ acpi_os_get_thread_id(); + } + } + +diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c +index a5c987ae665d..d593fa5247f5 100644 +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -581,8 +581,8 @@ static void do_nbd_request(struct request_queue *q) + BUG_ON(nbd->magic != NBD_MAGIC); + + if (unlikely(!nbd->sock)) { +- dev_err(disk_to_dev(nbd->disk), +- "Attempted send on closed socket\n"); ++ dev_err_ratelimited(disk_to_dev(nbd->disk), ++ "Attempted send on closed socket\n"); + req->errors++; + nbd_end_request(req); + spin_lock_irq(q->queue_lock); +diff --git a/drivers/block/paride/pd.c b/drivers/block/paride/pd.c +index 19ad8f0c83ef..897b6b9e53b1 100644 +--- a/drivers/block/paride/pd.c ++++ b/drivers/block/paride/pd.c +@@ -126,7 +126,7 @@ + */ + #include + +-static bool verbose = 0; ++static int verbose = 0; + static int major = PD_MAJOR; + static char *name = PD_NAME; + static int cluster = 64; +@@ -161,7 +161,7 @@ enum {D_PRT, D_PRO, D_UNI, D_MOD, D_GEO, D_SBY, D_DLY, D_SLV}; + static DEFINE_MUTEX(pd_mutex); + static DEFINE_SPINLOCK(pd_lock); + +-module_param(verbose, bool, 0); ++module_param(verbose, int, 0); + module_param(major, int, 0); + module_param(name, charp, 0); + module_param(cluster, int, 0); +diff --git a/drivers/block/paride/pt.c b/drivers/block/paride/pt.c +index 2596042eb987..ada45058e04d 100644 +--- a/drivers/block/paride/pt.c ++++ b/drivers/block/paride/pt.c +@@ -117,7 +117,7 @@ + + */ + +-static bool verbose = 0; ++static int verbose = 0; + static int major = PT_MAJOR; + static char *name = PT_NAME; + static int disable = 0; +@@ -152,7 +152,7 @@ static int (*drives[4])[6] = {&drive0, &drive1, &drive2, &drive3}; + + #include + +-module_param(verbose, bool, 0); ++module_param(verbose, int, 0); + module_param(major, int, 0); + module_param(name, charp, 0); + module_param_array(drive0, int, NULL, 0); +diff --git a/drivers/bluetooth/hci_vhci.c b/drivers/bluetooth/hci_vhci.c +index d8b7aed6e4a9..f3ce1c4f83e0 100644 +--- a/drivers/bluetooth/hci_vhci.c ++++ b/drivers/bluetooth/hci_vhci.c +@@ -265,6 +265,7 @@ static int vhci_release(struct inode *inode, struct file *file) + hci_unregister_dev(hdev); + hci_free_dev(hdev); + ++ skb_queue_purge(&data->readq); + file->private_data = NULL; + kfree(data); + +diff --git a/drivers/clk/versatile/clk-sp810.c b/drivers/clk/versatile/clk-sp810.c +index b9e05bde0c06..a21e2fa66a2a 100644 +--- a/drivers/clk/versatile/clk-sp810.c ++++ b/drivers/clk/versatile/clk-sp810.c +@@ -141,6 +141,7 @@ void __init clk_sp810_of_setup(struct device_node *node) + const char *parent_names[2]; + char name[12]; + struct clk_init_data init; ++ static int instance; + int i; + + if (!sp810) { +@@ -172,7 +173,7 @@ void __init clk_sp810_of_setup(struct device_node *node) + init.num_parents = ARRAY_SIZE(parent_names); + + for (i = 0; i < ARRAY_SIZE(sp810->timerclken); i++) { +- snprintf(name, ARRAY_SIZE(name), "timerclken%d", i); ++ snprintf(name, sizeof(name), "sp810_%d_%d", instance, i); + + sp810->timerclken[i].sp810 = sp810; + sp810->timerclken[i].channel = i; +@@ -184,5 +185,6 @@ void __init clk_sp810_of_setup(struct device_node *node) + } + + of_clk_add_provider(node, clk_sp810_timerclken_of_get, sp810); ++ instance++; + } + CLK_OF_DECLARE(sp810, "arm,sp810", clk_sp810_of_setup); +diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c +index 8b3d90143514..19353112cf10 100644 +--- a/drivers/edac/amd64_edac.c ++++ b/drivers/edac/amd64_edac.c +@@ -1266,7 +1266,7 @@ static u64 f1x_get_norm_dct_addr(struct amd64_pvt *pvt, u8 range, + u64 chan_off; + u64 dram_base = get_dram_base(pvt, range); + u64 hole_off = f10_dhar_offset(pvt); +- u64 dct_sel_base_off = (pvt->dct_sel_hi & 0xFFFFFC00) << 16; ++ u64 dct_sel_base_off = (u64)(pvt->dct_sel_hi & 0xFFFFFC00) << 16; + + if (hi_rng) { + /* +diff --git a/drivers/edac/i7core_edac.c b/drivers/edac/i7core_edac.c +index 271818a5a33a..c4131a7a2b46 100644 +--- a/drivers/edac/i7core_edac.c ++++ b/drivers/edac/i7core_edac.c +@@ -1878,7 +1878,7 @@ static int i7core_mce_check_error(struct notifier_block *nb, unsigned long val, + + i7_dev = get_i7core_dev(mce->socketid); + if (!i7_dev) +- return NOTIFY_BAD; ++ return NOTIFY_DONE; + + mci = i7_dev->mci; + pvt = mci->pvt_info; +diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c +index 3bdefbfb4377..0d40f7f0c379 100644 +--- a/drivers/edac/sb_edac.c ++++ b/drivers/edac/sb_edac.c +@@ -1538,7 +1538,7 @@ static int sbridge_mce_check_error(struct notifier_block *nb, unsigned long val, + + mci = get_mci_for_node_id(mce->socketid); + if (!mci) +- return NOTIFY_BAD; ++ return NOTIFY_DONE; + pvt = mci->pvt_info; + + /* +diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c +index 9f82b5545edd..61e7ec5a742c 100644 +--- a/drivers/firmware/efi/vars.c ++++ b/drivers/firmware/efi/vars.c +@@ -202,29 +202,44 @@ static const struct variable_validate variable_validate[] = { + { NULL_GUID, "", NULL }, + }; + ++/* ++ * Check if @var_name matches the pattern given in @match_name. ++ * ++ * @var_name: an array of @len non-NUL characters. ++ * @match_name: a NUL-terminated pattern string, optionally ending in "*". A ++ * final "*" character matches any trailing characters @var_name, ++ * including the case when there are none left in @var_name. ++ * @match: on output, the number of non-wildcard characters in @match_name ++ * that @var_name matches, regardless of the return value. ++ * @return: whether @var_name fully matches @match_name. ++ */ + static bool + variable_matches(const char *var_name, size_t len, const char *match_name, + int *match) + { + for (*match = 0; ; (*match)++) { + char c = match_name[*match]; +- char u = var_name[*match]; + +- /* Wildcard in the matching name means we've matched */ +- if (c == '*') ++ switch (c) { ++ case '*': ++ /* Wildcard in @match_name means we've matched. */ + return true; + +- /* Case sensitive match */ +- if (!c && *match == len) +- return true; ++ case '\0': ++ /* @match_name has ended. Has @var_name too? */ ++ return (*match == len); + +- if (c != u) ++ default: ++ /* ++ * We've reached a non-wildcard char in @match_name. ++ * Continue only if there's an identical character in ++ * @var_name. ++ */ ++ if (*match < len && c == var_name[*match]) ++ continue; + return false; +- +- if (!c) +- return true; ++ } + } +- return true; + } + + bool +diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c +index 1b564d7e4191..5b8d868d8691 100644 +--- a/drivers/gpu/drm/radeon/atombios_encoders.c ++++ b/drivers/gpu/drm/radeon/atombios_encoders.c +@@ -870,8 +870,6 @@ atombios_dig_encoder_setup(struct drm_encoder *encoder, int action, int panel_mo + else + args.v1.ucLaneNum = 4; + +- if (ENCODER_MODE_IS_DP(args.v1.ucEncoderMode) && (dp_clock == 270000)) +- args.v1.ucConfig |= ATOM_ENCODER_CONFIG_DPLINKRATE_2_70GHZ; + switch (radeon_encoder->encoder_id) { + case ENCODER_OBJECT_ID_INTERNAL_UNIPHY: + args.v1.ucConfig = ATOM_ENCODER_CONFIG_V2_TRANSMITTER1; +@@ -888,6 +886,10 @@ atombios_dig_encoder_setup(struct drm_encoder *encoder, int action, int panel_mo + args.v1.ucConfig |= ATOM_ENCODER_CONFIG_LINKB; + else + args.v1.ucConfig |= ATOM_ENCODER_CONFIG_LINKA; ++ ++ if (ENCODER_MODE_IS_DP(args.v1.ucEncoderMode) && (dp_clock == 270000)) ++ args.v1.ucConfig |= ATOM_ENCODER_CONFIG_DPLINKRATE_2_70GHZ; ++ + break; + case 2: + case 3: +diff --git a/drivers/gpu/drm/radeon/radeon_sa.c b/drivers/gpu/drm/radeon/radeon_sa.c +index f0bac68254b7..8962411b5f2b 100644 +--- a/drivers/gpu/drm/radeon/radeon_sa.c ++++ b/drivers/gpu/drm/radeon/radeon_sa.c +@@ -349,8 +349,15 @@ int radeon_sa_bo_new(struct radeon_device *rdev, + /* see if we can skip over some allocations */ + } while (radeon_sa_bo_next_hole(sa_manager, fences, tries)); + ++ for (i = 0; i < RADEON_NUM_RINGS; ++i) { ++ if (fences[i]) ++ radeon_fence_ref(fences[i]); ++ } ++ + spin_unlock(&sa_manager->wq.lock); + r = radeon_fence_wait_any(rdev, fences, false); ++ for (i = 0; i < RADEON_NUM_RINGS; ++i) ++ radeon_fence_unref(&fences[i]); + spin_lock(&sa_manager->wq.lock); + /* if we have nothing to wait for block */ + if (r == -ENOENT && block) { +diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c +index 5da58e3899eb..92aef9824d6f 100644 +--- a/drivers/hid/usbhid/hid-core.c ++++ b/drivers/hid/usbhid/hid-core.c +@@ -988,14 +988,6 @@ static int usbhid_output_raw_report(struct hid_device *hid, __u8 *buf, size_t co + return ret; + } + +-static void usbhid_restart_queues(struct usbhid_device *usbhid) +-{ +- if (usbhid->urbout && !test_bit(HID_OUT_RUNNING, &usbhid->iofl)) +- usbhid_restart_out_queue(usbhid); +- if (!test_bit(HID_CTRL_RUNNING, &usbhid->iofl)) +- usbhid_restart_ctrl_queue(usbhid); +-} +- + static void hid_free_buffers(struct usb_device *dev, struct hid_device *hid) + { + struct usbhid_device *usbhid = hid->driver_data; +@@ -1412,6 +1404,37 @@ static void hid_cease_io(struct usbhid_device *usbhid) + usb_kill_urb(usbhid->urbout); + } + ++static void hid_restart_io(struct hid_device *hid) ++{ ++ struct usbhid_device *usbhid = hid->driver_data; ++ int clear_halt = test_bit(HID_CLEAR_HALT, &usbhid->iofl); ++ int reset_pending = test_bit(HID_RESET_PENDING, &usbhid->iofl); ++ ++ spin_lock_irq(&usbhid->lock); ++ clear_bit(HID_SUSPENDED, &usbhid->iofl); ++ usbhid_mark_busy(usbhid); ++ ++ if (clear_halt || reset_pending) ++ schedule_work(&usbhid->reset_work); ++ usbhid->retry_delay = 0; ++ spin_unlock_irq(&usbhid->lock); ++ ++ if (reset_pending || !test_bit(HID_STARTED, &usbhid->iofl)) ++ return; ++ ++ if (!clear_halt) { ++ if (hid_start_in(hid) < 0) ++ hid_io_error(hid); ++ } ++ ++ spin_lock_irq(&usbhid->lock); ++ if (usbhid->urbout && !test_bit(HID_OUT_RUNNING, &usbhid->iofl)) ++ usbhid_restart_out_queue(usbhid); ++ if (!test_bit(HID_CTRL_RUNNING, &usbhid->iofl)) ++ usbhid_restart_ctrl_queue(usbhid); ++ spin_unlock_irq(&usbhid->lock); ++} ++ + /* Treat USB reset pretty much the same as suspend/resume */ + static int hid_pre_reset(struct usb_interface *intf) + { +@@ -1461,14 +1484,14 @@ static int hid_post_reset(struct usb_interface *intf) + return 1; + } + ++ /* No need to do another reset or clear a halted endpoint */ + spin_lock_irq(&usbhid->lock); + clear_bit(HID_RESET_PENDING, &usbhid->iofl); ++ clear_bit(HID_CLEAR_HALT, &usbhid->iofl); + spin_unlock_irq(&usbhid->lock); + hid_set_idle(dev, intf->cur_altsetting->desc.bInterfaceNumber, 0, 0); +- status = hid_start_in(hid); +- if (status < 0) +- hid_io_error(hid); +- usbhid_restart_queues(usbhid); ++ ++ hid_restart_io(hid); + + return 0; + } +@@ -1491,25 +1514,9 @@ void usbhid_put_power(struct hid_device *hid) + #ifdef CONFIG_PM + static int hid_resume_common(struct hid_device *hid, bool driver_suspended) + { +- struct usbhid_device *usbhid = hid->driver_data; +- int status; +- +- spin_lock_irq(&usbhid->lock); +- clear_bit(HID_SUSPENDED, &usbhid->iofl); +- usbhid_mark_busy(usbhid); +- +- if (test_bit(HID_CLEAR_HALT, &usbhid->iofl) || +- test_bit(HID_RESET_PENDING, &usbhid->iofl)) +- schedule_work(&usbhid->reset_work); +- usbhid->retry_delay = 0; +- +- usbhid_restart_queues(usbhid); +- spin_unlock_irq(&usbhid->lock); +- +- status = hid_start_in(hid); +- if (status < 0) +- hid_io_error(hid); ++ int status = 0; + ++ hid_restart_io(hid); + if (driver_suspended && hid->driver && hid->driver->resume) + status = hid->driver->resume(hid); + return status; +@@ -1576,12 +1583,8 @@ static int hid_suspend(struct usb_interface *intf, pm_message_t message) + static int hid_resume(struct usb_interface *intf) + { + struct hid_device *hid = usb_get_intfdata (intf); +- struct usbhid_device *usbhid = hid->driver_data; + int status; + +- if (!test_bit(HID_STARTED, &usbhid->iofl)) +- return 0; +- + status = hid_resume_common(hid, true); + dev_dbg(&intf->dev, "resume status %d\n", status); + return 0; +@@ -1590,10 +1593,8 @@ static int hid_resume(struct usb_interface *intf) + static int hid_reset_resume(struct usb_interface *intf) + { + struct hid_device *hid = usb_get_intfdata(intf); +- struct usbhid_device *usbhid = hid->driver_data; + int status; + +- clear_bit(HID_SUSPENDED, &usbhid->iofl); + status = hid_post_reset(intf); + if (status >= 0 && hid->driver && hid->driver->reset_resume) { + int ret = hid->driver->reset_resume(hid); +diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c +index f445b0840d33..80754e2d8086 100644 +--- a/drivers/hv/vmbus_drv.c ++++ b/drivers/hv/vmbus_drv.c +@@ -32,6 +32,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -517,6 +518,39 @@ static void vmbus_flow_handler(unsigned int irq, struct irq_desc *desc) + desc->action->handler(irq, desc->action->dev_id); + } + ++#ifdef CONFIG_HOTPLUG_CPU ++static int hyperv_cpu_disable(void) ++{ ++ return -ENOSYS; ++} ++ ++static void hv_cpu_hotplug_quirk(bool vmbus_loaded) ++{ ++ static void *previous_cpu_disable; ++ ++ /* ++ * Offlining a CPU when running on newer hypervisors (WS2012R2, Win8, ++ * ...) is not supported at this moment as channel interrupts are ++ * distributed across all of them. ++ */ ++ ++ if ((vmbus_proto_version == VERSION_WS2008) || ++ (vmbus_proto_version == VERSION_WIN7)) ++ return; ++ ++ if (vmbus_loaded) { ++ previous_cpu_disable = smp_ops.cpu_disable; ++ smp_ops.cpu_disable = hyperv_cpu_disable; ++ pr_notice("CPU offlining is not supported by hypervisor\n"); ++ } else if (previous_cpu_disable) ++ smp_ops.cpu_disable = previous_cpu_disable; ++} ++#else ++static void hv_cpu_hotplug_quirk(bool vmbus_loaded) ++{ ++} ++#endif ++ + /* + * vmbus_bus_init -Main vmbus driver initialization routine. + * +@@ -572,6 +606,7 @@ static int vmbus_bus_init(int irq) + if (ret) + goto err_irq; + ++ hv_cpu_hotplug_quirk(true); + vmbus_request_offers(); + + return 0; +@@ -808,6 +843,7 @@ static void __exit vmbus_exit(void) + bus_unregister(&hv_bus); + hv_cleanup(); + acpi_bus_unregister_driver(&vmbus_acpi_driver); ++ hv_cpu_hotplug_quirk(false); + } + + +diff --git a/drivers/hwmon/max1111.c b/drivers/hwmon/max1111.c +index eda077de8a9f..f787f04a0d1a 100644 +--- a/drivers/hwmon/max1111.c ++++ b/drivers/hwmon/max1111.c +@@ -85,6 +85,9 @@ static struct max1111_data *the_max1111; + + int max1111_read_channel(int channel) + { ++ if (!the_max1111 || !the_max1111->spi) ++ return -ENODEV; ++ + return max1111_read(&the_max1111->spi->dev, channel); + } + EXPORT_SYMBOL(max1111_read_channel); +@@ -260,6 +263,9 @@ static int max1111_remove(struct spi_device *spi) + { + struct max1111_data *data = spi_get_drvdata(spi); + ++#ifdef CONFIG_SHARPSL_PM ++ the_max1111 = NULL; ++#endif + hwmon_device_unregister(data->hwmon_dev); + sysfs_remove_group(&spi->dev.kobj, &max1110_attr_group); + sysfs_remove_group(&spi->dev.kobj, &max1111_attr_group); +diff --git a/drivers/i2c/busses/i2c-cpm.c b/drivers/i2c/busses/i2c-cpm.c +index 3823623baa48..693e4ceb85ce 100644 +--- a/drivers/i2c/busses/i2c-cpm.c ++++ b/drivers/i2c/busses/i2c-cpm.c +@@ -120,8 +120,8 @@ struct cpm_i2c { + cbd_t __iomem *rbase; + u_char *txbuf[CPM_MAXBD]; + u_char *rxbuf[CPM_MAXBD]; +- u32 txdma[CPM_MAXBD]; +- u32 rxdma[CPM_MAXBD]; ++ dma_addr_t txdma[CPM_MAXBD]; ++ dma_addr_t rxdma[CPM_MAXBD]; + }; + + static irqreturn_t cpm_i2c_interrupt(int irq, void *dev_id) +diff --git a/drivers/input/misc/ati_remote2.c b/drivers/input/misc/ati_remote2.c +index f63341f20b91..e8c6a4842e91 100644 +--- a/drivers/input/misc/ati_remote2.c ++++ b/drivers/input/misc/ati_remote2.c +@@ -817,26 +817,49 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d + + ar2->udev = udev; + ++ /* Sanity check, first interface must have an endpoint */ ++ if (alt->desc.bNumEndpoints < 1 || !alt->endpoint) { ++ dev_err(&interface->dev, ++ "%s(): interface 0 must have an endpoint\n", __func__); ++ r = -ENODEV; ++ goto fail1; ++ } + ar2->intf[0] = interface; + ar2->ep[0] = &alt->endpoint[0].desc; + ++ /* Sanity check, the device must have two interfaces */ + ar2->intf[1] = usb_ifnum_to_if(udev, 1); ++ if ((udev->actconfig->desc.bNumInterfaces < 2) || !ar2->intf[1]) { ++ dev_err(&interface->dev, "%s(): need 2 interfaces, found %d\n", ++ __func__, udev->actconfig->desc.bNumInterfaces); ++ r = -ENODEV; ++ goto fail1; ++ } ++ + r = usb_driver_claim_interface(&ati_remote2_driver, ar2->intf[1], ar2); + if (r) + goto fail1; ++ ++ /* Sanity check, second interface must have an endpoint */ + alt = ar2->intf[1]->cur_altsetting; ++ if (alt->desc.bNumEndpoints < 1 || !alt->endpoint) { ++ dev_err(&interface->dev, ++ "%s(): interface 1 must have an endpoint\n", __func__); ++ r = -ENODEV; ++ goto fail2; ++ } + ar2->ep[1] = &alt->endpoint[0].desc; + + r = ati_remote2_urb_init(ar2); + if (r) +- goto fail2; ++ goto fail3; + + ar2->channel_mask = channel_mask; + ar2->mode_mask = mode_mask; + + r = ati_remote2_setup(ar2, ar2->channel_mask); + if (r) +- goto fail2; ++ goto fail3; + + usb_make_path(udev, ar2->phys, sizeof(ar2->phys)); + strlcat(ar2->phys, "/input0", sizeof(ar2->phys)); +@@ -845,11 +868,11 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d + + r = sysfs_create_group(&udev->dev.kobj, &ati_remote2_attr_group); + if (r) +- goto fail2; ++ goto fail3; + + r = ati_remote2_input_init(ar2); + if (r) +- goto fail3; ++ goto fail4; + + usb_set_intfdata(interface, ar2); + +@@ -857,10 +880,11 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d + + return 0; + +- fail3: ++ fail4: + sysfs_remove_group(&udev->dev.kobj, &ati_remote2_attr_group); +- fail2: ++ fail3: + ati_remote2_urb_cleanup(ar2); ++ fail2: + usb_driver_release_interface(&ati_remote2_driver, ar2->intf[1]); + fail1: + kfree(ar2); +diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c +index e204f26b0011..77164dc1bedd 100644 +--- a/drivers/input/misc/ims-pcu.c ++++ b/drivers/input/misc/ims-pcu.c +@@ -1433,6 +1433,8 @@ static int ims_pcu_parse_cdc_data(struct usb_interface *intf, struct ims_pcu *pc + + pcu->ctrl_intf = usb_ifnum_to_if(pcu->udev, + union_desc->bMasterInterface0); ++ if (!pcu->ctrl_intf) ++ return -EINVAL; + + alt = pcu->ctrl_intf->cur_altsetting; + pcu->ep_ctrl = &alt->endpoint[0].desc; +@@ -1440,6 +1442,8 @@ static int ims_pcu_parse_cdc_data(struct usb_interface *intf, struct ims_pcu *pc + + pcu->data_intf = usb_ifnum_to_if(pcu->udev, + union_desc->bSlaveInterface0); ++ if (!pcu->data_intf) ++ return -EINVAL; + + alt = pcu->data_intf->cur_altsetting; + if (alt->desc.bNumEndpoints != 2) { +diff --git a/drivers/input/misc/max8997_haptic.c b/drivers/input/misc/max8997_haptic.c +index e973133212a5..a8c91226cd22 100644 +--- a/drivers/input/misc/max8997_haptic.c ++++ b/drivers/input/misc/max8997_haptic.c +@@ -246,12 +246,14 @@ static int max8997_haptic_probe(struct platform_device *pdev) + struct max8997_dev *iodev = dev_get_drvdata(pdev->dev.parent); + const struct max8997_platform_data *pdata = + dev_get_platdata(iodev->dev); +- const struct max8997_haptic_platform_data *haptic_pdata = +- pdata->haptic_pdata; ++ const struct max8997_haptic_platform_data *haptic_pdata = NULL; + struct max8997_haptic *chip; + struct input_dev *input_dev; + int error; + ++ if (pdata) ++ haptic_pdata = pdata->haptic_pdata; ++ + if (!haptic_pdata) { + dev_err(&pdev->dev, "no haptic platform data\n"); + return -EINVAL; +diff --git a/drivers/input/misc/powermate.c b/drivers/input/misc/powermate.c +index 49c0c3ebd321..21ce1cf757bb 100644 +--- a/drivers/input/misc/powermate.c ++++ b/drivers/input/misc/powermate.c +@@ -308,6 +308,9 @@ static int powermate_probe(struct usb_interface *intf, const struct usb_device_i + int error = -ENOMEM; + + interface = intf->cur_altsetting; ++ if (interface->desc.bNumEndpoints < 1) ++ return -EINVAL; ++ + endpoint = &interface->endpoint[0].desc; + if (!usb_endpoint_is_int_in(endpoint)) + return -EIO; +diff --git a/drivers/input/tablet/gtco.c b/drivers/input/tablet/gtco.c +index 29e01ab6859f..a9f8f925ba2b 100644 +--- a/drivers/input/tablet/gtco.c ++++ b/drivers/input/tablet/gtco.c +@@ -869,6 +869,14 @@ static int gtco_probe(struct usb_interface *usbinterface, + goto err_free_buf; + } + ++ /* Sanity check that a device has an endpoint */ ++ if (usbinterface->altsetting[0].desc.bNumEndpoints < 1) { ++ dev_err(&usbinterface->dev, ++ "Invalid number of endpoints\n"); ++ error = -EINVAL; ++ goto err_free_urb; ++ } ++ + /* + * The endpoint is always altsetting 0, we know this since we know + * this device only has one interrupt endpoint +@@ -890,7 +898,7 @@ static int gtco_probe(struct usb_interface *usbinterface, + * HID report descriptor + */ + if (usb_get_extra_descriptor(usbinterface->cur_altsetting, +- HID_DEVICE_TYPE, &hid_desc) != 0){ ++ HID_DEVICE_TYPE, &hid_desc) != 0) { + dev_err(&usbinterface->dev, + "Can't retrieve exta USB descriptor to get hid report descriptor length\n"); + error = -EIO; +diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c +index 84ccf140c1bb..9332e46b53ed 100644 +--- a/drivers/input/touchscreen/ads7846.c ++++ b/drivers/input/touchscreen/ads7846.c +@@ -697,18 +697,22 @@ static int ads7846_no_filter(void *ads, int data_idx, int *val) + + static int ads7846_get_value(struct ads7846 *ts, struct spi_message *m) + { ++ int value; + struct spi_transfer *t = + list_entry(m->transfers.prev, struct spi_transfer, transfer_list); + + if (ts->model == 7845) { +- return be16_to_cpup((__be16 *)&(((char*)t->rx_buf)[1])) >> 3; ++ value = be16_to_cpup((__be16 *)&(((char *)t->rx_buf)[1])); + } else { + /* + * adjust: on-wire is a must-ignore bit, a BE12 value, then + * padding; built from two 8 bit values written msb-first. + */ +- return be16_to_cpup((__be16 *)t->rx_buf) >> 3; ++ value = be16_to_cpup((__be16 *)t->rx_buf); + } ++ ++ /* enforce ADC output is 12 bits width */ ++ return (value >> 3) & 0xfff; + } + + static void ads7846_update_value(struct spi_message *m, int val) +diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c +index 2d2915fdbf02..2a4c13af482a 100644 +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -1295,6 +1295,9 @@ static void cache_set_flush(struct closure *cl) + set_bit(CACHE_SET_STOPPING_2, &c->flags); + wake_up(&c->alloc_wait); + ++ if (!c) ++ closure_return(cl); ++ + bch_cache_accounting_destroy(&c->accounting); + + kobject_put(&c->internal); +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index ef18ca745b1e..9ee3c460fa37 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -5658,8 +5658,8 @@ static int run(struct mddev *mddev) + } + + if (discard_supported && +- mddev->queue->limits.max_discard_sectors >= stripe && +- mddev->queue->limits.discard_granularity >= stripe) ++ mddev->queue->limits.max_discard_sectors >= (stripe >> 9) && ++ mddev->queue->limits.discard_granularity >= stripe) + queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, + mddev->queue); + else +diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c +index e2633d9270b7..aa4519e5cafa 100644 +--- a/drivers/media/pci/bt8xx/bttv-driver.c ++++ b/drivers/media/pci/bt8xx/bttv-driver.c +@@ -2376,6 +2376,19 @@ static int bttv_g_fmt_vid_overlay(struct file *file, void *priv, + return 0; + } + ++static void bttv_get_width_mask_vid_cap(const struct bttv_format *fmt, ++ unsigned int *width_mask, ++ unsigned int *width_bias) ++{ ++ if (fmt->flags & FORMAT_FLAGS_PLANAR) { ++ *width_mask = ~15; /* width must be a multiple of 16 pixels */ ++ *width_bias = 8; /* nearest */ ++ } else { ++ *width_mask = ~3; /* width must be a multiple of 4 pixels */ ++ *width_bias = 2; /* nearest */ ++ } ++} ++ + static int bttv_try_fmt_vid_cap(struct file *file, void *priv, + struct v4l2_format *f) + { +@@ -2385,6 +2398,7 @@ static int bttv_try_fmt_vid_cap(struct file *file, void *priv, + enum v4l2_field field; + __s32 width, height; + __s32 height2; ++ unsigned int width_mask, width_bias; + int rc; + + fmt = format_by_fourcc(f->fmt.pix.pixelformat); +@@ -2417,9 +2431,9 @@ static int bttv_try_fmt_vid_cap(struct file *file, void *priv, + width = f->fmt.pix.width; + height = f->fmt.pix.height; + ++ bttv_get_width_mask_vid_cap(fmt, &width_mask, &width_bias); + rc = limit_scaled_size_lock(fh, &width, &height, field, +- /* width_mask: 4 pixels */ ~3, +- /* width_bias: nearest */ 2, ++ width_mask, width_bias, + /* adjust_size */ 1, + /* adjust_crop */ 0); + if (0 != rc) +@@ -2452,6 +2466,7 @@ static int bttv_s_fmt_vid_cap(struct file *file, void *priv, + struct bttv_fh *fh = priv; + struct bttv *btv = fh->btv; + __s32 width, height; ++ unsigned int width_mask, width_bias; + enum v4l2_field field; + + retval = bttv_switch_type(fh, f->type); +@@ -2466,9 +2481,10 @@ static int bttv_s_fmt_vid_cap(struct file *file, void *priv, + height = f->fmt.pix.height; + field = f->fmt.pix.field; + ++ fmt = format_by_fourcc(f->fmt.pix.pixelformat); ++ bttv_get_width_mask_vid_cap(fmt, &width_mask, &width_bias); + retval = limit_scaled_size_lock(fh, &width, &height, f->fmt.pix.field, +- /* width_mask: 4 pixels */ ~3, +- /* width_bias: nearest */ 2, ++ width_mask, width_bias, + /* adjust_size */ 1, + /* adjust_crop */ 1); + if (0 != retval) +@@ -2476,8 +2492,6 @@ static int bttv_s_fmt_vid_cap(struct file *file, void *priv, + + f->fmt.pix.field = field; + +- fmt = format_by_fourcc(f->fmt.pix.pixelformat); +- + /* update our state informations */ + fh->fmt = fmt; + fh->cap.field = f->fmt.pix.field; +diff --git a/drivers/media/usb/pwc/pwc-if.c b/drivers/media/usb/pwc/pwc-if.c +index 77bbf7889659..db1e8ee13ded 100644 +--- a/drivers/media/usb/pwc/pwc-if.c ++++ b/drivers/media/usb/pwc/pwc-if.c +@@ -91,6 +91,7 @@ static const struct usb_device_id pwc_device_table [] = { + { USB_DEVICE(0x0471, 0x0312) }, + { USB_DEVICE(0x0471, 0x0313) }, /* the 'new' 720K */ + { USB_DEVICE(0x0471, 0x0329) }, /* Philips SPC 900NC PC Camera */ ++ { USB_DEVICE(0x0471, 0x032C) }, /* Philips SPC 880NC PC Camera */ + { USB_DEVICE(0x069A, 0x0001) }, /* Askey */ + { USB_DEVICE(0x046D, 0x08B0) }, /* Logitech QuickCam Pro 3000 */ + { USB_DEVICE(0x046D, 0x08B1) }, /* Logitech QuickCam Notebook Pro */ +@@ -799,6 +800,11 @@ static int usb_pwc_probe(struct usb_interface *intf, const struct usb_device_id + name = "Philips SPC 900NC webcam"; + type_id = 740; + break; ++ case 0x032C: ++ PWC_INFO("Philips SPC 880NC USB webcam detected.\n"); ++ name = "Philips SPC 880NC webcam"; ++ type_id = 740; ++ break; + default: + return -ENODEV; + break; +diff --git a/drivers/media/usb/usbvision/usbvision-video.c b/drivers/media/usb/usbvision/usbvision-video.c +index d34c2afe2c24..bcfefe61a592 100644 +--- a/drivers/media/usb/usbvision/usbvision-video.c ++++ b/drivers/media/usb/usbvision/usbvision-video.c +@@ -1459,6 +1459,7 @@ static void usbvision_release(struct usb_usbvision *usbvision) + + usbvision_remove_sysfs(usbvision->vdev); + usbvision_unregister_video(usbvision); ++ kfree(usbvision->alt_max_pkt_size); + + usb_free_urb(usbvision->ctrl_urb); + +@@ -1520,7 +1521,7 @@ static int usbvision_probe(struct usb_interface *intf, + const struct usb_host_interface *interface; + struct usb_usbvision *usbvision = NULL; + const struct usb_endpoint_descriptor *endpoint; +- int model, i; ++ int model, i, ret; + + PDEBUG(DBG_PROBE, "VID=%#04x, PID=%#04x, ifnum=%u", + dev->descriptor.idVendor, +@@ -1529,33 +1530,51 @@ static int usbvision_probe(struct usb_interface *intf, + model = devid->driver_info; + if (model < 0 || model >= usbvision_device_data_size) { + PDEBUG(DBG_PROBE, "model out of bounds %d", model); +- return -ENODEV; ++ ret = -ENODEV; ++ goto err_usb; + } + printk(KERN_INFO "%s: %s found\n", __func__, + usbvision_device_data[model].model_string); + + if (usbvision_device_data[model].interface >= 0) + interface = &dev->actconfig->interface[usbvision_device_data[model].interface]->altsetting[0]; +- else ++ else if (ifnum < dev->actconfig->desc.bNumInterfaces) + interface = &dev->actconfig->interface[ifnum]->altsetting[0]; ++ else { ++ dev_err(&intf->dev, "interface %d is invalid, max is %d\n", ++ ifnum, dev->actconfig->desc.bNumInterfaces - 1); ++ ret = -ENODEV; ++ goto err_usb; ++ } ++ ++ if (interface->desc.bNumEndpoints < 2) { ++ dev_err(&intf->dev, "interface %d has %d endpoints, but must" ++ " have minimum 2\n", ifnum, interface->desc.bNumEndpoints); ++ ret = -ENODEV; ++ goto err_usb; ++ } + endpoint = &interface->endpoint[1].desc; ++ + if (!usb_endpoint_xfer_isoc(endpoint)) { + dev_err(&intf->dev, "%s: interface %d. has non-ISO endpoint!\n", + __func__, ifnum); + dev_err(&intf->dev, "%s: Endpoint attributes %d", + __func__, endpoint->bmAttributes); +- return -ENODEV; ++ ret = -ENODEV; ++ goto err_usb; + } + if (usb_endpoint_dir_out(endpoint)) { + dev_err(&intf->dev, "%s: interface %d. has ISO OUT endpoint!\n", + __func__, ifnum); +- return -ENODEV; ++ ret = -ENODEV; ++ goto err_usb; + } + + usbvision = usbvision_alloc(dev, intf); + if (usbvision == NULL) { + dev_err(&intf->dev, "%s: couldn't allocate USBVision struct\n", __func__); +- return -ENOMEM; ++ ret = -ENOMEM; ++ goto err_usb; + } + + if (dev->descriptor.bNumConfigurations > 1) +@@ -1574,7 +1593,8 @@ static int usbvision_probe(struct usb_interface *intf, + usbvision->alt_max_pkt_size = kmalloc(32 * usbvision->num_alt, GFP_KERNEL); + if (usbvision->alt_max_pkt_size == NULL) { + dev_err(&intf->dev, "usbvision: out of memory!\n"); +- return -ENOMEM; ++ ret = -ENOMEM; ++ goto err_pkt; + } + + for (i = 0; i < usbvision->num_alt; i++) { +@@ -1609,6 +1629,12 @@ static int usbvision_probe(struct usb_interface *intf, + + PDEBUG(DBG_PROBE, "success"); + return 0; ++ ++err_pkt: ++ usbvision_release(usbvision); ++err_usb: ++ usb_put_dev(dev); ++ return ret; + } + + +diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c +index 35fb8f0cb539..07d6ce4c9c6f 100644 +--- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c ++++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c +@@ -392,7 +392,8 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user + get_user(kp->index, &up->index) || + get_user(kp->type, &up->type) || + get_user(kp->flags, &up->flags) || +- get_user(kp->memory, &up->memory)) ++ get_user(kp->memory, &up->memory) || ++ get_user(kp->length, &up->length)) + return -EFAULT; + + if (V4L2_TYPE_IS_OUTPUT(kp->type)) +@@ -404,9 +405,6 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user + return -EFAULT; + + if (V4L2_TYPE_IS_MULTIPLANAR(kp->type)) { +- if (get_user(kp->length, &up->length)) +- return -EFAULT; +- + num_planes = kp->length; + if (num_planes == 0) { + kp->m.planes = NULL; +@@ -439,16 +437,14 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user + } else { + switch (kp->memory) { + case V4L2_MEMORY_MMAP: +- if (get_user(kp->length, &up->length) || +- get_user(kp->m.offset, &up->m.offset)) ++ if (get_user(kp->m.offset, &up->m.offset)) + return -EFAULT; + break; + case V4L2_MEMORY_USERPTR: + { + compat_long_t tmp; + +- if (get_user(kp->length, &up->length) || +- get_user(tmp, &up->m.userptr)) ++ if (get_user(tmp, &up->m.userptr)) + return -EFAULT; + + kp->m.userptr = (unsigned long)compat_ptr(tmp); +@@ -490,7 +486,8 @@ static int put_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user + copy_to_user(&up->timecode, &kp->timecode, sizeof(struct v4l2_timecode)) || + put_user(kp->sequence, &up->sequence) || + put_user(kp->reserved2, &up->reserved2) || +- put_user(kp->reserved, &up->reserved)) ++ put_user(kp->reserved, &up->reserved) || ++ put_user(kp->length, &up->length)) + return -EFAULT; + + if (V4L2_TYPE_IS_MULTIPLANAR(kp->type)) { +@@ -513,13 +510,11 @@ static int put_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user + } else { + switch (kp->memory) { + case V4L2_MEMORY_MMAP: +- if (put_user(kp->length, &up->length) || +- put_user(kp->m.offset, &up->m.offset)) ++ if (put_user(kp->m.offset, &up->m.offset)) + return -EFAULT; + break; + case V4L2_MEMORY_USERPTR: +- if (put_user(kp->length, &up->length) || +- put_user(kp->m.userptr, &up->m.userptr)) ++ if (put_user(kp->m.userptr, &up->m.userptr)) + return -EFAULT; + break; + case V4L2_MEMORY_OVERLAY: +diff --git a/drivers/mfd/omap-usb-tll.c b/drivers/mfd/omap-usb-tll.c +index e59ac4cbac96..c7576a503e5b 100644 +--- a/drivers/mfd/omap-usb-tll.c ++++ b/drivers/mfd/omap-usb-tll.c +@@ -269,6 +269,8 @@ static int usbtll_omap_probe(struct platform_device *pdev) + + if (IS_ERR(tll->ch_clk[i])) + dev_dbg(dev, "can't get clock : %s\n", clkname); ++ else ++ clk_prepare(tll->ch_clk[i]); + } + + pm_runtime_put_sync(dev); +@@ -301,9 +303,12 @@ static int usbtll_omap_remove(struct platform_device *pdev) + tll_dev = NULL; + spin_unlock(&tll_lock); + +- for (i = 0; i < tll->nch; i++) +- if (!IS_ERR(tll->ch_clk[i])) ++ for (i = 0; i < tll->nch; i++) { ++ if (!IS_ERR(tll->ch_clk[i])) { ++ clk_unprepare(tll->ch_clk[i]); + clk_put(tll->ch_clk[i]); ++ } ++ } + + pm_runtime_disable(&pdev->dev); + return 0; +diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig +index c002d8660e30..7a6818407836 100644 +--- a/drivers/misc/Kconfig ++++ b/drivers/misc/Kconfig +@@ -451,7 +451,7 @@ config ARM_CHARLCD + still useful. + + config BMP085 +- bool ++ tristate + depends on SYSFS + + config BMP085_I2C +diff --git a/drivers/misc/ad525x_dpot.c b/drivers/misc/ad525x_dpot.c +index 8f99e8e3f0ac..beb7422c3cc7 100644 +--- a/drivers/misc/ad525x_dpot.c ++++ b/drivers/misc/ad525x_dpot.c +@@ -216,7 +216,7 @@ static s32 dpot_read_i2c(struct dpot_data *dpot, u8 reg) + */ + value = swab16(value); + +- if (dpot->uid == DPOT_UID(AD5271_ID)) ++ if (dpot->uid == DPOT_UID(AD5274_ID)) + value = value >> 2; + return value; + default: +diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c +index ebb40a292d67..c6bf23599eb9 100644 +--- a/drivers/mmc/card/block.c ++++ b/drivers/mmc/card/block.c +@@ -2322,11 +2322,12 @@ static const struct mmc_fixup blk_fixups[] = + MMC_QUIRK_BLK_NO_CMD23), + + /* +- * Some Micron MMC cards needs longer data read timeout than +- * indicated in CSD. ++ * Some MMC cards need longer data read timeout than indicated in CSD. + */ + MMC_FIXUP(CID_NAME_ANY, CID_MANFID_MICRON, 0x200, add_quirk_mmc, + MMC_QUIRK_LONG_READ_TIME), ++ MMC_FIXUP("008GE0", CID_MANFID_TOSHIBA, CID_OEMID_ANY, add_quirk_mmc, ++ MMC_QUIRK_LONG_READ_TIME), + + /* + * On these Samsung MoviNAND parts, performing secure erase or +diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c +index 68ab26385d06..3ae6f1325773 100644 +--- a/drivers/mmc/core/core.c ++++ b/drivers/mmc/core/core.c +@@ -801,11 +801,11 @@ void mmc_set_data_timeout(struct mmc_data *data, const struct mmc_card *card) + /* + * Some cards require longer data read timeout than indicated in CSD. + * Address this by setting the read timeout to a "reasonably high" +- * value. For the cards tested, 300ms has proven enough. If necessary, ++ * value. For the cards tested, 600ms has proven enough. If necessary, + * this value can be increased if other problematic cards require this. + */ + if (mmc_card_long_read_time(card) && data->flags & MMC_DATA_READ) { +- data->timeout_ns = 300000000; ++ data->timeout_ns = 600000000; + data->timeout_clks = 0; + } + +diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c +index 0cbd1effe960..dda1a42ae822 100644 +--- a/drivers/mmc/core/mmc.c ++++ b/drivers/mmc/core/mmc.c +@@ -266,6 +266,9 @@ static void mmc_select_card_type(struct mmc_card *card) + card->ext_csd.card_type = card_type; + } + ++/* Minimum partition switch timeout in milliseconds */ ++#define MMC_MIN_PART_SWITCH_TIME 300 ++ + /* + * Decode extended CSD. + */ +@@ -330,6 +333,10 @@ static int mmc_read_ext_csd(struct mmc_card *card, u8 *ext_csd) + + /* EXT_CSD value is in units of 10ms, but we store in ms */ + card->ext_csd.part_time = 10 * ext_csd[EXT_CSD_PART_SWITCH_TIME]; ++ /* Some eMMC set the value too low so set a minimum */ ++ if (card->ext_csd.part_time && ++ card->ext_csd.part_time < MMC_MIN_PART_SWITCH_TIME) ++ card->ext_csd.part_time = MMC_MIN_PART_SWITCH_TIME; + + /* Sleep / awake timeout in 100ns units */ + if (sa_shift > 0 && sa_shift <= 0x17) +diff --git a/drivers/mtd/onenand/onenand_base.c b/drivers/mtd/onenand/onenand_base.c +index b3f41f200622..0f13fd4748ec 100644 +--- a/drivers/mtd/onenand/onenand_base.c ++++ b/drivers/mtd/onenand/onenand_base.c +@@ -2610,6 +2610,7 @@ static int onenand_default_block_markbad(struct mtd_info *mtd, loff_t ofs) + */ + static int onenand_block_markbad(struct mtd_info *mtd, loff_t ofs) + { ++ struct onenand_chip *this = mtd->priv; + int ret; + + ret = onenand_block_isbad(mtd, ofs); +@@ -2621,7 +2622,7 @@ static int onenand_block_markbad(struct mtd_info *mtd, loff_t ofs) + } + + onenand_get_device(mtd, FL_WRITING); +- ret = mtd_block_markbad(mtd, ofs); ++ ret = this->block_markbad(mtd, ofs); + onenand_release_device(mtd); + return ret; + } +diff --git a/drivers/net/ethernet/atheros/atlx/atl2.c b/drivers/net/ethernet/atheros/atlx/atl2.c +index 265ce1b752ed..96fe542b4acb 100644 +--- a/drivers/net/ethernet/atheros/atlx/atl2.c ++++ b/drivers/net/ethernet/atheros/atlx/atl2.c +@@ -1413,7 +1413,7 @@ static int atl2_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + + err = -EIO; + +- netdev->hw_features = NETIF_F_SG | NETIF_F_HW_VLAN_CTAG_RX; ++ netdev->hw_features = NETIF_F_HW_VLAN_CTAG_RX; + netdev->features |= (NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_HW_VLAN_CTAG_RX); + + /* Init PHY as early as possible due to power saving issue */ +diff --git a/drivers/net/ethernet/jme.c b/drivers/net/ethernet/jme.c +index 070a6f1a0577..2f4cbcae9c7c 100644 +--- a/drivers/net/ethernet/jme.c ++++ b/drivers/net/ethernet/jme.c +@@ -3290,13 +3290,14 @@ jme_resume(struct device *dev) + jme_reset_phy_processor(jme); + jme_phy_calibration(jme); + jme_phy_setEA(jme); +- jme_start_irq(jme); + netif_device_attach(netdev); + + atomic_inc(&jme->link_changing); + + jme_reset_link(jme); + ++ jme_start_irq(jme); ++ + return 0; + } + +diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_main.c b/drivers/net/ethernet/qlogic/qlge/qlge_main.c +index f87cc216045b..a978cc2eafe0 100644 +--- a/drivers/net/ethernet/qlogic/qlge/qlge_main.c ++++ b/drivers/net/ethernet/qlogic/qlge/qlge_main.c +@@ -1620,7 +1620,18 @@ static void ql_process_mac_rx_skb(struct ql_adapter *qdev, + return; + } + skb_reserve(new_skb, NET_IP_ALIGN); ++ ++ pci_dma_sync_single_for_cpu(qdev->pdev, ++ dma_unmap_addr(sbq_desc, mapaddr), ++ dma_unmap_len(sbq_desc, maplen), ++ PCI_DMA_FROMDEVICE); ++ + memcpy(skb_put(new_skb, length), skb->data, length); ++ ++ pci_dma_sync_single_for_device(qdev->pdev, ++ dma_unmap_addr(sbq_desc, mapaddr), ++ dma_unmap_len(sbq_desc, maplen), ++ PCI_DMA_FROMDEVICE); + skb = new_skb; + + /* Frame error, so drop the packet. */ +diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c +index b93a0fb17236..93b652516a94 100644 +--- a/drivers/net/ethernet/renesas/sh_eth.c ++++ b/drivers/net/ethernet/renesas/sh_eth.c +@@ -1161,7 +1161,8 @@ static void sh_eth_ring_format(struct net_device *ndev) + mdp->dirty_rx = (u32) (i - mdp->num_rx_ring); + + /* Mark the last entry as wrapping the ring. */ +- rxdesc->status |= cpu_to_edmac(mdp, RD_RDEL); ++ if (rxdesc) ++ rxdesc->status |= cpu_to_edmac(mdp, RD_RDEL); + + memset(mdp->tx_ring, 0, tx_ringsize); + +diff --git a/drivers/net/irda/irtty-sir.c b/drivers/net/irda/irtty-sir.c +index a41267197839..0d71fa9f0c68 100644 +--- a/drivers/net/irda/irtty-sir.c ++++ b/drivers/net/irda/irtty-sir.c +@@ -430,16 +430,6 @@ static int irtty_open(struct tty_struct *tty) + + /* Module stuff handled via irda_ldisc.owner - Jean II */ + +- /* First make sure we're not already connected. */ +- if (tty->disc_data != NULL) { +- priv = tty->disc_data; +- if (priv && priv->magic == IRTTY_MAGIC) { +- ret = -EEXIST; +- goto out; +- } +- tty->disc_data = NULL; /* ### */ +- } +- + /* stop the underlying driver */ + irtty_stop_receiver(tty, TRUE); + if (tty->ops->stop) +diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c +index a2d7d5f066f1..14a8d2958698 100644 +--- a/drivers/net/ppp/ppp_generic.c ++++ b/drivers/net/ppp/ppp_generic.c +@@ -2220,7 +2220,7 @@ int ppp_register_net_channel(struct net *net, struct ppp_channel *chan) + + pch->ppp = NULL; + pch->chan = chan; +- pch->chan_net = net; ++ pch->chan_net = get_net(net); + chan->ppp = pch; + init_ppp_file(&pch->file, CHANNEL); + pch->file.hdrlen = chan->hdrlen; +@@ -2317,6 +2317,8 @@ ppp_unregister_channel(struct ppp_channel *chan) + spin_lock_bh(&pn->all_channels_lock); + list_del(&pch->list); + spin_unlock_bh(&pn->all_channels_lock); ++ put_net(pch->chan_net); ++ pch->chan_net = NULL; + + pch->file.dead = 1; + wake_up_interruptible(&pch->file.rwait); +diff --git a/drivers/net/rionet.c b/drivers/net/rionet.c +index f433b594388e..00a8128cf927 100644 +--- a/drivers/net/rionet.c ++++ b/drivers/net/rionet.c +@@ -269,7 +269,7 @@ static void rionet_outb_msg_event(struct rio_mport *mport, void *dev_id, int mbo + struct net_device *ndev = dev_id; + struct rionet_private *rnet = netdev_priv(ndev); + +- spin_lock(&rnet->lock); ++ spin_lock(&rnet->tx_lock); + + if (netif_msg_intr(rnet)) + printk(KERN_INFO +@@ -288,7 +288,7 @@ static void rionet_outb_msg_event(struct rio_mport *mport, void *dev_id, int mbo + if (rnet->tx_cnt < RIONET_TX_RING_SIZE) + netif_wake_queue(ndev); + +- spin_unlock(&rnet->lock); ++ spin_unlock(&rnet->tx_lock); + } + + static int rionet_open(struct net_device *ndev) +diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c +index 43afde8f48d2..74581cbcafa7 100644 +--- a/drivers/net/usb/cdc_ncm.c ++++ b/drivers/net/usb/cdc_ncm.c +@@ -464,7 +464,11 @@ advance: + + iface_no = ctx->data->cur_altsetting->desc.bInterfaceNumber; + +- /* reset data interface */ ++ /* Reset data interface. Some devices will not reset properly ++ * unless they are configured first. Toggle the altsetting to ++ * force a reset ++ */ ++ usb_set_interface(dev->udev, iface_no, data_altsetting); + temp = usb_set_interface(dev->udev, iface_no, 0); + if (temp) + goto error2; +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index 0244a1fb38f9..12aaf1f4f890 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -724,6 +724,7 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x19d2, 0x1426, 2)}, /* ZTE MF91 */ + {QMI_FIXED_INTF(0x19d2, 0x1428, 2)}, /* Telewell TW-LTE 4G v2 */ + {QMI_FIXED_INTF(0x19d2, 0x2002, 4)}, /* ZTE (Vodafone) K3765-Z */ ++ {QMI_FIXED_INTF(0x2001, 0x7e19, 4)}, /* D-Link DWM-221 B1 */ + {QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)}, /* Sierra Wireless MC7700 */ + {QMI_FIXED_INTF(0x114f, 0x68a2, 8)}, /* Sierra Wireless MC7750 */ + {QMI_FIXED_INTF(0x1199, 0x68a2, 8)}, /* Sierra Wireless MC7710 in QMI mode */ +diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c +index fb068ada0c5a..2255d8965037 100644 +--- a/drivers/net/usb/usbnet.c ++++ b/drivers/net/usb/usbnet.c +@@ -1622,6 +1622,13 @@ out3: + if (info->unbind) + info->unbind (dev, udev); + out1: ++ /* subdrivers must undo all they did in bind() if they ++ * fail it, but we may fail later and a deferred kevent ++ * may trigger an error resubmitting itself and, worse, ++ * schedule a timer. So we kill it all just in case. ++ */ ++ cancel_work_sync(&dev->kevent); ++ del_timer_sync(&dev->delay); + free_netdev(net); + out: + return status; +diff --git a/drivers/net/wan/farsync.c b/drivers/net/wan/farsync.c +index bcfff0d62de4..2dfa1478d7d1 100644 +--- a/drivers/net/wan/farsync.c ++++ b/drivers/net/wan/farsync.c +@@ -2545,7 +2545,7 @@ fst_add_one(struct pci_dev *pdev, const struct pci_device_id *ent) + dev->mem_start = card->phys_mem + + BUF_OFFSET ( txBuffer[i][0][0]); + dev->mem_end = card->phys_mem +- + BUF_OFFSET ( txBuffer[i][NUM_TX_BUFFER][0]); ++ + BUF_OFFSET ( txBuffer[i][NUM_TX_BUFFER - 1][LEN_RX_BUFFER - 1]); + dev->base_addr = card->pci_conf; + dev->irq = card->irq; + +diff --git a/drivers/net/wireless/ath/ath9k/eeprom.c b/drivers/net/wireless/ath/ath9k/eeprom.c +index 971d770722cf..2ac05486424b 100644 +--- a/drivers/net/wireless/ath/ath9k/eeprom.c ++++ b/drivers/net/wireless/ath/ath9k/eeprom.c +@@ -408,10 +408,9 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah, + + if (match) { + if (AR_SREV_9287(ah)) { +- /* FIXME: array overrun? */ + for (i = 0; i < numXpdGains; i++) { + minPwrT4[i] = data_9287[idxL].pwrPdg[i][0]; +- maxPwrT4[i] = data_9287[idxL].pwrPdg[i][4]; ++ maxPwrT4[i] = data_9287[idxL].pwrPdg[i][intercepts - 1]; + ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i], + data_9287[idxL].pwrPdg[i], + data_9287[idxL].vpdPdg[i], +@@ -421,7 +420,7 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah, + } else if (eeprom_4k) { + for (i = 0; i < numXpdGains; i++) { + minPwrT4[i] = data_4k[idxL].pwrPdg[i][0]; +- maxPwrT4[i] = data_4k[idxL].pwrPdg[i][4]; ++ maxPwrT4[i] = data_4k[idxL].pwrPdg[i][intercepts - 1]; + ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i], + data_4k[idxL].pwrPdg[i], + data_4k[idxL].vpdPdg[i], +@@ -431,7 +430,7 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah, + } else { + for (i = 0; i < numXpdGains; i++) { + minPwrT4[i] = data_def[idxL].pwrPdg[i][0]; +- maxPwrT4[i] = data_def[idxL].pwrPdg[i][4]; ++ maxPwrT4[i] = data_def[idxL].pwrPdg[i][intercepts - 1]; + ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i], + data_def[idxL].pwrPdg[i], + data_def[idxL].vpdPdg[i], +diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c +index 034a4d2964d6..d332d55885f8 100644 +--- a/drivers/pci/probe.c ++++ b/drivers/pci/probe.c +@@ -173,6 +173,9 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type, + struct pci_bus_region region; + bool bar_too_big = false, bar_disabled = false; + ++ if (dev->non_compliant_bars) ++ return 0; ++ + mask = type ? PCI_ROM_ADDRESS_MASK : ~0; + + /* No printks while decoding is disabled! */ +@@ -981,6 +984,7 @@ void set_pcie_hotplug_bridge(struct pci_dev *pdev) + int pci_setup_device(struct pci_dev *dev) + { + u32 class; ++ u16 cmd; + u8 hdr_type; + struct pci_slot *slot; + int pos = 0; +@@ -1028,6 +1032,16 @@ int pci_setup_device(struct pci_dev *dev) + /* device class may be changed after fixup */ + class = dev->class >> 8; + ++ if (dev->non_compliant_bars) { ++ pci_read_config_word(dev, PCI_COMMAND, &cmd); ++ if (cmd & (PCI_COMMAND_IO | PCI_COMMAND_MEMORY)) { ++ dev_info(&dev->dev, "device has non-compliant BARs; disabling IO/MEM decoding\n"); ++ cmd &= ~PCI_COMMAND_IO; ++ cmd &= ~PCI_COMMAND_MEMORY; ++ pci_write_config_word(dev, PCI_COMMAND, cmd); ++ } ++ } ++ + switch (dev->hdr_type) { /* header type */ + case PCI_HEADER_TYPE_NORMAL: /* standard header */ + if (class == PCI_CLASS_BRIDGE_PCI) +diff --git a/drivers/pnp/pnpbios/bioscalls.c b/drivers/pnp/pnpbios/bioscalls.c +index 769d265b221b..deb7f4bcdb7b 100644 +--- a/drivers/pnp/pnpbios/bioscalls.c ++++ b/drivers/pnp/pnpbios/bioscalls.c +@@ -21,7 +21,7 @@ + + #include "pnpbios.h" + +-static struct { ++__visible struct { + u16 offset; + u16 segment; + } pnp_bios_callpoint; +@@ -41,6 +41,7 @@ asmlinkage void pnp_bios_callfunc(void); + + __asm__(".text \n" + __ALIGN_STR "\n" ++ ".globl pnp_bios_callfunc\n" + "pnp_bios_callfunc:\n" + " pushl %edx \n" + " pushl %ecx \n" +@@ -66,9 +67,9 @@ static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092, + * after PnP BIOS oopses. + */ + +-u32 pnp_bios_fault_esp; +-u32 pnp_bios_fault_eip; +-u32 pnp_bios_is_utter_crap = 0; ++__visible u32 pnp_bios_fault_esp; ++__visible u32 pnp_bios_fault_eip; ++__visible u32 pnp_bios_is_utter_crap = 0; + + static spinlock_t pnp_bios_lock; + +diff --git a/drivers/rtc/rtc-vr41xx.c b/drivers/rtc/rtc-vr41xx.c +index f91be04b9050..ca0f213c06a5 100644 +--- a/drivers/rtc/rtc-vr41xx.c ++++ b/drivers/rtc/rtc-vr41xx.c +@@ -272,12 +272,13 @@ static irqreturn_t rtclong1_interrupt(int irq, void *dev_id) + } + + static const struct rtc_class_ops vr41xx_rtc_ops = { +- .release = vr41xx_rtc_release, +- .ioctl = vr41xx_rtc_ioctl, +- .read_time = vr41xx_rtc_read_time, +- .set_time = vr41xx_rtc_set_time, +- .read_alarm = vr41xx_rtc_read_alarm, +- .set_alarm = vr41xx_rtc_set_alarm, ++ .release = vr41xx_rtc_release, ++ .ioctl = vr41xx_rtc_ioctl, ++ .read_time = vr41xx_rtc_read_time, ++ .set_time = vr41xx_rtc_set_time, ++ .read_alarm = vr41xx_rtc_read_alarm, ++ .set_alarm = vr41xx_rtc_set_alarm, ++ .alarm_irq_enable = vr41xx_rtc_alarm_irq_enable, + }; + + static int rtc_probe(struct platform_device *pdev) +diff --git a/drivers/scsi/aacraid/commsup.c b/drivers/scsi/aacraid/commsup.c +index 1be0776a80c4..6a0d362e2596 100644 +--- a/drivers/scsi/aacraid/commsup.c ++++ b/drivers/scsi/aacraid/commsup.c +@@ -83,9 +83,12 @@ static int fib_map_alloc(struct aac_dev *dev) + + void aac_fib_map_free(struct aac_dev *dev) + { +- pci_free_consistent(dev->pdev, +- dev->max_fib_size * (dev->scsi_host_ptr->can_queue + AAC_NUM_MGT_FIB), +- dev->hw_fib_va, dev->hw_fib_pa); ++ if (dev->hw_fib_va && dev->max_fib_size) { ++ pci_free_consistent(dev->pdev, ++ (dev->max_fib_size * ++ (dev->scsi_host_ptr->can_queue + AAC_NUM_MGT_FIB)), ++ dev->hw_fib_va, dev->hw_fib_pa); ++ } + dev->hw_fib_va = NULL; + dev->hw_fib_pa = 0; + } +diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c +index bfe812fcce34..a683a831527b 100644 +--- a/drivers/scsi/be2iscsi/be_main.c ++++ b/drivers/scsi/be2iscsi/be_main.c +@@ -4040,6 +4040,7 @@ put_shost: + scsi_host_put(phba->shost); + free_kset: + iscsi_boot_destroy_kset(phba->boot_kset); ++ phba->boot_kset = NULL; + return -ENOMEM; + } + +diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c +index 4a79a5f0d95e..25ac2c00f8b3 100644 +--- a/drivers/scsi/ipr.c ++++ b/drivers/scsi/ipr.c +@@ -3908,13 +3908,17 @@ static ssize_t ipr_store_update_fw(struct device *dev, + struct ipr_sglist *sglist; + char fname[100]; + char *src; +- int len, result, dnld_size; ++ char *endline; ++ int result, dnld_size; + + if (!capable(CAP_SYS_ADMIN)) + return -EACCES; + +- len = snprintf(fname, 99, "%s", buf); +- fname[len-1] = '\0'; ++ snprintf(fname, sizeof(fname), "%s", buf); ++ ++ endline = strchr(fname, '\n'); ++ if (endline) ++ *endline = '\0'; + + if (request_firmware(&fw_entry, fname, &ioa_cfg->pdev->dev)) { + dev_err(&ioa_cfg->pdev->dev, "Firmware file %s not found\n", fname); +diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c +index cb465b253910..e6e0679ec882 100644 +--- a/drivers/scsi/lpfc/lpfc_init.c ++++ b/drivers/scsi/lpfc/lpfc_init.c +@@ -2684,7 +2684,7 @@ lpfc_online(struct lpfc_hba *phba) + } + + vports = lpfc_create_vport_work_array(phba); +- if (vports != NULL) ++ if (vports != NULL) { + for (i = 0; i <= phba->max_vports && vports[i] != NULL; i++) { + struct Scsi_Host *shost; + shost = lpfc_shost_from_vport(vports[i]); +@@ -2701,7 +2701,8 @@ lpfc_online(struct lpfc_hba *phba) + } + spin_unlock_irq(shost->host_lock); + } +- lpfc_destroy_vport_work_array(phba, vports); ++ } ++ lpfc_destroy_vport_work_array(phba, vports); + + lpfc_unblock_mgmt_io(phba); + return 0; +diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c +index 0be16bf5f0cd..1f65e32db285 100644 +--- a/drivers/scsi/sg.c ++++ b/drivers/scsi/sg.c +@@ -633,7 +633,8 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos) + else + hp->dxfer_direction = (mxsize > 0) ? SG_DXFER_FROM_DEV : SG_DXFER_NONE; + hp->dxfer_len = mxsize; +- if (hp->dxfer_direction == SG_DXFER_TO_DEV) ++ if ((hp->dxfer_direction == SG_DXFER_TO_DEV) || ++ (hp->dxfer_direction == SG_DXFER_TO_FROM_DEV)) + hp->dxferp = (char __user *)buf + cmd_size; + else + hp->dxferp = NULL; +diff --git a/drivers/staging/usbip/usbip_common.c b/drivers/staging/usbip/usbip_common.c +index 7b97df6f2a42..b4f237e55931 100644 +--- a/drivers/staging/usbip/usbip_common.c ++++ b/drivers/staging/usbip/usbip_common.c +@@ -784,6 +784,17 @@ int usbip_recv_xbuff(struct usbip_device *ud, struct urb *urb) + if (!(size > 0)) + return 0; + ++ if (size > urb->transfer_buffer_length) { ++ /* should not happen, probably malicious packet */ ++ if (ud->side == USBIP_STUB) { ++ usbip_event_add(ud, SDEV_EVENT_ERROR_TCP); ++ return 0; ++ } else { ++ usbip_event_add(ud, VDEV_EVENT_ERROR_TCP); ++ return -EPIPE; ++ } ++ } ++ + ret = usbip_recv(ud->tcp_socket, urb->transfer_buffer, size); + if (ret != size) { + dev_err(&urb->dev->dev, "recv xbuf, %d\n", ret); +diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c +index d8c06a3d391e..1119d533c8e2 100644 +--- a/drivers/tty/serial/8250/8250_core.c ++++ b/drivers/tty/serial/8250/8250_core.c +@@ -686,22 +686,16 @@ static int size_fifo(struct uart_8250_port *up) + */ + static unsigned int autoconfig_read_divisor_id(struct uart_8250_port *p) + { +- unsigned char old_dll, old_dlm, old_lcr; +- unsigned int id; ++ unsigned char old_lcr; ++ unsigned int id, old_dl; + + old_lcr = serial_in(p, UART_LCR); + serial_out(p, UART_LCR, UART_LCR_CONF_MODE_A); ++ old_dl = serial_dl_read(p); ++ serial_dl_write(p, 0); ++ id = serial_dl_read(p); ++ serial_dl_write(p, old_dl); + +- old_dll = serial_in(p, UART_DLL); +- old_dlm = serial_in(p, UART_DLM); +- +- serial_out(p, UART_DLL, 0); +- serial_out(p, UART_DLM, 0); +- +- id = serial_in(p, UART_DLL) | serial_in(p, UART_DLM) << 8; +- +- serial_out(p, UART_DLL, old_dll); +- serial_out(p, UART_DLM, old_dlm); + serial_out(p, UART_LCR, old_lcr); + + return id; +diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c +index b8366b154fb9..921bf90bcc6a 100644 +--- a/drivers/tty/serial/samsung.c ++++ b/drivers/tty/serial/samsung.c +@@ -724,6 +724,8 @@ static void s3c24xx_serial_set_termios(struct uart_port *port, + /* check to see if we need to change clock source */ + + if (ourport->baudclk != clk) { ++ clk_prepare_enable(clk); ++ + s3c24xx_serial_setsource(port, clk_sel); + + if (!IS_ERR(ourport->baudclk)) { +@@ -731,8 +733,6 @@ static void s3c24xx_serial_set_termios(struct uart_port *port, + ourport->baudclk = ERR_PTR(-EINVAL); + } + +- clk_prepare_enable(clk); +- + ourport->baudclk = clk; + ourport->baudclk_rate = clk ? clk_get_rate(clk) : 0; + } +diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c +index db9d69fa1085..6dff194751f1 100644 +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -3534,9 +3534,10 @@ static int do_register_con_driver(const struct consw *csw, int first, int last) + goto err; + + desc = csw->con_startup(); +- +- if (!desc) ++ if (!desc) { ++ retval = -ENODEV; + goto err; ++ } + + retval = -EINVAL; + +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index d6dab8adf60e..e7436ebbf04c 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -997,6 +997,9 @@ static int acm_probe(struct usb_interface *intf, + if (quirks == NO_UNION_NORMAL) { + data_interface = usb_ifnum_to_if(usb_dev, 1); + control_interface = usb_ifnum_to_if(usb_dev, 0); ++ /* we would crash */ ++ if (!data_interface || !control_interface) ++ return -ENODEV; + goto skip_normal_probe; + } + +diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c +index 2cdd5079ae78..f7310dd107ca 100644 +--- a/drivers/usb/core/driver.c ++++ b/drivers/usb/core/driver.c +@@ -461,11 +461,15 @@ static int usb_unbind_interface(struct device *dev) + int usb_driver_claim_interface(struct usb_driver *driver, + struct usb_interface *iface, void *priv) + { +- struct device *dev = &iface->dev; ++ struct device *dev; + struct usb_device *udev; + int retval = 0; + int lpm_disable_error; + ++ if (!iface) ++ return -ENODEV; ++ ++ dev = &iface->dev; + if (dev->driver) + return -EBUSY; + +diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c +index 4676917e2b1f..1eac8ddc5556 100644 +--- a/drivers/usb/core/hcd-pci.c ++++ b/drivers/usb/core/hcd-pci.c +@@ -74,6 +74,15 @@ static void for_each_companion(struct pci_dev *pdev, struct usb_hcd *hcd, + if (companion->bus != pdev->bus || + PCI_SLOT(companion->devfn) != slot) + continue; ++ ++ /* ++ * Companion device should be either UHCI,OHCI or EHCI host ++ * controller, otherwise skip. ++ */ ++ if (companion->class != CL_UHCI && companion->class != CL_OHCI && ++ companion->class != CL_EHCI) ++ continue; ++ + companion_hcd = pci_get_drvdata(companion); + if (!companion_hcd || !companion_hcd->self.root_hub) + continue; +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index 92873f2773fc..8eb2de6beee4 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -4167,7 +4167,13 @@ hub_port_init (struct usb_hub *hub, struct usb_device *udev, int port1, + r = -EPROTO; + break; + } +- if (r == 0) ++ /* ++ * Some devices time out if they are powered on ++ * when already connected. They need a second ++ * reset. But only on the first attempt, ++ * lest we get into a time out/reset loop ++ */ ++ if (r == 0 || (r == -ETIMEDOUT && j == 0)) + break; + } + udev->descriptor.bMaxPacketSize0 = +diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c +index 87e82e6b0c38..af9e4e8c9064 100644 +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -1861,6 +1861,11 @@ no_bw: + kfree(xhci->port_array); + kfree(xhci->rh_bw); + ++ xhci->usb2_ports = NULL; ++ xhci->usb3_ports = NULL; ++ xhci->port_array = NULL; ++ xhci->rh_bw = NULL; ++ + xhci->page_size = 0; + xhci->page_shift = 0; + xhci->bus_state[0].bus_suspended = 0; +diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c +index d36f34e25bed..4c24ba0a6574 100644 +--- a/drivers/usb/misc/iowarrior.c ++++ b/drivers/usb/misc/iowarrior.c +@@ -792,6 +792,12 @@ static int iowarrior_probe(struct usb_interface *interface, + iface_desc = interface->cur_altsetting; + dev->product_id = le16_to_cpu(udev->descriptor.idProduct); + ++ if (iface_desc->desc.bNumEndpoints < 1) { ++ dev_err(&interface->dev, "Invalid number of endpoints\n"); ++ retval = -EINVAL; ++ goto error; ++ } ++ + /* set up the endpoint information */ + for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) { + endpoint = &iface_desc->endpoint[i].desc; +diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c +index 45b94019aec8..157a9f9afc2d 100644 +--- a/drivers/usb/renesas_usbhs/fifo.c ++++ b/drivers/usb/renesas_usbhs/fifo.c +@@ -166,7 +166,8 @@ static int usbhsf_pkt_handler(struct usbhs_pipe *pipe, int type) + goto __usbhs_pkt_handler_end; + } + +- ret = func(pkt, &is_done); ++ if (likely(func)) ++ ret = func(pkt, &is_done); + + if (is_done) + __usbhsf_pkt_del(pkt); +@@ -933,6 +934,7 @@ static int usbhsf_dma_try_pop(struct usbhs_pkt *pkt, int *is_done) + + pkt->trans = len; + ++ usbhsf_tx_irq_ctrl(pipe, 0); + INIT_WORK(&pkt->work, xfer_work); + schedule_work(&pkt->work); + +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index 84b770461655..0093261ccc57 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -108,6 +108,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x10C4, 0x826B) }, /* Cygnal Integrated Products, Inc., Fasttrax GPS demonstration module */ + { USB_DEVICE(0x10C4, 0x8281) }, /* Nanotec Plug & Drive */ + { USB_DEVICE(0x10C4, 0x8293) }, /* Telegesis ETRX2USB */ ++ { USB_DEVICE(0x10C4, 0x82F4) }, /* Starizona MicroTouch */ + { USB_DEVICE(0x10C4, 0x82F9) }, /* Procyon AVS */ + { USB_DEVICE(0x10C4, 0x8341) }, /* Siemens MC35PU GPRS Modem */ + { USB_DEVICE(0x10C4, 0x8382) }, /* Cygnal Integrated Products, Inc. */ +@@ -117,6 +118,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x10C4, 0x8418) }, /* IRZ Automation Teleport SG-10 GSM/GPRS Modem */ + { USB_DEVICE(0x10C4, 0x846E) }, /* BEI USB Sensor Interface (VCP) */ + { USB_DEVICE(0x10C4, 0x8477) }, /* Balluff RFID */ ++ { USB_DEVICE(0x10C4, 0x84B6) }, /* Starizona Hyperion */ + { USB_DEVICE(0x10C4, 0x85EA) }, /* AC-Services IBUS-IF */ + { USB_DEVICE(0x10C4, 0x85EB) }, /* AC-Services CIS-IBUS */ + { USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */ +@@ -140,6 +142,8 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x10C4, 0xF004) }, /* Elan Digital Systems USBcount50 */ + { USB_DEVICE(0x10C5, 0xEA61) }, /* Silicon Labs MobiData GPRS USB Modem */ + { USB_DEVICE(0x10CE, 0xEA6A) }, /* Silicon Labs MobiData GPRS USB Modem 100EU */ ++ { USB_DEVICE(0x12B8, 0xEC60) }, /* Link G4 ECU */ ++ { USB_DEVICE(0x12B8, 0xEC62) }, /* Link G4+ ECU */ + { USB_DEVICE(0x13AD, 0x9999) }, /* Baltech card reader */ + { USB_DEVICE(0x1555, 0x0004) }, /* Owen AC4 USB-RS485 Converter */ + { USB_DEVICE(0x166A, 0x0201) }, /* Clipsal 5500PACA C-Bus Pascal Automation Controller */ +@@ -164,6 +168,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x18EF, 0xE025) }, /* ELV Marble Sound Board 1 */ + { USB_DEVICE(0x1901, 0x0190) }, /* GE B850 CP2105 Recorder interface */ + { USB_DEVICE(0x1901, 0x0193) }, /* GE B650 CP2104 PMC interface */ ++ { USB_DEVICE(0x1901, 0x0194) }, /* GE Healthcare Remote Alarm Box */ + { USB_DEVICE(0x19CF, 0x3000) }, /* Parrot NMEA GPS Flight Recorder */ + { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */ + { USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */ +diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c +index 082120198f87..09f0f631389e 100644 +--- a/drivers/usb/serial/cypress_m8.c ++++ b/drivers/usb/serial/cypress_m8.c +@@ -449,6 +449,11 @@ static int cypress_generic_port_probe(struct usb_serial_port *port) + struct usb_serial *serial = port->serial; + struct cypress_private *priv; + ++ if (!port->interrupt_out_urb || !port->interrupt_in_urb) { ++ dev_err(&port->dev, "required endpoint is missing\n"); ++ return -ENODEV; ++ } ++ + priv = kzalloc(sizeof(struct cypress_private), GFP_KERNEL); + if (!priv) + return -ENOMEM; +@@ -606,12 +611,6 @@ static int cypress_open(struct tty_struct *tty, struct usb_serial_port *port) + cypress_set_termios(tty, port, &priv->tmp_termios); + + /* setup the port and start reading from the device */ +- if (!port->interrupt_in_urb) { +- dev_err(&port->dev, "%s - interrupt_in_urb is empty!\n", +- __func__); +- return -1; +- } +- + usb_fill_int_urb(port->interrupt_in_urb, serial->dev, + usb_rcvintpipe(serial->dev, port->interrupt_in_endpointAddress), + port->interrupt_in_urb->transfer_buffer, +diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c +index 7b807d389527..8c34d9cfb226 100644 +--- a/drivers/usb/serial/digi_acceleport.c ++++ b/drivers/usb/serial/digi_acceleport.c +@@ -1253,8 +1253,27 @@ static int digi_port_init(struct usb_serial_port *port, unsigned port_num) + + static int digi_startup(struct usb_serial *serial) + { ++ struct device *dev = &serial->interface->dev; + struct digi_serial *serial_priv; + int ret; ++ int i; ++ ++ /* check whether the device has the expected number of endpoints */ ++ if (serial->num_port_pointers < serial->type->num_ports + 1) { ++ dev_err(dev, "OOB endpoints missing\n"); ++ return -ENODEV; ++ } ++ ++ for (i = 0; i < serial->type->num_ports + 1 ; i++) { ++ if (!serial->port[i]->read_urb) { ++ dev_err(dev, "bulk-in endpoint missing\n"); ++ return -ENODEV; ++ } ++ if (!serial->port[i]->write_urb) { ++ dev_err(dev, "bulk-out endpoint missing\n"); ++ return -ENODEV; ++ } ++ } + + serial_priv = kzalloc(sizeof(*serial_priv), GFP_KERNEL); + if (!serial_priv) +diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c +index 1477e8593476..c574d312f1f5 100644 +--- a/drivers/usb/serial/io_edgeport.c ++++ b/drivers/usb/serial/io_edgeport.c +@@ -2988,16 +2988,9 @@ static void edge_disconnect(struct usb_serial *serial) + { + struct edgeport_serial *edge_serial = usb_get_serial_data(serial); + +- /* stop reads and writes on all ports */ +- /* free up our endpoint stuff */ + if (edge_serial->is_epic) { + usb_kill_urb(edge_serial->interrupt_read_urb); +- usb_free_urb(edge_serial->interrupt_read_urb); +- kfree(edge_serial->interrupt_in_buffer); +- + usb_kill_urb(edge_serial->read_urb); +- usb_free_urb(edge_serial->read_urb); +- kfree(edge_serial->bulk_in_buffer); + } + } + +@@ -3010,6 +3003,16 @@ static void edge_release(struct usb_serial *serial) + { + struct edgeport_serial *edge_serial = usb_get_serial_data(serial); + ++ if (edge_serial->is_epic) { ++ usb_kill_urb(edge_serial->interrupt_read_urb); ++ usb_free_urb(edge_serial->interrupt_read_urb); ++ kfree(edge_serial->interrupt_in_buffer); ++ ++ usb_kill_urb(edge_serial->read_urb); ++ usb_free_urb(edge_serial->read_urb); ++ kfree(edge_serial->bulk_in_buffer); ++ } ++ + kfree(edge_serial); + } + +diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c +index cec377b8bb8b..32a67c69eec8 100644 +--- a/drivers/usb/serial/keyspan.c ++++ b/drivers/usb/serial/keyspan.c +@@ -2392,6 +2392,10 @@ static void keyspan_release(struct usb_serial *serial) + + s_priv = usb_get_serial_data(serial); + ++ /* Make sure to unlink the URBs submitted in attach. */ ++ usb_kill_urb(s_priv->instat_urb); ++ usb_kill_urb(s_priv->indat_urb); ++ + usb_free_urb(s_priv->instat_urb); + usb_free_urb(s_priv->indat_urb); + usb_free_urb(s_priv->glocont_urb); +diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c +index 6a15adf53360..c14c29ff1151 100644 +--- a/drivers/usb/serial/mct_u232.c ++++ b/drivers/usb/serial/mct_u232.c +@@ -377,14 +377,21 @@ static void mct_u232_msr_to_state(struct usb_serial_port *port, + + static int mct_u232_port_probe(struct usb_serial_port *port) + { ++ struct usb_serial *serial = port->serial; + struct mct_u232_private *priv; + ++ /* check first to simplify error handling */ ++ if (!serial->port[1] || !serial->port[1]->interrupt_in_urb) { ++ dev_err(&port->dev, "expected endpoint missing\n"); ++ return -ENODEV; ++ } ++ + priv = kzalloc(sizeof(*priv), GFP_KERNEL); + if (!priv) + return -ENOMEM; + + /* Use second interrupt-in endpoint for reading. */ +- priv->read_urb = port->serial->port[1]->interrupt_in_urb; ++ priv->read_urb = serial->port[1]->interrupt_in_urb; + priv->read_urb->context = port; + + spin_lock_init(&priv->lock); +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 24366a2afea6..bcb6f5c2bae4 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -375,18 +375,22 @@ static void option_instat_callback(struct urb *urb); + #define HAIER_PRODUCT_CE81B 0x10f8 + #define HAIER_PRODUCT_CE100 0x2009 + +-/* Cinterion (formerly Siemens) products */ +-#define SIEMENS_VENDOR_ID 0x0681 +-#define CINTERION_VENDOR_ID 0x1e2d ++/* Gemalto's Cinterion products (formerly Siemens) */ ++#define SIEMENS_VENDOR_ID 0x0681 ++#define CINTERION_VENDOR_ID 0x1e2d ++#define CINTERION_PRODUCT_HC25_MDMNET 0x0040 + #define CINTERION_PRODUCT_HC25_MDM 0x0047 +-#define CINTERION_PRODUCT_HC25_MDMNET 0x0040 ++#define CINTERION_PRODUCT_HC28_MDMNET 0x004A /* same for HC28J */ + #define CINTERION_PRODUCT_HC28_MDM 0x004C +-#define CINTERION_PRODUCT_HC28_MDMNET 0x004A /* same for HC28J */ + #define CINTERION_PRODUCT_EU3_E 0x0051 + #define CINTERION_PRODUCT_EU3_P 0x0052 + #define CINTERION_PRODUCT_PH8 0x0053 + #define CINTERION_PRODUCT_AHXX 0x0055 + #define CINTERION_PRODUCT_PLXX 0x0060 ++#define CINTERION_PRODUCT_PH8_2RMNET 0x0082 ++#define CINTERION_PRODUCT_PH8_AUDIO 0x0083 ++#define CINTERION_PRODUCT_AHXX_2RMNET 0x0084 ++#define CINTERION_PRODUCT_AHXX_AUDIO 0x0085 + + /* Olivetti products */ + #define OLIVETTI_VENDOR_ID 0x0b3c +@@ -641,6 +645,10 @@ static const struct option_blacklist_info telit_le922_blacklist_usbcfg3 = { + .reserved = BIT(1) | BIT(2) | BIT(3), + }; + ++static const struct option_blacklist_info cinterion_rmnet2_blacklist = { ++ .reserved = BIT(4) | BIT(5), ++}; ++ + static const struct usb_device_id option_ids[] = { + { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) }, + { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) }, +@@ -1712,7 +1720,13 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX, 0xff) }, + { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PLXX), + .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, +- { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, ++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8_2RMNET, 0xff), ++ .driver_info = (kernel_ulong_t)&cinterion_rmnet2_blacklist }, ++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8_AUDIO, 0xff), ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, ++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX_2RMNET, 0xff) }, ++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX_AUDIO, 0xff) }, ++ { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, + { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) }, + { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDM) }, + { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDMNET) }, +@@ -1818,6 +1832,8 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d02, 0xff, 0x00, 0x00) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x02, 0x01) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e19, 0xff), /* D-Link DWM-221 B1 */ ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ + { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */ +diff --git a/drivers/usb/serial/quatech2.c b/drivers/usb/serial/quatech2.c +index 02b0803425c5..13824b5ca343 100644 +--- a/drivers/usb/serial/quatech2.c ++++ b/drivers/usb/serial/quatech2.c +@@ -141,6 +141,7 @@ static void qt2_release(struct usb_serial *serial) + + serial_priv = usb_get_serial_data(serial); + ++ usb_kill_urb(serial_priv->read_urb); + usb_free_urb(serial_priv->read_urb); + kfree(serial_priv); + } +diff --git a/drivers/video/da8xx-fb.c b/drivers/video/da8xx-fb.c +index 0810939936f4..b13bfb2e52a2 100644 +--- a/drivers/video/da8xx-fb.c ++++ b/drivers/video/da8xx-fb.c +@@ -226,8 +226,7 @@ static struct fb_videomode known_lcd_panels[] = { + .lower_margin = 2, + .hsync_len = 0, + .vsync_len = 0, +- .sync = FB_SYNC_CLK_INVERT | +- FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT, ++ .sync = FB_SYNC_CLK_INVERT, + }, + /* Sharp LK043T1DG01 */ + [1] = { +@@ -241,7 +240,7 @@ static struct fb_videomode known_lcd_panels[] = { + .lower_margin = 2, + .hsync_len = 41, + .vsync_len = 10, +- .sync = FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT, ++ .sync = 0, + .flag = 0, + }, + [2] = { +@@ -256,7 +255,7 @@ static struct fb_videomode known_lcd_panels[] = { + .lower_margin = 10, + .hsync_len = 10, + .vsync_len = 10, +- .sync = FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT, ++ .sync = 0, + .flag = 0, + }, + }; +diff --git a/drivers/watchdog/rc32434_wdt.c b/drivers/watchdog/rc32434_wdt.c +index f78bc008cbb7..ea8f58216d4d 100644 +--- a/drivers/watchdog/rc32434_wdt.c ++++ b/drivers/watchdog/rc32434_wdt.c +@@ -237,7 +237,7 @@ static long rc32434_wdt_ioctl(struct file *file, unsigned int cmd, + return -EINVAL; + /* Fall through */ + case WDIOC_GETTIMEOUT: +- return copy_to_user(argp, &timeout, sizeof(int)); ++ return copy_to_user(argp, &timeout, sizeof(int)) ? -EFAULT : 0; + default: + return -ENOTTY; + } +diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c +index 8edc9eb1ef7b..d65e16e9d1d9 100644 +--- a/fs/cifs/sess.c ++++ b/fs/cifs/sess.c +@@ -487,19 +487,27 @@ int build_ntlmssp_auth_blob(unsigned char *pbuffer, + sec_blob->LmChallengeResponse.MaximumLength = 0; + + sec_blob->NtChallengeResponse.BufferOffset = cpu_to_le32(tmp - pbuffer); +- rc = setup_ntlmv2_rsp(ses, nls_cp); +- if (rc) { +- cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc); +- goto setup_ntlmv2_ret; +- } +- memcpy(tmp, ses->auth_key.response + CIFS_SESS_KEY_SIZE, +- ses->auth_key.len - CIFS_SESS_KEY_SIZE); +- tmp += ses->auth_key.len - CIFS_SESS_KEY_SIZE; ++ if (ses->user_name != NULL) { ++ rc = setup_ntlmv2_rsp(ses, nls_cp); ++ if (rc) { ++ cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc); ++ goto setup_ntlmv2_ret; ++ } ++ memcpy(tmp, ses->auth_key.response + CIFS_SESS_KEY_SIZE, ++ ses->auth_key.len - CIFS_SESS_KEY_SIZE); ++ tmp += ses->auth_key.len - CIFS_SESS_KEY_SIZE; + +- sec_blob->NtChallengeResponse.Length = +- cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE); +- sec_blob->NtChallengeResponse.MaximumLength = +- cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE); ++ sec_blob->NtChallengeResponse.Length = ++ cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE); ++ sec_blob->NtChallengeResponse.MaximumLength = ++ cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE); ++ } else { ++ /* ++ * don't send an NT Response for anonymous access ++ */ ++ sec_blob->NtChallengeResponse.Length = 0; ++ sec_blob->NtChallengeResponse.MaximumLength = 0; ++ } + + if (ses->domainName == NULL) { + sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - pbuffer); +diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h +index 6f74b8919237..046e3e93783e 100644 +--- a/fs/ext4/ext4.h ++++ b/fs/ext4/ext4.h +@@ -851,6 +851,29 @@ do { \ + #include "extents_status.h" + + /* ++ * Lock subclasses for i_data_sem in the ext4_inode_info structure. ++ * ++ * These are needed to avoid lockdep false positives when we need to ++ * allocate blocks to the quota inode during ext4_map_blocks(), while ++ * holding i_data_sem for a normal (non-quota) inode. Since we don't ++ * do quota tracking for the quota inode, this avoids deadlock (as ++ * well as infinite recursion, since it isn't turtles all the way ++ * down...) ++ * ++ * I_DATA_SEM_NORMAL - Used for most inodes ++ * I_DATA_SEM_OTHER - Used by move_inode.c for the second normal inode ++ * where the second inode has larger inode number ++ * than the first ++ * I_DATA_SEM_QUOTA - Used for quota inodes only ++ */ ++enum { ++ I_DATA_SEM_NORMAL = 0, ++ I_DATA_SEM_OTHER, ++ I_DATA_SEM_QUOTA, ++}; ++ ++ ++/* + * fourth extended file system inode data in memory + */ + struct ext4_inode_info { +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index 10b71e4029a0..fb7e576df25c 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -5063,6 +5063,8 @@ int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode) + might_sleep(); + trace_ext4_mark_inode_dirty(inode, _RET_IP_); + err = ext4_reserve_inode_write(handle, inode, &iloc); ++ if (err) ++ return err; + if (ext4_handle_valid(handle) && + EXT4_I(inode)->i_extra_isize < sbi->s_want_extra_isize && + !ext4_test_inode_state(inode, EXT4_STATE_NO_EXPAND)) { +@@ -5093,9 +5095,7 @@ int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode) + } + } + } +- if (!err) +- err = ext4_mark_iloc_dirty(handle, inode, &iloc); +- return err; ++ return ext4_mark_iloc_dirty(handle, inode, &iloc); + } + + /* +diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c +index 3dcbf364022f..ad52ace2b79a 100644 +--- a/fs/ext4/move_extent.c ++++ b/fs/ext4/move_extent.c +@@ -154,10 +154,10 @@ ext4_double_down_write_data_sem(struct inode *first, struct inode *second) + { + if (first < second) { + down_write(&EXT4_I(first)->i_data_sem); +- down_write_nested(&EXT4_I(second)->i_data_sem, SINGLE_DEPTH_NESTING); ++ down_write_nested(&EXT4_I(second)->i_data_sem, I_DATA_SEM_OTHER); + } else { + down_write(&EXT4_I(second)->i_data_sem); +- down_write_nested(&EXT4_I(first)->i_data_sem, SINGLE_DEPTH_NESTING); ++ down_write_nested(&EXT4_I(first)->i_data_sem, I_DATA_SEM_OTHER); + + } + } +@@ -1117,6 +1117,13 @@ mext_check_arguments(struct inode *orig_inode, + return -EINVAL; + } + ++ if (IS_NOQUOTA(orig_inode) || IS_NOQUOTA(donor_inode)) { ++ ext4_debug("ext4 move extent: The argument files should " ++ "not be quota files [ino:orig %lu, donor %lu]\n", ++ orig_inode->i_ino, donor_inode->i_ino); ++ return -EBUSY; ++ } ++ + /* Ext4 move extent supports only extent based file */ + if (!(ext4_test_inode_flag(orig_inode, EXT4_INODE_EXTENTS))) { + ext4_debug("ext4 move extent: orig file is not extents " +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index a7e079749425..063eb5094a63 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -4984,6 +4984,20 @@ static int ext4_quota_on_mount(struct super_block *sb, int type) + EXT4_SB(sb)->s_jquota_fmt, type); + } + ++static void lockdep_set_quota_inode(struct inode *inode, int subclass) ++{ ++ struct ext4_inode_info *ei = EXT4_I(inode); ++ ++ /* The first argument of lockdep_set_subclass has to be ++ * *exactly* the same as the argument to init_rwsem() --- in ++ * this case, in init_once() --- or lockdep gets unhappy ++ * because the name of the lock is set using the ++ * stringification of the argument to init_rwsem(). ++ */ ++ (void) ei; /* shut up clang warning if !CONFIG_LOCKDEP */ ++ lockdep_set_subclass(&ei->i_data_sem, subclass); ++} ++ + /* + * Standard function to be called on quota_on + */ +@@ -5023,8 +5037,12 @@ static int ext4_quota_on(struct super_block *sb, int type, int format_id, + if (err) + return err; + } +- +- return dquot_quota_on(sb, type, format_id, path); ++ lockdep_set_quota_inode(path->dentry->d_inode, I_DATA_SEM_QUOTA); ++ err = dquot_quota_on(sb, type, format_id, path); ++ if (err) ++ lockdep_set_quota_inode(path->dentry->d_inode, ++ I_DATA_SEM_NORMAL); ++ return err; + } + + static int ext4_quota_enable(struct super_block *sb, int type, int format_id, +@@ -5050,8 +5068,11 @@ static int ext4_quota_enable(struct super_block *sb, int type, int format_id, + + /* Don't account quota for quota files to avoid recursion */ + qf_inode->i_flags |= S_NOQUOTA; ++ lockdep_set_quota_inode(qf_inode, I_DATA_SEM_QUOTA); + err = dquot_enable(qf_inode, type, format_id, flags); + iput(qf_inode); ++ if (err) ++ lockdep_set_quota_inode(qf_inode, I_DATA_SEM_NORMAL); + + return err; + } +diff --git a/fs/isofs/rock.c b/fs/isofs/rock.c +index 735d7522a3a9..204659a5f6db 100644 +--- a/fs/isofs/rock.c ++++ b/fs/isofs/rock.c +@@ -203,6 +203,8 @@ int get_rock_ridge_filename(struct iso_directory_record *de, + int retnamlen = 0; + int truncate = 0; + int ret = 0; ++ char *p; ++ int len; + + if (!ISOFS_SB(inode->i_sb)->s_rock) + return 0; +@@ -267,12 +269,17 @@ repeat: + rr->u.NM.flags); + break; + } +- if ((strlen(retname) + rr->len - 5) >= 254) { ++ len = rr->len - 5; ++ if (retnamlen + len >= 254) { + truncate = 1; + break; + } +- strncat(retname, rr->u.NM.name, rr->len - 5); +- retnamlen += rr->len - 5; ++ p = memchr(rr->u.NM.name, '\0', len); ++ if (unlikely(p)) ++ len = p - rr->u.NM.name; ++ memcpy(retname + retnamlen, rr->u.NM.name, len); ++ retnamlen += len; ++ retname[retnamlen] = '\0'; + break; + case SIG('R', 'E'): + kfree(rs.buffer); +diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c +index 644f95e7208f..85733dd95e14 100644 +--- a/fs/jbd2/journal.c ++++ b/fs/jbd2/journal.c +@@ -1407,11 +1407,12 @@ out: + /** + * jbd2_mark_journal_empty() - Mark on disk journal as empty. + * @journal: The journal to update. ++ * @write_op: With which operation should we write the journal sb + * + * Update a journal's dynamic superblock fields to show that journal is empty. + * Write updated superblock to disk waiting for IO to complete. + */ +-static void jbd2_mark_journal_empty(journal_t *journal) ++static void jbd2_mark_journal_empty(journal_t *journal, int write_op) + { + journal_superblock_t *sb = journal->j_superblock; + +@@ -1429,7 +1430,7 @@ static void jbd2_mark_journal_empty(journal_t *journal) + sb->s_start = cpu_to_be32(0); + read_unlock(&journal->j_state_lock); + +- jbd2_write_superblock(journal, WRITE_FUA); ++ jbd2_write_superblock(journal, write_op); + + /* Log is no longer empty */ + write_lock(&journal->j_state_lock); +@@ -1697,7 +1698,13 @@ int jbd2_journal_destroy(journal_t *journal) + if (journal->j_sb_buffer) { + if (!is_journal_aborted(journal)) { + mutex_lock(&journal->j_checkpoint_mutex); +- jbd2_mark_journal_empty(journal); ++ ++ write_lock(&journal->j_state_lock); ++ journal->j_tail_sequence = ++ ++journal->j_transaction_sequence; ++ write_unlock(&journal->j_state_lock); ++ ++ jbd2_mark_journal_empty(journal, WRITE_FLUSH_FUA); + mutex_unlock(&journal->j_checkpoint_mutex); + } else + err = -EIO; +@@ -1952,7 +1959,7 @@ int jbd2_journal_flush(journal_t *journal) + * the magic code for a fully-recovered superblock. Any future + * commits of data to the journal will restore the current + * s_start value. */ +- jbd2_mark_journal_empty(journal); ++ jbd2_mark_journal_empty(journal, WRITE_FUA); + mutex_unlock(&journal->j_checkpoint_mutex); + write_lock(&journal->j_state_lock); + J_ASSERT(!journal->j_running_transaction); +@@ -1998,7 +2005,7 @@ int jbd2_journal_wipe(journal_t *journal, int write) + if (write) { + /* Lock to make assertions happy... */ + mutex_lock(&journal->j_checkpoint_mutex); +- jbd2_mark_journal_empty(journal); ++ jbd2_mark_journal_empty(journal, WRITE_FUA); + mutex_unlock(&journal->j_checkpoint_mutex); + } + +diff --git a/fs/ocfs2/dlm/dlmconvert.c b/fs/ocfs2/dlm/dlmconvert.c +index 29a886d1e82c..f65bdcf61526 100644 +--- a/fs/ocfs2/dlm/dlmconvert.c ++++ b/fs/ocfs2/dlm/dlmconvert.c +@@ -265,6 +265,7 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm, + struct dlm_lock *lock, int flags, int type) + { + enum dlm_status status; ++ u8 old_owner = res->owner; + + mlog(0, "type=%d, convert_type=%d, busy=%d\n", lock->ml.type, + lock->ml.convert_type, res->state & DLM_LOCK_RES_IN_PROGRESS); +@@ -290,6 +291,19 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm, + status = DLM_DENIED; + goto bail; + } ++ ++ if (lock->ml.type == type && lock->ml.convert_type == LKM_IVMODE) { ++ mlog(0, "last convert request returned DLM_RECOVERING, but " ++ "owner has already queued and sent ast to me. res %.*s, " ++ "(cookie=%u:%llu, type=%d, conv=%d)\n", ++ res->lockname.len, res->lockname.name, ++ dlm_get_lock_cookie_node(be64_to_cpu(lock->ml.cookie)), ++ dlm_get_lock_cookie_seq(be64_to_cpu(lock->ml.cookie)), ++ lock->ml.type, lock->ml.convert_type); ++ status = DLM_NORMAL; ++ goto bail; ++ } ++ + res->state |= DLM_LOCK_RES_IN_PROGRESS; + /* move lock to local convert queue */ + /* do not alter lock refcount. switching lists. */ +@@ -319,11 +333,19 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm, + spin_lock(&res->spinlock); + res->state &= ~DLM_LOCK_RES_IN_PROGRESS; + lock->convert_pending = 0; +- /* if it failed, move it back to granted queue */ ++ /* if it failed, move it back to granted queue. ++ * if master returns DLM_NORMAL and then down before sending ast, ++ * it may have already been moved to granted queue, reset to ++ * DLM_RECOVERING and retry convert */ + if (status != DLM_NORMAL) { + if (status != DLM_NOTQUEUED) + dlm_error(status); + dlm_revert_pending_convert(res, lock); ++ } else if ((res->state & DLM_LOCK_RES_RECOVERING) || ++ (old_owner != res->owner)) { ++ mlog(0, "res %.*s is in recovering or has been recovered.\n", ++ res->lockname.len, res->lockname.name); ++ status = DLM_RECOVERING; + } + bail: + spin_unlock(&res->spinlock); +diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c +index 01c69f24e416..33e9d705ee8f 100644 +--- a/fs/ocfs2/dlm/dlmrecovery.c ++++ b/fs/ocfs2/dlm/dlmrecovery.c +@@ -2034,7 +2034,6 @@ void dlm_move_lockres_to_recovery_list(struct dlm_ctxt *dlm, + dlm_lock_get(lock); + if (lock->convert_pending) { + /* move converting lock back to granted */ +- BUG_ON(i != DLM_CONVERTING_LIST); + mlog(0, "node died with convert pending " + "on %.*s. move back to granted list.\n", + res->lockname.len, res->lockname.name); +diff --git a/fs/pipe.c b/fs/pipe.c +index 3e7ab278bb0c..50267e6ba688 100644 +--- a/fs/pipe.c ++++ b/fs/pipe.c +@@ -401,6 +401,7 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov, + void *addr; + size_t chars = buf->len, remaining; + int error, atomic; ++ int offset; + + if (chars > total_len) + chars = total_len; +@@ -414,9 +415,10 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov, + + atomic = !iov_fault_in_pages_write(iov, chars); + remaining = chars; ++ offset = buf->offset; + redo: + addr = ops->map(pipe, buf, atomic); +- error = pipe_iov_copy_to_user(iov, addr, &buf->offset, ++ error = pipe_iov_copy_to_user(iov, addr, &offset, + &remaining, atomic); + ops->unmap(pipe, buf, addr); + if (unlikely(error)) { +@@ -432,6 +434,7 @@ redo: + break; + } + ret += chars; ++ buf->offset += chars; + buf->len -= chars; + + /* Was it a packet buffer? Clean up and exit */ +diff --git a/fs/proc/base.c b/fs/proc/base.c +index 7b5d453ebf53..e5160b744d0b 100644 +--- a/fs/proc/base.c ++++ b/fs/proc/base.c +@@ -844,7 +844,8 @@ static ssize_t environ_read(struct file *file, char __user *buf, + int ret = 0; + struct mm_struct *mm = file->private_data; + +- if (!mm) ++ /* Ensure the process spawned far enough to have an environment. */ ++ if (!mm || !mm->env_end) + return 0; + + page = (char *)__get_free_page(GFP_TEMPORARY); +diff --git a/fs/splice.c b/fs/splice.c +index 3b94a6bba29f..2ffa7b0c62fd 100644 +--- a/fs/splice.c ++++ b/fs/splice.c +@@ -189,6 +189,9 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe, + unsigned int spd_pages = spd->nr_pages; + int ret, do_wakeup, page_nr; + ++ if (!spd_pages) ++ return 0; ++ + ret = 0; + do_wakeup = 0; + page_nr = 0; +diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h +index 02ae99e8e6d3..953cd12175c4 100644 +--- a/include/linux/compiler-gcc.h ++++ b/include/linux/compiler-gcc.h +@@ -100,10 +100,116 @@ + #define __maybe_unused __attribute__((unused)) + #define __always_unused __attribute__((unused)) + +-#define __gcc_header(x) #x +-#define _gcc_header(x) __gcc_header(linux/compiler-gcc##x.h) +-#define gcc_header(x) _gcc_header(x) +-#include gcc_header(__GNUC__) ++/* gcc version specific checks */ ++ ++#if GCC_VERSION < 30200 ++# error Sorry, your compiler is too old - please upgrade it. ++#endif ++ ++#if GCC_VERSION < 30300 ++# define __used __attribute__((__unused__)) ++#else ++# define __used __attribute__((__used__)) ++#endif ++ ++#ifdef CONFIG_GCOV_KERNEL ++# if GCC_VERSION < 30400 ++# error "GCOV profiling support for gcc versions below 3.4 not included" ++# endif /* __GNUC_MINOR__ */ ++#endif /* CONFIG_GCOV_KERNEL */ ++ ++#if GCC_VERSION >= 30400 ++#define __must_check __attribute__((warn_unused_result)) ++#endif ++ ++#if GCC_VERSION >= 40000 ++ ++/* GCC 4.1.[01] miscompiles __weak */ ++#ifdef __KERNEL__ ++# if GCC_VERSION >= 40100 && GCC_VERSION <= 40101 ++# error Your version of gcc miscompiles the __weak directive ++# endif ++#endif ++ ++#define __used __attribute__((__used__)) ++#define __compiler_offsetof(a, b) \ ++ __builtin_offsetof(a, b) ++ ++#if GCC_VERSION >= 40100 && GCC_VERSION < 40600 ++# define __compiletime_object_size(obj) __builtin_object_size(obj, 0) ++#endif ++ ++#if GCC_VERSION >= 40300 ++/* Mark functions as cold. gcc will assume any path leading to a call ++ * to them will be unlikely. This means a lot of manual unlikely()s ++ * are unnecessary now for any paths leading to the usual suspects ++ * like BUG(), printk(), panic() etc. [but let's keep them for now for ++ * older compilers] ++ * ++ * Early snapshots of gcc 4.3 don't support this and we can't detect this ++ * in the preprocessor, but we can live with this because they're unreleased. ++ * Maketime probing would be overkill here. ++ * ++ * gcc also has a __attribute__((__hot__)) to move hot functions into ++ * a special section, but I don't see any sense in this right now in ++ * the kernel context ++ */ ++#define __cold __attribute__((__cold__)) ++ ++#define __UNIQUE_ID(prefix) __PASTE(__PASTE(__UNIQUE_ID_, prefix), __COUNTER__) ++ ++#ifndef __CHECKER__ ++# define __compiletime_warning(message) __attribute__((warning(message))) ++# define __compiletime_error(message) __attribute__((error(message))) ++#endif /* __CHECKER__ */ ++#endif /* GCC_VERSION >= 40300 */ ++ ++#if GCC_VERSION >= 40500 ++/* ++ * Mark a position in code as unreachable. This can be used to ++ * suppress control flow warnings after asm blocks that transfer ++ * control elsewhere. ++ * ++ * Early snapshots of gcc 4.5 don't support this and we can't detect ++ * this in the preprocessor, but we can live with this because they're ++ * unreleased. Really, we need to have autoconf for the kernel. ++ */ ++#define unreachable() __builtin_unreachable() ++ ++/* Mark a function definition as prohibited from being cloned. */ ++#define __noclone __attribute__((__noclone__, __optimize__("no-tracer"))) ++ ++#endif /* GCC_VERSION >= 40500 */ ++ ++#if GCC_VERSION >= 40600 ++/* ++ * Tell the optimizer that something else uses this function or variable. ++ */ ++#define __visible __attribute__((externally_visible)) ++#endif ++ ++/* ++ * GCC 'asm goto' miscompiles certain code sequences: ++ * ++ * http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58670 ++ * ++ * Work it around via a compiler barrier quirk suggested by Jakub Jelinek. ++ * ++ * (asm goto is automatically volatile - the naming reflects this.) ++ */ ++#define asm_volatile_goto(x...) do { asm goto(x); asm (""); } while (0) ++ ++#ifdef CONFIG_ARCH_USE_BUILTIN_BSWAP ++#if GCC_VERSION >= 40400 ++#define __HAVE_BUILTIN_BSWAP32__ ++#define __HAVE_BUILTIN_BSWAP64__ ++#endif ++#if GCC_VERSION >= 40800 || (defined(__powerpc__) && GCC_VERSION >= 40600) ++#define __HAVE_BUILTIN_BSWAP16__ ++#endif ++#endif /* CONFIG_ARCH_USE_BUILTIN_BSWAP */ ++ ++#endif /* gcc version >= 40000 specific checks */ + + #if !defined(__noclone) + #define __noclone /* not needed */ +diff --git a/include/linux/compiler-gcc3.h b/include/linux/compiler-gcc3.h +deleted file mode 100644 +index 7d89febe4d79..000000000000 +--- a/include/linux/compiler-gcc3.h ++++ /dev/null +@@ -1,23 +0,0 @@ +-#ifndef __LINUX_COMPILER_H +-#error "Please don't include directly, include instead." +-#endif +- +-#if GCC_VERSION < 30200 +-# error Sorry, your compiler is too old - please upgrade it. +-#endif +- +-#if GCC_VERSION >= 30300 +-# define __used __attribute__((__used__)) +-#else +-# define __used __attribute__((__unused__)) +-#endif +- +-#if GCC_VERSION >= 30400 +-#define __must_check __attribute__((warn_unused_result)) +-#endif +- +-#ifdef CONFIG_GCOV_KERNEL +-# if GCC_VERSION < 30400 +-# error "GCOV profiling support for gcc versions below 3.4 not included" +-# endif /* __GNUC_MINOR__ */ +-#endif /* CONFIG_GCOV_KERNEL */ +diff --git a/include/linux/compiler-gcc4.h b/include/linux/compiler-gcc4.h +deleted file mode 100644 +index 2507fd2a1eb4..000000000000 +--- a/include/linux/compiler-gcc4.h ++++ /dev/null +@@ -1,88 +0,0 @@ +-#ifndef __LINUX_COMPILER_H +-#error "Please don't include directly, include instead." +-#endif +- +-/* GCC 4.1.[01] miscompiles __weak */ +-#ifdef __KERNEL__ +-# if GCC_VERSION >= 40100 && GCC_VERSION <= 40101 +-# error Your version of gcc miscompiles the __weak directive +-# endif +-#endif +- +-#define __used __attribute__((__used__)) +-#define __must_check __attribute__((warn_unused_result)) +-#define __compiler_offsetof(a,b) __builtin_offsetof(a,b) +- +-#if GCC_VERSION >= 40100 && GCC_VERSION < 40600 +-# define __compiletime_object_size(obj) __builtin_object_size(obj, 0) +-#endif +- +-#if GCC_VERSION >= 40300 +-/* Mark functions as cold. gcc will assume any path leading to a call +- to them will be unlikely. This means a lot of manual unlikely()s +- are unnecessary now for any paths leading to the usual suspects +- like BUG(), printk(), panic() etc. [but let's keep them for now for +- older compilers] +- +- Early snapshots of gcc 4.3 don't support this and we can't detect this +- in the preprocessor, but we can live with this because they're unreleased. +- Maketime probing would be overkill here. +- +- gcc also has a __attribute__((__hot__)) to move hot functions into +- a special section, but I don't see any sense in this right now in +- the kernel context */ +-#define __cold __attribute__((__cold__)) +- +-#define __UNIQUE_ID(prefix) __PASTE(__PASTE(__UNIQUE_ID_, prefix), __COUNTER__) +- +-#ifndef __CHECKER__ +-# define __compiletime_warning(message) __attribute__((warning(message))) +-# define __compiletime_error(message) __attribute__((error(message))) +-#endif /* __CHECKER__ */ +-#endif /* GCC_VERSION >= 40300 */ +- +-#if GCC_VERSION >= 40500 +-/* +- * Mark a position in code as unreachable. This can be used to +- * suppress control flow warnings after asm blocks that transfer +- * control elsewhere. +- * +- * Early snapshots of gcc 4.5 don't support this and we can't detect +- * this in the preprocessor, but we can live with this because they're +- * unreleased. Really, we need to have autoconf for the kernel. +- */ +-#define unreachable() __builtin_unreachable() +- +-/* Mark a function definition as prohibited from being cloned. */ +-#define __noclone __attribute__((__noclone__)) +- +-#endif /* GCC_VERSION >= 40500 */ +- +-#if GCC_VERSION >= 40600 +-/* +- * Tell the optimizer that something else uses this function or variable. +- */ +-#define __visible __attribute__((externally_visible)) +-#endif +- +-/* +- * GCC 'asm goto' miscompiles certain code sequences: +- * +- * http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58670 +- * +- * Work it around via a compiler barrier quirk suggested by Jakub Jelinek. +- * Fixed in GCC 4.8.2 and later versions. +- * +- * (asm goto is automatically volatile - the naming reflects this.) +- */ +-#define asm_volatile_goto(x...) do { asm goto(x); asm (""); } while (0) +- +-#ifdef CONFIG_ARCH_USE_BUILTIN_BSWAP +-#if GCC_VERSION >= 40400 +-#define __HAVE_BUILTIN_BSWAP32__ +-#define __HAVE_BUILTIN_BSWAP64__ +-#endif +-#if GCC_VERSION >= 40800 || (defined(__powerpc__) && GCC_VERSION >= 40600) +-#define __HAVE_BUILTIN_BSWAP16__ +-#endif +-#endif /* CONFIG_ARCH_USE_BUILTIN_BSWAP */ +diff --git a/include/linux/compiler-gcc5.h b/include/linux/compiler-gcc5.h +deleted file mode 100644 +index cdd1cc202d51..000000000000 +--- a/include/linux/compiler-gcc5.h ++++ /dev/null +@@ -1,66 +0,0 @@ +-#ifndef __LINUX_COMPILER_H +-#error "Please don't include directly, include instead." +-#endif +- +-#define __used __attribute__((__used__)) +-#define __must_check __attribute__((warn_unused_result)) +-#define __compiler_offsetof(a, b) __builtin_offsetof(a, b) +- +-/* Mark functions as cold. gcc will assume any path leading to a call +- to them will be unlikely. This means a lot of manual unlikely()s +- are unnecessary now for any paths leading to the usual suspects +- like BUG(), printk(), panic() etc. [but let's keep them for now for +- older compilers] +- +- Early snapshots of gcc 4.3 don't support this and we can't detect this +- in the preprocessor, but we can live with this because they're unreleased. +- Maketime probing would be overkill here. +- +- gcc also has a __attribute__((__hot__)) to move hot functions into +- a special section, but I don't see any sense in this right now in +- the kernel context */ +-#define __cold __attribute__((__cold__)) +- +-#define __UNIQUE_ID(prefix) __PASTE(__PASTE(__UNIQUE_ID_, prefix), __COUNTER__) +- +-#ifndef __CHECKER__ +-# define __compiletime_warning(message) __attribute__((warning(message))) +-# define __compiletime_error(message) __attribute__((error(message))) +-#endif /* __CHECKER__ */ +- +-/* +- * Mark a position in code as unreachable. This can be used to +- * suppress control flow warnings after asm blocks that transfer +- * control elsewhere. +- * +- * Early snapshots of gcc 4.5 don't support this and we can't detect +- * this in the preprocessor, but we can live with this because they're +- * unreleased. Really, we need to have autoconf for the kernel. +- */ +-#define unreachable() __builtin_unreachable() +- +-/* Mark a function definition as prohibited from being cloned. */ +-#define __noclone __attribute__((__noclone__)) +- +-/* +- * Tell the optimizer that something else uses this function or variable. +- */ +-#define __visible __attribute__((externally_visible)) +- +-/* +- * GCC 'asm goto' miscompiles certain code sequences: +- * +- * http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58670 +- * +- * Work it around via a compiler barrier quirk suggested by Jakub Jelinek. +- * Fixed in GCC 4.8.2 and later versions. +- * +- * (asm goto is automatically volatile - the naming reflects this.) +- */ +-#define asm_volatile_goto(x...) do { asm goto(x); asm (""); } while (0) +- +-#ifdef CONFIG_ARCH_USE_BUILTIN_BSWAP +-#define __HAVE_BUILTIN_BSWAP32__ +-#define __HAVE_BUILTIN_BSWAP64__ +-#define __HAVE_BUILTIN_BSWAP16__ +-#endif /* CONFIG_ARCH_USE_BUILTIN_BSWAP */ +diff --git a/include/linux/kernel.h b/include/linux/kernel.h +index 341551c7b4c8..5f4554b8348a 100644 +--- a/include/linux/kernel.h ++++ b/include/linux/kernel.h +@@ -557,7 +557,7 @@ do { \ + + #define do_trace_printk(fmt, args...) \ + do { \ +- static const char *trace_printk_fmt \ ++ static const char *trace_printk_fmt __used \ + __attribute__((section("__trace_printk_fmt"))) = \ + __builtin_constant_p(fmt) ? fmt : NULL; \ + \ +@@ -604,7 +604,7 @@ extern int __trace_puts(unsigned long ip, const char *str, int size); + */ + + #define trace_puts(str) ({ \ +- static const char *trace_printk_fmt \ ++ static const char *trace_printk_fmt __used \ + __attribute__((section("__trace_printk_fmt"))) = \ + __builtin_constant_p(str) ? str : NULL; \ + \ +@@ -624,7 +624,7 @@ extern void trace_dump_stack(int skip); + #define ftrace_vprintk(fmt, vargs) \ + do { \ + if (__builtin_constant_p(fmt)) { \ +- static const char *trace_printk_fmt \ ++ static const char *trace_printk_fmt __used \ + __attribute__((section("__trace_printk_fmt"))) = \ + __builtin_constant_p(fmt) ? fmt : NULL; \ + \ +diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h +index b3bd7e737e8b..d31364857aa8 100644 +--- a/include/linux/mod_devicetable.h ++++ b/include/linux/mod_devicetable.h +@@ -397,6 +397,7 @@ struct virtio_device_id { + /* + * For Hyper-V devices we use the device guid as the id. + */ ++#define vmbus_device_id hv_vmbus_device_id + struct hv_vmbus_device_id { + __u8 guid[16]; + kernel_ulong_t driver_data; /* Data private to the driver */ +@@ -547,6 +548,11 @@ struct amba_id { + * See documentation of "x86_match_cpu" for details. + */ + ++/* ++ * MODULE_DEVICE_TABLE expects this struct to be called x86cpu_device_id. ++ * Although gcc seems to ignore this error, clang fails without this define. ++ */ ++#define x86cpu_device_id x86_cpu_id + struct x86_cpu_id { + __u16 vendor; + __u16 family; +@@ -574,6 +580,7 @@ struct ipack_device_id { + #define MEI_CL_MODULE_PREFIX "mei:" + #define MEI_CL_NAME_SIZE 32 + ++#define mei_device_id mei_cl_device_id + struct mei_cl_device_id { + char name[MEI_CL_NAME_SIZE]; + kernel_ulong_t driver_info; +diff --git a/include/linux/pci.h b/include/linux/pci.h +index 102136ab1a5f..655ef37fd139 100644 +--- a/include/linux/pci.h ++++ b/include/linux/pci.h +@@ -330,6 +330,7 @@ struct pci_dev { + unsigned int __aer_firmware_first:1; + unsigned int broken_intx_masking:1; + unsigned int io_window_1k:1; /* Intel P2P bridge 1K I/O windows */ ++ unsigned int non_compliant_bars:1; /* broken BARs; ignore them */ + pci_dev_flags_t dev_flags; + atomic_t enable_cnt; /* pci_enable_device has been called */ + +diff --git a/include/linux/poison.h b/include/linux/poison.h +index 2110a81c5e2a..253c9b4198ef 100644 +--- a/include/linux/poison.h ++++ b/include/linux/poison.h +@@ -19,8 +19,8 @@ + * under normal circumstances, used to verify that nobody uses + * non-initialized list entries. + */ +-#define LIST_POISON1 ((void *) 0x00100100 + POISON_POINTER_DELTA) +-#define LIST_POISON2 ((void *) 0x00200200 + POISON_POINTER_DELTA) ++#define LIST_POISON1 ((void *) 0x100 + POISON_POINTER_DELTA) ++#define LIST_POISON2 ((void *) 0x200 + POISON_POINTER_DELTA) + + /********** include/linux/timer.h **********/ + /* +diff --git a/include/uapi/linux/const.h b/include/uapi/linux/const.h +index c22c707c455d..c872bfd25e13 100644 +--- a/include/uapi/linux/const.h ++++ b/include/uapi/linux/const.h +@@ -21,4 +21,7 @@ + #define _AT(T,X) ((T)(X)) + #endif + ++#define _BITUL(x) (_AC(1,UL) << (x)) ++#define _BITULL(x) (_AC(1,ULL) << (x)) ++ + #endif /* !(_LINUX_CONST_H) */ +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index f234c84d36c8..655d6110a6e1 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -5217,6 +5217,7 @@ migration_call(struct notifier_block *nfb, unsigned long action, void *hcpu) + + case CPU_UP_PREPARE: + rq->calc_load_update = calc_load_update; ++ account_reset_rq(rq); + break; + + case CPU_ONLINE: +diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h +index dfa31d533e3f..e7f4d554fa5d 100644 +--- a/kernel/sched/sched.h ++++ b/kernel/sched/sched.h +@@ -1378,3 +1378,16 @@ static inline u64 irq_time_read(int cpu) + } + #endif /* CONFIG_64BIT */ + #endif /* CONFIG_IRQ_TIME_ACCOUNTING */ ++ ++static inline void account_reset_rq(struct rq *rq) ++{ ++#ifdef CONFIG_IRQ_TIME_ACCOUNTING ++ rq->prev_irq_time = 0; ++#endif ++#ifdef CONFIG_PARAVIRT ++ rq->prev_steal_time = 0; ++#endif ++#ifdef CONFIG_PARAVIRT_TIME_ACCOUNTING ++ rq->prev_steal_time_rq = 0; ++#endif ++} +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index cb73c4e0741e..c4ce3a951a1c 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -463,7 +463,7 @@ struct ring_buffer_per_cpu { + raw_spinlock_t reader_lock; /* serialize readers */ + arch_spinlock_t lock; + struct lock_class_key lock_key; +- unsigned int nr_pages; ++ unsigned long nr_pages; + struct list_head *pages; + struct buffer_page *head_page; /* read from head */ + struct buffer_page *tail_page; /* write to tail */ +@@ -483,7 +483,7 @@ struct ring_buffer_per_cpu { + u64 write_stamp; + u64 read_stamp; + /* ring buffer pages to update, > 0 to add, < 0 to remove */ +- int nr_pages_to_update; ++ long nr_pages_to_update; + struct list_head new_pages; /* new pages to add */ + struct work_struct update_pages_work; + struct completion update_done; +@@ -1120,10 +1120,10 @@ static int rb_check_pages(struct ring_buffer_per_cpu *cpu_buffer) + return 0; + } + +-static int __rb_allocate_pages(int nr_pages, struct list_head *pages, int cpu) ++static int __rb_allocate_pages(long nr_pages, struct list_head *pages, int cpu) + { +- int i; + struct buffer_page *bpage, *tmp; ++ long i; + + for (i = 0; i < nr_pages; i++) { + struct page *page; +@@ -1160,7 +1160,7 @@ free_pages: + } + + static int rb_allocate_pages(struct ring_buffer_per_cpu *cpu_buffer, +- unsigned nr_pages) ++ unsigned long nr_pages) + { + LIST_HEAD(pages); + +@@ -1185,7 +1185,7 @@ static int rb_allocate_pages(struct ring_buffer_per_cpu *cpu_buffer, + } + + static struct ring_buffer_per_cpu * +-rb_allocate_cpu_buffer(struct ring_buffer *buffer, int nr_pages, int cpu) ++rb_allocate_cpu_buffer(struct ring_buffer *buffer, long nr_pages, int cpu) + { + struct ring_buffer_per_cpu *cpu_buffer; + struct buffer_page *bpage; +@@ -1284,8 +1284,9 @@ struct ring_buffer *__ring_buffer_alloc(unsigned long size, unsigned flags, + struct lock_class_key *key) + { + struct ring_buffer *buffer; ++ long nr_pages; + int bsize; +- int cpu, nr_pages; ++ int cpu; + + /* keep it in its own cache line */ + buffer = kzalloc(ALIGN(sizeof(*buffer), cache_line_size()), +@@ -1408,12 +1409,12 @@ static inline unsigned long rb_page_write(struct buffer_page *bpage) + } + + static int +-rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned int nr_pages) ++rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned long nr_pages) + { + struct list_head *tail_page, *to_remove, *next_page; + struct buffer_page *to_remove_page, *tmp_iter_page; + struct buffer_page *last_page, *first_page; +- unsigned int nr_removed; ++ unsigned long nr_removed; + unsigned long head_bit; + int page_entries; + +@@ -1629,7 +1630,7 @@ int ring_buffer_resize(struct ring_buffer *buffer, unsigned long size, + int cpu_id) + { + struct ring_buffer_per_cpu *cpu_buffer; +- unsigned nr_pages; ++ unsigned long nr_pages; + int cpu, err = 0; + + /* +@@ -1643,14 +1644,13 @@ int ring_buffer_resize(struct ring_buffer *buffer, unsigned long size, + !cpumask_test_cpu(cpu_id, buffer->cpumask)) + return size; + +- size = DIV_ROUND_UP(size, BUF_PAGE_SIZE); +- size *= BUF_PAGE_SIZE; ++ nr_pages = DIV_ROUND_UP(size, BUF_PAGE_SIZE); + + /* we need a minimum of two pages */ +- if (size < BUF_PAGE_SIZE * 2) +- size = BUF_PAGE_SIZE * 2; ++ if (nr_pages < 2) ++ nr_pages = 2; + +- nr_pages = DIV_ROUND_UP(size, BUF_PAGE_SIZE); ++ size = nr_pages * BUF_PAGE_SIZE; + + /* + * Don't succeed if resizing is disabled, as a reader might be +@@ -4607,8 +4607,9 @@ static int rb_cpu_notify(struct notifier_block *self, + struct ring_buffer *buffer = + container_of(self, struct ring_buffer, cpu_notify); + long cpu = (long)hcpu; +- int cpu_i, nr_pages_same; +- unsigned int nr_pages; ++ long nr_pages_same; ++ int cpu_i; ++ unsigned long nr_pages; + + switch (action) { + case CPU_UP_PREPARE: +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 640e4c44b170..eff26a976f02 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -4351,7 +4351,10 @@ static ssize_t tracing_splice_read_pipe(struct file *filp, + + spd.nr_pages = i; + +- ret = splice_to_pipe(pipe, &spd); ++ if (i) ++ ret = splice_to_pipe(pipe, &spd); ++ else ++ ret = 0; + out: + splice_shrink_spd(&spd); + return ret; +diff --git a/kernel/trace/trace_irqsoff.c b/kernel/trace/trace_irqsoff.c +index 2aefbee93a6d..56e083e26ca9 100644 +--- a/kernel/trace/trace_irqsoff.c ++++ b/kernel/trace/trace_irqsoff.c +@@ -118,8 +118,12 @@ static int func_prolog_dec(struct trace_array *tr, + return 0; + + local_save_flags(*flags); +- /* slight chance to get a false positive on tracing_cpu */ +- if (!irqs_disabled_flags(*flags)) ++ /* ++ * Slight chance to get a false positive on tracing_cpu, ++ * although I'm starting to think there isn't a chance. ++ * Leave this for now just to be paranoid. ++ */ ++ if (!irqs_disabled_flags(*flags) && !preempt_count()) + return 0; + + *data = per_cpu_ptr(tr->trace_buffer.data, cpu); +diff --git a/kernel/trace/trace_printk.c b/kernel/trace/trace_printk.c +index a9077c1b4ad3..fdb23e84b011 100644 +--- a/kernel/trace/trace_printk.c ++++ b/kernel/trace/trace_printk.c +@@ -272,6 +272,9 @@ static int t_show(struct seq_file *m, void *v) + const char *str = *fmt; + int i; + ++ if (!*fmt) ++ return 0; ++ + seq_printf(m, "0x%lx : \"", *(unsigned long *)fmt); + + /* +diff --git a/kernel/workqueue.c b/kernel/workqueue.c +index fe7c4b91d2e7..66972ac0c6c0 100644 +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -606,6 +606,35 @@ static void set_work_pool_and_clear_pending(struct work_struct *work, + */ + smp_wmb(); + set_work_data(work, (unsigned long)pool_id << WORK_OFFQ_POOL_SHIFT, 0); ++ /* ++ * The following mb guarantees that previous clear of a PENDING bit ++ * will not be reordered with any speculative LOADS or STORES from ++ * work->current_func, which is executed afterwards. This possible ++ * reordering can lead to a missed execution on attempt to qeueue ++ * the same @work. E.g. consider this case: ++ * ++ * CPU#0 CPU#1 ++ * ---------------------------- -------------------------------- ++ * ++ * 1 STORE event_indicated ++ * 2 queue_work_on() { ++ * 3 test_and_set_bit(PENDING) ++ * 4 } set_..._and_clear_pending() { ++ * 5 set_work_data() # clear bit ++ * 6 smp_mb() ++ * 7 work->current_func() { ++ * 8 LOAD event_indicated ++ * } ++ * ++ * Without an explicit full barrier speculative LOAD on line 8 can ++ * be executed before CPU#0 does STORE on line 1. If that happens, ++ * CPU#0 observes the PENDING bit is still set and new execution of ++ * a @work is not queued in a hope, that CPU#1 will eventually ++ * finish the queued @work. Meanwhile CPU#1 does not see ++ * event_indicated is set, because speculative LOAD was executed ++ * before actual STORE. ++ */ ++ smp_mb(); + } + + static void clear_work_data(struct work_struct *work) +diff --git a/net/batman-adv/send.c b/net/batman-adv/send.c +index 263cfd1ccee7..cf5b76661252 100644 +--- a/net/batman-adv/send.c ++++ b/net/batman-adv/send.c +@@ -353,6 +353,9 @@ batadv_purge_outstanding_packets(struct batadv_priv *bat_priv, + + if (pending) { + hlist_del(&forw_packet->list); ++ if (!forw_packet->own) ++ atomic_inc(&bat_priv->batman_queue_left); ++ + batadv_forw_packet_free(forw_packet); + } + } +@@ -379,6 +382,9 @@ batadv_purge_outstanding_packets(struct batadv_priv *bat_priv, + + if (pending) { + hlist_del(&forw_packet->list); ++ if (!forw_packet->own) ++ atomic_inc(&bat_priv->bcast_queue_left); ++ + batadv_forw_packet_free(forw_packet); + } + } +diff --git a/net/bridge/br_ioctl.c b/net/bridge/br_ioctl.c +index b73eaba85667..a882db499d33 100644 +--- a/net/bridge/br_ioctl.c ++++ b/net/bridge/br_ioctl.c +@@ -21,18 +21,19 @@ + #include + #include "br_private.h" + +-/* called with RTNL */ + static int get_bridge_ifindices(struct net *net, int *indices, int num) + { + struct net_device *dev; + int i = 0; + +- for_each_netdev(net, dev) { ++ rcu_read_lock(); ++ for_each_netdev_rcu(net, dev) { + if (i >= num) + break; + if (dev->priv_flags & IFF_EBRIDGE) + indices[i++] = dev->ifindex; + } ++ rcu_read_unlock(); + + return i; + } +diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c +index a67310e00b3f..602c6d0492e2 100644 +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -899,14 +899,16 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev, + goto nla_put_failure; + + if (1) { +- struct rtnl_link_ifmap map = { +- .mem_start = dev->mem_start, +- .mem_end = dev->mem_end, +- .base_addr = dev->base_addr, +- .irq = dev->irq, +- .dma = dev->dma, +- .port = dev->if_port, +- }; ++ struct rtnl_link_ifmap map; ++ ++ memset(&map, 0, sizeof(map)); ++ map.mem_start = dev->mem_start; ++ map.mem_end = dev->mem_end; ++ map.base_addr = dev->base_addr; ++ map.irq = dev->irq; ++ map.dma = dev->dma; ++ map.port = dev->if_port; ++ + if (nla_put(skb, IFLA_MAP, sizeof(map), &map)) + goto nla_put_failure; + } +diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c +index fe32388ea24f..b9610051f3b2 100644 +--- a/net/decnet/dn_route.c ++++ b/net/decnet/dn_route.c +@@ -1030,10 +1030,13 @@ source_ok: + if (!fld.daddr) { + fld.daddr = fld.saddr; + +- err = -EADDRNOTAVAIL; + if (dev_out) + dev_put(dev_out); ++ err = -EINVAL; + dev_out = init_net.loopback_dev; ++ if (!dev_out->dn_ptr) ++ goto out; ++ err = -EADDRNOTAVAIL; + dev_hold(dev_out); + if (!fld.daddr) { + fld.daddr = +@@ -1106,6 +1109,8 @@ source_ok: + if (dev_out == NULL) + goto out; + dn_db = rcu_dereference_raw(dev_out->dn_ptr); ++ if (!dn_db) ++ goto e_inval; + /* Possible improvement - check all devices for local addr */ + if (dn_dev_islocal(dev_out, fld.daddr)) { + dev_put(dev_out); +@@ -1147,6 +1152,8 @@ select_source: + dev_put(dev_out); + dev_out = init_net.loopback_dev; + dev_hold(dev_out); ++ if (!dev_out->dn_ptr) ++ goto e_inval; + fld.flowidn_oif = dev_out->ifindex; + if (res.fi) + dn_fib_info_put(res.fi); +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index 222e1b6141d3..624ca8ed350c 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -1876,6 +1876,18 @@ static struct rtable *__mkroute_output(const struct fib_result *res, + */ + if (fi && res->prefixlen < 4) + fi = NULL; ++ } else if ((type == RTN_LOCAL) && (orig_oif != 0) && ++ (orig_oif != dev_out->ifindex)) { ++ /* For local routes that require a particular output interface ++ * we do not want to cache the result. Caching the result ++ * causes incorrect behaviour when there are multiple source ++ * addresses on the interface, the end result being that if the ++ * intended recipient is waiting on that interface for the ++ * packet he won't receive it because it will be delivered on ++ * the loopback interface and the IP_PKTINFO ipi_ifindex will ++ * be set to the loopback interface as well. ++ */ ++ fi = NULL; + } + + fnhe = NULL; +diff --git a/net/ipv6/exthdrs_core.c b/net/ipv6/exthdrs_core.c +index 51af9d0d019a..f66c1b629582 100644 +--- a/net/ipv6/exthdrs_core.c ++++ b/net/ipv6/exthdrs_core.c +@@ -257,7 +257,11 @@ int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset, + *fragoff = _frag_off; + return hp->nexthdr; + } +- return -ENOENT; ++ if (!found) ++ return -ENOENT; ++ if (fragoff) ++ *fragoff = _frag_off; ++ break; + } + hdrlen = 8; + } else if (nexthdr == NEXTHDR_AUTH) { +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index 14f46af17704..31bab1ab007c 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -266,12 +266,12 @@ static int ip6_tnl_create2(struct net_device *dev) + + t = netdev_priv(dev); + ++ dev->rtnl_link_ops = &ip6_link_ops; + err = register_netdevice(dev); + if (err < 0) + goto out; + + strcpy(t->parms.name, dev->name); +- dev->rtnl_link_ops = &ip6_link_ops; + + dev_hold(dev); + ip6_tnl_link(ip6n, t); +diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c +index 7e3901893413..3046d0244393 100644 +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -839,11 +839,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, + int ret = udpv6_queue_rcv_skb(sk, skb); + sock_put(sk); + +- /* a return value > 0 means to resubmit the input, but +- * it wants the return to be -protocol, or 0 +- */ ++ /* a return value > 0 means to resubmit the input */ + if (ret > 0) +- return -ret; ++ return ret; + + return 0; + } +diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c +index da1a1cee1a08..07f8b97f9ae9 100644 +--- a/net/l2tp/l2tp_ip.c ++++ b/net/l2tp/l2tp_ip.c +@@ -123,12 +123,11 @@ static int l2tp_ip_recv(struct sk_buff *skb) + struct l2tp_tunnel *tunnel = NULL; + int length; + +- /* Point to L2TP header */ +- optr = ptr = skb->data; +- + if (!pskb_may_pull(skb, 4)) + goto discard; + ++ /* Point to L2TP header */ ++ optr = ptr = skb->data; + session_id = ntohl(*((__be32 *) ptr)); + ptr += 4; + +@@ -156,6 +155,9 @@ static int l2tp_ip_recv(struct sk_buff *skb) + if (!pskb_may_pull(skb, length)) + goto discard; + ++ /* Point to L2TP header */ ++ optr = ptr = skb->data; ++ ptr += 4; + pr_debug("%s: ip recv\n", tunnel->name); + print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, ptr, length); + } +diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c +index e6e8408c9e36..db96af978da5 100644 +--- a/net/l2tp/l2tp_ip6.c ++++ b/net/l2tp/l2tp_ip6.c +@@ -135,12 +135,11 @@ static int l2tp_ip6_recv(struct sk_buff *skb) + struct l2tp_tunnel *tunnel = NULL; + int length; + +- /* Point to L2TP header */ +- optr = ptr = skb->data; +- + if (!pskb_may_pull(skb, 4)) + goto discard; + ++ /* Point to L2TP header */ ++ optr = ptr = skb->data; + session_id = ntohl(*((__be32 *) ptr)); + ptr += 4; + +@@ -168,6 +167,9 @@ static int l2tp_ip6_recv(struct sk_buff *skb) + if (!pskb_may_pull(skb, length)) + goto discard; + ++ /* Point to L2TP header */ ++ optr = ptr = skb->data; ++ ptr += 4; + pr_debug("%s: ip recv\n", tunnel->name); + print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, ptr, length); + } +diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c +index c3ee80547066..9d140594082c 100644 +--- a/net/llc/af_llc.c ++++ b/net/llc/af_llc.c +@@ -626,6 +626,7 @@ static void llc_cmsg_rcv(struct msghdr *msg, struct sk_buff *skb) + if (llc->cmsg_flags & LLC_CMSG_PKTINFO) { + struct llc_pktinfo info; + ++ memset(&info, 0, sizeof(info)); + info.lpi_ifindex = llc_sk(skb->sk)->dev->ifindex; + llc_pdu_decode_dsap(skb, &info.lpi_sap); + llc_pdu_decode_da(skb, info.lpi_mac); +diff --git a/net/netfilter/ipvs/ip_vs_pe_sip.c b/net/netfilter/ipvs/ip_vs_pe_sip.c +index bed5f7042529..bb318e4623a3 100644 +--- a/net/netfilter/ipvs/ip_vs_pe_sip.c ++++ b/net/netfilter/ipvs/ip_vs_pe_sip.c +@@ -88,7 +88,7 @@ ip_vs_sip_fill_param(struct ip_vs_conn_param *p, struct sk_buff *skb) + dptr = skb->data + dataoff; + datalen = skb->len - dataoff; + +- if (get_callid(dptr, dataoff, datalen, &matchoff, &matchlen)) ++ if (get_callid(dptr, 0, datalen, &matchoff, &matchlen)) + return -EINVAL; + + /* N.B: pe_data is only set on success, +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 39fa33969b09..2d454a235e84 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -2997,6 +2997,7 @@ static int packet_mc_add(struct sock *sk, struct packet_mreq_max *mreq) + i->ifindex = mreq->mr_ifindex; + i->alen = mreq->mr_alen; + memcpy(i->addr, mreq->mr_address, i->alen); ++ memset(i->addr + i->alen, 0, sizeof(i->addr) - i->alen); + i->count = 1; + i->next = po->mclist; + po->mclist = i; +diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c +index bee032a7003f..10d3e2874dd1 100644 +--- a/net/sctp/ipv6.c ++++ b/net/sctp/ipv6.c +@@ -520,6 +520,8 @@ static int sctp_v6_cmp_addr(const union sctp_addr *addr1, + } + return 0; + } ++ if (addr1->v6.sin6_port != addr2->v6.sin6_port) ++ return 0; + if (!ipv6_addr_equal(&addr1->v6.sin6_addr, &addr2->v6.sin6_addr)) + return 0; + /* If this is a linklocal address, compare the scope_id. */ +diff --git a/net/socket.c b/net/socket.c +index 53b6e411f7a4..e91e8ed1b8df 100644 +--- a/net/socket.c ++++ b/net/socket.c +@@ -2381,31 +2381,31 @@ int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen, + break; + } + +-out_put: +- fput_light(sock->file, fput_needed); +- + if (err == 0) +- return datagrams; ++ goto out_put; + +- if (datagrams != 0) { ++ if (datagrams == 0) { ++ datagrams = err; ++ goto out_put; ++ } ++ ++ /* ++ * We may return less entries than requested (vlen) if the ++ * sock is non block and there aren't enough datagrams... ++ */ ++ if (err != -EAGAIN) { + /* +- * We may return less entries than requested (vlen) if the +- * sock is non block and there aren't enough datagrams... ++ * ... or if recvmsg returns an error after we ++ * received some datagrams, where we record the ++ * error to return on the next call or if the ++ * app asks about it using getsockopt(SO_ERROR). + */ +- if (err != -EAGAIN) { +- /* +- * ... or if recvmsg returns an error after we +- * received some datagrams, where we record the +- * error to return on the next call or if the +- * app asks about it using getsockopt(SO_ERROR). +- */ +- sock->sk->sk_err = -err; +- } +- +- return datagrams; ++ sock->sk->sk_err = -err; + } ++out_put: ++ fput_light(sock->file, fput_needed); + +- return err; ++ return datagrams; + } + + SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg, +diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c +index 9b88693bcc99..66a9bf52fac6 100644 +--- a/net/vmw_vsock/af_vsock.c ++++ b/net/vmw_vsock/af_vsock.c +@@ -1804,27 +1804,8 @@ vsock_stream_recvmsg(struct kiocb *kiocb, + else if (sk->sk_shutdown & RCV_SHUTDOWN) + err = 0; + +- if (copied > 0) { +- /* We only do these additional bookkeeping/notification steps +- * if we actually copied something out of the queue pair +- * instead of just peeking ahead. +- */ +- +- if (!(flags & MSG_PEEK)) { +- /* If the other side has shutdown for sending and there +- * is nothing more to read, then modify the socket +- * state. +- */ +- if (vsk->peer_shutdown & SEND_SHUTDOWN) { +- if (vsock_stream_has_data(vsk) <= 0) { +- sk->sk_state = SS_UNCONNECTED; +- sock_set_flag(sk, SOCK_DONE); +- sk->sk_state_change(sk); +- } +- } +- } ++ if (copied > 0) + err = copied; +- } + + out_wait: + finish_wait(sk_sleep(sk), &wait); +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index 90a0e552cb32..dd3dbed89c8f 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -10685,7 +10685,7 @@ static int nl80211_netlink_notify(struct notifier_block * nb, + struct wireless_dev *wdev; + struct cfg80211_beacon_registration *reg, *tmp; + +- if (state != NETLINK_URELEASE) ++ if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC) + return NOTIFY_DONE; + + rcu_read_lock(); +diff --git a/net/x25/x25_facilities.c b/net/x25/x25_facilities.c +index 66c638730c7a..de7552d8ee20 100644 +--- a/net/x25/x25_facilities.c ++++ b/net/x25/x25_facilities.c +@@ -271,6 +271,7 @@ int x25_negotiate_facilities(struct sk_buff *skb, struct sock *sk, + + memset(&theirs, 0, sizeof(theirs)); + memcpy(new, ours, sizeof(*new)); ++ memset(dte, 0, sizeof(*dte)); + + len = x25_parse_facilities(skb, &theirs, dte, &x25->vc_facil_mask); + if (len < 0) +diff --git a/scripts/coccinelle/iterators/use_after_iter.cocci b/scripts/coccinelle/iterators/use_after_iter.cocci +index 06284c57a951..93e37ff8b0f6 100644 +--- a/scripts/coccinelle/iterators/use_after_iter.cocci ++++ b/scripts/coccinelle/iterators/use_after_iter.cocci +@@ -123,7 +123,7 @@ list_remove_head(x,c,...) + | + sizeof(<+...c...+>) + | +-&c->member ++ &c->member + | + c = E + | +diff --git a/sound/core/timer.c b/sound/core/timer.c +index d90d8f4b85fe..38742e826900 100644 +--- a/sound/core/timer.c ++++ b/sound/core/timer.c +@@ -1012,8 +1012,8 @@ static int snd_timer_s_start(struct snd_timer * timer) + njiff += timer->sticks - priv->correction; + priv->correction = 0; + } +- priv->last_expires = priv->tlist.expires = njiff; +- add_timer(&priv->tlist); ++ priv->last_expires = njiff; ++ mod_timer(&priv->tlist, njiff); + return 0; + } + +diff --git a/sound/pci/intel8x0.c b/sound/pci/intel8x0.c +index b8fe40531b9c..7022450fb6dd 100644 +--- a/sound/pci/intel8x0.c ++++ b/sound/pci/intel8x0.c +@@ -2885,6 +2885,7 @@ static void intel8x0_measure_ac97_clock(struct intel8x0 *chip) + + static struct snd_pci_quirk intel8x0_clock_list[] = { + SND_PCI_QUIRK(0x0e11, 0x008a, "AD1885", 41000), ++ SND_PCI_QUIRK(0x1014, 0x0581, "AD1981B", 48000), + SND_PCI_QUIRK(0x1028, 0x00be, "AD1885", 44100), + SND_PCI_QUIRK(0x1028, 0x0177, "AD1980", 48000), + SND_PCI_QUIRK(0x1028, 0x01ad, "AD1981B", 48000), +diff --git a/sound/soc/samsung/s3c-i2s-v2.c b/sound/soc/samsung/s3c-i2s-v2.c +index 20e98d1dded2..38c36cdd8c77 100644 +--- a/sound/soc/samsung/s3c-i2s-v2.c ++++ b/sound/soc/samsung/s3c-i2s-v2.c +@@ -732,7 +732,7 @@ static int s3c2412_i2s_resume(struct snd_soc_dai *dai) + #endif + + int s3c_i2sv2_register_component(struct device *dev, int id, +- struct snd_soc_component_driver *cmp_drv, ++ const struct snd_soc_component_driver *cmp_drv, + struct snd_soc_dai_driver *dai_drv) + { + struct snd_soc_dai_ops *ops = drv->ops; +diff --git a/sound/soc/samsung/s3c-i2s-v2.h b/sound/soc/samsung/s3c-i2s-v2.h +index 90abab364b49..d0684145ed1f 100644 +--- a/sound/soc/samsung/s3c-i2s-v2.h ++++ b/sound/soc/samsung/s3c-i2s-v2.h +@@ -101,7 +101,7 @@ extern int s3c_i2sv2_probe(struct snd_soc_dai *dai, + * soc core. + */ + extern int s3c_i2sv2_register_component(struct device *dev, int id, +- struct snd_soc_component_driver *cmp_drv, ++ const struct snd_soc_component_driver *cmp_drv, + struct snd_soc_dai_driver *dai_drv); + + #endif /* __SND_SOC_S3C24XX_S3C_I2SV2_I2S_H */ +diff --git a/tools/perf/Documentation/perf-stat.txt b/tools/perf/Documentation/perf-stat.txt +index 2fe87fb558f0..8c9604797e87 100644 +--- a/tools/perf/Documentation/perf-stat.txt ++++ b/tools/perf/Documentation/perf-stat.txt +@@ -50,6 +50,14 @@ OPTIONS + --scale:: + scale/normalize counter values + ++-d:: ++--detailed:: ++ print more detailed statistics, can be specified up to 3 times ++ ++ -d: detailed events, L1 and LLC data cache ++ -d -d: more detailed events, dTLB and iTLB events ++ -d -d -d: very detailed events, adding prefetch events ++ + -r:: + --repeat=:: + repeat command and print average + stddev (max: 100). 0 means forever. +diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c +index 1d4b8bed4e48..4f865e122c21 100644 +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -468,6 +468,16 @@ static struct kvm *kvm_create_vm(unsigned long type) + if (!kvm) + return ERR_PTR(-ENOMEM); + ++ spin_lock_init(&kvm->mmu_lock); ++ atomic_inc(¤t->mm->mm_count); ++ kvm->mm = current->mm; ++ kvm_eventfd_init(kvm); ++ mutex_init(&kvm->lock); ++ mutex_init(&kvm->irq_lock); ++ mutex_init(&kvm->slots_lock); ++ atomic_set(&kvm->users_count, 1); ++ INIT_LIST_HEAD(&kvm->devices); ++ + r = kvm_arch_init_vm(kvm, type); + if (r) + goto out_err_nodisable; +@@ -497,16 +507,6 @@ static struct kvm *kvm_create_vm(unsigned long type) + goto out_err; + } + +- spin_lock_init(&kvm->mmu_lock); +- kvm->mm = current->mm; +- atomic_inc(&kvm->mm->mm_count); +- kvm_eventfd_init(kvm); +- mutex_init(&kvm->lock); +- mutex_init(&kvm->irq_lock); +- mutex_init(&kvm->slots_lock); +- atomic_set(&kvm->users_count, 1); +- INIT_LIST_HEAD(&kvm->devices); +- + r = kvm_init_mmu_notifier(kvm); + if (r) + goto out_err; +@@ -526,6 +526,7 @@ out_err_nodisable: + kfree(kvm->buses[i]); + kfree(kvm->memslots); + kvm_arch_free_vm(kvm); ++ mmdrop(current->mm); + return ERR_PTR(r); + } + diff --git a/patch/kernel/odroidc1-default/patch-3.10.101-102.patch b/patch/kernel/odroidc1-default/patch-3.10.101-102.patch new file mode 100644 index 000000000..af1472cd2 --- /dev/null +++ b/patch/kernel/odroidc1-default/patch-3.10.101-102.patch @@ -0,0 +1,4381 @@ +diff --git a/MAINTAINERS b/MAINTAINERS +index 48c748080c96..29d7d74a8d04 100644 +--- a/MAINTAINERS ++++ b/MAINTAINERS +@@ -3032,8 +3032,8 @@ F: Documentation/x86/efi-stub.txt + F: arch/ia64/kernel/efi.c + F: arch/x86/boot/compressed/eboot.[ch] + F: arch/x86/include/asm/efi.h +-F: arch/x86/platform/efi/* +-F: drivers/firmware/efi/* ++F: arch/x86/platform/efi/ ++F: drivers/firmware/efi/ + F: include/linux/efi*.h + + EFI VARIABLE FILESYSTEM +diff --git a/Makefile b/Makefile +index 4be9e643cef0..868093c16ae0 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 10 +-SUBLEVEL = 101 ++SUBLEVEL = 102 + EXTRAVERSION = + NAME = TOSSUG Baby Fish + +diff --git a/arch/arm/mach-omap2/cpuidle34xx.c b/arch/arm/mach-omap2/cpuidle34xx.c +index e18709d3b95d..38e1bdcaf015 100644 +--- a/arch/arm/mach-omap2/cpuidle34xx.c ++++ b/arch/arm/mach-omap2/cpuidle34xx.c +@@ -34,6 +34,7 @@ + #include "pm.h" + #include "control.h" + #include "common.h" ++#include "soc.h" + + /* Mach specific information to be recorded in the C-state driver_data */ + struct omap3_idle_statedata { +@@ -322,6 +323,69 @@ static struct cpuidle_driver omap3_idle_driver = { + .safe_state_index = 0, + }; + ++/* ++ * Numbers based on measurements made in October 2009 for PM optimized kernel ++ * with CPU freq enabled on device Nokia N900. Assumes OPP2 (main idle OPP, ++ * and worst case latencies). ++ */ ++static struct cpuidle_driver omap3430_idle_driver = { ++ .name = "omap3430_idle", ++ .owner = THIS_MODULE, ++ .states = { ++ { ++ .enter = omap3_enter_idle_bm, ++ .exit_latency = 110 + 162, ++ .target_residency = 5, ++ .name = "C1", ++ .desc = "MPU ON + CORE ON", ++ }, ++ { ++ .enter = omap3_enter_idle_bm, ++ .exit_latency = 106 + 180, ++ .target_residency = 309, ++ .name = "C2", ++ .desc = "MPU ON + CORE ON", ++ }, ++ { ++ .enter = omap3_enter_idle_bm, ++ .exit_latency = 107 + 410, ++ .target_residency = 46057, ++ .name = "C3", ++ .desc = "MPU RET + CORE ON", ++ }, ++ { ++ .enter = omap3_enter_idle_bm, ++ .exit_latency = 121 + 3374, ++ .target_residency = 46057, ++ .name = "C4", ++ .desc = "MPU OFF + CORE ON", ++ }, ++ { ++ .enter = omap3_enter_idle_bm, ++ .exit_latency = 855 + 1146, ++ .target_residency = 46057, ++ .name = "C5", ++ .desc = "MPU RET + CORE RET", ++ }, ++ { ++ .enter = omap3_enter_idle_bm, ++ .exit_latency = 7580 + 4134, ++ .target_residency = 484329, ++ .name = "C6", ++ .desc = "MPU OFF + CORE RET", ++ }, ++ { ++ .enter = omap3_enter_idle_bm, ++ .exit_latency = 7505 + 15274, ++ .target_residency = 484329, ++ .name = "C7", ++ .desc = "MPU OFF + CORE OFF", ++ }, ++ }, ++ .state_count = ARRAY_SIZE(omap3_idle_data), ++ .safe_state_index = 0, ++}; ++ + /* Public functions */ + + /** +@@ -340,5 +404,8 @@ int __init omap3_idle_init(void) + if (!mpu_pd || !core_pd || !per_pd || !cam_pd) + return -ENODEV; + +- return cpuidle_register(&omap3_idle_driver, NULL); ++ if (cpu_is_omap3430()) ++ return cpuidle_register(&omap3430_idle_driver, NULL); ++ else ++ return cpuidle_register(&omap3_idle_driver, NULL); + } +diff --git a/arch/arm/mach-omap2/sleep34xx.S b/arch/arm/mach-omap2/sleep34xx.S +index d1dedc8195ed..eafd120b53f1 100644 +--- a/arch/arm/mach-omap2/sleep34xx.S ++++ b/arch/arm/mach-omap2/sleep34xx.S +@@ -203,23 +203,8 @@ save_context_wfi: + */ + ldr r1, kernel_flush + blx r1 +- /* +- * The kernel doesn't interwork: v7_flush_dcache_all in particluar will +- * always return in Thumb state when CONFIG_THUMB2_KERNEL is enabled. +- * This sequence switches back to ARM. Note that .align may insert a +- * nop: bx pc needs to be word-aligned in order to work. +- */ +- THUMB( .thumb ) +- THUMB( .align ) +- THUMB( bx pc ) +- THUMB( nop ) +- .arm +- + b omap3_do_wfi +- +-/* +- * Local variables +- */ ++ENDPROC(omap34xx_cpu_suspend) + omap3_do_wfi_sram_addr: + .word omap3_do_wfi_sram + kernel_flush: +@@ -364,10 +349,7 @@ exit_nonoff_modes: + * =================================== + */ + ldmfd sp!, {r4 - r11, pc} @ restore regs and return +- +-/* +- * Local variables +- */ ++ENDPROC(omap3_do_wfi) + sdrc_power: + .word SDRC_POWER_V + cm_idlest1_core: +diff --git a/arch/arm/mach-socfpga/headsmp.S b/arch/arm/mach-socfpga/headsmp.S +index 9004bfb1756e..a6f5519072cc 100644 +--- a/arch/arm/mach-socfpga/headsmp.S ++++ b/arch/arm/mach-socfpga/headsmp.S +@@ -12,6 +12,7 @@ + + __CPUINIT + .arch armv7-a ++ .arm + + ENTRY(secondary_trampoline) + movw r2, #:lower16:cpu1start_addr +diff --git a/arch/parisc/kernel/parisc_ksyms.c b/arch/parisc/kernel/parisc_ksyms.c +index 568b2c61ea02..3cad8aadc69e 100644 +--- a/arch/parisc/kernel/parisc_ksyms.c ++++ b/arch/parisc/kernel/parisc_ksyms.c +@@ -47,11 +47,11 @@ EXPORT_SYMBOL(__cmpxchg_u64); + EXPORT_SYMBOL(lclear_user); + EXPORT_SYMBOL(lstrnlen_user); + +-/* Global fixups */ +-extern void fixup_get_user_skip_1(void); +-extern void fixup_get_user_skip_2(void); +-extern void fixup_put_user_skip_1(void); +-extern void fixup_put_user_skip_2(void); ++/* Global fixups - defined as int to avoid creation of function pointers */ ++extern int fixup_get_user_skip_1; ++extern int fixup_get_user_skip_2; ++extern int fixup_put_user_skip_1; ++extern int fixup_put_user_skip_2; + EXPORT_SYMBOL(fixup_get_user_skip_1); + EXPORT_SYMBOL(fixup_get_user_skip_2); + EXPORT_SYMBOL(fixup_put_user_skip_1); +diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c +index b3f87a3b4bce..0c329b2c5df4 100644 +--- a/arch/parisc/kernel/traps.c ++++ b/arch/parisc/kernel/traps.c +@@ -811,6 +811,9 @@ void notrace handle_interruption(int code, struct pt_regs *regs) + + if (fault_space == 0 && !in_atomic()) + { ++ /* Clean up and return if in exception table. */ ++ if (fixup_exception(regs)) ++ return; + pdc_chassis_send_status(PDC_CHASSIS_DIRECT_PANIC); + parisc_terminate("Kernel Fault", regs, code, fault_address); + } +diff --git a/arch/powerpc/include/uapi/asm/cputable.h b/arch/powerpc/include/uapi/asm/cputable.h +index de2c0e4ee1aa..67de80a8e178 100644 +--- a/arch/powerpc/include/uapi/asm/cputable.h ++++ b/arch/powerpc/include/uapi/asm/cputable.h +@@ -31,6 +31,7 @@ + #define PPC_FEATURE_PSERIES_PERFMON_COMPAT \ + 0x00000040 + ++/* Reserved - do not use 0x00000004 */ + #define PPC_FEATURE_TRUE_LE 0x00000002 + #define PPC_FEATURE_PPC_LE 0x00000001 + +diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c +index 8b6f7a99cce2..e8c45b7438e7 100644 +--- a/arch/powerpc/kernel/prom.c ++++ b/arch/powerpc/kernel/prom.c +@@ -159,7 +159,7 @@ static struct ibm_pa_feature { + {CPU_FTR_NOEXECUTE, 0, 0, 0, 6, 0}, + {CPU_FTR_NODSISRALIGN, 0, 0, 1, 1, 1}, + {0, MMU_FTR_CI_LARGE_PAGE, 0, 1, 2, 0}, +- {CPU_FTR_REAL_LE, PPC_FEATURE_TRUE_LE, 5, 0, 0}, ++ {CPU_FTR_REAL_LE, 0, PPC_FEATURE_TRUE_LE, 5, 0, 0}, + }; + + static void __init scan_features(unsigned long node, unsigned char *ftrs, +diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h +index 98b68c2f1a1c..b76c1bf6125d 100644 +--- a/arch/x86/include/asm/kvm_host.h ++++ b/arch/x86/include/asm/kvm_host.h +@@ -59,7 +59,7 @@ + (~(unsigned long)(X86_CR4_VME | X86_CR4_PVI | X86_CR4_TSD | X86_CR4_DE\ + | X86_CR4_PSE | X86_CR4_PAE | X86_CR4_MCE \ + | X86_CR4_PGE | X86_CR4_PCE | X86_CR4_OSFXSR | X86_CR4_PCIDE \ +- | X86_CR4_OSXSAVE | X86_CR4_SMEP | X86_CR4_RDWRGSFS \ ++ | X86_CR4_OSXSAVE | X86_CR4_SMEP | X86_CR4_FSGSBASE \ + | X86_CR4_OSXMMEXCPT | X86_CR4_VMXE)) + + #define CR8_RESERVED_BITS (~(unsigned long)X86_CR8_TPR) +diff --git a/arch/x86/include/asm/xen/hypervisor.h b/arch/x86/include/asm/xen/hypervisor.h +index 125f344f06a9..8ac93f05a8ea 100644 +--- a/arch/x86/include/asm/xen/hypervisor.h ++++ b/arch/x86/include/asm/xen/hypervisor.h +@@ -71,4 +71,6 @@ static inline bool xen_x2apic_para_available(void) + } + #endif + ++extern void xen_set_iopl_mask(unsigned mask); ++ + #endif /* _ASM_X86_XEN_HYPERVISOR_H */ +diff --git a/arch/x86/include/uapi/asm/processor-flags.h b/arch/x86/include/uapi/asm/processor-flags.h +index b16e6d28f149..180a0c3c224d 100644 +--- a/arch/x86/include/uapi/asm/processor-flags.h ++++ b/arch/x86/include/uapi/asm/processor-flags.h +@@ -2,75 +2,129 @@ + #define _UAPI_ASM_X86_PROCESSOR_FLAGS_H + /* Various flags defined: can be included from assembler. */ + ++#include ++ + /* + * EFLAGS bits + */ +-#define X86_EFLAGS_CF 0x00000001 /* Carry Flag */ +-#define X86_EFLAGS_FIXED 0x00000002 /* Bit 1 - always on */ +-#define X86_EFLAGS_PF 0x00000004 /* Parity Flag */ +-#define X86_EFLAGS_AF 0x00000010 /* Auxiliary carry Flag */ +-#define X86_EFLAGS_ZF 0x00000040 /* Zero Flag */ +-#define X86_EFLAGS_SF 0x00000080 /* Sign Flag */ +-#define X86_EFLAGS_TF 0x00000100 /* Trap Flag */ +-#define X86_EFLAGS_IF 0x00000200 /* Interrupt Flag */ +-#define X86_EFLAGS_DF 0x00000400 /* Direction Flag */ +-#define X86_EFLAGS_OF 0x00000800 /* Overflow Flag */ +-#define X86_EFLAGS_IOPL 0x00003000 /* IOPL mask */ +-#define X86_EFLAGS_NT 0x00004000 /* Nested Task */ +-#define X86_EFLAGS_RF 0x00010000 /* Resume Flag */ +-#define X86_EFLAGS_VM 0x00020000 /* Virtual Mode */ +-#define X86_EFLAGS_AC 0x00040000 /* Alignment Check */ +-#define X86_EFLAGS_VIF 0x00080000 /* Virtual Interrupt Flag */ +-#define X86_EFLAGS_VIP 0x00100000 /* Virtual Interrupt Pending */ +-#define X86_EFLAGS_ID 0x00200000 /* CPUID detection flag */ ++#define X86_EFLAGS_CF_BIT 0 /* Carry Flag */ ++#define X86_EFLAGS_CF _BITUL(X86_EFLAGS_CF_BIT) ++#define X86_EFLAGS_FIXED_BIT 1 /* Bit 1 - always on */ ++#define X86_EFLAGS_FIXED _BITUL(X86_EFLAGS_FIXED_BIT) ++#define X86_EFLAGS_PF_BIT 2 /* Parity Flag */ ++#define X86_EFLAGS_PF _BITUL(X86_EFLAGS_PF_BIT) ++#define X86_EFLAGS_AF_BIT 4 /* Auxiliary carry Flag */ ++#define X86_EFLAGS_AF _BITUL(X86_EFLAGS_AF_BIT) ++#define X86_EFLAGS_ZF_BIT 6 /* Zero Flag */ ++#define X86_EFLAGS_ZF _BITUL(X86_EFLAGS_ZF_BIT) ++#define X86_EFLAGS_SF_BIT 7 /* Sign Flag */ ++#define X86_EFLAGS_SF _BITUL(X86_EFLAGS_SF_BIT) ++#define X86_EFLAGS_TF_BIT 8 /* Trap Flag */ ++#define X86_EFLAGS_TF _BITUL(X86_EFLAGS_TF_BIT) ++#define X86_EFLAGS_IF_BIT 9 /* Interrupt Flag */ ++#define X86_EFLAGS_IF _BITUL(X86_EFLAGS_IF_BIT) ++#define X86_EFLAGS_DF_BIT 10 /* Direction Flag */ ++#define X86_EFLAGS_DF _BITUL(X86_EFLAGS_DF_BIT) ++#define X86_EFLAGS_OF_BIT 11 /* Overflow Flag */ ++#define X86_EFLAGS_OF _BITUL(X86_EFLAGS_OF_BIT) ++#define X86_EFLAGS_IOPL_BIT 12 /* I/O Privilege Level (2 bits) */ ++#define X86_EFLAGS_IOPL (_AC(3,UL) << X86_EFLAGS_IOPL_BIT) ++#define X86_EFLAGS_NT_BIT 14 /* Nested Task */ ++#define X86_EFLAGS_NT _BITUL(X86_EFLAGS_NT_BIT) ++#define X86_EFLAGS_RF_BIT 16 /* Resume Flag */ ++#define X86_EFLAGS_RF _BITUL(X86_EFLAGS_RF_BIT) ++#define X86_EFLAGS_VM_BIT 17 /* Virtual Mode */ ++#define X86_EFLAGS_VM _BITUL(X86_EFLAGS_VM_BIT) ++#define X86_EFLAGS_AC_BIT 18 /* Alignment Check/Access Control */ ++#define X86_EFLAGS_AC _BITUL(X86_EFLAGS_AC_BIT) ++#define X86_EFLAGS_AC_BIT 18 /* Alignment Check/Access Control */ ++#define X86_EFLAGS_AC _BITUL(X86_EFLAGS_AC_BIT) ++#define X86_EFLAGS_VIF_BIT 19 /* Virtual Interrupt Flag */ ++#define X86_EFLAGS_VIF _BITUL(X86_EFLAGS_VIF_BIT) ++#define X86_EFLAGS_VIP_BIT 20 /* Virtual Interrupt Pending */ ++#define X86_EFLAGS_VIP _BITUL(X86_EFLAGS_VIP_BIT) ++#define X86_EFLAGS_ID_BIT 21 /* CPUID detection */ ++#define X86_EFLAGS_ID _BITUL(X86_EFLAGS_ID_BIT) + + /* + * Basic CPU control in CR0 + */ +-#define X86_CR0_PE 0x00000001 /* Protection Enable */ +-#define X86_CR0_MP 0x00000002 /* Monitor Coprocessor */ +-#define X86_CR0_EM 0x00000004 /* Emulation */ +-#define X86_CR0_TS 0x00000008 /* Task Switched */ +-#define X86_CR0_ET 0x00000010 /* Extension Type */ +-#define X86_CR0_NE 0x00000020 /* Numeric Error */ +-#define X86_CR0_WP 0x00010000 /* Write Protect */ +-#define X86_CR0_AM 0x00040000 /* Alignment Mask */ +-#define X86_CR0_NW 0x20000000 /* Not Write-through */ +-#define X86_CR0_CD 0x40000000 /* Cache Disable */ +-#define X86_CR0_PG 0x80000000 /* Paging */ ++#define X86_CR0_PE_BIT 0 /* Protection Enable */ ++#define X86_CR0_PE _BITUL(X86_CR0_PE_BIT) ++#define X86_CR0_MP_BIT 1 /* Monitor Coprocessor */ ++#define X86_CR0_MP _BITUL(X86_CR0_MP_BIT) ++#define X86_CR0_EM_BIT 2 /* Emulation */ ++#define X86_CR0_EM _BITUL(X86_CR0_EM_BIT) ++#define X86_CR0_TS_BIT 3 /* Task Switched */ ++#define X86_CR0_TS _BITUL(X86_CR0_TS_BIT) ++#define X86_CR0_ET_BIT 4 /* Extension Type */ ++#define X86_CR0_ET _BITUL(X86_CR0_ET_BIT) ++#define X86_CR0_NE_BIT 5 /* Numeric Error */ ++#define X86_CR0_NE _BITUL(X86_CR0_NE_BIT) ++#define X86_CR0_WP_BIT 16 /* Write Protect */ ++#define X86_CR0_WP _BITUL(X86_CR0_WP_BIT) ++#define X86_CR0_AM_BIT 18 /* Alignment Mask */ ++#define X86_CR0_AM _BITUL(X86_CR0_AM_BIT) ++#define X86_CR0_NW_BIT 29 /* Not Write-through */ ++#define X86_CR0_NW _BITUL(X86_CR0_NW_BIT) ++#define X86_CR0_CD_BIT 30 /* Cache Disable */ ++#define X86_CR0_CD _BITUL(X86_CR0_CD_BIT) ++#define X86_CR0_PG_BIT 31 /* Paging */ ++#define X86_CR0_PG _BITUL(X86_CR0_PG_BIT) + + /* + * Paging options in CR3 + */ +-#define X86_CR3_PWT 0x00000008 /* Page Write Through */ +-#define X86_CR3_PCD 0x00000010 /* Page Cache Disable */ +-#define X86_CR3_PCID_MASK 0x00000fff /* PCID Mask */ ++#define X86_CR3_PWT_BIT 3 /* Page Write Through */ ++#define X86_CR3_PWT _BITUL(X86_CR3_PWT_BIT) ++#define X86_CR3_PCD_BIT 4 /* Page Cache Disable */ ++#define X86_CR3_PCD _BITUL(X86_CR3_PCD_BIT) ++#define X86_CR3_PCID_MASK _AC(0x00000fff,UL) /* PCID Mask */ + + /* + * Intel CPU features in CR4 + */ +-#define X86_CR4_VME 0x00000001 /* enable vm86 extensions */ +-#define X86_CR4_PVI 0x00000002 /* virtual interrupts flag enable */ +-#define X86_CR4_TSD 0x00000004 /* disable time stamp at ipl 3 */ +-#define X86_CR4_DE 0x00000008 /* enable debugging extensions */ +-#define X86_CR4_PSE 0x00000010 /* enable page size extensions */ +-#define X86_CR4_PAE 0x00000020 /* enable physical address extensions */ +-#define X86_CR4_MCE 0x00000040 /* Machine check enable */ +-#define X86_CR4_PGE 0x00000080 /* enable global pages */ +-#define X86_CR4_PCE 0x00000100 /* enable performance counters at ipl 3 */ +-#define X86_CR4_OSFXSR 0x00000200 /* enable fast FPU save and restore */ +-#define X86_CR4_OSXMMEXCPT 0x00000400 /* enable unmasked SSE exceptions */ +-#define X86_CR4_VMXE 0x00002000 /* enable VMX virtualization */ +-#define X86_CR4_RDWRGSFS 0x00010000 /* enable RDWRGSFS support */ +-#define X86_CR4_PCIDE 0x00020000 /* enable PCID support */ +-#define X86_CR4_OSXSAVE 0x00040000 /* enable xsave and xrestore */ +-#define X86_CR4_SMEP 0x00100000 /* enable SMEP support */ +-#define X86_CR4_SMAP 0x00200000 /* enable SMAP support */ ++#define X86_CR4_VME_BIT 0 /* enable vm86 extensions */ ++#define X86_CR4_VME _BITUL(X86_CR4_VME_BIT) ++#define X86_CR4_PVI_BIT 1 /* virtual interrupts flag enable */ ++#define X86_CR4_PVI _BITUL(X86_CR4_PVI_BIT) ++#define X86_CR4_TSD_BIT 2 /* disable time stamp at ipl 3 */ ++#define X86_CR4_TSD _BITUL(X86_CR4_TSD_BIT) ++#define X86_CR4_DE_BIT 3 /* enable debugging extensions */ ++#define X86_CR4_DE _BITUL(X86_CR4_DE_BIT) ++#define X86_CR4_PSE_BIT 4 /* enable page size extensions */ ++#define X86_CR4_PSE _BITUL(X86_CR4_PSE_BIT) ++#define X86_CR4_PAE_BIT 5 /* enable physical address extensions */ ++#define X86_CR4_PAE _BITUL(X86_CR4_PAE_BIT) ++#define X86_CR4_MCE_BIT 6 /* Machine check enable */ ++#define X86_CR4_MCE _BITUL(X86_CR4_MCE_BIT) ++#define X86_CR4_PGE_BIT 7 /* enable global pages */ ++#define X86_CR4_PGE _BITUL(X86_CR4_PGE_BIT) ++#define X86_CR4_PCE_BIT 8 /* enable performance counters at ipl 3 */ ++#define X86_CR4_PCE _BITUL(X86_CR4_PCE_BIT) ++#define X86_CR4_OSFXSR_BIT 9 /* enable fast FPU save and restore */ ++#define X86_CR4_OSFXSR _BITUL(X86_CR4_OSFXSR_BIT) ++#define X86_CR4_OSXMMEXCPT_BIT 10 /* enable unmasked SSE exceptions */ ++#define X86_CR4_OSXMMEXCPT _BITUL(X86_CR4_OSXMMEXCPT_BIT) ++#define X86_CR4_VMXE_BIT 13 /* enable VMX virtualization */ ++#define X86_CR4_VMXE _BITUL(X86_CR4_VMXE_BIT) ++#define X86_CR4_SMXE_BIT 14 /* enable safer mode (TXT) */ ++#define X86_CR4_SMXE _BITUL(X86_CR4_SMXE_BIT) ++#define X86_CR4_FSGSBASE_BIT 16 /* enable RDWRFSGS support */ ++#define X86_CR4_FSGSBASE _BITUL(X86_CR4_FSGSBASE_BIT) ++#define X86_CR4_PCIDE_BIT 17 /* enable PCID support */ ++#define X86_CR4_PCIDE _BITUL(X86_CR4_PCIDE_BIT) ++#define X86_CR4_OSXSAVE_BIT 18 /* enable xsave and xrestore */ ++#define X86_CR4_OSXSAVE _BITUL(X86_CR4_OSXSAVE_BIT) ++#define X86_CR4_SMEP_BIT 20 /* enable SMEP support */ ++#define X86_CR4_SMEP _BITUL(X86_CR4_SMEP_BIT) ++#define X86_CR4_SMAP_BIT 21 /* enable SMAP support */ ++#define X86_CR4_SMAP _BITUL(X86_CR4_SMAP_BIT) + + /* + * x86-64 Task Priority Register, CR8 + */ +-#define X86_CR8_TPR 0x0000000F /* task priority register */ ++#define X86_CR8_TPR _AC(0x0000000f,UL) /* task priority register */ + + /* + * AMD and Transmeta use MSRs for configuration; see +diff --git a/arch/x86/kernel/cpu/perf_event.h b/arch/x86/kernel/cpu/perf_event.h +index ba9aadfa683b..5fd0bbe1aeb0 100644 +--- a/arch/x86/kernel/cpu/perf_event.h ++++ b/arch/x86/kernel/cpu/perf_event.h +@@ -665,6 +665,8 @@ void intel_pmu_lbr_init_atom(void); + + void intel_pmu_lbr_init_snb(void); + ++void intel_pmu_pebs_data_source_nhm(void); ++ + int intel_pmu_setup_lbr_filter(struct perf_event *event); + + int p4_pmu_init(void); +diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c +index 6d6bb6f4fd43..ac057583282a 100644 +--- a/arch/x86/kernel/cpu/perf_event_intel.c ++++ b/arch/x86/kernel/cpu/perf_event_intel.c +@@ -2088,6 +2088,7 @@ __init int intel_pmu_init(void) + intel_perfmon_event_map[PERF_COUNT_HW_STALLED_CYCLES_BACKEND] = + X86_CONFIG(.event=0xb1, .umask=0x3f, .inv=1, .cmask=1); + ++ intel_pmu_pebs_data_source_nhm(); + x86_add_quirk(intel_nehalem_quirk); + + pr_cont("Nehalem events, "); +@@ -2133,6 +2134,7 @@ __init int intel_pmu_init(void) + intel_perfmon_event_map[PERF_COUNT_HW_STALLED_CYCLES_BACKEND] = + X86_CONFIG(.event=0xb1, .umask=0x3f, .inv=1, .cmask=1); + ++ intel_pmu_pebs_data_source_nhm(); + pr_cont("Westmere events, "); + break; + +diff --git a/arch/x86/kernel/cpu/perf_event_intel_ds.c b/arch/x86/kernel/cpu/perf_event_intel_ds.c +index 60250f687052..17b090a298b4 100644 +--- a/arch/x86/kernel/cpu/perf_event_intel_ds.c ++++ b/arch/x86/kernel/cpu/perf_event_intel_ds.c +@@ -50,7 +50,8 @@ union intel_x86_pebs_dse { + #define OP_LH (P(OP, LOAD) | P(LVL, HIT)) + #define SNOOP_NONE_MISS (P(SNOOP, NONE) | P(SNOOP, MISS)) + +-static const u64 pebs_data_source[] = { ++/* Version for Sandy Bridge and later */ ++static u64 pebs_data_source[] = { + P(OP, LOAD) | P(LVL, MISS) | P(LVL, L3) | P(SNOOP, NA),/* 0x00:ukn L3 */ + OP_LH | P(LVL, L1) | P(SNOOP, NONE), /* 0x01: L1 local */ + OP_LH | P(LVL, LFB) | P(SNOOP, NONE), /* 0x02: LFB hit */ +@@ -69,6 +70,14 @@ static const u64 pebs_data_source[] = { + OP_LH | P(LVL, UNC) | P(SNOOP, NONE), /* 0x0f: uncached */ + }; + ++/* Patch up minor differences in the bits */ ++void __init intel_pmu_pebs_data_source_nhm(void) ++{ ++ pebs_data_source[0x05] = OP_LH | P(LVL, L3) | P(SNOOP, HIT); ++ pebs_data_source[0x06] = OP_LH | P(LVL, L3) | P(SNOOP, HITM); ++ pebs_data_source[0x07] = OP_LH | P(LVL, L3) | P(SNOOP, HITM); ++} ++ + static u64 precise_store_data(u64 status) + { + union intel_x86_pebs_dse dse; +diff --git a/arch/x86/kernel/ioport.c b/arch/x86/kernel/ioport.c +index 4ddaf66ea35f..792621a32457 100644 +--- a/arch/x86/kernel/ioport.c ++++ b/arch/x86/kernel/ioport.c +@@ -96,9 +96,14 @@ asmlinkage long sys_ioperm(unsigned long from, unsigned long num, int turn_on) + SYSCALL_DEFINE1(iopl, unsigned int, level) + { + struct pt_regs *regs = current_pt_regs(); +- unsigned int old = (regs->flags >> 12) & 3; + struct thread_struct *t = ¤t->thread; + ++ /* ++ * Careful: the IOPL bits in regs->flags are undefined under Xen PV ++ * and changing them has no effect. ++ */ ++ unsigned int old = t->iopl >> X86_EFLAGS_IOPL_BIT; ++ + if (level > 3) + return -EINVAL; + /* Trying to gain more privileges? */ +@@ -106,8 +111,9 @@ SYSCALL_DEFINE1(iopl, unsigned int, level) + if (!capable(CAP_SYS_RAWIO)) + return -EPERM; + } +- regs->flags = (regs->flags & ~X86_EFLAGS_IOPL) | (level << 12); +- t->iopl = level << 12; ++ regs->flags = (regs->flags & ~X86_EFLAGS_IOPL) | ++ (level << X86_EFLAGS_IOPL_BIT); ++ t->iopl = level << X86_EFLAGS_IOPL_BIT; + set_iopl_mask(t->iopl); + + return 0; +diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c +index 7099ab1e075b..580001c2b69a 100644 +--- a/arch/x86/kernel/process_64.c ++++ b/arch/x86/kernel/process_64.c +@@ -49,6 +49,7 @@ + #include + #include + #include ++#include + + asmlinkage extern void ret_from_fork(void); + +@@ -412,6 +413,17 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p) + task_thread_info(prev_p)->flags & _TIF_WORK_CTXSW_PREV)) + __switch_to_xtra(prev_p, next_p, tss); + ++#ifdef CONFIG_XEN ++ /* ++ * On Xen PV, IOPL bits in pt_regs->flags have no effect, and ++ * current_pt_regs()->flags may not match the current task's ++ * intended IOPL. We need to switch it manually. ++ */ ++ if (unlikely(xen_pv_domain() && ++ prev->iopl != next->iopl)) ++ xen_set_iopl_mask(next->iopl); ++#endif ++ + return prev_p; + } + +diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c +index 1406ffde3e35..b0a706d063cb 100644 +--- a/arch/x86/kvm/i8254.c ++++ b/arch/x86/kvm/i8254.c +@@ -244,7 +244,7 @@ static void kvm_pit_ack_irq(struct kvm_irq_ack_notifier *kian) + * PIC is being reset. Handle it gracefully here + */ + atomic_inc(&ps->pending); +- else if (value > 0) ++ else if (value > 0 && ps->reinject) + /* in this case, we had multiple outstanding pit interrupts + * that we needed to inject. Reinject + */ +@@ -287,7 +287,9 @@ static void pit_do_work(struct kthread_work *work) + * last one has been acked. + */ + spin_lock(&ps->inject_lock); +- if (ps->irq_ack) { ++ if (!ps->reinject) ++ inject = 1; ++ else if (ps->irq_ack) { + ps->irq_ack = 0; + inject = 1; + } +@@ -316,10 +318,10 @@ static enum hrtimer_restart pit_timer_fn(struct hrtimer *data) + struct kvm_kpit_state *ps = container_of(data, struct kvm_kpit_state, timer); + struct kvm_pit *pt = ps->kvm->arch.vpit; + +- if (ps->reinject || !atomic_read(&ps->pending)) { ++ if (ps->reinject) + atomic_inc(&ps->pending); +- queue_kthread_work(&pt->worker, &pt->expired); +- } ++ ++ queue_kthread_work(&pt->worker, &pt->expired); + + if (ps->is_periodic) { + hrtimer_add_expires_ns(&ps->timer, ps->period); +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 7f2b6dec4b2b..3c0b085b4336 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -626,7 +626,7 @@ int kvm_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4) + if (!guest_cpuid_has_smep(vcpu) && (cr4 & X86_CR4_SMEP)) + return 1; + +- if (!guest_cpuid_has_fsgsbase(vcpu) && (cr4 & X86_CR4_RDWRGSFS)) ++ if (!guest_cpuid_has_fsgsbase(vcpu) && (cr4 & X86_CR4_FSGSBASE)) + return 1; + + if (is_long_mode(vcpu)) { +diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c +index 91cbe75a91d5..34511cf6baad 100644 +--- a/arch/x86/xen/enlighten.c ++++ b/arch/x86/xen/enlighten.c +@@ -952,7 +952,7 @@ static void xen_load_sp0(struct tss_struct *tss, + xen_mc_issue(PARAVIRT_LAZY_CPU); + } + +-static void xen_set_iopl_mask(unsigned mask) ++void xen_set_iopl_mask(unsigned mask) + { + struct physdev_set_iopl set_iopl; + +diff --git a/arch/xtensa/kernel/head.S b/arch/xtensa/kernel/head.S +index 7d740ebbe198..bb12d778f64f 100644 +--- a/arch/xtensa/kernel/head.S ++++ b/arch/xtensa/kernel/head.S +@@ -118,7 +118,7 @@ ENTRY(_startup) + wsr a0, icountlevel + + .set _index, 0 +- .rept XCHAL_NUM_DBREAK - 1 ++ .rept XCHAL_NUM_DBREAK + wsr a0, SREG_DBREAKC + _index + .set _index, _index + 1 + .endr +diff --git a/arch/xtensa/platforms/iss/console.c b/arch/xtensa/platforms/iss/console.c +index 70cb408bc20d..92d785fefb6d 100644 +--- a/arch/xtensa/platforms/iss/console.c ++++ b/arch/xtensa/platforms/iss/console.c +@@ -100,21 +100,23 @@ static void rs_poll(unsigned long priv) + { + struct tty_port *port = (struct tty_port *)priv; + int i = 0; ++ int rd = 1; + unsigned char c; + + spin_lock(&timer_lock); + + while (simc_poll(0)) { +- simc_read(0, &c, 1); ++ rd = simc_read(0, &c, 1); ++ if (rd <= 0) ++ break; + tty_insert_flip_char(port, c, TTY_NORMAL); + i++; + } + + if (i) + tty_flip_buffer_push(port); +- +- +- mod_timer(&serial_timer, jiffies + SERIAL_TIMER_VALUE); ++ if (rd) ++ mod_timer(&serial_timer, jiffies + SERIAL_TIMER_VALUE); + spin_unlock(&timer_lock); + } + +diff --git a/crypto/ahash.c b/crypto/ahash.c +index 857ae2b2a2a2..bcd5efc7eb4c 100644 +--- a/crypto/ahash.c ++++ b/crypto/ahash.c +@@ -64,8 +64,9 @@ static int hash_walk_new_entry(struct crypto_hash_walk *walk) + struct scatterlist *sg; + + sg = walk->sg; +- walk->pg = sg_page(sg); + walk->offset = sg->offset; ++ walk->pg = sg_page(walk->sg) + (walk->offset >> PAGE_SHIFT); ++ walk->offset = offset_in_page(walk->offset); + walk->entrylen = sg->length; + + if (walk->entrylen > walk->total) +diff --git a/crypto/gcm.c b/crypto/gcm.c +index b4c252066f7b..cd97cdd8cabe 100644 +--- a/crypto/gcm.c ++++ b/crypto/gcm.c +@@ -1173,6 +1173,9 @@ static struct aead_request *crypto_rfc4543_crypt(struct aead_request *req, + aead_request_set_tfm(subreq, ctx->child); + aead_request_set_callback(subreq, req->base.flags, crypto_rfc4543_done, + req); ++ if (!enc) ++ aead_request_set_callback(subreq, req->base.flags, ++ req->base.complete, req->base.data); + aead_request_set_crypt(subreq, cipher, cipher, enc ? 0 : authsize, iv); + aead_request_set_assoc(subreq, assoc, assoclen); + +diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c +index a9ffd44c18fe..2184259c386b 100644 +--- a/drivers/acpi/acpica/dsmethod.c ++++ b/drivers/acpi/acpica/dsmethod.c +@@ -267,6 +267,9 @@ acpi_ds_begin_method_execution(struct acpi_namespace_node *method_node, + obj_desc->method.mutex->mutex. + original_sync_level = + obj_desc->method.mutex->mutex.sync_level; ++ ++ obj_desc->method.mutex->mutex.thread_id = ++ acpi_os_get_thread_id(); + } + } + +diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c +index a5c987ae665d..d593fa5247f5 100644 +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -581,8 +581,8 @@ static void do_nbd_request(struct request_queue *q) + BUG_ON(nbd->magic != NBD_MAGIC); + + if (unlikely(!nbd->sock)) { +- dev_err(disk_to_dev(nbd->disk), +- "Attempted send on closed socket\n"); ++ dev_err_ratelimited(disk_to_dev(nbd->disk), ++ "Attempted send on closed socket\n"); + req->errors++; + nbd_end_request(req); + spin_lock_irq(q->queue_lock); +diff --git a/drivers/block/paride/pd.c b/drivers/block/paride/pd.c +index 19ad8f0c83ef..897b6b9e53b1 100644 +--- a/drivers/block/paride/pd.c ++++ b/drivers/block/paride/pd.c +@@ -126,7 +126,7 @@ + */ + #include + +-static bool verbose = 0; ++static int verbose = 0; + static int major = PD_MAJOR; + static char *name = PD_NAME; + static int cluster = 64; +@@ -161,7 +161,7 @@ enum {D_PRT, D_PRO, D_UNI, D_MOD, D_GEO, D_SBY, D_DLY, D_SLV}; + static DEFINE_MUTEX(pd_mutex); + static DEFINE_SPINLOCK(pd_lock); + +-module_param(verbose, bool, 0); ++module_param(verbose, int, 0); + module_param(major, int, 0); + module_param(name, charp, 0); + module_param(cluster, int, 0); +diff --git a/drivers/block/paride/pt.c b/drivers/block/paride/pt.c +index 2596042eb987..ada45058e04d 100644 +--- a/drivers/block/paride/pt.c ++++ b/drivers/block/paride/pt.c +@@ -117,7 +117,7 @@ + + */ + +-static bool verbose = 0; ++static int verbose = 0; + static int major = PT_MAJOR; + static char *name = PT_NAME; + static int disable = 0; +@@ -152,7 +152,7 @@ static int (*drives[4])[6] = {&drive0, &drive1, &drive2, &drive3}; + + #include + +-module_param(verbose, bool, 0); ++module_param(verbose, int, 0); + module_param(major, int, 0); + module_param(name, charp, 0); + module_param_array(drive0, int, NULL, 0); +diff --git a/drivers/bluetooth/hci_vhci.c b/drivers/bluetooth/hci_vhci.c +index d8b7aed6e4a9..f3ce1c4f83e0 100644 +--- a/drivers/bluetooth/hci_vhci.c ++++ b/drivers/bluetooth/hci_vhci.c +@@ -265,6 +265,7 @@ static int vhci_release(struct inode *inode, struct file *file) + hci_unregister_dev(hdev); + hci_free_dev(hdev); + ++ skb_queue_purge(&data->readq); + file->private_data = NULL; + kfree(data); + +diff --git a/drivers/clk/versatile/clk-sp810.c b/drivers/clk/versatile/clk-sp810.c +index b9e05bde0c06..a21e2fa66a2a 100644 +--- a/drivers/clk/versatile/clk-sp810.c ++++ b/drivers/clk/versatile/clk-sp810.c +@@ -141,6 +141,7 @@ void __init clk_sp810_of_setup(struct device_node *node) + const char *parent_names[2]; + char name[12]; + struct clk_init_data init; ++ static int instance; + int i; + + if (!sp810) { +@@ -172,7 +173,7 @@ void __init clk_sp810_of_setup(struct device_node *node) + init.num_parents = ARRAY_SIZE(parent_names); + + for (i = 0; i < ARRAY_SIZE(sp810->timerclken); i++) { +- snprintf(name, ARRAY_SIZE(name), "timerclken%d", i); ++ snprintf(name, sizeof(name), "sp810_%d_%d", instance, i); + + sp810->timerclken[i].sp810 = sp810; + sp810->timerclken[i].channel = i; +@@ -184,5 +185,6 @@ void __init clk_sp810_of_setup(struct device_node *node) + } + + of_clk_add_provider(node, clk_sp810_timerclken_of_get, sp810); ++ instance++; + } + CLK_OF_DECLARE(sp810, "arm,sp810", clk_sp810_of_setup); +diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c +index 8b3d90143514..19353112cf10 100644 +--- a/drivers/edac/amd64_edac.c ++++ b/drivers/edac/amd64_edac.c +@@ -1266,7 +1266,7 @@ static u64 f1x_get_norm_dct_addr(struct amd64_pvt *pvt, u8 range, + u64 chan_off; + u64 dram_base = get_dram_base(pvt, range); + u64 hole_off = f10_dhar_offset(pvt); +- u64 dct_sel_base_off = (pvt->dct_sel_hi & 0xFFFFFC00) << 16; ++ u64 dct_sel_base_off = (u64)(pvt->dct_sel_hi & 0xFFFFFC00) << 16; + + if (hi_rng) { + /* +diff --git a/drivers/edac/i7core_edac.c b/drivers/edac/i7core_edac.c +index 271818a5a33a..c4131a7a2b46 100644 +--- a/drivers/edac/i7core_edac.c ++++ b/drivers/edac/i7core_edac.c +@@ -1878,7 +1878,7 @@ static int i7core_mce_check_error(struct notifier_block *nb, unsigned long val, + + i7_dev = get_i7core_dev(mce->socketid); + if (!i7_dev) +- return NOTIFY_BAD; ++ return NOTIFY_DONE; + + mci = i7_dev->mci; + pvt = mci->pvt_info; +diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c +index 3bdefbfb4377..0d40f7f0c379 100644 +--- a/drivers/edac/sb_edac.c ++++ b/drivers/edac/sb_edac.c +@@ -1538,7 +1538,7 @@ static int sbridge_mce_check_error(struct notifier_block *nb, unsigned long val, + + mci = get_mci_for_node_id(mce->socketid); + if (!mci) +- return NOTIFY_BAD; ++ return NOTIFY_DONE; + pvt = mci->pvt_info; + + /* +diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c +index 9f82b5545edd..61e7ec5a742c 100644 +--- a/drivers/firmware/efi/vars.c ++++ b/drivers/firmware/efi/vars.c +@@ -202,29 +202,44 @@ static const struct variable_validate variable_validate[] = { + { NULL_GUID, "", NULL }, + }; + ++/* ++ * Check if @var_name matches the pattern given in @match_name. ++ * ++ * @var_name: an array of @len non-NUL characters. ++ * @match_name: a NUL-terminated pattern string, optionally ending in "*". A ++ * final "*" character matches any trailing characters @var_name, ++ * including the case when there are none left in @var_name. ++ * @match: on output, the number of non-wildcard characters in @match_name ++ * that @var_name matches, regardless of the return value. ++ * @return: whether @var_name fully matches @match_name. ++ */ + static bool + variable_matches(const char *var_name, size_t len, const char *match_name, + int *match) + { + for (*match = 0; ; (*match)++) { + char c = match_name[*match]; +- char u = var_name[*match]; + +- /* Wildcard in the matching name means we've matched */ +- if (c == '*') ++ switch (c) { ++ case '*': ++ /* Wildcard in @match_name means we've matched. */ + return true; + +- /* Case sensitive match */ +- if (!c && *match == len) +- return true; ++ case '\0': ++ /* @match_name has ended. Has @var_name too? */ ++ return (*match == len); + +- if (c != u) ++ default: ++ /* ++ * We've reached a non-wildcard char in @match_name. ++ * Continue only if there's an identical character in ++ * @var_name. ++ */ ++ if (*match < len && c == var_name[*match]) ++ continue; + return false; +- +- if (!c) +- return true; ++ } + } +- return true; + } + + bool +diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c +index 1b564d7e4191..5b8d868d8691 100644 +--- a/drivers/gpu/drm/radeon/atombios_encoders.c ++++ b/drivers/gpu/drm/radeon/atombios_encoders.c +@@ -870,8 +870,6 @@ atombios_dig_encoder_setup(struct drm_encoder *encoder, int action, int panel_mo + else + args.v1.ucLaneNum = 4; + +- if (ENCODER_MODE_IS_DP(args.v1.ucEncoderMode) && (dp_clock == 270000)) +- args.v1.ucConfig |= ATOM_ENCODER_CONFIG_DPLINKRATE_2_70GHZ; + switch (radeon_encoder->encoder_id) { + case ENCODER_OBJECT_ID_INTERNAL_UNIPHY: + args.v1.ucConfig = ATOM_ENCODER_CONFIG_V2_TRANSMITTER1; +@@ -888,6 +886,10 @@ atombios_dig_encoder_setup(struct drm_encoder *encoder, int action, int panel_mo + args.v1.ucConfig |= ATOM_ENCODER_CONFIG_LINKB; + else + args.v1.ucConfig |= ATOM_ENCODER_CONFIG_LINKA; ++ ++ if (ENCODER_MODE_IS_DP(args.v1.ucEncoderMode) && (dp_clock == 270000)) ++ args.v1.ucConfig |= ATOM_ENCODER_CONFIG_DPLINKRATE_2_70GHZ; ++ + break; + case 2: + case 3: +diff --git a/drivers/gpu/drm/radeon/radeon_sa.c b/drivers/gpu/drm/radeon/radeon_sa.c +index f0bac68254b7..8962411b5f2b 100644 +--- a/drivers/gpu/drm/radeon/radeon_sa.c ++++ b/drivers/gpu/drm/radeon/radeon_sa.c +@@ -349,8 +349,15 @@ int radeon_sa_bo_new(struct radeon_device *rdev, + /* see if we can skip over some allocations */ + } while (radeon_sa_bo_next_hole(sa_manager, fences, tries)); + ++ for (i = 0; i < RADEON_NUM_RINGS; ++i) { ++ if (fences[i]) ++ radeon_fence_ref(fences[i]); ++ } ++ + spin_unlock(&sa_manager->wq.lock); + r = radeon_fence_wait_any(rdev, fences, false); ++ for (i = 0; i < RADEON_NUM_RINGS; ++i) ++ radeon_fence_unref(&fences[i]); + spin_lock(&sa_manager->wq.lock); + /* if we have nothing to wait for block */ + if (r == -ENOENT && block) { +diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c +index 5da58e3899eb..92aef9824d6f 100644 +--- a/drivers/hid/usbhid/hid-core.c ++++ b/drivers/hid/usbhid/hid-core.c +@@ -988,14 +988,6 @@ static int usbhid_output_raw_report(struct hid_device *hid, __u8 *buf, size_t co + return ret; + } + +-static void usbhid_restart_queues(struct usbhid_device *usbhid) +-{ +- if (usbhid->urbout && !test_bit(HID_OUT_RUNNING, &usbhid->iofl)) +- usbhid_restart_out_queue(usbhid); +- if (!test_bit(HID_CTRL_RUNNING, &usbhid->iofl)) +- usbhid_restart_ctrl_queue(usbhid); +-} +- + static void hid_free_buffers(struct usb_device *dev, struct hid_device *hid) + { + struct usbhid_device *usbhid = hid->driver_data; +@@ -1412,6 +1404,37 @@ static void hid_cease_io(struct usbhid_device *usbhid) + usb_kill_urb(usbhid->urbout); + } + ++static void hid_restart_io(struct hid_device *hid) ++{ ++ struct usbhid_device *usbhid = hid->driver_data; ++ int clear_halt = test_bit(HID_CLEAR_HALT, &usbhid->iofl); ++ int reset_pending = test_bit(HID_RESET_PENDING, &usbhid->iofl); ++ ++ spin_lock_irq(&usbhid->lock); ++ clear_bit(HID_SUSPENDED, &usbhid->iofl); ++ usbhid_mark_busy(usbhid); ++ ++ if (clear_halt || reset_pending) ++ schedule_work(&usbhid->reset_work); ++ usbhid->retry_delay = 0; ++ spin_unlock_irq(&usbhid->lock); ++ ++ if (reset_pending || !test_bit(HID_STARTED, &usbhid->iofl)) ++ return; ++ ++ if (!clear_halt) { ++ if (hid_start_in(hid) < 0) ++ hid_io_error(hid); ++ } ++ ++ spin_lock_irq(&usbhid->lock); ++ if (usbhid->urbout && !test_bit(HID_OUT_RUNNING, &usbhid->iofl)) ++ usbhid_restart_out_queue(usbhid); ++ if (!test_bit(HID_CTRL_RUNNING, &usbhid->iofl)) ++ usbhid_restart_ctrl_queue(usbhid); ++ spin_unlock_irq(&usbhid->lock); ++} ++ + /* Treat USB reset pretty much the same as suspend/resume */ + static int hid_pre_reset(struct usb_interface *intf) + { +@@ -1461,14 +1484,14 @@ static int hid_post_reset(struct usb_interface *intf) + return 1; + } + ++ /* No need to do another reset or clear a halted endpoint */ + spin_lock_irq(&usbhid->lock); + clear_bit(HID_RESET_PENDING, &usbhid->iofl); ++ clear_bit(HID_CLEAR_HALT, &usbhid->iofl); + spin_unlock_irq(&usbhid->lock); + hid_set_idle(dev, intf->cur_altsetting->desc.bInterfaceNumber, 0, 0); +- status = hid_start_in(hid); +- if (status < 0) +- hid_io_error(hid); +- usbhid_restart_queues(usbhid); ++ ++ hid_restart_io(hid); + + return 0; + } +@@ -1491,25 +1514,9 @@ void usbhid_put_power(struct hid_device *hid) + #ifdef CONFIG_PM + static int hid_resume_common(struct hid_device *hid, bool driver_suspended) + { +- struct usbhid_device *usbhid = hid->driver_data; +- int status; +- +- spin_lock_irq(&usbhid->lock); +- clear_bit(HID_SUSPENDED, &usbhid->iofl); +- usbhid_mark_busy(usbhid); +- +- if (test_bit(HID_CLEAR_HALT, &usbhid->iofl) || +- test_bit(HID_RESET_PENDING, &usbhid->iofl)) +- schedule_work(&usbhid->reset_work); +- usbhid->retry_delay = 0; +- +- usbhid_restart_queues(usbhid); +- spin_unlock_irq(&usbhid->lock); +- +- status = hid_start_in(hid); +- if (status < 0) +- hid_io_error(hid); ++ int status = 0; + ++ hid_restart_io(hid); + if (driver_suspended && hid->driver && hid->driver->resume) + status = hid->driver->resume(hid); + return status; +@@ -1576,12 +1583,8 @@ static int hid_suspend(struct usb_interface *intf, pm_message_t message) + static int hid_resume(struct usb_interface *intf) + { + struct hid_device *hid = usb_get_intfdata (intf); +- struct usbhid_device *usbhid = hid->driver_data; + int status; + +- if (!test_bit(HID_STARTED, &usbhid->iofl)) +- return 0; +- + status = hid_resume_common(hid, true); + dev_dbg(&intf->dev, "resume status %d\n", status); + return 0; +@@ -1590,10 +1593,8 @@ static int hid_resume(struct usb_interface *intf) + static int hid_reset_resume(struct usb_interface *intf) + { + struct hid_device *hid = usb_get_intfdata(intf); +- struct usbhid_device *usbhid = hid->driver_data; + int status; + +- clear_bit(HID_SUSPENDED, &usbhid->iofl); + status = hid_post_reset(intf); + if (status >= 0 && hid->driver && hid->driver->reset_resume) { + int ret = hid->driver->reset_resume(hid); +diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c +index f445b0840d33..80754e2d8086 100644 +--- a/drivers/hv/vmbus_drv.c ++++ b/drivers/hv/vmbus_drv.c +@@ -32,6 +32,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -517,6 +518,39 @@ static void vmbus_flow_handler(unsigned int irq, struct irq_desc *desc) + desc->action->handler(irq, desc->action->dev_id); + } + ++#ifdef CONFIG_HOTPLUG_CPU ++static int hyperv_cpu_disable(void) ++{ ++ return -ENOSYS; ++} ++ ++static void hv_cpu_hotplug_quirk(bool vmbus_loaded) ++{ ++ static void *previous_cpu_disable; ++ ++ /* ++ * Offlining a CPU when running on newer hypervisors (WS2012R2, Win8, ++ * ...) is not supported at this moment as channel interrupts are ++ * distributed across all of them. ++ */ ++ ++ if ((vmbus_proto_version == VERSION_WS2008) || ++ (vmbus_proto_version == VERSION_WIN7)) ++ return; ++ ++ if (vmbus_loaded) { ++ previous_cpu_disable = smp_ops.cpu_disable; ++ smp_ops.cpu_disable = hyperv_cpu_disable; ++ pr_notice("CPU offlining is not supported by hypervisor\n"); ++ } else if (previous_cpu_disable) ++ smp_ops.cpu_disable = previous_cpu_disable; ++} ++#else ++static void hv_cpu_hotplug_quirk(bool vmbus_loaded) ++{ ++} ++#endif ++ + /* + * vmbus_bus_init -Main vmbus driver initialization routine. + * +@@ -572,6 +606,7 @@ static int vmbus_bus_init(int irq) + if (ret) + goto err_irq; + ++ hv_cpu_hotplug_quirk(true); + vmbus_request_offers(); + + return 0; +@@ -808,6 +843,7 @@ static void __exit vmbus_exit(void) + bus_unregister(&hv_bus); + hv_cleanup(); + acpi_bus_unregister_driver(&vmbus_acpi_driver); ++ hv_cpu_hotplug_quirk(false); + } + + +diff --git a/drivers/hwmon/max1111.c b/drivers/hwmon/max1111.c +index eda077de8a9f..f787f04a0d1a 100644 +--- a/drivers/hwmon/max1111.c ++++ b/drivers/hwmon/max1111.c +@@ -85,6 +85,9 @@ static struct max1111_data *the_max1111; + + int max1111_read_channel(int channel) + { ++ if (!the_max1111 || !the_max1111->spi) ++ return -ENODEV; ++ + return max1111_read(&the_max1111->spi->dev, channel); + } + EXPORT_SYMBOL(max1111_read_channel); +@@ -260,6 +263,9 @@ static int max1111_remove(struct spi_device *spi) + { + struct max1111_data *data = spi_get_drvdata(spi); + ++#ifdef CONFIG_SHARPSL_PM ++ the_max1111 = NULL; ++#endif + hwmon_device_unregister(data->hwmon_dev); + sysfs_remove_group(&spi->dev.kobj, &max1110_attr_group); + sysfs_remove_group(&spi->dev.kobj, &max1111_attr_group); +diff --git a/drivers/i2c/busses/i2c-cpm.c b/drivers/i2c/busses/i2c-cpm.c +index 3823623baa48..693e4ceb85ce 100644 +--- a/drivers/i2c/busses/i2c-cpm.c ++++ b/drivers/i2c/busses/i2c-cpm.c +@@ -120,8 +120,8 @@ struct cpm_i2c { + cbd_t __iomem *rbase; + u_char *txbuf[CPM_MAXBD]; + u_char *rxbuf[CPM_MAXBD]; +- u32 txdma[CPM_MAXBD]; +- u32 rxdma[CPM_MAXBD]; ++ dma_addr_t txdma[CPM_MAXBD]; ++ dma_addr_t rxdma[CPM_MAXBD]; + }; + + static irqreturn_t cpm_i2c_interrupt(int irq, void *dev_id) +diff --git a/drivers/input/misc/ati_remote2.c b/drivers/input/misc/ati_remote2.c +index f63341f20b91..e8c6a4842e91 100644 +--- a/drivers/input/misc/ati_remote2.c ++++ b/drivers/input/misc/ati_remote2.c +@@ -817,26 +817,49 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d + + ar2->udev = udev; + ++ /* Sanity check, first interface must have an endpoint */ ++ if (alt->desc.bNumEndpoints < 1 || !alt->endpoint) { ++ dev_err(&interface->dev, ++ "%s(): interface 0 must have an endpoint\n", __func__); ++ r = -ENODEV; ++ goto fail1; ++ } + ar2->intf[0] = interface; + ar2->ep[0] = &alt->endpoint[0].desc; + ++ /* Sanity check, the device must have two interfaces */ + ar2->intf[1] = usb_ifnum_to_if(udev, 1); ++ if ((udev->actconfig->desc.bNumInterfaces < 2) || !ar2->intf[1]) { ++ dev_err(&interface->dev, "%s(): need 2 interfaces, found %d\n", ++ __func__, udev->actconfig->desc.bNumInterfaces); ++ r = -ENODEV; ++ goto fail1; ++ } ++ + r = usb_driver_claim_interface(&ati_remote2_driver, ar2->intf[1], ar2); + if (r) + goto fail1; ++ ++ /* Sanity check, second interface must have an endpoint */ + alt = ar2->intf[1]->cur_altsetting; ++ if (alt->desc.bNumEndpoints < 1 || !alt->endpoint) { ++ dev_err(&interface->dev, ++ "%s(): interface 1 must have an endpoint\n", __func__); ++ r = -ENODEV; ++ goto fail2; ++ } + ar2->ep[1] = &alt->endpoint[0].desc; + + r = ati_remote2_urb_init(ar2); + if (r) +- goto fail2; ++ goto fail3; + + ar2->channel_mask = channel_mask; + ar2->mode_mask = mode_mask; + + r = ati_remote2_setup(ar2, ar2->channel_mask); + if (r) +- goto fail2; ++ goto fail3; + + usb_make_path(udev, ar2->phys, sizeof(ar2->phys)); + strlcat(ar2->phys, "/input0", sizeof(ar2->phys)); +@@ -845,11 +868,11 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d + + r = sysfs_create_group(&udev->dev.kobj, &ati_remote2_attr_group); + if (r) +- goto fail2; ++ goto fail3; + + r = ati_remote2_input_init(ar2); + if (r) +- goto fail3; ++ goto fail4; + + usb_set_intfdata(interface, ar2); + +@@ -857,10 +880,11 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d + + return 0; + +- fail3: ++ fail4: + sysfs_remove_group(&udev->dev.kobj, &ati_remote2_attr_group); +- fail2: ++ fail3: + ati_remote2_urb_cleanup(ar2); ++ fail2: + usb_driver_release_interface(&ati_remote2_driver, ar2->intf[1]); + fail1: + kfree(ar2); +diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c +index e204f26b0011..77164dc1bedd 100644 +--- a/drivers/input/misc/ims-pcu.c ++++ b/drivers/input/misc/ims-pcu.c +@@ -1433,6 +1433,8 @@ static int ims_pcu_parse_cdc_data(struct usb_interface *intf, struct ims_pcu *pc + + pcu->ctrl_intf = usb_ifnum_to_if(pcu->udev, + union_desc->bMasterInterface0); ++ if (!pcu->ctrl_intf) ++ return -EINVAL; + + alt = pcu->ctrl_intf->cur_altsetting; + pcu->ep_ctrl = &alt->endpoint[0].desc; +@@ -1440,6 +1442,8 @@ static int ims_pcu_parse_cdc_data(struct usb_interface *intf, struct ims_pcu *pc + + pcu->data_intf = usb_ifnum_to_if(pcu->udev, + union_desc->bSlaveInterface0); ++ if (!pcu->data_intf) ++ return -EINVAL; + + alt = pcu->data_intf->cur_altsetting; + if (alt->desc.bNumEndpoints != 2) { +diff --git a/drivers/input/misc/max8997_haptic.c b/drivers/input/misc/max8997_haptic.c +index e973133212a5..a8c91226cd22 100644 +--- a/drivers/input/misc/max8997_haptic.c ++++ b/drivers/input/misc/max8997_haptic.c +@@ -246,12 +246,14 @@ static int max8997_haptic_probe(struct platform_device *pdev) + struct max8997_dev *iodev = dev_get_drvdata(pdev->dev.parent); + const struct max8997_platform_data *pdata = + dev_get_platdata(iodev->dev); +- const struct max8997_haptic_platform_data *haptic_pdata = +- pdata->haptic_pdata; ++ const struct max8997_haptic_platform_data *haptic_pdata = NULL; + struct max8997_haptic *chip; + struct input_dev *input_dev; + int error; + ++ if (pdata) ++ haptic_pdata = pdata->haptic_pdata; ++ + if (!haptic_pdata) { + dev_err(&pdev->dev, "no haptic platform data\n"); + return -EINVAL; +diff --git a/drivers/input/misc/powermate.c b/drivers/input/misc/powermate.c +index 49c0c3ebd321..21ce1cf757bb 100644 +--- a/drivers/input/misc/powermate.c ++++ b/drivers/input/misc/powermate.c +@@ -308,6 +308,9 @@ static int powermate_probe(struct usb_interface *intf, const struct usb_device_i + int error = -ENOMEM; + + interface = intf->cur_altsetting; ++ if (interface->desc.bNumEndpoints < 1) ++ return -EINVAL; ++ + endpoint = &interface->endpoint[0].desc; + if (!usb_endpoint_is_int_in(endpoint)) + return -EIO; +diff --git a/drivers/input/tablet/gtco.c b/drivers/input/tablet/gtco.c +index 29e01ab6859f..a9f8f925ba2b 100644 +--- a/drivers/input/tablet/gtco.c ++++ b/drivers/input/tablet/gtco.c +@@ -869,6 +869,14 @@ static int gtco_probe(struct usb_interface *usbinterface, + goto err_free_buf; + } + ++ /* Sanity check that a device has an endpoint */ ++ if (usbinterface->altsetting[0].desc.bNumEndpoints < 1) { ++ dev_err(&usbinterface->dev, ++ "Invalid number of endpoints\n"); ++ error = -EINVAL; ++ goto err_free_urb; ++ } ++ + /* + * The endpoint is always altsetting 0, we know this since we know + * this device only has one interrupt endpoint +@@ -890,7 +898,7 @@ static int gtco_probe(struct usb_interface *usbinterface, + * HID report descriptor + */ + if (usb_get_extra_descriptor(usbinterface->cur_altsetting, +- HID_DEVICE_TYPE, &hid_desc) != 0){ ++ HID_DEVICE_TYPE, &hid_desc) != 0) { + dev_err(&usbinterface->dev, + "Can't retrieve exta USB descriptor to get hid report descriptor length\n"); + error = -EIO; +diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c +index 84ccf140c1bb..9332e46b53ed 100644 +--- a/drivers/input/touchscreen/ads7846.c ++++ b/drivers/input/touchscreen/ads7846.c +@@ -697,18 +697,22 @@ static int ads7846_no_filter(void *ads, int data_idx, int *val) + + static int ads7846_get_value(struct ads7846 *ts, struct spi_message *m) + { ++ int value; + struct spi_transfer *t = + list_entry(m->transfers.prev, struct spi_transfer, transfer_list); + + if (ts->model == 7845) { +- return be16_to_cpup((__be16 *)&(((char*)t->rx_buf)[1])) >> 3; ++ value = be16_to_cpup((__be16 *)&(((char *)t->rx_buf)[1])); + } else { + /* + * adjust: on-wire is a must-ignore bit, a BE12 value, then + * padding; built from two 8 bit values written msb-first. + */ +- return be16_to_cpup((__be16 *)t->rx_buf) >> 3; ++ value = be16_to_cpup((__be16 *)t->rx_buf); + } ++ ++ /* enforce ADC output is 12 bits width */ ++ return (value >> 3) & 0xfff; + } + + static void ads7846_update_value(struct spi_message *m, int val) +diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c +index 2d2915fdbf02..2a4c13af482a 100644 +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -1295,6 +1295,9 @@ static void cache_set_flush(struct closure *cl) + set_bit(CACHE_SET_STOPPING_2, &c->flags); + wake_up(&c->alloc_wait); + ++ if (!c) ++ closure_return(cl); ++ + bch_cache_accounting_destroy(&c->accounting); + + kobject_put(&c->internal); +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index ef18ca745b1e..9ee3c460fa37 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -5658,8 +5658,8 @@ static int run(struct mddev *mddev) + } + + if (discard_supported && +- mddev->queue->limits.max_discard_sectors >= stripe && +- mddev->queue->limits.discard_granularity >= stripe) ++ mddev->queue->limits.max_discard_sectors >= (stripe >> 9) && ++ mddev->queue->limits.discard_granularity >= stripe) + queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, + mddev->queue); + else +diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c +index e2633d9270b7..aa4519e5cafa 100644 +--- a/drivers/media/pci/bt8xx/bttv-driver.c ++++ b/drivers/media/pci/bt8xx/bttv-driver.c +@@ -2376,6 +2376,19 @@ static int bttv_g_fmt_vid_overlay(struct file *file, void *priv, + return 0; + } + ++static void bttv_get_width_mask_vid_cap(const struct bttv_format *fmt, ++ unsigned int *width_mask, ++ unsigned int *width_bias) ++{ ++ if (fmt->flags & FORMAT_FLAGS_PLANAR) { ++ *width_mask = ~15; /* width must be a multiple of 16 pixels */ ++ *width_bias = 8; /* nearest */ ++ } else { ++ *width_mask = ~3; /* width must be a multiple of 4 pixels */ ++ *width_bias = 2; /* nearest */ ++ } ++} ++ + static int bttv_try_fmt_vid_cap(struct file *file, void *priv, + struct v4l2_format *f) + { +@@ -2385,6 +2398,7 @@ static int bttv_try_fmt_vid_cap(struct file *file, void *priv, + enum v4l2_field field; + __s32 width, height; + __s32 height2; ++ unsigned int width_mask, width_bias; + int rc; + + fmt = format_by_fourcc(f->fmt.pix.pixelformat); +@@ -2417,9 +2431,9 @@ static int bttv_try_fmt_vid_cap(struct file *file, void *priv, + width = f->fmt.pix.width; + height = f->fmt.pix.height; + ++ bttv_get_width_mask_vid_cap(fmt, &width_mask, &width_bias); + rc = limit_scaled_size_lock(fh, &width, &height, field, +- /* width_mask: 4 pixels */ ~3, +- /* width_bias: nearest */ 2, ++ width_mask, width_bias, + /* adjust_size */ 1, + /* adjust_crop */ 0); + if (0 != rc) +@@ -2452,6 +2466,7 @@ static int bttv_s_fmt_vid_cap(struct file *file, void *priv, + struct bttv_fh *fh = priv; + struct bttv *btv = fh->btv; + __s32 width, height; ++ unsigned int width_mask, width_bias; + enum v4l2_field field; + + retval = bttv_switch_type(fh, f->type); +@@ -2466,9 +2481,10 @@ static int bttv_s_fmt_vid_cap(struct file *file, void *priv, + height = f->fmt.pix.height; + field = f->fmt.pix.field; + ++ fmt = format_by_fourcc(f->fmt.pix.pixelformat); ++ bttv_get_width_mask_vid_cap(fmt, &width_mask, &width_bias); + retval = limit_scaled_size_lock(fh, &width, &height, f->fmt.pix.field, +- /* width_mask: 4 pixels */ ~3, +- /* width_bias: nearest */ 2, ++ width_mask, width_bias, + /* adjust_size */ 1, + /* adjust_crop */ 1); + if (0 != retval) +@@ -2476,8 +2492,6 @@ static int bttv_s_fmt_vid_cap(struct file *file, void *priv, + + f->fmt.pix.field = field; + +- fmt = format_by_fourcc(f->fmt.pix.pixelformat); +- + /* update our state informations */ + fh->fmt = fmt; + fh->cap.field = f->fmt.pix.field; +diff --git a/drivers/media/usb/pwc/pwc-if.c b/drivers/media/usb/pwc/pwc-if.c +index 77bbf7889659..db1e8ee13ded 100644 +--- a/drivers/media/usb/pwc/pwc-if.c ++++ b/drivers/media/usb/pwc/pwc-if.c +@@ -91,6 +91,7 @@ static const struct usb_device_id pwc_device_table [] = { + { USB_DEVICE(0x0471, 0x0312) }, + { USB_DEVICE(0x0471, 0x0313) }, /* the 'new' 720K */ + { USB_DEVICE(0x0471, 0x0329) }, /* Philips SPC 900NC PC Camera */ ++ { USB_DEVICE(0x0471, 0x032C) }, /* Philips SPC 880NC PC Camera */ + { USB_DEVICE(0x069A, 0x0001) }, /* Askey */ + { USB_DEVICE(0x046D, 0x08B0) }, /* Logitech QuickCam Pro 3000 */ + { USB_DEVICE(0x046D, 0x08B1) }, /* Logitech QuickCam Notebook Pro */ +@@ -799,6 +800,11 @@ static int usb_pwc_probe(struct usb_interface *intf, const struct usb_device_id + name = "Philips SPC 900NC webcam"; + type_id = 740; + break; ++ case 0x032C: ++ PWC_INFO("Philips SPC 880NC USB webcam detected.\n"); ++ name = "Philips SPC 880NC webcam"; ++ type_id = 740; ++ break; + default: + return -ENODEV; + break; +diff --git a/drivers/media/usb/usbvision/usbvision-video.c b/drivers/media/usb/usbvision/usbvision-video.c +index d34c2afe2c24..bcfefe61a592 100644 +--- a/drivers/media/usb/usbvision/usbvision-video.c ++++ b/drivers/media/usb/usbvision/usbvision-video.c +@@ -1459,6 +1459,7 @@ static void usbvision_release(struct usb_usbvision *usbvision) + + usbvision_remove_sysfs(usbvision->vdev); + usbvision_unregister_video(usbvision); ++ kfree(usbvision->alt_max_pkt_size); + + usb_free_urb(usbvision->ctrl_urb); + +@@ -1520,7 +1521,7 @@ static int usbvision_probe(struct usb_interface *intf, + const struct usb_host_interface *interface; + struct usb_usbvision *usbvision = NULL; + const struct usb_endpoint_descriptor *endpoint; +- int model, i; ++ int model, i, ret; + + PDEBUG(DBG_PROBE, "VID=%#04x, PID=%#04x, ifnum=%u", + dev->descriptor.idVendor, +@@ -1529,33 +1530,51 @@ static int usbvision_probe(struct usb_interface *intf, + model = devid->driver_info; + if (model < 0 || model >= usbvision_device_data_size) { + PDEBUG(DBG_PROBE, "model out of bounds %d", model); +- return -ENODEV; ++ ret = -ENODEV; ++ goto err_usb; + } + printk(KERN_INFO "%s: %s found\n", __func__, + usbvision_device_data[model].model_string); + + if (usbvision_device_data[model].interface >= 0) + interface = &dev->actconfig->interface[usbvision_device_data[model].interface]->altsetting[0]; +- else ++ else if (ifnum < dev->actconfig->desc.bNumInterfaces) + interface = &dev->actconfig->interface[ifnum]->altsetting[0]; ++ else { ++ dev_err(&intf->dev, "interface %d is invalid, max is %d\n", ++ ifnum, dev->actconfig->desc.bNumInterfaces - 1); ++ ret = -ENODEV; ++ goto err_usb; ++ } ++ ++ if (interface->desc.bNumEndpoints < 2) { ++ dev_err(&intf->dev, "interface %d has %d endpoints, but must" ++ " have minimum 2\n", ifnum, interface->desc.bNumEndpoints); ++ ret = -ENODEV; ++ goto err_usb; ++ } + endpoint = &interface->endpoint[1].desc; ++ + if (!usb_endpoint_xfer_isoc(endpoint)) { + dev_err(&intf->dev, "%s: interface %d. has non-ISO endpoint!\n", + __func__, ifnum); + dev_err(&intf->dev, "%s: Endpoint attributes %d", + __func__, endpoint->bmAttributes); +- return -ENODEV; ++ ret = -ENODEV; ++ goto err_usb; + } + if (usb_endpoint_dir_out(endpoint)) { + dev_err(&intf->dev, "%s: interface %d. has ISO OUT endpoint!\n", + __func__, ifnum); +- return -ENODEV; ++ ret = -ENODEV; ++ goto err_usb; + } + + usbvision = usbvision_alloc(dev, intf); + if (usbvision == NULL) { + dev_err(&intf->dev, "%s: couldn't allocate USBVision struct\n", __func__); +- return -ENOMEM; ++ ret = -ENOMEM; ++ goto err_usb; + } + + if (dev->descriptor.bNumConfigurations > 1) +@@ -1574,7 +1593,8 @@ static int usbvision_probe(struct usb_interface *intf, + usbvision->alt_max_pkt_size = kmalloc(32 * usbvision->num_alt, GFP_KERNEL); + if (usbvision->alt_max_pkt_size == NULL) { + dev_err(&intf->dev, "usbvision: out of memory!\n"); +- return -ENOMEM; ++ ret = -ENOMEM; ++ goto err_pkt; + } + + for (i = 0; i < usbvision->num_alt; i++) { +@@ -1609,6 +1629,12 @@ static int usbvision_probe(struct usb_interface *intf, + + PDEBUG(DBG_PROBE, "success"); + return 0; ++ ++err_pkt: ++ usbvision_release(usbvision); ++err_usb: ++ usb_put_dev(dev); ++ return ret; + } + + +diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c +index 35fb8f0cb539..07d6ce4c9c6f 100644 +--- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c ++++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c +@@ -392,7 +392,8 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user + get_user(kp->index, &up->index) || + get_user(kp->type, &up->type) || + get_user(kp->flags, &up->flags) || +- get_user(kp->memory, &up->memory)) ++ get_user(kp->memory, &up->memory) || ++ get_user(kp->length, &up->length)) + return -EFAULT; + + if (V4L2_TYPE_IS_OUTPUT(kp->type)) +@@ -404,9 +405,6 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user + return -EFAULT; + + if (V4L2_TYPE_IS_MULTIPLANAR(kp->type)) { +- if (get_user(kp->length, &up->length)) +- return -EFAULT; +- + num_planes = kp->length; + if (num_planes == 0) { + kp->m.planes = NULL; +@@ -439,16 +437,14 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user + } else { + switch (kp->memory) { + case V4L2_MEMORY_MMAP: +- if (get_user(kp->length, &up->length) || +- get_user(kp->m.offset, &up->m.offset)) ++ if (get_user(kp->m.offset, &up->m.offset)) + return -EFAULT; + break; + case V4L2_MEMORY_USERPTR: + { + compat_long_t tmp; + +- if (get_user(kp->length, &up->length) || +- get_user(tmp, &up->m.userptr)) ++ if (get_user(tmp, &up->m.userptr)) + return -EFAULT; + + kp->m.userptr = (unsigned long)compat_ptr(tmp); +@@ -490,7 +486,8 @@ static int put_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user + copy_to_user(&up->timecode, &kp->timecode, sizeof(struct v4l2_timecode)) || + put_user(kp->sequence, &up->sequence) || + put_user(kp->reserved2, &up->reserved2) || +- put_user(kp->reserved, &up->reserved)) ++ put_user(kp->reserved, &up->reserved) || ++ put_user(kp->length, &up->length)) + return -EFAULT; + + if (V4L2_TYPE_IS_MULTIPLANAR(kp->type)) { +@@ -513,13 +510,11 @@ static int put_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user + } else { + switch (kp->memory) { + case V4L2_MEMORY_MMAP: +- if (put_user(kp->length, &up->length) || +- put_user(kp->m.offset, &up->m.offset)) ++ if (put_user(kp->m.offset, &up->m.offset)) + return -EFAULT; + break; + case V4L2_MEMORY_USERPTR: +- if (put_user(kp->length, &up->length) || +- put_user(kp->m.userptr, &up->m.userptr)) ++ if (put_user(kp->m.userptr, &up->m.userptr)) + return -EFAULT; + break; + case V4L2_MEMORY_OVERLAY: +diff --git a/drivers/mfd/omap-usb-tll.c b/drivers/mfd/omap-usb-tll.c +index e59ac4cbac96..c7576a503e5b 100644 +--- a/drivers/mfd/omap-usb-tll.c ++++ b/drivers/mfd/omap-usb-tll.c +@@ -269,6 +269,8 @@ static int usbtll_omap_probe(struct platform_device *pdev) + + if (IS_ERR(tll->ch_clk[i])) + dev_dbg(dev, "can't get clock : %s\n", clkname); ++ else ++ clk_prepare(tll->ch_clk[i]); + } + + pm_runtime_put_sync(dev); +@@ -301,9 +303,12 @@ static int usbtll_omap_remove(struct platform_device *pdev) + tll_dev = NULL; + spin_unlock(&tll_lock); + +- for (i = 0; i < tll->nch; i++) +- if (!IS_ERR(tll->ch_clk[i])) ++ for (i = 0; i < tll->nch; i++) { ++ if (!IS_ERR(tll->ch_clk[i])) { ++ clk_unprepare(tll->ch_clk[i]); + clk_put(tll->ch_clk[i]); ++ } ++ } + + pm_runtime_disable(&pdev->dev); + return 0; +diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig +index c002d8660e30..7a6818407836 100644 +--- a/drivers/misc/Kconfig ++++ b/drivers/misc/Kconfig +@@ -451,7 +451,7 @@ config ARM_CHARLCD + still useful. + + config BMP085 +- bool ++ tristate + depends on SYSFS + + config BMP085_I2C +diff --git a/drivers/misc/ad525x_dpot.c b/drivers/misc/ad525x_dpot.c +index 8f99e8e3f0ac..beb7422c3cc7 100644 +--- a/drivers/misc/ad525x_dpot.c ++++ b/drivers/misc/ad525x_dpot.c +@@ -216,7 +216,7 @@ static s32 dpot_read_i2c(struct dpot_data *dpot, u8 reg) + */ + value = swab16(value); + +- if (dpot->uid == DPOT_UID(AD5271_ID)) ++ if (dpot->uid == DPOT_UID(AD5274_ID)) + value = value >> 2; + return value; + default: +diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c +index ebb40a292d67..c6bf23599eb9 100644 +--- a/drivers/mmc/card/block.c ++++ b/drivers/mmc/card/block.c +@@ -2322,11 +2322,12 @@ static const struct mmc_fixup blk_fixups[] = + MMC_QUIRK_BLK_NO_CMD23), + + /* +- * Some Micron MMC cards needs longer data read timeout than +- * indicated in CSD. ++ * Some MMC cards need longer data read timeout than indicated in CSD. + */ + MMC_FIXUP(CID_NAME_ANY, CID_MANFID_MICRON, 0x200, add_quirk_mmc, + MMC_QUIRK_LONG_READ_TIME), ++ MMC_FIXUP("008GE0", CID_MANFID_TOSHIBA, CID_OEMID_ANY, add_quirk_mmc, ++ MMC_QUIRK_LONG_READ_TIME), + + /* + * On these Samsung MoviNAND parts, performing secure erase or +diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c +index 68ab26385d06..3ae6f1325773 100644 +--- a/drivers/mmc/core/core.c ++++ b/drivers/mmc/core/core.c +@@ -801,11 +801,11 @@ void mmc_set_data_timeout(struct mmc_data *data, const struct mmc_card *card) + /* + * Some cards require longer data read timeout than indicated in CSD. + * Address this by setting the read timeout to a "reasonably high" +- * value. For the cards tested, 300ms has proven enough. If necessary, ++ * value. For the cards tested, 600ms has proven enough. If necessary, + * this value can be increased if other problematic cards require this. + */ + if (mmc_card_long_read_time(card) && data->flags & MMC_DATA_READ) { +- data->timeout_ns = 300000000; ++ data->timeout_ns = 600000000; + data->timeout_clks = 0; + } + +diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c +index 0cbd1effe960..dda1a42ae822 100644 +--- a/drivers/mmc/core/mmc.c ++++ b/drivers/mmc/core/mmc.c +@@ -266,6 +266,9 @@ static void mmc_select_card_type(struct mmc_card *card) + card->ext_csd.card_type = card_type; + } + ++/* Minimum partition switch timeout in milliseconds */ ++#define MMC_MIN_PART_SWITCH_TIME 300 ++ + /* + * Decode extended CSD. + */ +@@ -330,6 +333,10 @@ static int mmc_read_ext_csd(struct mmc_card *card, u8 *ext_csd) + + /* EXT_CSD value is in units of 10ms, but we store in ms */ + card->ext_csd.part_time = 10 * ext_csd[EXT_CSD_PART_SWITCH_TIME]; ++ /* Some eMMC set the value too low so set a minimum */ ++ if (card->ext_csd.part_time && ++ card->ext_csd.part_time < MMC_MIN_PART_SWITCH_TIME) ++ card->ext_csd.part_time = MMC_MIN_PART_SWITCH_TIME; + + /* Sleep / awake timeout in 100ns units */ + if (sa_shift > 0 && sa_shift <= 0x17) +diff --git a/drivers/mtd/onenand/onenand_base.c b/drivers/mtd/onenand/onenand_base.c +index b3f41f200622..0f13fd4748ec 100644 +--- a/drivers/mtd/onenand/onenand_base.c ++++ b/drivers/mtd/onenand/onenand_base.c +@@ -2610,6 +2610,7 @@ static int onenand_default_block_markbad(struct mtd_info *mtd, loff_t ofs) + */ + static int onenand_block_markbad(struct mtd_info *mtd, loff_t ofs) + { ++ struct onenand_chip *this = mtd->priv; + int ret; + + ret = onenand_block_isbad(mtd, ofs); +@@ -2621,7 +2622,7 @@ static int onenand_block_markbad(struct mtd_info *mtd, loff_t ofs) + } + + onenand_get_device(mtd, FL_WRITING); +- ret = mtd_block_markbad(mtd, ofs); ++ ret = this->block_markbad(mtd, ofs); + onenand_release_device(mtd); + return ret; + } +diff --git a/drivers/net/ethernet/atheros/atlx/atl2.c b/drivers/net/ethernet/atheros/atlx/atl2.c +index 265ce1b752ed..96fe542b4acb 100644 +--- a/drivers/net/ethernet/atheros/atlx/atl2.c ++++ b/drivers/net/ethernet/atheros/atlx/atl2.c +@@ -1413,7 +1413,7 @@ static int atl2_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + + err = -EIO; + +- netdev->hw_features = NETIF_F_SG | NETIF_F_HW_VLAN_CTAG_RX; ++ netdev->hw_features = NETIF_F_HW_VLAN_CTAG_RX; + netdev->features |= (NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_HW_VLAN_CTAG_RX); + + /* Init PHY as early as possible due to power saving issue */ +diff --git a/drivers/net/ethernet/jme.c b/drivers/net/ethernet/jme.c +index 070a6f1a0577..2f4cbcae9c7c 100644 +--- a/drivers/net/ethernet/jme.c ++++ b/drivers/net/ethernet/jme.c +@@ -3290,13 +3290,14 @@ jme_resume(struct device *dev) + jme_reset_phy_processor(jme); + jme_phy_calibration(jme); + jme_phy_setEA(jme); +- jme_start_irq(jme); + netif_device_attach(netdev); + + atomic_inc(&jme->link_changing); + + jme_reset_link(jme); + ++ jme_start_irq(jme); ++ + return 0; + } + +diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_main.c b/drivers/net/ethernet/qlogic/qlge/qlge_main.c +index f87cc216045b..a978cc2eafe0 100644 +--- a/drivers/net/ethernet/qlogic/qlge/qlge_main.c ++++ b/drivers/net/ethernet/qlogic/qlge/qlge_main.c +@@ -1620,7 +1620,18 @@ static void ql_process_mac_rx_skb(struct ql_adapter *qdev, + return; + } + skb_reserve(new_skb, NET_IP_ALIGN); ++ ++ pci_dma_sync_single_for_cpu(qdev->pdev, ++ dma_unmap_addr(sbq_desc, mapaddr), ++ dma_unmap_len(sbq_desc, maplen), ++ PCI_DMA_FROMDEVICE); ++ + memcpy(skb_put(new_skb, length), skb->data, length); ++ ++ pci_dma_sync_single_for_device(qdev->pdev, ++ dma_unmap_addr(sbq_desc, mapaddr), ++ dma_unmap_len(sbq_desc, maplen), ++ PCI_DMA_FROMDEVICE); + skb = new_skb; + + /* Frame error, so drop the packet. */ +diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c +index b93a0fb17236..93b652516a94 100644 +--- a/drivers/net/ethernet/renesas/sh_eth.c ++++ b/drivers/net/ethernet/renesas/sh_eth.c +@@ -1161,7 +1161,8 @@ static void sh_eth_ring_format(struct net_device *ndev) + mdp->dirty_rx = (u32) (i - mdp->num_rx_ring); + + /* Mark the last entry as wrapping the ring. */ +- rxdesc->status |= cpu_to_edmac(mdp, RD_RDEL); ++ if (rxdesc) ++ rxdesc->status |= cpu_to_edmac(mdp, RD_RDEL); + + memset(mdp->tx_ring, 0, tx_ringsize); + +diff --git a/drivers/net/irda/irtty-sir.c b/drivers/net/irda/irtty-sir.c +index a41267197839..0d71fa9f0c68 100644 +--- a/drivers/net/irda/irtty-sir.c ++++ b/drivers/net/irda/irtty-sir.c +@@ -430,16 +430,6 @@ static int irtty_open(struct tty_struct *tty) + + /* Module stuff handled via irda_ldisc.owner - Jean II */ + +- /* First make sure we're not already connected. */ +- if (tty->disc_data != NULL) { +- priv = tty->disc_data; +- if (priv && priv->magic == IRTTY_MAGIC) { +- ret = -EEXIST; +- goto out; +- } +- tty->disc_data = NULL; /* ### */ +- } +- + /* stop the underlying driver */ + irtty_stop_receiver(tty, TRUE); + if (tty->ops->stop) +diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c +index a2d7d5f066f1..14a8d2958698 100644 +--- a/drivers/net/ppp/ppp_generic.c ++++ b/drivers/net/ppp/ppp_generic.c +@@ -2220,7 +2220,7 @@ int ppp_register_net_channel(struct net *net, struct ppp_channel *chan) + + pch->ppp = NULL; + pch->chan = chan; +- pch->chan_net = net; ++ pch->chan_net = get_net(net); + chan->ppp = pch; + init_ppp_file(&pch->file, CHANNEL); + pch->file.hdrlen = chan->hdrlen; +@@ -2317,6 +2317,8 @@ ppp_unregister_channel(struct ppp_channel *chan) + spin_lock_bh(&pn->all_channels_lock); + list_del(&pch->list); + spin_unlock_bh(&pn->all_channels_lock); ++ put_net(pch->chan_net); ++ pch->chan_net = NULL; + + pch->file.dead = 1; + wake_up_interruptible(&pch->file.rwait); +diff --git a/drivers/net/rionet.c b/drivers/net/rionet.c +index f433b594388e..00a8128cf927 100644 +--- a/drivers/net/rionet.c ++++ b/drivers/net/rionet.c +@@ -269,7 +269,7 @@ static void rionet_outb_msg_event(struct rio_mport *mport, void *dev_id, int mbo + struct net_device *ndev = dev_id; + struct rionet_private *rnet = netdev_priv(ndev); + +- spin_lock(&rnet->lock); ++ spin_lock(&rnet->tx_lock); + + if (netif_msg_intr(rnet)) + printk(KERN_INFO +@@ -288,7 +288,7 @@ static void rionet_outb_msg_event(struct rio_mport *mport, void *dev_id, int mbo + if (rnet->tx_cnt < RIONET_TX_RING_SIZE) + netif_wake_queue(ndev); + +- spin_unlock(&rnet->lock); ++ spin_unlock(&rnet->tx_lock); + } + + static int rionet_open(struct net_device *ndev) +diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c +index 43afde8f48d2..74581cbcafa7 100644 +--- a/drivers/net/usb/cdc_ncm.c ++++ b/drivers/net/usb/cdc_ncm.c +@@ -464,7 +464,11 @@ advance: + + iface_no = ctx->data->cur_altsetting->desc.bInterfaceNumber; + +- /* reset data interface */ ++ /* Reset data interface. Some devices will not reset properly ++ * unless they are configured first. Toggle the altsetting to ++ * force a reset ++ */ ++ usb_set_interface(dev->udev, iface_no, data_altsetting); + temp = usb_set_interface(dev->udev, iface_no, 0); + if (temp) + goto error2; +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index 0244a1fb38f9..12aaf1f4f890 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -724,6 +724,7 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x19d2, 0x1426, 2)}, /* ZTE MF91 */ + {QMI_FIXED_INTF(0x19d2, 0x1428, 2)}, /* Telewell TW-LTE 4G v2 */ + {QMI_FIXED_INTF(0x19d2, 0x2002, 4)}, /* ZTE (Vodafone) K3765-Z */ ++ {QMI_FIXED_INTF(0x2001, 0x7e19, 4)}, /* D-Link DWM-221 B1 */ + {QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)}, /* Sierra Wireless MC7700 */ + {QMI_FIXED_INTF(0x114f, 0x68a2, 8)}, /* Sierra Wireless MC7750 */ + {QMI_FIXED_INTF(0x1199, 0x68a2, 8)}, /* Sierra Wireless MC7710 in QMI mode */ +diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c +index fb068ada0c5a..2255d8965037 100644 +--- a/drivers/net/usb/usbnet.c ++++ b/drivers/net/usb/usbnet.c +@@ -1622,6 +1622,13 @@ out3: + if (info->unbind) + info->unbind (dev, udev); + out1: ++ /* subdrivers must undo all they did in bind() if they ++ * fail it, but we may fail later and a deferred kevent ++ * may trigger an error resubmitting itself and, worse, ++ * schedule a timer. So we kill it all just in case. ++ */ ++ cancel_work_sync(&dev->kevent); ++ del_timer_sync(&dev->delay); + free_netdev(net); + out: + return status; +diff --git a/drivers/net/wan/farsync.c b/drivers/net/wan/farsync.c +index bcfff0d62de4..2dfa1478d7d1 100644 +--- a/drivers/net/wan/farsync.c ++++ b/drivers/net/wan/farsync.c +@@ -2545,7 +2545,7 @@ fst_add_one(struct pci_dev *pdev, const struct pci_device_id *ent) + dev->mem_start = card->phys_mem + + BUF_OFFSET ( txBuffer[i][0][0]); + dev->mem_end = card->phys_mem +- + BUF_OFFSET ( txBuffer[i][NUM_TX_BUFFER][0]); ++ + BUF_OFFSET ( txBuffer[i][NUM_TX_BUFFER - 1][LEN_RX_BUFFER - 1]); + dev->base_addr = card->pci_conf; + dev->irq = card->irq; + +diff --git a/drivers/net/wireless/ath/ath9k/eeprom.c b/drivers/net/wireless/ath/ath9k/eeprom.c +index 971d770722cf..2ac05486424b 100644 +--- a/drivers/net/wireless/ath/ath9k/eeprom.c ++++ b/drivers/net/wireless/ath/ath9k/eeprom.c +@@ -408,10 +408,9 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah, + + if (match) { + if (AR_SREV_9287(ah)) { +- /* FIXME: array overrun? */ + for (i = 0; i < numXpdGains; i++) { + minPwrT4[i] = data_9287[idxL].pwrPdg[i][0]; +- maxPwrT4[i] = data_9287[idxL].pwrPdg[i][4]; ++ maxPwrT4[i] = data_9287[idxL].pwrPdg[i][intercepts - 1]; + ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i], + data_9287[idxL].pwrPdg[i], + data_9287[idxL].vpdPdg[i], +@@ -421,7 +420,7 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah, + } else if (eeprom_4k) { + for (i = 0; i < numXpdGains; i++) { + minPwrT4[i] = data_4k[idxL].pwrPdg[i][0]; +- maxPwrT4[i] = data_4k[idxL].pwrPdg[i][4]; ++ maxPwrT4[i] = data_4k[idxL].pwrPdg[i][intercepts - 1]; + ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i], + data_4k[idxL].pwrPdg[i], + data_4k[idxL].vpdPdg[i], +@@ -431,7 +430,7 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah, + } else { + for (i = 0; i < numXpdGains; i++) { + minPwrT4[i] = data_def[idxL].pwrPdg[i][0]; +- maxPwrT4[i] = data_def[idxL].pwrPdg[i][4]; ++ maxPwrT4[i] = data_def[idxL].pwrPdg[i][intercepts - 1]; + ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i], + data_def[idxL].pwrPdg[i], + data_def[idxL].vpdPdg[i], +diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c +index 034a4d2964d6..d332d55885f8 100644 +--- a/drivers/pci/probe.c ++++ b/drivers/pci/probe.c +@@ -173,6 +173,9 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type, + struct pci_bus_region region; + bool bar_too_big = false, bar_disabled = false; + ++ if (dev->non_compliant_bars) ++ return 0; ++ + mask = type ? PCI_ROM_ADDRESS_MASK : ~0; + + /* No printks while decoding is disabled! */ +@@ -981,6 +984,7 @@ void set_pcie_hotplug_bridge(struct pci_dev *pdev) + int pci_setup_device(struct pci_dev *dev) + { + u32 class; ++ u16 cmd; + u8 hdr_type; + struct pci_slot *slot; + int pos = 0; +@@ -1028,6 +1032,16 @@ int pci_setup_device(struct pci_dev *dev) + /* device class may be changed after fixup */ + class = dev->class >> 8; + ++ if (dev->non_compliant_bars) { ++ pci_read_config_word(dev, PCI_COMMAND, &cmd); ++ if (cmd & (PCI_COMMAND_IO | PCI_COMMAND_MEMORY)) { ++ dev_info(&dev->dev, "device has non-compliant BARs; disabling IO/MEM decoding\n"); ++ cmd &= ~PCI_COMMAND_IO; ++ cmd &= ~PCI_COMMAND_MEMORY; ++ pci_write_config_word(dev, PCI_COMMAND, cmd); ++ } ++ } ++ + switch (dev->hdr_type) { /* header type */ + case PCI_HEADER_TYPE_NORMAL: /* standard header */ + if (class == PCI_CLASS_BRIDGE_PCI) +diff --git a/drivers/pnp/pnpbios/bioscalls.c b/drivers/pnp/pnpbios/bioscalls.c +index 769d265b221b..deb7f4bcdb7b 100644 +--- a/drivers/pnp/pnpbios/bioscalls.c ++++ b/drivers/pnp/pnpbios/bioscalls.c +@@ -21,7 +21,7 @@ + + #include "pnpbios.h" + +-static struct { ++__visible struct { + u16 offset; + u16 segment; + } pnp_bios_callpoint; +@@ -41,6 +41,7 @@ asmlinkage void pnp_bios_callfunc(void); + + __asm__(".text \n" + __ALIGN_STR "\n" ++ ".globl pnp_bios_callfunc\n" + "pnp_bios_callfunc:\n" + " pushl %edx \n" + " pushl %ecx \n" +@@ -66,9 +67,9 @@ static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092, + * after PnP BIOS oopses. + */ + +-u32 pnp_bios_fault_esp; +-u32 pnp_bios_fault_eip; +-u32 pnp_bios_is_utter_crap = 0; ++__visible u32 pnp_bios_fault_esp; ++__visible u32 pnp_bios_fault_eip; ++__visible u32 pnp_bios_is_utter_crap = 0; + + static spinlock_t pnp_bios_lock; + +diff --git a/drivers/rtc/rtc-vr41xx.c b/drivers/rtc/rtc-vr41xx.c +index f91be04b9050..ca0f213c06a5 100644 +--- a/drivers/rtc/rtc-vr41xx.c ++++ b/drivers/rtc/rtc-vr41xx.c +@@ -272,12 +272,13 @@ static irqreturn_t rtclong1_interrupt(int irq, void *dev_id) + } + + static const struct rtc_class_ops vr41xx_rtc_ops = { +- .release = vr41xx_rtc_release, +- .ioctl = vr41xx_rtc_ioctl, +- .read_time = vr41xx_rtc_read_time, +- .set_time = vr41xx_rtc_set_time, +- .read_alarm = vr41xx_rtc_read_alarm, +- .set_alarm = vr41xx_rtc_set_alarm, ++ .release = vr41xx_rtc_release, ++ .ioctl = vr41xx_rtc_ioctl, ++ .read_time = vr41xx_rtc_read_time, ++ .set_time = vr41xx_rtc_set_time, ++ .read_alarm = vr41xx_rtc_read_alarm, ++ .set_alarm = vr41xx_rtc_set_alarm, ++ .alarm_irq_enable = vr41xx_rtc_alarm_irq_enable, + }; + + static int rtc_probe(struct platform_device *pdev) +diff --git a/drivers/scsi/aacraid/commsup.c b/drivers/scsi/aacraid/commsup.c +index 1be0776a80c4..6a0d362e2596 100644 +--- a/drivers/scsi/aacraid/commsup.c ++++ b/drivers/scsi/aacraid/commsup.c +@@ -83,9 +83,12 @@ static int fib_map_alloc(struct aac_dev *dev) + + void aac_fib_map_free(struct aac_dev *dev) + { +- pci_free_consistent(dev->pdev, +- dev->max_fib_size * (dev->scsi_host_ptr->can_queue + AAC_NUM_MGT_FIB), +- dev->hw_fib_va, dev->hw_fib_pa); ++ if (dev->hw_fib_va && dev->max_fib_size) { ++ pci_free_consistent(dev->pdev, ++ (dev->max_fib_size * ++ (dev->scsi_host_ptr->can_queue + AAC_NUM_MGT_FIB)), ++ dev->hw_fib_va, dev->hw_fib_pa); ++ } + dev->hw_fib_va = NULL; + dev->hw_fib_pa = 0; + } +diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c +index bfe812fcce34..a683a831527b 100644 +--- a/drivers/scsi/be2iscsi/be_main.c ++++ b/drivers/scsi/be2iscsi/be_main.c +@@ -4040,6 +4040,7 @@ put_shost: + scsi_host_put(phba->shost); + free_kset: + iscsi_boot_destroy_kset(phba->boot_kset); ++ phba->boot_kset = NULL; + return -ENOMEM; + } + +diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c +index 4a79a5f0d95e..25ac2c00f8b3 100644 +--- a/drivers/scsi/ipr.c ++++ b/drivers/scsi/ipr.c +@@ -3908,13 +3908,17 @@ static ssize_t ipr_store_update_fw(struct device *dev, + struct ipr_sglist *sglist; + char fname[100]; + char *src; +- int len, result, dnld_size; ++ char *endline; ++ int result, dnld_size; + + if (!capable(CAP_SYS_ADMIN)) + return -EACCES; + +- len = snprintf(fname, 99, "%s", buf); +- fname[len-1] = '\0'; ++ snprintf(fname, sizeof(fname), "%s", buf); ++ ++ endline = strchr(fname, '\n'); ++ if (endline) ++ *endline = '\0'; + + if (request_firmware(&fw_entry, fname, &ioa_cfg->pdev->dev)) { + dev_err(&ioa_cfg->pdev->dev, "Firmware file %s not found\n", fname); +diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c +index cb465b253910..e6e0679ec882 100644 +--- a/drivers/scsi/lpfc/lpfc_init.c ++++ b/drivers/scsi/lpfc/lpfc_init.c +@@ -2684,7 +2684,7 @@ lpfc_online(struct lpfc_hba *phba) + } + + vports = lpfc_create_vport_work_array(phba); +- if (vports != NULL) ++ if (vports != NULL) { + for (i = 0; i <= phba->max_vports && vports[i] != NULL; i++) { + struct Scsi_Host *shost; + shost = lpfc_shost_from_vport(vports[i]); +@@ -2701,7 +2701,8 @@ lpfc_online(struct lpfc_hba *phba) + } + spin_unlock_irq(shost->host_lock); + } +- lpfc_destroy_vport_work_array(phba, vports); ++ } ++ lpfc_destroy_vport_work_array(phba, vports); + + lpfc_unblock_mgmt_io(phba); + return 0; +diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c +index 0be16bf5f0cd..1f65e32db285 100644 +--- a/drivers/scsi/sg.c ++++ b/drivers/scsi/sg.c +@@ -633,7 +633,8 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos) + else + hp->dxfer_direction = (mxsize > 0) ? SG_DXFER_FROM_DEV : SG_DXFER_NONE; + hp->dxfer_len = mxsize; +- if (hp->dxfer_direction == SG_DXFER_TO_DEV) ++ if ((hp->dxfer_direction == SG_DXFER_TO_DEV) || ++ (hp->dxfer_direction == SG_DXFER_TO_FROM_DEV)) + hp->dxferp = (char __user *)buf + cmd_size; + else + hp->dxferp = NULL; +diff --git a/drivers/staging/usbip/usbip_common.c b/drivers/staging/usbip/usbip_common.c +index 7b97df6f2a42..b4f237e55931 100644 +--- a/drivers/staging/usbip/usbip_common.c ++++ b/drivers/staging/usbip/usbip_common.c +@@ -784,6 +784,17 @@ int usbip_recv_xbuff(struct usbip_device *ud, struct urb *urb) + if (!(size > 0)) + return 0; + ++ if (size > urb->transfer_buffer_length) { ++ /* should not happen, probably malicious packet */ ++ if (ud->side == USBIP_STUB) { ++ usbip_event_add(ud, SDEV_EVENT_ERROR_TCP); ++ return 0; ++ } else { ++ usbip_event_add(ud, VDEV_EVENT_ERROR_TCP); ++ return -EPIPE; ++ } ++ } ++ + ret = usbip_recv(ud->tcp_socket, urb->transfer_buffer, size); + if (ret != size) { + dev_err(&urb->dev->dev, "recv xbuf, %d\n", ret); +diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c +index d8c06a3d391e..1119d533c8e2 100644 +--- a/drivers/tty/serial/8250/8250_core.c ++++ b/drivers/tty/serial/8250/8250_core.c +@@ -686,22 +686,16 @@ static int size_fifo(struct uart_8250_port *up) + */ + static unsigned int autoconfig_read_divisor_id(struct uart_8250_port *p) + { +- unsigned char old_dll, old_dlm, old_lcr; +- unsigned int id; ++ unsigned char old_lcr; ++ unsigned int id, old_dl; + + old_lcr = serial_in(p, UART_LCR); + serial_out(p, UART_LCR, UART_LCR_CONF_MODE_A); ++ old_dl = serial_dl_read(p); ++ serial_dl_write(p, 0); ++ id = serial_dl_read(p); ++ serial_dl_write(p, old_dl); + +- old_dll = serial_in(p, UART_DLL); +- old_dlm = serial_in(p, UART_DLM); +- +- serial_out(p, UART_DLL, 0); +- serial_out(p, UART_DLM, 0); +- +- id = serial_in(p, UART_DLL) | serial_in(p, UART_DLM) << 8; +- +- serial_out(p, UART_DLL, old_dll); +- serial_out(p, UART_DLM, old_dlm); + serial_out(p, UART_LCR, old_lcr); + + return id; +diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c +index b8366b154fb9..921bf90bcc6a 100644 +--- a/drivers/tty/serial/samsung.c ++++ b/drivers/tty/serial/samsung.c +@@ -724,6 +724,8 @@ static void s3c24xx_serial_set_termios(struct uart_port *port, + /* check to see if we need to change clock source */ + + if (ourport->baudclk != clk) { ++ clk_prepare_enable(clk); ++ + s3c24xx_serial_setsource(port, clk_sel); + + if (!IS_ERR(ourport->baudclk)) { +@@ -731,8 +733,6 @@ static void s3c24xx_serial_set_termios(struct uart_port *port, + ourport->baudclk = ERR_PTR(-EINVAL); + } + +- clk_prepare_enable(clk); +- + ourport->baudclk = clk; + ourport->baudclk_rate = clk ? clk_get_rate(clk) : 0; + } +diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c +index db9d69fa1085..6dff194751f1 100644 +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -3534,9 +3534,10 @@ static int do_register_con_driver(const struct consw *csw, int first, int last) + goto err; + + desc = csw->con_startup(); +- +- if (!desc) ++ if (!desc) { ++ retval = -ENODEV; + goto err; ++ } + + retval = -EINVAL; + +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index d6dab8adf60e..e7436ebbf04c 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -997,6 +997,9 @@ static int acm_probe(struct usb_interface *intf, + if (quirks == NO_UNION_NORMAL) { + data_interface = usb_ifnum_to_if(usb_dev, 1); + control_interface = usb_ifnum_to_if(usb_dev, 0); ++ /* we would crash */ ++ if (!data_interface || !control_interface) ++ return -ENODEV; + goto skip_normal_probe; + } + +diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c +index 2cdd5079ae78..f7310dd107ca 100644 +--- a/drivers/usb/core/driver.c ++++ b/drivers/usb/core/driver.c +@@ -461,11 +461,15 @@ static int usb_unbind_interface(struct device *dev) + int usb_driver_claim_interface(struct usb_driver *driver, + struct usb_interface *iface, void *priv) + { +- struct device *dev = &iface->dev; ++ struct device *dev; + struct usb_device *udev; + int retval = 0; + int lpm_disable_error; + ++ if (!iface) ++ return -ENODEV; ++ ++ dev = &iface->dev; + if (dev->driver) + return -EBUSY; + +diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c +index 4676917e2b1f..1eac8ddc5556 100644 +--- a/drivers/usb/core/hcd-pci.c ++++ b/drivers/usb/core/hcd-pci.c +@@ -74,6 +74,15 @@ static void for_each_companion(struct pci_dev *pdev, struct usb_hcd *hcd, + if (companion->bus != pdev->bus || + PCI_SLOT(companion->devfn) != slot) + continue; ++ ++ /* ++ * Companion device should be either UHCI,OHCI or EHCI host ++ * controller, otherwise skip. ++ */ ++ if (companion->class != CL_UHCI && companion->class != CL_OHCI && ++ companion->class != CL_EHCI) ++ continue; ++ + companion_hcd = pci_get_drvdata(companion); + if (!companion_hcd || !companion_hcd->self.root_hub) + continue; +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index 92873f2773fc..8eb2de6beee4 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -4167,7 +4167,13 @@ hub_port_init (struct usb_hub *hub, struct usb_device *udev, int port1, + r = -EPROTO; + break; + } +- if (r == 0) ++ /* ++ * Some devices time out if they are powered on ++ * when already connected. They need a second ++ * reset. But only on the first attempt, ++ * lest we get into a time out/reset loop ++ */ ++ if (r == 0 || (r == -ETIMEDOUT && j == 0)) + break; + } + udev->descriptor.bMaxPacketSize0 = +diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c +index 87e82e6b0c38..af9e4e8c9064 100644 +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -1861,6 +1861,11 @@ no_bw: + kfree(xhci->port_array); + kfree(xhci->rh_bw); + ++ xhci->usb2_ports = NULL; ++ xhci->usb3_ports = NULL; ++ xhci->port_array = NULL; ++ xhci->rh_bw = NULL; ++ + xhci->page_size = 0; + xhci->page_shift = 0; + xhci->bus_state[0].bus_suspended = 0; +diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c +index d36f34e25bed..4c24ba0a6574 100644 +--- a/drivers/usb/misc/iowarrior.c ++++ b/drivers/usb/misc/iowarrior.c +@@ -792,6 +792,12 @@ static int iowarrior_probe(struct usb_interface *interface, + iface_desc = interface->cur_altsetting; + dev->product_id = le16_to_cpu(udev->descriptor.idProduct); + ++ if (iface_desc->desc.bNumEndpoints < 1) { ++ dev_err(&interface->dev, "Invalid number of endpoints\n"); ++ retval = -EINVAL; ++ goto error; ++ } ++ + /* set up the endpoint information */ + for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) { + endpoint = &iface_desc->endpoint[i].desc; +diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c +index 45b94019aec8..157a9f9afc2d 100644 +--- a/drivers/usb/renesas_usbhs/fifo.c ++++ b/drivers/usb/renesas_usbhs/fifo.c +@@ -166,7 +166,8 @@ static int usbhsf_pkt_handler(struct usbhs_pipe *pipe, int type) + goto __usbhs_pkt_handler_end; + } + +- ret = func(pkt, &is_done); ++ if (likely(func)) ++ ret = func(pkt, &is_done); + + if (is_done) + __usbhsf_pkt_del(pkt); +@@ -933,6 +934,7 @@ static int usbhsf_dma_try_pop(struct usbhs_pkt *pkt, int *is_done) + + pkt->trans = len; + ++ usbhsf_tx_irq_ctrl(pipe, 0); + INIT_WORK(&pkt->work, xfer_work); + schedule_work(&pkt->work); + +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index 84b770461655..0093261ccc57 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -108,6 +108,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x10C4, 0x826B) }, /* Cygnal Integrated Products, Inc., Fasttrax GPS demonstration module */ + { USB_DEVICE(0x10C4, 0x8281) }, /* Nanotec Plug & Drive */ + { USB_DEVICE(0x10C4, 0x8293) }, /* Telegesis ETRX2USB */ ++ { USB_DEVICE(0x10C4, 0x82F4) }, /* Starizona MicroTouch */ + { USB_DEVICE(0x10C4, 0x82F9) }, /* Procyon AVS */ + { USB_DEVICE(0x10C4, 0x8341) }, /* Siemens MC35PU GPRS Modem */ + { USB_DEVICE(0x10C4, 0x8382) }, /* Cygnal Integrated Products, Inc. */ +@@ -117,6 +118,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x10C4, 0x8418) }, /* IRZ Automation Teleport SG-10 GSM/GPRS Modem */ + { USB_DEVICE(0x10C4, 0x846E) }, /* BEI USB Sensor Interface (VCP) */ + { USB_DEVICE(0x10C4, 0x8477) }, /* Balluff RFID */ ++ { USB_DEVICE(0x10C4, 0x84B6) }, /* Starizona Hyperion */ + { USB_DEVICE(0x10C4, 0x85EA) }, /* AC-Services IBUS-IF */ + { USB_DEVICE(0x10C4, 0x85EB) }, /* AC-Services CIS-IBUS */ + { USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */ +@@ -140,6 +142,8 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x10C4, 0xF004) }, /* Elan Digital Systems USBcount50 */ + { USB_DEVICE(0x10C5, 0xEA61) }, /* Silicon Labs MobiData GPRS USB Modem */ + { USB_DEVICE(0x10CE, 0xEA6A) }, /* Silicon Labs MobiData GPRS USB Modem 100EU */ ++ { USB_DEVICE(0x12B8, 0xEC60) }, /* Link G4 ECU */ ++ { USB_DEVICE(0x12B8, 0xEC62) }, /* Link G4+ ECU */ + { USB_DEVICE(0x13AD, 0x9999) }, /* Baltech card reader */ + { USB_DEVICE(0x1555, 0x0004) }, /* Owen AC4 USB-RS485 Converter */ + { USB_DEVICE(0x166A, 0x0201) }, /* Clipsal 5500PACA C-Bus Pascal Automation Controller */ +@@ -164,6 +168,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x18EF, 0xE025) }, /* ELV Marble Sound Board 1 */ + { USB_DEVICE(0x1901, 0x0190) }, /* GE B850 CP2105 Recorder interface */ + { USB_DEVICE(0x1901, 0x0193) }, /* GE B650 CP2104 PMC interface */ ++ { USB_DEVICE(0x1901, 0x0194) }, /* GE Healthcare Remote Alarm Box */ + { USB_DEVICE(0x19CF, 0x3000) }, /* Parrot NMEA GPS Flight Recorder */ + { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */ + { USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */ +diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c +index 082120198f87..09f0f631389e 100644 +--- a/drivers/usb/serial/cypress_m8.c ++++ b/drivers/usb/serial/cypress_m8.c +@@ -449,6 +449,11 @@ static int cypress_generic_port_probe(struct usb_serial_port *port) + struct usb_serial *serial = port->serial; + struct cypress_private *priv; + ++ if (!port->interrupt_out_urb || !port->interrupt_in_urb) { ++ dev_err(&port->dev, "required endpoint is missing\n"); ++ return -ENODEV; ++ } ++ + priv = kzalloc(sizeof(struct cypress_private), GFP_KERNEL); + if (!priv) + return -ENOMEM; +@@ -606,12 +611,6 @@ static int cypress_open(struct tty_struct *tty, struct usb_serial_port *port) + cypress_set_termios(tty, port, &priv->tmp_termios); + + /* setup the port and start reading from the device */ +- if (!port->interrupt_in_urb) { +- dev_err(&port->dev, "%s - interrupt_in_urb is empty!\n", +- __func__); +- return -1; +- } +- + usb_fill_int_urb(port->interrupt_in_urb, serial->dev, + usb_rcvintpipe(serial->dev, port->interrupt_in_endpointAddress), + port->interrupt_in_urb->transfer_buffer, +diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c +index 7b807d389527..8c34d9cfb226 100644 +--- a/drivers/usb/serial/digi_acceleport.c ++++ b/drivers/usb/serial/digi_acceleport.c +@@ -1253,8 +1253,27 @@ static int digi_port_init(struct usb_serial_port *port, unsigned port_num) + + static int digi_startup(struct usb_serial *serial) + { ++ struct device *dev = &serial->interface->dev; + struct digi_serial *serial_priv; + int ret; ++ int i; ++ ++ /* check whether the device has the expected number of endpoints */ ++ if (serial->num_port_pointers < serial->type->num_ports + 1) { ++ dev_err(dev, "OOB endpoints missing\n"); ++ return -ENODEV; ++ } ++ ++ for (i = 0; i < serial->type->num_ports + 1 ; i++) { ++ if (!serial->port[i]->read_urb) { ++ dev_err(dev, "bulk-in endpoint missing\n"); ++ return -ENODEV; ++ } ++ if (!serial->port[i]->write_urb) { ++ dev_err(dev, "bulk-out endpoint missing\n"); ++ return -ENODEV; ++ } ++ } + + serial_priv = kzalloc(sizeof(*serial_priv), GFP_KERNEL); + if (!serial_priv) +diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c +index 1477e8593476..c574d312f1f5 100644 +--- a/drivers/usb/serial/io_edgeport.c ++++ b/drivers/usb/serial/io_edgeport.c +@@ -2988,16 +2988,9 @@ static void edge_disconnect(struct usb_serial *serial) + { + struct edgeport_serial *edge_serial = usb_get_serial_data(serial); + +- /* stop reads and writes on all ports */ +- /* free up our endpoint stuff */ + if (edge_serial->is_epic) { + usb_kill_urb(edge_serial->interrupt_read_urb); +- usb_free_urb(edge_serial->interrupt_read_urb); +- kfree(edge_serial->interrupt_in_buffer); +- + usb_kill_urb(edge_serial->read_urb); +- usb_free_urb(edge_serial->read_urb); +- kfree(edge_serial->bulk_in_buffer); + } + } + +@@ -3010,6 +3003,16 @@ static void edge_release(struct usb_serial *serial) + { + struct edgeport_serial *edge_serial = usb_get_serial_data(serial); + ++ if (edge_serial->is_epic) { ++ usb_kill_urb(edge_serial->interrupt_read_urb); ++ usb_free_urb(edge_serial->interrupt_read_urb); ++ kfree(edge_serial->interrupt_in_buffer); ++ ++ usb_kill_urb(edge_serial->read_urb); ++ usb_free_urb(edge_serial->read_urb); ++ kfree(edge_serial->bulk_in_buffer); ++ } ++ + kfree(edge_serial); + } + +diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c +index cec377b8bb8b..32a67c69eec8 100644 +--- a/drivers/usb/serial/keyspan.c ++++ b/drivers/usb/serial/keyspan.c +@@ -2392,6 +2392,10 @@ static void keyspan_release(struct usb_serial *serial) + + s_priv = usb_get_serial_data(serial); + ++ /* Make sure to unlink the URBs submitted in attach. */ ++ usb_kill_urb(s_priv->instat_urb); ++ usb_kill_urb(s_priv->indat_urb); ++ + usb_free_urb(s_priv->instat_urb); + usb_free_urb(s_priv->indat_urb); + usb_free_urb(s_priv->glocont_urb); +diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c +index 6a15adf53360..c14c29ff1151 100644 +--- a/drivers/usb/serial/mct_u232.c ++++ b/drivers/usb/serial/mct_u232.c +@@ -377,14 +377,21 @@ static void mct_u232_msr_to_state(struct usb_serial_port *port, + + static int mct_u232_port_probe(struct usb_serial_port *port) + { ++ struct usb_serial *serial = port->serial; + struct mct_u232_private *priv; + ++ /* check first to simplify error handling */ ++ if (!serial->port[1] || !serial->port[1]->interrupt_in_urb) { ++ dev_err(&port->dev, "expected endpoint missing\n"); ++ return -ENODEV; ++ } ++ + priv = kzalloc(sizeof(*priv), GFP_KERNEL); + if (!priv) + return -ENOMEM; + + /* Use second interrupt-in endpoint for reading. */ +- priv->read_urb = port->serial->port[1]->interrupt_in_urb; ++ priv->read_urb = serial->port[1]->interrupt_in_urb; + priv->read_urb->context = port; + + spin_lock_init(&priv->lock); +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 24366a2afea6..bcb6f5c2bae4 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -375,18 +375,22 @@ static void option_instat_callback(struct urb *urb); + #define HAIER_PRODUCT_CE81B 0x10f8 + #define HAIER_PRODUCT_CE100 0x2009 + +-/* Cinterion (formerly Siemens) products */ +-#define SIEMENS_VENDOR_ID 0x0681 +-#define CINTERION_VENDOR_ID 0x1e2d ++/* Gemalto's Cinterion products (formerly Siemens) */ ++#define SIEMENS_VENDOR_ID 0x0681 ++#define CINTERION_VENDOR_ID 0x1e2d ++#define CINTERION_PRODUCT_HC25_MDMNET 0x0040 + #define CINTERION_PRODUCT_HC25_MDM 0x0047 +-#define CINTERION_PRODUCT_HC25_MDMNET 0x0040 ++#define CINTERION_PRODUCT_HC28_MDMNET 0x004A /* same for HC28J */ + #define CINTERION_PRODUCT_HC28_MDM 0x004C +-#define CINTERION_PRODUCT_HC28_MDMNET 0x004A /* same for HC28J */ + #define CINTERION_PRODUCT_EU3_E 0x0051 + #define CINTERION_PRODUCT_EU3_P 0x0052 + #define CINTERION_PRODUCT_PH8 0x0053 + #define CINTERION_PRODUCT_AHXX 0x0055 + #define CINTERION_PRODUCT_PLXX 0x0060 ++#define CINTERION_PRODUCT_PH8_2RMNET 0x0082 ++#define CINTERION_PRODUCT_PH8_AUDIO 0x0083 ++#define CINTERION_PRODUCT_AHXX_2RMNET 0x0084 ++#define CINTERION_PRODUCT_AHXX_AUDIO 0x0085 + + /* Olivetti products */ + #define OLIVETTI_VENDOR_ID 0x0b3c +@@ -641,6 +645,10 @@ static const struct option_blacklist_info telit_le922_blacklist_usbcfg3 = { + .reserved = BIT(1) | BIT(2) | BIT(3), + }; + ++static const struct option_blacklist_info cinterion_rmnet2_blacklist = { ++ .reserved = BIT(4) | BIT(5), ++}; ++ + static const struct usb_device_id option_ids[] = { + { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) }, + { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) }, +@@ -1712,7 +1720,13 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX, 0xff) }, + { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PLXX), + .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, +- { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, ++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8_2RMNET, 0xff), ++ .driver_info = (kernel_ulong_t)&cinterion_rmnet2_blacklist }, ++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8_AUDIO, 0xff), ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, ++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX_2RMNET, 0xff) }, ++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX_AUDIO, 0xff) }, ++ { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, + { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) }, + { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDM) }, + { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDMNET) }, +@@ -1818,6 +1832,8 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d02, 0xff, 0x00, 0x00) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x02, 0x01) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e19, 0xff), /* D-Link DWM-221 B1 */ ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ + { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */ +diff --git a/drivers/usb/serial/quatech2.c b/drivers/usb/serial/quatech2.c +index 02b0803425c5..13824b5ca343 100644 +--- a/drivers/usb/serial/quatech2.c ++++ b/drivers/usb/serial/quatech2.c +@@ -141,6 +141,7 @@ static void qt2_release(struct usb_serial *serial) + + serial_priv = usb_get_serial_data(serial); + ++ usb_kill_urb(serial_priv->read_urb); + usb_free_urb(serial_priv->read_urb); + kfree(serial_priv); + } +diff --git a/drivers/video/da8xx-fb.c b/drivers/video/da8xx-fb.c +index 0810939936f4..b13bfb2e52a2 100644 +--- a/drivers/video/da8xx-fb.c ++++ b/drivers/video/da8xx-fb.c +@@ -226,8 +226,7 @@ static struct fb_videomode known_lcd_panels[] = { + .lower_margin = 2, + .hsync_len = 0, + .vsync_len = 0, +- .sync = FB_SYNC_CLK_INVERT | +- FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT, ++ .sync = FB_SYNC_CLK_INVERT, + }, + /* Sharp LK043T1DG01 */ + [1] = { +@@ -241,7 +240,7 @@ static struct fb_videomode known_lcd_panels[] = { + .lower_margin = 2, + .hsync_len = 41, + .vsync_len = 10, +- .sync = FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT, ++ .sync = 0, + .flag = 0, + }, + [2] = { +@@ -256,7 +255,7 @@ static struct fb_videomode known_lcd_panels[] = { + .lower_margin = 10, + .hsync_len = 10, + .vsync_len = 10, +- .sync = FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT, ++ .sync = 0, + .flag = 0, + }, + }; +diff --git a/drivers/watchdog/rc32434_wdt.c b/drivers/watchdog/rc32434_wdt.c +index f78bc008cbb7..ea8f58216d4d 100644 +--- a/drivers/watchdog/rc32434_wdt.c ++++ b/drivers/watchdog/rc32434_wdt.c +@@ -237,7 +237,7 @@ static long rc32434_wdt_ioctl(struct file *file, unsigned int cmd, + return -EINVAL; + /* Fall through */ + case WDIOC_GETTIMEOUT: +- return copy_to_user(argp, &timeout, sizeof(int)); ++ return copy_to_user(argp, &timeout, sizeof(int)) ? -EFAULT : 0; + default: + return -ENOTTY; + } +diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c +index 8edc9eb1ef7b..d65e16e9d1d9 100644 +--- a/fs/cifs/sess.c ++++ b/fs/cifs/sess.c +@@ -487,19 +487,27 @@ int build_ntlmssp_auth_blob(unsigned char *pbuffer, + sec_blob->LmChallengeResponse.MaximumLength = 0; + + sec_blob->NtChallengeResponse.BufferOffset = cpu_to_le32(tmp - pbuffer); +- rc = setup_ntlmv2_rsp(ses, nls_cp); +- if (rc) { +- cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc); +- goto setup_ntlmv2_ret; +- } +- memcpy(tmp, ses->auth_key.response + CIFS_SESS_KEY_SIZE, +- ses->auth_key.len - CIFS_SESS_KEY_SIZE); +- tmp += ses->auth_key.len - CIFS_SESS_KEY_SIZE; ++ if (ses->user_name != NULL) { ++ rc = setup_ntlmv2_rsp(ses, nls_cp); ++ if (rc) { ++ cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc); ++ goto setup_ntlmv2_ret; ++ } ++ memcpy(tmp, ses->auth_key.response + CIFS_SESS_KEY_SIZE, ++ ses->auth_key.len - CIFS_SESS_KEY_SIZE); ++ tmp += ses->auth_key.len - CIFS_SESS_KEY_SIZE; + +- sec_blob->NtChallengeResponse.Length = +- cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE); +- sec_blob->NtChallengeResponse.MaximumLength = +- cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE); ++ sec_blob->NtChallengeResponse.Length = ++ cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE); ++ sec_blob->NtChallengeResponse.MaximumLength = ++ cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE); ++ } else { ++ /* ++ * don't send an NT Response for anonymous access ++ */ ++ sec_blob->NtChallengeResponse.Length = 0; ++ sec_blob->NtChallengeResponse.MaximumLength = 0; ++ } + + if (ses->domainName == NULL) { + sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - pbuffer); +diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h +index 6f74b8919237..046e3e93783e 100644 +--- a/fs/ext4/ext4.h ++++ b/fs/ext4/ext4.h +@@ -851,6 +851,29 @@ do { \ + #include "extents_status.h" + + /* ++ * Lock subclasses for i_data_sem in the ext4_inode_info structure. ++ * ++ * These are needed to avoid lockdep false positives when we need to ++ * allocate blocks to the quota inode during ext4_map_blocks(), while ++ * holding i_data_sem for a normal (non-quota) inode. Since we don't ++ * do quota tracking for the quota inode, this avoids deadlock (as ++ * well as infinite recursion, since it isn't turtles all the way ++ * down...) ++ * ++ * I_DATA_SEM_NORMAL - Used for most inodes ++ * I_DATA_SEM_OTHER - Used by move_inode.c for the second normal inode ++ * where the second inode has larger inode number ++ * than the first ++ * I_DATA_SEM_QUOTA - Used for quota inodes only ++ */ ++enum { ++ I_DATA_SEM_NORMAL = 0, ++ I_DATA_SEM_OTHER, ++ I_DATA_SEM_QUOTA, ++}; ++ ++ ++/* + * fourth extended file system inode data in memory + */ + struct ext4_inode_info { +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index 10b71e4029a0..fb7e576df25c 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -5063,6 +5063,8 @@ int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode) + might_sleep(); + trace_ext4_mark_inode_dirty(inode, _RET_IP_); + err = ext4_reserve_inode_write(handle, inode, &iloc); ++ if (err) ++ return err; + if (ext4_handle_valid(handle) && + EXT4_I(inode)->i_extra_isize < sbi->s_want_extra_isize && + !ext4_test_inode_state(inode, EXT4_STATE_NO_EXPAND)) { +@@ -5093,9 +5095,7 @@ int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode) + } + } + } +- if (!err) +- err = ext4_mark_iloc_dirty(handle, inode, &iloc); +- return err; ++ return ext4_mark_iloc_dirty(handle, inode, &iloc); + } + + /* +diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c +index 3dcbf364022f..ad52ace2b79a 100644 +--- a/fs/ext4/move_extent.c ++++ b/fs/ext4/move_extent.c +@@ -154,10 +154,10 @@ ext4_double_down_write_data_sem(struct inode *first, struct inode *second) + { + if (first < second) { + down_write(&EXT4_I(first)->i_data_sem); +- down_write_nested(&EXT4_I(second)->i_data_sem, SINGLE_DEPTH_NESTING); ++ down_write_nested(&EXT4_I(second)->i_data_sem, I_DATA_SEM_OTHER); + } else { + down_write(&EXT4_I(second)->i_data_sem); +- down_write_nested(&EXT4_I(first)->i_data_sem, SINGLE_DEPTH_NESTING); ++ down_write_nested(&EXT4_I(first)->i_data_sem, I_DATA_SEM_OTHER); + + } + } +@@ -1117,6 +1117,13 @@ mext_check_arguments(struct inode *orig_inode, + return -EINVAL; + } + ++ if (IS_NOQUOTA(orig_inode) || IS_NOQUOTA(donor_inode)) { ++ ext4_debug("ext4 move extent: The argument files should " ++ "not be quota files [ino:orig %lu, donor %lu]\n", ++ orig_inode->i_ino, donor_inode->i_ino); ++ return -EBUSY; ++ } ++ + /* Ext4 move extent supports only extent based file */ + if (!(ext4_test_inode_flag(orig_inode, EXT4_INODE_EXTENTS))) { + ext4_debug("ext4 move extent: orig file is not extents " +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index a7e079749425..063eb5094a63 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -4984,6 +4984,20 @@ static int ext4_quota_on_mount(struct super_block *sb, int type) + EXT4_SB(sb)->s_jquota_fmt, type); + } + ++static void lockdep_set_quota_inode(struct inode *inode, int subclass) ++{ ++ struct ext4_inode_info *ei = EXT4_I(inode); ++ ++ /* The first argument of lockdep_set_subclass has to be ++ * *exactly* the same as the argument to init_rwsem() --- in ++ * this case, in init_once() --- or lockdep gets unhappy ++ * because the name of the lock is set using the ++ * stringification of the argument to init_rwsem(). ++ */ ++ (void) ei; /* shut up clang warning if !CONFIG_LOCKDEP */ ++ lockdep_set_subclass(&ei->i_data_sem, subclass); ++} ++ + /* + * Standard function to be called on quota_on + */ +@@ -5023,8 +5037,12 @@ static int ext4_quota_on(struct super_block *sb, int type, int format_id, + if (err) + return err; + } +- +- return dquot_quota_on(sb, type, format_id, path); ++ lockdep_set_quota_inode(path->dentry->d_inode, I_DATA_SEM_QUOTA); ++ err = dquot_quota_on(sb, type, format_id, path); ++ if (err) ++ lockdep_set_quota_inode(path->dentry->d_inode, ++ I_DATA_SEM_NORMAL); ++ return err; + } + + static int ext4_quota_enable(struct super_block *sb, int type, int format_id, +@@ -5050,8 +5068,11 @@ static int ext4_quota_enable(struct super_block *sb, int type, int format_id, + + /* Don't account quota for quota files to avoid recursion */ + qf_inode->i_flags |= S_NOQUOTA; ++ lockdep_set_quota_inode(qf_inode, I_DATA_SEM_QUOTA); + err = dquot_enable(qf_inode, type, format_id, flags); + iput(qf_inode); ++ if (err) ++ lockdep_set_quota_inode(qf_inode, I_DATA_SEM_NORMAL); + + return err; + } +diff --git a/fs/isofs/rock.c b/fs/isofs/rock.c +index 735d7522a3a9..204659a5f6db 100644 +--- a/fs/isofs/rock.c ++++ b/fs/isofs/rock.c +@@ -203,6 +203,8 @@ int get_rock_ridge_filename(struct iso_directory_record *de, + int retnamlen = 0; + int truncate = 0; + int ret = 0; ++ char *p; ++ int len; + + if (!ISOFS_SB(inode->i_sb)->s_rock) + return 0; +@@ -267,12 +269,17 @@ repeat: + rr->u.NM.flags); + break; + } +- if ((strlen(retname) + rr->len - 5) >= 254) { ++ len = rr->len - 5; ++ if (retnamlen + len >= 254) { + truncate = 1; + break; + } +- strncat(retname, rr->u.NM.name, rr->len - 5); +- retnamlen += rr->len - 5; ++ p = memchr(rr->u.NM.name, '\0', len); ++ if (unlikely(p)) ++ len = p - rr->u.NM.name; ++ memcpy(retname + retnamlen, rr->u.NM.name, len); ++ retnamlen += len; ++ retname[retnamlen] = '\0'; + break; + case SIG('R', 'E'): + kfree(rs.buffer); +diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c +index 644f95e7208f..85733dd95e14 100644 +--- a/fs/jbd2/journal.c ++++ b/fs/jbd2/journal.c +@@ -1407,11 +1407,12 @@ out: + /** + * jbd2_mark_journal_empty() - Mark on disk journal as empty. + * @journal: The journal to update. ++ * @write_op: With which operation should we write the journal sb + * + * Update a journal's dynamic superblock fields to show that journal is empty. + * Write updated superblock to disk waiting for IO to complete. + */ +-static void jbd2_mark_journal_empty(journal_t *journal) ++static void jbd2_mark_journal_empty(journal_t *journal, int write_op) + { + journal_superblock_t *sb = journal->j_superblock; + +@@ -1429,7 +1430,7 @@ static void jbd2_mark_journal_empty(journal_t *journal) + sb->s_start = cpu_to_be32(0); + read_unlock(&journal->j_state_lock); + +- jbd2_write_superblock(journal, WRITE_FUA); ++ jbd2_write_superblock(journal, write_op); + + /* Log is no longer empty */ + write_lock(&journal->j_state_lock); +@@ -1697,7 +1698,13 @@ int jbd2_journal_destroy(journal_t *journal) + if (journal->j_sb_buffer) { + if (!is_journal_aborted(journal)) { + mutex_lock(&journal->j_checkpoint_mutex); +- jbd2_mark_journal_empty(journal); ++ ++ write_lock(&journal->j_state_lock); ++ journal->j_tail_sequence = ++ ++journal->j_transaction_sequence; ++ write_unlock(&journal->j_state_lock); ++ ++ jbd2_mark_journal_empty(journal, WRITE_FLUSH_FUA); + mutex_unlock(&journal->j_checkpoint_mutex); + } else + err = -EIO; +@@ -1952,7 +1959,7 @@ int jbd2_journal_flush(journal_t *journal) + * the magic code for a fully-recovered superblock. Any future + * commits of data to the journal will restore the current + * s_start value. */ +- jbd2_mark_journal_empty(journal); ++ jbd2_mark_journal_empty(journal, WRITE_FUA); + mutex_unlock(&journal->j_checkpoint_mutex); + write_lock(&journal->j_state_lock); + J_ASSERT(!journal->j_running_transaction); +@@ -1998,7 +2005,7 @@ int jbd2_journal_wipe(journal_t *journal, int write) + if (write) { + /* Lock to make assertions happy... */ + mutex_lock(&journal->j_checkpoint_mutex); +- jbd2_mark_journal_empty(journal); ++ jbd2_mark_journal_empty(journal, WRITE_FUA); + mutex_unlock(&journal->j_checkpoint_mutex); + } + +diff --git a/fs/ocfs2/dlm/dlmconvert.c b/fs/ocfs2/dlm/dlmconvert.c +index 29a886d1e82c..f65bdcf61526 100644 +--- a/fs/ocfs2/dlm/dlmconvert.c ++++ b/fs/ocfs2/dlm/dlmconvert.c +@@ -265,6 +265,7 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm, + struct dlm_lock *lock, int flags, int type) + { + enum dlm_status status; ++ u8 old_owner = res->owner; + + mlog(0, "type=%d, convert_type=%d, busy=%d\n", lock->ml.type, + lock->ml.convert_type, res->state & DLM_LOCK_RES_IN_PROGRESS); +@@ -290,6 +291,19 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm, + status = DLM_DENIED; + goto bail; + } ++ ++ if (lock->ml.type == type && lock->ml.convert_type == LKM_IVMODE) { ++ mlog(0, "last convert request returned DLM_RECOVERING, but " ++ "owner has already queued and sent ast to me. res %.*s, " ++ "(cookie=%u:%llu, type=%d, conv=%d)\n", ++ res->lockname.len, res->lockname.name, ++ dlm_get_lock_cookie_node(be64_to_cpu(lock->ml.cookie)), ++ dlm_get_lock_cookie_seq(be64_to_cpu(lock->ml.cookie)), ++ lock->ml.type, lock->ml.convert_type); ++ status = DLM_NORMAL; ++ goto bail; ++ } ++ + res->state |= DLM_LOCK_RES_IN_PROGRESS; + /* move lock to local convert queue */ + /* do not alter lock refcount. switching lists. */ +@@ -319,11 +333,19 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm, + spin_lock(&res->spinlock); + res->state &= ~DLM_LOCK_RES_IN_PROGRESS; + lock->convert_pending = 0; +- /* if it failed, move it back to granted queue */ ++ /* if it failed, move it back to granted queue. ++ * if master returns DLM_NORMAL and then down before sending ast, ++ * it may have already been moved to granted queue, reset to ++ * DLM_RECOVERING and retry convert */ + if (status != DLM_NORMAL) { + if (status != DLM_NOTQUEUED) + dlm_error(status); + dlm_revert_pending_convert(res, lock); ++ } else if ((res->state & DLM_LOCK_RES_RECOVERING) || ++ (old_owner != res->owner)) { ++ mlog(0, "res %.*s is in recovering or has been recovered.\n", ++ res->lockname.len, res->lockname.name); ++ status = DLM_RECOVERING; + } + bail: + spin_unlock(&res->spinlock); +diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c +index 01c69f24e416..33e9d705ee8f 100644 +--- a/fs/ocfs2/dlm/dlmrecovery.c ++++ b/fs/ocfs2/dlm/dlmrecovery.c +@@ -2034,7 +2034,6 @@ void dlm_move_lockres_to_recovery_list(struct dlm_ctxt *dlm, + dlm_lock_get(lock); + if (lock->convert_pending) { + /* move converting lock back to granted */ +- BUG_ON(i != DLM_CONVERTING_LIST); + mlog(0, "node died with convert pending " + "on %.*s. move back to granted list.\n", + res->lockname.len, res->lockname.name); +diff --git a/fs/pipe.c b/fs/pipe.c +index 3e7ab278bb0c..50267e6ba688 100644 +--- a/fs/pipe.c ++++ b/fs/pipe.c +@@ -401,6 +401,7 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov, + void *addr; + size_t chars = buf->len, remaining; + int error, atomic; ++ int offset; + + if (chars > total_len) + chars = total_len; +@@ -414,9 +415,10 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov, + + atomic = !iov_fault_in_pages_write(iov, chars); + remaining = chars; ++ offset = buf->offset; + redo: + addr = ops->map(pipe, buf, atomic); +- error = pipe_iov_copy_to_user(iov, addr, &buf->offset, ++ error = pipe_iov_copy_to_user(iov, addr, &offset, + &remaining, atomic); + ops->unmap(pipe, buf, addr); + if (unlikely(error)) { +@@ -432,6 +434,7 @@ redo: + break; + } + ret += chars; ++ buf->offset += chars; + buf->len -= chars; + + /* Was it a packet buffer? Clean up and exit */ +diff --git a/fs/proc/base.c b/fs/proc/base.c +index 7b5d453ebf53..e5160b744d0b 100644 +--- a/fs/proc/base.c ++++ b/fs/proc/base.c +@@ -844,7 +844,8 @@ static ssize_t environ_read(struct file *file, char __user *buf, + int ret = 0; + struct mm_struct *mm = file->private_data; + +- if (!mm) ++ /* Ensure the process spawned far enough to have an environment. */ ++ if (!mm || !mm->env_end) + return 0; + + page = (char *)__get_free_page(GFP_TEMPORARY); +diff --git a/fs/splice.c b/fs/splice.c +index 3b94a6bba29f..2ffa7b0c62fd 100644 +--- a/fs/splice.c ++++ b/fs/splice.c +@@ -189,6 +189,9 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe, + unsigned int spd_pages = spd->nr_pages; + int ret, do_wakeup, page_nr; + ++ if (!spd_pages) ++ return 0; ++ + ret = 0; + do_wakeup = 0; + page_nr = 0; +diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h +index 02ae99e8e6d3..953cd12175c4 100644 +--- a/include/linux/compiler-gcc.h ++++ b/include/linux/compiler-gcc.h +@@ -100,10 +100,116 @@ + #define __maybe_unused __attribute__((unused)) + #define __always_unused __attribute__((unused)) + +-#define __gcc_header(x) #x +-#define _gcc_header(x) __gcc_header(linux/compiler-gcc##x.h) +-#define gcc_header(x) _gcc_header(x) +-#include gcc_header(__GNUC__) ++/* gcc version specific checks */ ++ ++#if GCC_VERSION < 30200 ++# error Sorry, your compiler is too old - please upgrade it. ++#endif ++ ++#if GCC_VERSION < 30300 ++# define __used __attribute__((__unused__)) ++#else ++# define __used __attribute__((__used__)) ++#endif ++ ++#ifdef CONFIG_GCOV_KERNEL ++# if GCC_VERSION < 30400 ++# error "GCOV profiling support for gcc versions below 3.4 not included" ++# endif /* __GNUC_MINOR__ */ ++#endif /* CONFIG_GCOV_KERNEL */ ++ ++#if GCC_VERSION >= 30400 ++#define __must_check __attribute__((warn_unused_result)) ++#endif ++ ++#if GCC_VERSION >= 40000 ++ ++/* GCC 4.1.[01] miscompiles __weak */ ++#ifdef __KERNEL__ ++# if GCC_VERSION >= 40100 && GCC_VERSION <= 40101 ++# error Your version of gcc miscompiles the __weak directive ++# endif ++#endif ++ ++#define __used __attribute__((__used__)) ++#define __compiler_offsetof(a, b) \ ++ __builtin_offsetof(a, b) ++ ++#if GCC_VERSION >= 40100 && GCC_VERSION < 40600 ++# define __compiletime_object_size(obj) __builtin_object_size(obj, 0) ++#endif ++ ++#if GCC_VERSION >= 40300 ++/* Mark functions as cold. gcc will assume any path leading to a call ++ * to them will be unlikely. This means a lot of manual unlikely()s ++ * are unnecessary now for any paths leading to the usual suspects ++ * like BUG(), printk(), panic() etc. [but let's keep them for now for ++ * older compilers] ++ * ++ * Early snapshots of gcc 4.3 don't support this and we can't detect this ++ * in the preprocessor, but we can live with this because they're unreleased. ++ * Maketime probing would be overkill here. ++ * ++ * gcc also has a __attribute__((__hot__)) to move hot functions into ++ * a special section, but I don't see any sense in this right now in ++ * the kernel context ++ */ ++#define __cold __attribute__((__cold__)) ++ ++#define __UNIQUE_ID(prefix) __PASTE(__PASTE(__UNIQUE_ID_, prefix), __COUNTER__) ++ ++#ifndef __CHECKER__ ++# define __compiletime_warning(message) __attribute__((warning(message))) ++# define __compiletime_error(message) __attribute__((error(message))) ++#endif /* __CHECKER__ */ ++#endif /* GCC_VERSION >= 40300 */ ++ ++#if GCC_VERSION >= 40500 ++/* ++ * Mark a position in code as unreachable. This can be used to ++ * suppress control flow warnings after asm blocks that transfer ++ * control elsewhere. ++ * ++ * Early snapshots of gcc 4.5 don't support this and we can't detect ++ * this in the preprocessor, but we can live with this because they're ++ * unreleased. Really, we need to have autoconf for the kernel. ++ */ ++#define unreachable() __builtin_unreachable() ++ ++/* Mark a function definition as prohibited from being cloned. */ ++#define __noclone __attribute__((__noclone__, __optimize__("no-tracer"))) ++ ++#endif /* GCC_VERSION >= 40500 */ ++ ++#if GCC_VERSION >= 40600 ++/* ++ * Tell the optimizer that something else uses this function or variable. ++ */ ++#define __visible __attribute__((externally_visible)) ++#endif ++ ++/* ++ * GCC 'asm goto' miscompiles certain code sequences: ++ * ++ * http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58670 ++ * ++ * Work it around via a compiler barrier quirk suggested by Jakub Jelinek. ++ * ++ * (asm goto is automatically volatile - the naming reflects this.) ++ */ ++#define asm_volatile_goto(x...) do { asm goto(x); asm (""); } while (0) ++ ++#ifdef CONFIG_ARCH_USE_BUILTIN_BSWAP ++#if GCC_VERSION >= 40400 ++#define __HAVE_BUILTIN_BSWAP32__ ++#define __HAVE_BUILTIN_BSWAP64__ ++#endif ++#if GCC_VERSION >= 40800 || (defined(__powerpc__) && GCC_VERSION >= 40600) ++#define __HAVE_BUILTIN_BSWAP16__ ++#endif ++#endif /* CONFIG_ARCH_USE_BUILTIN_BSWAP */ ++ ++#endif /* gcc version >= 40000 specific checks */ + + #if !defined(__noclone) + #define __noclone /* not needed */ +diff --git a/include/linux/compiler-gcc3.h b/include/linux/compiler-gcc3.h +deleted file mode 100644 +index 7d89febe4d79..000000000000 +--- a/include/linux/compiler-gcc3.h ++++ /dev/null +@@ -1,23 +0,0 @@ +-#ifndef __LINUX_COMPILER_H +-#error "Please don't include directly, include instead." +-#endif +- +-#if GCC_VERSION < 30200 +-# error Sorry, your compiler is too old - please upgrade it. +-#endif +- +-#if GCC_VERSION >= 30300 +-# define __used __attribute__((__used__)) +-#else +-# define __used __attribute__((__unused__)) +-#endif +- +-#if GCC_VERSION >= 30400 +-#define __must_check __attribute__((warn_unused_result)) +-#endif +- +-#ifdef CONFIG_GCOV_KERNEL +-# if GCC_VERSION < 30400 +-# error "GCOV profiling support for gcc versions below 3.4 not included" +-# endif /* __GNUC_MINOR__ */ +-#endif /* CONFIG_GCOV_KERNEL */ +diff --git a/include/linux/compiler-gcc4.h b/include/linux/compiler-gcc4.h +deleted file mode 100644 +index 2507fd2a1eb4..000000000000 +--- a/include/linux/compiler-gcc4.h ++++ /dev/null +@@ -1,88 +0,0 @@ +-#ifndef __LINUX_COMPILER_H +-#error "Please don't include directly, include instead." +-#endif +- +-/* GCC 4.1.[01] miscompiles __weak */ +-#ifdef __KERNEL__ +-# if GCC_VERSION >= 40100 && GCC_VERSION <= 40101 +-# error Your version of gcc miscompiles the __weak directive +-# endif +-#endif +- +-#define __used __attribute__((__used__)) +-#define __must_check __attribute__((warn_unused_result)) +-#define __compiler_offsetof(a,b) __builtin_offsetof(a,b) +- +-#if GCC_VERSION >= 40100 && GCC_VERSION < 40600 +-# define __compiletime_object_size(obj) __builtin_object_size(obj, 0) +-#endif +- +-#if GCC_VERSION >= 40300 +-/* Mark functions as cold. gcc will assume any path leading to a call +- to them will be unlikely. This means a lot of manual unlikely()s +- are unnecessary now for any paths leading to the usual suspects +- like BUG(), printk(), panic() etc. [but let's keep them for now for +- older compilers] +- +- Early snapshots of gcc 4.3 don't support this and we can't detect this +- in the preprocessor, but we can live with this because they're unreleased. +- Maketime probing would be overkill here. +- +- gcc also has a __attribute__((__hot__)) to move hot functions into +- a special section, but I don't see any sense in this right now in +- the kernel context */ +-#define __cold __attribute__((__cold__)) +- +-#define __UNIQUE_ID(prefix) __PASTE(__PASTE(__UNIQUE_ID_, prefix), __COUNTER__) +- +-#ifndef __CHECKER__ +-# define __compiletime_warning(message) __attribute__((warning(message))) +-# define __compiletime_error(message) __attribute__((error(message))) +-#endif /* __CHECKER__ */ +-#endif /* GCC_VERSION >= 40300 */ +- +-#if GCC_VERSION >= 40500 +-/* +- * Mark a position in code as unreachable. This can be used to +- * suppress control flow warnings after asm blocks that transfer +- * control elsewhere. +- * +- * Early snapshots of gcc 4.5 don't support this and we can't detect +- * this in the preprocessor, but we can live with this because they're +- * unreleased. Really, we need to have autoconf for the kernel. +- */ +-#define unreachable() __builtin_unreachable() +- +-/* Mark a function definition as prohibited from being cloned. */ +-#define __noclone __attribute__((__noclone__)) +- +-#endif /* GCC_VERSION >= 40500 */ +- +-#if GCC_VERSION >= 40600 +-/* +- * Tell the optimizer that something else uses this function or variable. +- */ +-#define __visible __attribute__((externally_visible)) +-#endif +- +-/* +- * GCC 'asm goto' miscompiles certain code sequences: +- * +- * http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58670 +- * +- * Work it around via a compiler barrier quirk suggested by Jakub Jelinek. +- * Fixed in GCC 4.8.2 and later versions. +- * +- * (asm goto is automatically volatile - the naming reflects this.) +- */ +-#define asm_volatile_goto(x...) do { asm goto(x); asm (""); } while (0) +- +-#ifdef CONFIG_ARCH_USE_BUILTIN_BSWAP +-#if GCC_VERSION >= 40400 +-#define __HAVE_BUILTIN_BSWAP32__ +-#define __HAVE_BUILTIN_BSWAP64__ +-#endif +-#if GCC_VERSION >= 40800 || (defined(__powerpc__) && GCC_VERSION >= 40600) +-#define __HAVE_BUILTIN_BSWAP16__ +-#endif +-#endif /* CONFIG_ARCH_USE_BUILTIN_BSWAP */ +diff --git a/include/linux/compiler-gcc5.h b/include/linux/compiler-gcc5.h +deleted file mode 100644 +index cdd1cc202d51..000000000000 +--- a/include/linux/compiler-gcc5.h ++++ /dev/null +@@ -1,66 +0,0 @@ +-#ifndef __LINUX_COMPILER_H +-#error "Please don't include directly, include instead." +-#endif +- +-#define __used __attribute__((__used__)) +-#define __must_check __attribute__((warn_unused_result)) +-#define __compiler_offsetof(a, b) __builtin_offsetof(a, b) +- +-/* Mark functions as cold. gcc will assume any path leading to a call +- to them will be unlikely. This means a lot of manual unlikely()s +- are unnecessary now for any paths leading to the usual suspects +- like BUG(), printk(), panic() etc. [but let's keep them for now for +- older compilers] +- +- Early snapshots of gcc 4.3 don't support this and we can't detect this +- in the preprocessor, but we can live with this because they're unreleased. +- Maketime probing would be overkill here. +- +- gcc also has a __attribute__((__hot__)) to move hot functions into +- a special section, but I don't see any sense in this right now in +- the kernel context */ +-#define __cold __attribute__((__cold__)) +- +-#define __UNIQUE_ID(prefix) __PASTE(__PASTE(__UNIQUE_ID_, prefix), __COUNTER__) +- +-#ifndef __CHECKER__ +-# define __compiletime_warning(message) __attribute__((warning(message))) +-# define __compiletime_error(message) __attribute__((error(message))) +-#endif /* __CHECKER__ */ +- +-/* +- * Mark a position in code as unreachable. This can be used to +- * suppress control flow warnings after asm blocks that transfer +- * control elsewhere. +- * +- * Early snapshots of gcc 4.5 don't support this and we can't detect +- * this in the preprocessor, but we can live with this because they're +- * unreleased. Really, we need to have autoconf for the kernel. +- */ +-#define unreachable() __builtin_unreachable() +- +-/* Mark a function definition as prohibited from being cloned. */ +-#define __noclone __attribute__((__noclone__)) +- +-/* +- * Tell the optimizer that something else uses this function or variable. +- */ +-#define __visible __attribute__((externally_visible)) +- +-/* +- * GCC 'asm goto' miscompiles certain code sequences: +- * +- * http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58670 +- * +- * Work it around via a compiler barrier quirk suggested by Jakub Jelinek. +- * Fixed in GCC 4.8.2 and later versions. +- * +- * (asm goto is automatically volatile - the naming reflects this.) +- */ +-#define asm_volatile_goto(x...) do { asm goto(x); asm (""); } while (0) +- +-#ifdef CONFIG_ARCH_USE_BUILTIN_BSWAP +-#define __HAVE_BUILTIN_BSWAP32__ +-#define __HAVE_BUILTIN_BSWAP64__ +-#define __HAVE_BUILTIN_BSWAP16__ +-#endif /* CONFIG_ARCH_USE_BUILTIN_BSWAP */ +diff --git a/include/linux/kernel.h b/include/linux/kernel.h +index 341551c7b4c8..5f4554b8348a 100644 +--- a/include/linux/kernel.h ++++ b/include/linux/kernel.h +@@ -557,7 +557,7 @@ do { \ + + #define do_trace_printk(fmt, args...) \ + do { \ +- static const char *trace_printk_fmt \ ++ static const char *trace_printk_fmt __used \ + __attribute__((section("__trace_printk_fmt"))) = \ + __builtin_constant_p(fmt) ? fmt : NULL; \ + \ +@@ -604,7 +604,7 @@ extern int __trace_puts(unsigned long ip, const char *str, int size); + */ + + #define trace_puts(str) ({ \ +- static const char *trace_printk_fmt \ ++ static const char *trace_printk_fmt __used \ + __attribute__((section("__trace_printk_fmt"))) = \ + __builtin_constant_p(str) ? str : NULL; \ + \ +@@ -624,7 +624,7 @@ extern void trace_dump_stack(int skip); + #define ftrace_vprintk(fmt, vargs) \ + do { \ + if (__builtin_constant_p(fmt)) { \ +- static const char *trace_printk_fmt \ ++ static const char *trace_printk_fmt __used \ + __attribute__((section("__trace_printk_fmt"))) = \ + __builtin_constant_p(fmt) ? fmt : NULL; \ + \ +diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h +index b3bd7e737e8b..d31364857aa8 100644 +--- a/include/linux/mod_devicetable.h ++++ b/include/linux/mod_devicetable.h +@@ -397,6 +397,7 @@ struct virtio_device_id { + /* + * For Hyper-V devices we use the device guid as the id. + */ ++#define vmbus_device_id hv_vmbus_device_id + struct hv_vmbus_device_id { + __u8 guid[16]; + kernel_ulong_t driver_data; /* Data private to the driver */ +@@ -547,6 +548,11 @@ struct amba_id { + * See documentation of "x86_match_cpu" for details. + */ + ++/* ++ * MODULE_DEVICE_TABLE expects this struct to be called x86cpu_device_id. ++ * Although gcc seems to ignore this error, clang fails without this define. ++ */ ++#define x86cpu_device_id x86_cpu_id + struct x86_cpu_id { + __u16 vendor; + __u16 family; +@@ -574,6 +580,7 @@ struct ipack_device_id { + #define MEI_CL_MODULE_PREFIX "mei:" + #define MEI_CL_NAME_SIZE 32 + ++#define mei_device_id mei_cl_device_id + struct mei_cl_device_id { + char name[MEI_CL_NAME_SIZE]; + kernel_ulong_t driver_info; +diff --git a/include/linux/pci.h b/include/linux/pci.h +index 102136ab1a5f..655ef37fd139 100644 +--- a/include/linux/pci.h ++++ b/include/linux/pci.h +@@ -330,6 +330,7 @@ struct pci_dev { + unsigned int __aer_firmware_first:1; + unsigned int broken_intx_masking:1; + unsigned int io_window_1k:1; /* Intel P2P bridge 1K I/O windows */ ++ unsigned int non_compliant_bars:1; /* broken BARs; ignore them */ + pci_dev_flags_t dev_flags; + atomic_t enable_cnt; /* pci_enable_device has been called */ + +diff --git a/include/linux/poison.h b/include/linux/poison.h +index 2110a81c5e2a..253c9b4198ef 100644 +--- a/include/linux/poison.h ++++ b/include/linux/poison.h +@@ -19,8 +19,8 @@ + * under normal circumstances, used to verify that nobody uses + * non-initialized list entries. + */ +-#define LIST_POISON1 ((void *) 0x00100100 + POISON_POINTER_DELTA) +-#define LIST_POISON2 ((void *) 0x00200200 + POISON_POINTER_DELTA) ++#define LIST_POISON1 ((void *) 0x100 + POISON_POINTER_DELTA) ++#define LIST_POISON2 ((void *) 0x200 + POISON_POINTER_DELTA) + + /********** include/linux/timer.h **********/ + /* +diff --git a/include/uapi/linux/const.h b/include/uapi/linux/const.h +index c22c707c455d..c872bfd25e13 100644 +--- a/include/uapi/linux/const.h ++++ b/include/uapi/linux/const.h +@@ -21,4 +21,7 @@ + #define _AT(T,X) ((T)(X)) + #endif + ++#define _BITUL(x) (_AC(1,UL) << (x)) ++#define _BITULL(x) (_AC(1,ULL) << (x)) ++ + #endif /* !(_LINUX_CONST_H) */ +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index f234c84d36c8..655d6110a6e1 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -5217,6 +5217,7 @@ migration_call(struct notifier_block *nfb, unsigned long action, void *hcpu) + + case CPU_UP_PREPARE: + rq->calc_load_update = calc_load_update; ++ account_reset_rq(rq); + break; + + case CPU_ONLINE: +diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h +index dfa31d533e3f..e7f4d554fa5d 100644 +--- a/kernel/sched/sched.h ++++ b/kernel/sched/sched.h +@@ -1378,3 +1378,16 @@ static inline u64 irq_time_read(int cpu) + } + #endif /* CONFIG_64BIT */ + #endif /* CONFIG_IRQ_TIME_ACCOUNTING */ ++ ++static inline void account_reset_rq(struct rq *rq) ++{ ++#ifdef CONFIG_IRQ_TIME_ACCOUNTING ++ rq->prev_irq_time = 0; ++#endif ++#ifdef CONFIG_PARAVIRT ++ rq->prev_steal_time = 0; ++#endif ++#ifdef CONFIG_PARAVIRT_TIME_ACCOUNTING ++ rq->prev_steal_time_rq = 0; ++#endif ++} +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index cb73c4e0741e..c4ce3a951a1c 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -463,7 +463,7 @@ struct ring_buffer_per_cpu { + raw_spinlock_t reader_lock; /* serialize readers */ + arch_spinlock_t lock; + struct lock_class_key lock_key; +- unsigned int nr_pages; ++ unsigned long nr_pages; + struct list_head *pages; + struct buffer_page *head_page; /* read from head */ + struct buffer_page *tail_page; /* write to tail */ +@@ -483,7 +483,7 @@ struct ring_buffer_per_cpu { + u64 write_stamp; + u64 read_stamp; + /* ring buffer pages to update, > 0 to add, < 0 to remove */ +- int nr_pages_to_update; ++ long nr_pages_to_update; + struct list_head new_pages; /* new pages to add */ + struct work_struct update_pages_work; + struct completion update_done; +@@ -1120,10 +1120,10 @@ static int rb_check_pages(struct ring_buffer_per_cpu *cpu_buffer) + return 0; + } + +-static int __rb_allocate_pages(int nr_pages, struct list_head *pages, int cpu) ++static int __rb_allocate_pages(long nr_pages, struct list_head *pages, int cpu) + { +- int i; + struct buffer_page *bpage, *tmp; ++ long i; + + for (i = 0; i < nr_pages; i++) { + struct page *page; +@@ -1160,7 +1160,7 @@ free_pages: + } + + static int rb_allocate_pages(struct ring_buffer_per_cpu *cpu_buffer, +- unsigned nr_pages) ++ unsigned long nr_pages) + { + LIST_HEAD(pages); + +@@ -1185,7 +1185,7 @@ static int rb_allocate_pages(struct ring_buffer_per_cpu *cpu_buffer, + } + + static struct ring_buffer_per_cpu * +-rb_allocate_cpu_buffer(struct ring_buffer *buffer, int nr_pages, int cpu) ++rb_allocate_cpu_buffer(struct ring_buffer *buffer, long nr_pages, int cpu) + { + struct ring_buffer_per_cpu *cpu_buffer; + struct buffer_page *bpage; +@@ -1284,8 +1284,9 @@ struct ring_buffer *__ring_buffer_alloc(unsigned long size, unsigned flags, + struct lock_class_key *key) + { + struct ring_buffer *buffer; ++ long nr_pages; + int bsize; +- int cpu, nr_pages; ++ int cpu; + + /* keep it in its own cache line */ + buffer = kzalloc(ALIGN(sizeof(*buffer), cache_line_size()), +@@ -1408,12 +1409,12 @@ static inline unsigned long rb_page_write(struct buffer_page *bpage) + } + + static int +-rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned int nr_pages) ++rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned long nr_pages) + { + struct list_head *tail_page, *to_remove, *next_page; + struct buffer_page *to_remove_page, *tmp_iter_page; + struct buffer_page *last_page, *first_page; +- unsigned int nr_removed; ++ unsigned long nr_removed; + unsigned long head_bit; + int page_entries; + +@@ -1629,7 +1630,7 @@ int ring_buffer_resize(struct ring_buffer *buffer, unsigned long size, + int cpu_id) + { + struct ring_buffer_per_cpu *cpu_buffer; +- unsigned nr_pages; ++ unsigned long nr_pages; + int cpu, err = 0; + + /* +@@ -1643,14 +1644,13 @@ int ring_buffer_resize(struct ring_buffer *buffer, unsigned long size, + !cpumask_test_cpu(cpu_id, buffer->cpumask)) + return size; + +- size = DIV_ROUND_UP(size, BUF_PAGE_SIZE); +- size *= BUF_PAGE_SIZE; ++ nr_pages = DIV_ROUND_UP(size, BUF_PAGE_SIZE); + + /* we need a minimum of two pages */ +- if (size < BUF_PAGE_SIZE * 2) +- size = BUF_PAGE_SIZE * 2; ++ if (nr_pages < 2) ++ nr_pages = 2; + +- nr_pages = DIV_ROUND_UP(size, BUF_PAGE_SIZE); ++ size = nr_pages * BUF_PAGE_SIZE; + + /* + * Don't succeed if resizing is disabled, as a reader might be +@@ -4607,8 +4607,9 @@ static int rb_cpu_notify(struct notifier_block *self, + struct ring_buffer *buffer = + container_of(self, struct ring_buffer, cpu_notify); + long cpu = (long)hcpu; +- int cpu_i, nr_pages_same; +- unsigned int nr_pages; ++ long nr_pages_same; ++ int cpu_i; ++ unsigned long nr_pages; + + switch (action) { + case CPU_UP_PREPARE: +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 640e4c44b170..eff26a976f02 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -4351,7 +4351,10 @@ static ssize_t tracing_splice_read_pipe(struct file *filp, + + spd.nr_pages = i; + +- ret = splice_to_pipe(pipe, &spd); ++ if (i) ++ ret = splice_to_pipe(pipe, &spd); ++ else ++ ret = 0; + out: + splice_shrink_spd(&spd); + return ret; +diff --git a/kernel/trace/trace_irqsoff.c b/kernel/trace/trace_irqsoff.c +index 2aefbee93a6d..56e083e26ca9 100644 +--- a/kernel/trace/trace_irqsoff.c ++++ b/kernel/trace/trace_irqsoff.c +@@ -118,8 +118,12 @@ static int func_prolog_dec(struct trace_array *tr, + return 0; + + local_save_flags(*flags); +- /* slight chance to get a false positive on tracing_cpu */ +- if (!irqs_disabled_flags(*flags)) ++ /* ++ * Slight chance to get a false positive on tracing_cpu, ++ * although I'm starting to think there isn't a chance. ++ * Leave this for now just to be paranoid. ++ */ ++ if (!irqs_disabled_flags(*flags) && !preempt_count()) + return 0; + + *data = per_cpu_ptr(tr->trace_buffer.data, cpu); +diff --git a/kernel/trace/trace_printk.c b/kernel/trace/trace_printk.c +index a9077c1b4ad3..fdb23e84b011 100644 +--- a/kernel/trace/trace_printk.c ++++ b/kernel/trace/trace_printk.c +@@ -272,6 +272,9 @@ static int t_show(struct seq_file *m, void *v) + const char *str = *fmt; + int i; + ++ if (!*fmt) ++ return 0; ++ + seq_printf(m, "0x%lx : \"", *(unsigned long *)fmt); + + /* +diff --git a/kernel/workqueue.c b/kernel/workqueue.c +index fe7c4b91d2e7..66972ac0c6c0 100644 +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -606,6 +606,35 @@ static void set_work_pool_and_clear_pending(struct work_struct *work, + */ + smp_wmb(); + set_work_data(work, (unsigned long)pool_id << WORK_OFFQ_POOL_SHIFT, 0); ++ /* ++ * The following mb guarantees that previous clear of a PENDING bit ++ * will not be reordered with any speculative LOADS or STORES from ++ * work->current_func, which is executed afterwards. This possible ++ * reordering can lead to a missed execution on attempt to qeueue ++ * the same @work. E.g. consider this case: ++ * ++ * CPU#0 CPU#1 ++ * ---------------------------- -------------------------------- ++ * ++ * 1 STORE event_indicated ++ * 2 queue_work_on() { ++ * 3 test_and_set_bit(PENDING) ++ * 4 } set_..._and_clear_pending() { ++ * 5 set_work_data() # clear bit ++ * 6 smp_mb() ++ * 7 work->current_func() { ++ * 8 LOAD event_indicated ++ * } ++ * ++ * Without an explicit full barrier speculative LOAD on line 8 can ++ * be executed before CPU#0 does STORE on line 1. If that happens, ++ * CPU#0 observes the PENDING bit is still set and new execution of ++ * a @work is not queued in a hope, that CPU#1 will eventually ++ * finish the queued @work. Meanwhile CPU#1 does not see ++ * event_indicated is set, because speculative LOAD was executed ++ * before actual STORE. ++ */ ++ smp_mb(); + } + + static void clear_work_data(struct work_struct *work) +diff --git a/net/batman-adv/send.c b/net/batman-adv/send.c +index 263cfd1ccee7..cf5b76661252 100644 +--- a/net/batman-adv/send.c ++++ b/net/batman-adv/send.c +@@ -353,6 +353,9 @@ batadv_purge_outstanding_packets(struct batadv_priv *bat_priv, + + if (pending) { + hlist_del(&forw_packet->list); ++ if (!forw_packet->own) ++ atomic_inc(&bat_priv->batman_queue_left); ++ + batadv_forw_packet_free(forw_packet); + } + } +@@ -379,6 +382,9 @@ batadv_purge_outstanding_packets(struct batadv_priv *bat_priv, + + if (pending) { + hlist_del(&forw_packet->list); ++ if (!forw_packet->own) ++ atomic_inc(&bat_priv->bcast_queue_left); ++ + batadv_forw_packet_free(forw_packet); + } + } +diff --git a/net/bridge/br_ioctl.c b/net/bridge/br_ioctl.c +index b73eaba85667..a882db499d33 100644 +--- a/net/bridge/br_ioctl.c ++++ b/net/bridge/br_ioctl.c +@@ -21,18 +21,19 @@ + #include + #include "br_private.h" + +-/* called with RTNL */ + static int get_bridge_ifindices(struct net *net, int *indices, int num) + { + struct net_device *dev; + int i = 0; + +- for_each_netdev(net, dev) { ++ rcu_read_lock(); ++ for_each_netdev_rcu(net, dev) { + if (i >= num) + break; + if (dev->priv_flags & IFF_EBRIDGE) + indices[i++] = dev->ifindex; + } ++ rcu_read_unlock(); + + return i; + } +diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c +index a67310e00b3f..602c6d0492e2 100644 +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -899,14 +899,16 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev, + goto nla_put_failure; + + if (1) { +- struct rtnl_link_ifmap map = { +- .mem_start = dev->mem_start, +- .mem_end = dev->mem_end, +- .base_addr = dev->base_addr, +- .irq = dev->irq, +- .dma = dev->dma, +- .port = dev->if_port, +- }; ++ struct rtnl_link_ifmap map; ++ ++ memset(&map, 0, sizeof(map)); ++ map.mem_start = dev->mem_start; ++ map.mem_end = dev->mem_end; ++ map.base_addr = dev->base_addr; ++ map.irq = dev->irq; ++ map.dma = dev->dma; ++ map.port = dev->if_port; ++ + if (nla_put(skb, IFLA_MAP, sizeof(map), &map)) + goto nla_put_failure; + } +diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c +index fe32388ea24f..b9610051f3b2 100644 +--- a/net/decnet/dn_route.c ++++ b/net/decnet/dn_route.c +@@ -1030,10 +1030,13 @@ source_ok: + if (!fld.daddr) { + fld.daddr = fld.saddr; + +- err = -EADDRNOTAVAIL; + if (dev_out) + dev_put(dev_out); ++ err = -EINVAL; + dev_out = init_net.loopback_dev; ++ if (!dev_out->dn_ptr) ++ goto out; ++ err = -EADDRNOTAVAIL; + dev_hold(dev_out); + if (!fld.daddr) { + fld.daddr = +@@ -1106,6 +1109,8 @@ source_ok: + if (dev_out == NULL) + goto out; + dn_db = rcu_dereference_raw(dev_out->dn_ptr); ++ if (!dn_db) ++ goto e_inval; + /* Possible improvement - check all devices for local addr */ + if (dn_dev_islocal(dev_out, fld.daddr)) { + dev_put(dev_out); +@@ -1147,6 +1152,8 @@ select_source: + dev_put(dev_out); + dev_out = init_net.loopback_dev; + dev_hold(dev_out); ++ if (!dev_out->dn_ptr) ++ goto e_inval; + fld.flowidn_oif = dev_out->ifindex; + if (res.fi) + dn_fib_info_put(res.fi); +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index 222e1b6141d3..624ca8ed350c 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -1876,6 +1876,18 @@ static struct rtable *__mkroute_output(const struct fib_result *res, + */ + if (fi && res->prefixlen < 4) + fi = NULL; ++ } else if ((type == RTN_LOCAL) && (orig_oif != 0) && ++ (orig_oif != dev_out->ifindex)) { ++ /* For local routes that require a particular output interface ++ * we do not want to cache the result. Caching the result ++ * causes incorrect behaviour when there are multiple source ++ * addresses on the interface, the end result being that if the ++ * intended recipient is waiting on that interface for the ++ * packet he won't receive it because it will be delivered on ++ * the loopback interface and the IP_PKTINFO ipi_ifindex will ++ * be set to the loopback interface as well. ++ */ ++ fi = NULL; + } + + fnhe = NULL; +diff --git a/net/ipv6/exthdrs_core.c b/net/ipv6/exthdrs_core.c +index 51af9d0d019a..f66c1b629582 100644 +--- a/net/ipv6/exthdrs_core.c ++++ b/net/ipv6/exthdrs_core.c +@@ -257,7 +257,11 @@ int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset, + *fragoff = _frag_off; + return hp->nexthdr; + } +- return -ENOENT; ++ if (!found) ++ return -ENOENT; ++ if (fragoff) ++ *fragoff = _frag_off; ++ break; + } + hdrlen = 8; + } else if (nexthdr == NEXTHDR_AUTH) { +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index 14f46af17704..31bab1ab007c 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -266,12 +266,12 @@ static int ip6_tnl_create2(struct net_device *dev) + + t = netdev_priv(dev); + ++ dev->rtnl_link_ops = &ip6_link_ops; + err = register_netdevice(dev); + if (err < 0) + goto out; + + strcpy(t->parms.name, dev->name); +- dev->rtnl_link_ops = &ip6_link_ops; + + dev_hold(dev); + ip6_tnl_link(ip6n, t); +diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c +index 7e3901893413..3046d0244393 100644 +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -839,11 +839,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, + int ret = udpv6_queue_rcv_skb(sk, skb); + sock_put(sk); + +- /* a return value > 0 means to resubmit the input, but +- * it wants the return to be -protocol, or 0 +- */ ++ /* a return value > 0 means to resubmit the input */ + if (ret > 0) +- return -ret; ++ return ret; + + return 0; + } +diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c +index da1a1cee1a08..07f8b97f9ae9 100644 +--- a/net/l2tp/l2tp_ip.c ++++ b/net/l2tp/l2tp_ip.c +@@ -123,12 +123,11 @@ static int l2tp_ip_recv(struct sk_buff *skb) + struct l2tp_tunnel *tunnel = NULL; + int length; + +- /* Point to L2TP header */ +- optr = ptr = skb->data; +- + if (!pskb_may_pull(skb, 4)) + goto discard; + ++ /* Point to L2TP header */ ++ optr = ptr = skb->data; + session_id = ntohl(*((__be32 *) ptr)); + ptr += 4; + +@@ -156,6 +155,9 @@ static int l2tp_ip_recv(struct sk_buff *skb) + if (!pskb_may_pull(skb, length)) + goto discard; + ++ /* Point to L2TP header */ ++ optr = ptr = skb->data; ++ ptr += 4; + pr_debug("%s: ip recv\n", tunnel->name); + print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, ptr, length); + } +diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c +index e6e8408c9e36..db96af978da5 100644 +--- a/net/l2tp/l2tp_ip6.c ++++ b/net/l2tp/l2tp_ip6.c +@@ -135,12 +135,11 @@ static int l2tp_ip6_recv(struct sk_buff *skb) + struct l2tp_tunnel *tunnel = NULL; + int length; + +- /* Point to L2TP header */ +- optr = ptr = skb->data; +- + if (!pskb_may_pull(skb, 4)) + goto discard; + ++ /* Point to L2TP header */ ++ optr = ptr = skb->data; + session_id = ntohl(*((__be32 *) ptr)); + ptr += 4; + +@@ -168,6 +167,9 @@ static int l2tp_ip6_recv(struct sk_buff *skb) + if (!pskb_may_pull(skb, length)) + goto discard; + ++ /* Point to L2TP header */ ++ optr = ptr = skb->data; ++ ptr += 4; + pr_debug("%s: ip recv\n", tunnel->name); + print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, ptr, length); + } +diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c +index c3ee80547066..9d140594082c 100644 +--- a/net/llc/af_llc.c ++++ b/net/llc/af_llc.c +@@ -626,6 +626,7 @@ static void llc_cmsg_rcv(struct msghdr *msg, struct sk_buff *skb) + if (llc->cmsg_flags & LLC_CMSG_PKTINFO) { + struct llc_pktinfo info; + ++ memset(&info, 0, sizeof(info)); + info.lpi_ifindex = llc_sk(skb->sk)->dev->ifindex; + llc_pdu_decode_dsap(skb, &info.lpi_sap); + llc_pdu_decode_da(skb, info.lpi_mac); +diff --git a/net/netfilter/ipvs/ip_vs_pe_sip.c b/net/netfilter/ipvs/ip_vs_pe_sip.c +index bed5f7042529..bb318e4623a3 100644 +--- a/net/netfilter/ipvs/ip_vs_pe_sip.c ++++ b/net/netfilter/ipvs/ip_vs_pe_sip.c +@@ -88,7 +88,7 @@ ip_vs_sip_fill_param(struct ip_vs_conn_param *p, struct sk_buff *skb) + dptr = skb->data + dataoff; + datalen = skb->len - dataoff; + +- if (get_callid(dptr, dataoff, datalen, &matchoff, &matchlen)) ++ if (get_callid(dptr, 0, datalen, &matchoff, &matchlen)) + return -EINVAL; + + /* N.B: pe_data is only set on success, +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 39fa33969b09..2d454a235e84 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -2997,6 +2997,7 @@ static int packet_mc_add(struct sock *sk, struct packet_mreq_max *mreq) + i->ifindex = mreq->mr_ifindex; + i->alen = mreq->mr_alen; + memcpy(i->addr, mreq->mr_address, i->alen); ++ memset(i->addr + i->alen, 0, sizeof(i->addr) - i->alen); + i->count = 1; + i->next = po->mclist; + po->mclist = i; +diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c +index bee032a7003f..10d3e2874dd1 100644 +--- a/net/sctp/ipv6.c ++++ b/net/sctp/ipv6.c +@@ -520,6 +520,8 @@ static int sctp_v6_cmp_addr(const union sctp_addr *addr1, + } + return 0; + } ++ if (addr1->v6.sin6_port != addr2->v6.sin6_port) ++ return 0; + if (!ipv6_addr_equal(&addr1->v6.sin6_addr, &addr2->v6.sin6_addr)) + return 0; + /* If this is a linklocal address, compare the scope_id. */ +diff --git a/net/socket.c b/net/socket.c +index 53b6e411f7a4..e91e8ed1b8df 100644 +--- a/net/socket.c ++++ b/net/socket.c +@@ -2381,31 +2381,31 @@ int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen, + break; + } + +-out_put: +- fput_light(sock->file, fput_needed); +- + if (err == 0) +- return datagrams; ++ goto out_put; + +- if (datagrams != 0) { ++ if (datagrams == 0) { ++ datagrams = err; ++ goto out_put; ++ } ++ ++ /* ++ * We may return less entries than requested (vlen) if the ++ * sock is non block and there aren't enough datagrams... ++ */ ++ if (err != -EAGAIN) { + /* +- * We may return less entries than requested (vlen) if the +- * sock is non block and there aren't enough datagrams... ++ * ... or if recvmsg returns an error after we ++ * received some datagrams, where we record the ++ * error to return on the next call or if the ++ * app asks about it using getsockopt(SO_ERROR). + */ +- if (err != -EAGAIN) { +- /* +- * ... or if recvmsg returns an error after we +- * received some datagrams, where we record the +- * error to return on the next call or if the +- * app asks about it using getsockopt(SO_ERROR). +- */ +- sock->sk->sk_err = -err; +- } +- +- return datagrams; ++ sock->sk->sk_err = -err; + } ++out_put: ++ fput_light(sock->file, fput_needed); + +- return err; ++ return datagrams; + } + + SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg, +diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c +index 9b88693bcc99..66a9bf52fac6 100644 +--- a/net/vmw_vsock/af_vsock.c ++++ b/net/vmw_vsock/af_vsock.c +@@ -1804,27 +1804,8 @@ vsock_stream_recvmsg(struct kiocb *kiocb, + else if (sk->sk_shutdown & RCV_SHUTDOWN) + err = 0; + +- if (copied > 0) { +- /* We only do these additional bookkeeping/notification steps +- * if we actually copied something out of the queue pair +- * instead of just peeking ahead. +- */ +- +- if (!(flags & MSG_PEEK)) { +- /* If the other side has shutdown for sending and there +- * is nothing more to read, then modify the socket +- * state. +- */ +- if (vsk->peer_shutdown & SEND_SHUTDOWN) { +- if (vsock_stream_has_data(vsk) <= 0) { +- sk->sk_state = SS_UNCONNECTED; +- sock_set_flag(sk, SOCK_DONE); +- sk->sk_state_change(sk); +- } +- } +- } ++ if (copied > 0) + err = copied; +- } + + out_wait: + finish_wait(sk_sleep(sk), &wait); +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index 90a0e552cb32..dd3dbed89c8f 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -10685,7 +10685,7 @@ static int nl80211_netlink_notify(struct notifier_block * nb, + struct wireless_dev *wdev; + struct cfg80211_beacon_registration *reg, *tmp; + +- if (state != NETLINK_URELEASE) ++ if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC) + return NOTIFY_DONE; + + rcu_read_lock(); +diff --git a/net/x25/x25_facilities.c b/net/x25/x25_facilities.c +index 66c638730c7a..de7552d8ee20 100644 +--- a/net/x25/x25_facilities.c ++++ b/net/x25/x25_facilities.c +@@ -271,6 +271,7 @@ int x25_negotiate_facilities(struct sk_buff *skb, struct sock *sk, + + memset(&theirs, 0, sizeof(theirs)); + memcpy(new, ours, sizeof(*new)); ++ memset(dte, 0, sizeof(*dte)); + + len = x25_parse_facilities(skb, &theirs, dte, &x25->vc_facil_mask); + if (len < 0) +diff --git a/scripts/coccinelle/iterators/use_after_iter.cocci b/scripts/coccinelle/iterators/use_after_iter.cocci +index 06284c57a951..93e37ff8b0f6 100644 +--- a/scripts/coccinelle/iterators/use_after_iter.cocci ++++ b/scripts/coccinelle/iterators/use_after_iter.cocci +@@ -123,7 +123,7 @@ list_remove_head(x,c,...) + | + sizeof(<+...c...+>) + | +-&c->member ++ &c->member + | + c = E + | +diff --git a/sound/core/timer.c b/sound/core/timer.c +index d90d8f4b85fe..38742e826900 100644 +--- a/sound/core/timer.c ++++ b/sound/core/timer.c +@@ -1012,8 +1012,8 @@ static int snd_timer_s_start(struct snd_timer * timer) + njiff += timer->sticks - priv->correction; + priv->correction = 0; + } +- priv->last_expires = priv->tlist.expires = njiff; +- add_timer(&priv->tlist); ++ priv->last_expires = njiff; ++ mod_timer(&priv->tlist, njiff); + return 0; + } + +diff --git a/sound/pci/intel8x0.c b/sound/pci/intel8x0.c +index b8fe40531b9c..7022450fb6dd 100644 +--- a/sound/pci/intel8x0.c ++++ b/sound/pci/intel8x0.c +@@ -2885,6 +2885,7 @@ static void intel8x0_measure_ac97_clock(struct intel8x0 *chip) + + static struct snd_pci_quirk intel8x0_clock_list[] = { + SND_PCI_QUIRK(0x0e11, 0x008a, "AD1885", 41000), ++ SND_PCI_QUIRK(0x1014, 0x0581, "AD1981B", 48000), + SND_PCI_QUIRK(0x1028, 0x00be, "AD1885", 44100), + SND_PCI_QUIRK(0x1028, 0x0177, "AD1980", 48000), + SND_PCI_QUIRK(0x1028, 0x01ad, "AD1981B", 48000), +diff --git a/sound/soc/samsung/s3c-i2s-v2.c b/sound/soc/samsung/s3c-i2s-v2.c +index 20e98d1dded2..38c36cdd8c77 100644 +--- a/sound/soc/samsung/s3c-i2s-v2.c ++++ b/sound/soc/samsung/s3c-i2s-v2.c +@@ -732,7 +732,7 @@ static int s3c2412_i2s_resume(struct snd_soc_dai *dai) + #endif + + int s3c_i2sv2_register_component(struct device *dev, int id, +- struct snd_soc_component_driver *cmp_drv, ++ const struct snd_soc_component_driver *cmp_drv, + struct snd_soc_dai_driver *dai_drv) + { + struct snd_soc_dai_ops *ops = drv->ops; +diff --git a/sound/soc/samsung/s3c-i2s-v2.h b/sound/soc/samsung/s3c-i2s-v2.h +index 90abab364b49..d0684145ed1f 100644 +--- a/sound/soc/samsung/s3c-i2s-v2.h ++++ b/sound/soc/samsung/s3c-i2s-v2.h +@@ -101,7 +101,7 @@ extern int s3c_i2sv2_probe(struct snd_soc_dai *dai, + * soc core. + */ + extern int s3c_i2sv2_register_component(struct device *dev, int id, +- struct snd_soc_component_driver *cmp_drv, ++ const struct snd_soc_component_driver *cmp_drv, + struct snd_soc_dai_driver *dai_drv); + + #endif /* __SND_SOC_S3C24XX_S3C_I2SV2_I2S_H */ +diff --git a/tools/perf/Documentation/perf-stat.txt b/tools/perf/Documentation/perf-stat.txt +index 2fe87fb558f0..8c9604797e87 100644 +--- a/tools/perf/Documentation/perf-stat.txt ++++ b/tools/perf/Documentation/perf-stat.txt +@@ -50,6 +50,14 @@ OPTIONS + --scale:: + scale/normalize counter values + ++-d:: ++--detailed:: ++ print more detailed statistics, can be specified up to 3 times ++ ++ -d: detailed events, L1 and LLC data cache ++ -d -d: more detailed events, dTLB and iTLB events ++ -d -d -d: very detailed events, adding prefetch events ++ + -r:: + --repeat=:: + repeat command and print average + stddev (max: 100). 0 means forever. +diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c +index 1d4b8bed4e48..4f865e122c21 100644 +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -468,6 +468,16 @@ static struct kvm *kvm_create_vm(unsigned long type) + if (!kvm) + return ERR_PTR(-ENOMEM); + ++ spin_lock_init(&kvm->mmu_lock); ++ atomic_inc(¤t->mm->mm_count); ++ kvm->mm = current->mm; ++ kvm_eventfd_init(kvm); ++ mutex_init(&kvm->lock); ++ mutex_init(&kvm->irq_lock); ++ mutex_init(&kvm->slots_lock); ++ atomic_set(&kvm->users_count, 1); ++ INIT_LIST_HEAD(&kvm->devices); ++ + r = kvm_arch_init_vm(kvm, type); + if (r) + goto out_err_nodisable; +@@ -497,16 +507,6 @@ static struct kvm *kvm_create_vm(unsigned long type) + goto out_err; + } + +- spin_lock_init(&kvm->mmu_lock); +- kvm->mm = current->mm; +- atomic_inc(&kvm->mm->mm_count); +- kvm_eventfd_init(kvm); +- mutex_init(&kvm->lock); +- mutex_init(&kvm->irq_lock); +- mutex_init(&kvm->slots_lock); +- atomic_set(&kvm->users_count, 1); +- INIT_LIST_HEAD(&kvm->devices); +- + r = kvm_init_mmu_notifier(kvm); + if (r) + goto out_err; +@@ -526,6 +526,7 @@ out_err_nodisable: + kfree(kvm->buses[i]); + kfree(kvm->memslots); + kvm_arch_free_vm(kvm); ++ mmdrop(current->mm); + return ERR_PTR(r); + } +