Muehlenhoff has uploaded a new change for review. https://gerrit.wikimedia.org/r/225850
Change subject: Update to 3.19.8-ckt3 ...................................................................... Update to 3.19.8-ckt3 Change-Id: Iaaa1dd5fa4d31bf35f4f77b2506703ef363da0da --- M debian/changelog A debian/patches/bugfix/all/stable-3.19.8-ckt3.patch M debian/patches/series 3 files changed, 2,956 insertions(+), 2 deletions(-) git pull ssh://gerrit.wikimedia.org:29418/operations/debs/linux refs/changes/50/225850/1 diff --git a/debian/changelog b/debian/changelog index 2043f91..b1b1bc9 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,7 +1,16 @@ +linux (3.19.3-7) jessie-wikimedia; urgency=medium + + * New upstream stable update: + http://kernel.ubuntu.com/stable/ChangeLog-3.19.8-ckt3 + -> CVE-2015-1420 (161f873b8913) + -> CVE-2015-4692 (ce40cd3fc7fa40a6119e5fe6c0f2bc0eb4541009) + + -- Moritz Muehlenhoff <mmuhlenh...@wikimedia.org> Mon, 20 Jul 2015 10:07:54 +0200 + linux (3.19.3-6) jessie-wikimedia; urgency=medium * New upstream stable update: - http://kernel.ubuntu.com/stable/ChangeLog-3.19.8-ckt1 + http://kernel.ubuntu.com/stable/ChangeLog-3.19.8-ckt2 -> CVE-2015-4001 (b1bb5b49373b61bf9d2c73a4d30058ba6f069e4c) -> CVE-2015-4002 (d114b9fe78c8d6fc6e70808c2092aa307c36dc8e, 9a59029bc218b48eff8b5d4dde5662fd79d3e1a8) diff --git a/debian/patches/bugfix/all/stable-3.19.8-ckt3.patch b/debian/patches/bugfix/all/stable-3.19.8-ckt3.patch new file mode 100644 index 0000000..5dcfc5c --- /dev/null +++ b/debian/patches/bugfix/all/stable-3.19.8-ckt3.patch @@ -0,0 +1,2945 @@ +diff --git a/Makefile b/Makefile +index 32d76f2..b2f65ac 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + VERSION = 3 + PATCHLEVEL = 19 + SUBLEVEL = 8 +-EXTRAVERSION = -ckt2 ++EXTRAVERSION = -ckt3 + NAME = Sedated Swine + + # *DOCUMENTATION* +diff --git a/arch/arm/boot/dts/am335x-bone-common.dtsi b/arch/arm/boot/dts/am335x-bone-common.dtsi +index 2c6248d..7ecde1a 100644 +--- a/arch/arm/boot/dts/am335x-bone-common.dtsi ++++ b/arch/arm/boot/dts/am335x-bone-common.dtsi +@@ -223,6 +223,25 @@ + /include/ "tps65217.dtsi" + + &tps { ++ /* ++ * Configure pmic to enter OFF-state instead of SLEEP-state ("RTC-only ++ * mode") at poweroff. Most BeagleBone versions do not support RTC-only ++ * mode and risk hardware damage if this mode is entered. ++ * ++ * For details, see linux-omap mailing list May 2015 thread ++ * [PATCH] ARM: dts: am335x-bone* enable pmic-shutdown-controller ++ * In particular, messages: ++ * http://www.spinics.net/lists/linux-omap/msg118585.html ++ * http://www.spinics.net/lists/linux-omap/msg118615.html ++ * ++ * You can override this later with ++ * &tps { /delete-property/ ti,pmic-shutdown-controller; } ++ * if you want to use RTC-only mode and made sure you are not affected ++ * by the hardware problems. (Tip: double-check by performing a current ++ * measurement after shutdown: it should be less than 1 mA.) ++ */ ++ ti,pmic-shutdown-controller; ++ + regulators { + dcdc1_reg: regulator@0 { + regulator-name = "vdds_dpr"; +diff --git a/arch/arm/boot/dts/exynos4412-trats2.dts b/arch/arm/boot/dts/exynos4412-trats2.dts +index 29231b4..1ec4d33 100644 +--- a/arch/arm/boot/dts/exynos4412-trats2.dts ++++ b/arch/arm/boot/dts/exynos4412-trats2.dts +@@ -691,7 +691,7 @@ + + display-timings { + timing-0 { +- clock-frequency = <0>; ++ clock-frequency = <57153600>; + hactive = <720>; + vactive = <1280>; + hfront-porch = <5>; +diff --git a/arch/arm/boot/dts/imx27.dtsi b/arch/arm/boot/dts/imx27.dtsi +index 107d713..12ac5f7 100644 +--- a/arch/arm/boot/dts/imx27.dtsi ++++ b/arch/arm/boot/dts/imx27.dtsi +@@ -531,7 +531,7 @@ + + fec: ethernet@1002b000 { + compatible = "fsl,imx27-fec"; +- reg = <0x1002b000 0x4000>; ++ reg = <0x1002b000 0x1000>; + interrupts = <50>; + clocks = <&clks IMX27_CLK_FEC_IPG_GATE>, + <&clks IMX27_CLK_FEC_AHB_GATE>; +diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c +index 4e6ef89..7186382 100644 +--- a/arch/arm/mm/mmu.c ++++ b/arch/arm/mm/mmu.c +@@ -1112,22 +1112,22 @@ void __init sanity_check_meminfo(void) + } + + /* +- * Find the first non-section-aligned page, and point ++ * Find the first non-pmd-aligned page, and point + * memblock_limit at it. This relies on rounding the +- * limit down to be section-aligned, which happens at +- * the end of this function. ++ * limit down to be pmd-aligned, which happens at the ++ * end of this function. + * + * With this algorithm, the start or end of almost any +- * bank can be non-section-aligned. The only exception +- * is that the start of the bank 0 must be section- ++ * bank can be non-pmd-aligned. The only exception is ++ * that the start of the bank 0 must be section- + * aligned, since otherwise memory would need to be + * allocated when mapping the start of bank 0, which + * occurs before any free memory is mapped. + */ + if (!memblock_limit) { +- if (!IS_ALIGNED(block_start, SECTION_SIZE)) ++ if (!IS_ALIGNED(block_start, PMD_SIZE)) + memblock_limit = block_start; +- else if (!IS_ALIGNED(block_end, SECTION_SIZE)) ++ else if (!IS_ALIGNED(block_end, PMD_SIZE)) + memblock_limit = arm_lowmem_limit; + } + +@@ -1137,12 +1137,12 @@ void __init sanity_check_meminfo(void) + high_memory = __va(arm_lowmem_limit - 1) + 1; + + /* +- * Round the memblock limit down to a section size. This ++ * Round the memblock limit down to a pmd size. This + * helps to ensure that we will allocate memory from the +- * last full section, which should be mapped. ++ * last full pmd, which should be mapped. + */ + if (memblock_limit) +- memblock_limit = round_down(memblock_limit, SECTION_SIZE); ++ memblock_limit = round_down(memblock_limit, PMD_SIZE); + if (!memblock_limit) + memblock_limit = arm_lowmem_limit; + +diff --git a/arch/mips/kernel/irq.c b/arch/mips/kernel/irq.c +index d2bfbc2..be15e52 100644 +--- a/arch/mips/kernel/irq.c ++++ b/arch/mips/kernel/irq.c +@@ -109,7 +109,7 @@ void __init init_IRQ(void) + #endif + } + +-#ifdef DEBUG_STACKOVERFLOW ++#ifdef CONFIG_DEBUG_STACKOVERFLOW + static inline void check_stack_overflow(void) + { + unsigned long sp; +diff --git a/arch/mips/ralink/ill_acc.c b/arch/mips/ralink/ill_acc.c +index e20b02e..e10d10b 100644 +--- a/arch/mips/ralink/ill_acc.c ++++ b/arch/mips/ralink/ill_acc.c +@@ -41,7 +41,7 @@ static irqreturn_t ill_acc_irq_handler(int irq, void *_priv) + addr, (type >> ILL_ACC_OFF_S) & ILL_ACC_OFF_M, + type & ILL_ACC_LEN_M); + +- rt_memc_w32(REG_ILL_ACC_TYPE, REG_ILL_ACC_TYPE); ++ rt_memc_w32(ILL_INT_STATUS, REG_ILL_ACC_TYPE); + + return IRQ_HANDLED; + } +diff --git a/arch/x86/include/asm/segment.h b/arch/x86/include/asm/segment.h +index db257a5..69670ae 100644 +--- a/arch/x86/include/asm/segment.h ++++ b/arch/x86/include/asm/segment.h +@@ -200,10 +200,20 @@ + #define TLS_SIZE (GDT_ENTRY_TLS_ENTRIES * 8) + + #ifdef __KERNEL__ ++ ++/* ++ * early_idt_handler_array is an array of entry points referenced in the ++ * early IDT. For simplicity, it's a real array with one entry point ++ * every nine bytes. That leaves room for an optional 'push $0' if the ++ * vector has no error code (two bytes), a 'push $vector_number' (two ++ * bytes), and a jump to the common entry code (up to five bytes). ++ */ ++#define EARLY_IDT_HANDLER_SIZE 9 ++ + #ifndef __ASSEMBLY__ +-extern const char early_idt_handlers[NUM_EXCEPTION_VECTORS][2+2+5]; ++extern const char early_idt_handler_array[NUM_EXCEPTION_VECTORS][EARLY_IDT_HANDLER_SIZE]; + #ifdef CONFIG_TRACING +-#define trace_early_idt_handlers early_idt_handlers ++# define trace_early_idt_handler_array early_idt_handler_array + #endif + + /* +diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c +index d2c6116..1596e04 100644 +--- a/arch/x86/kernel/cpu/mcheck/mce.c ++++ b/arch/x86/kernel/cpu/mcheck/mce.c +@@ -706,6 +706,7 @@ static int mce_no_way_out(struct mce *m, char **msg, unsigned long *validp, + struct pt_regs *regs) + { + int i, ret = 0; ++ char *tmp; + + for (i = 0; i < mca_cfg.banks; i++) { + m->status = mce_rdmsrl(MSR_IA32_MCx_STATUS(i)); +@@ -714,9 +715,11 @@ static int mce_no_way_out(struct mce *m, char **msg, unsigned long *validp, + if (quirk_no_way_out) + quirk_no_way_out(i, m, regs); + } +- if (mce_severity(m, mca_cfg.tolerant, msg, true) >= +- MCE_PANIC_SEVERITY) ++ ++ if (mce_severity(m, mca_cfg.tolerant, &tmp, true) >= MCE_PANIC_SEVERITY) { ++ *msg = tmp; + ret = 1; ++ } + } + return ret; + } +diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c +index eda1a86..7823beb 100644 +--- a/arch/x86/kernel/head64.c ++++ b/arch/x86/kernel/head64.c +@@ -162,7 +162,7 @@ asmlinkage __visible void __init x86_64_start_kernel(char * real_mode_data) + clear_bss(); + + for (i = 0; i < NUM_EXCEPTION_VECTORS; i++) +- set_intr_gate(i, early_idt_handlers[i]); ++ set_intr_gate(i, early_idt_handler_array[i]); + load_idt((const struct desc_ptr *)&idt_descr); + + copy_bootdata(__va(real_mode_data)); +diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S +index f36bd42..30a2aa3 100644 +--- a/arch/x86/kernel/head_32.S ++++ b/arch/x86/kernel/head_32.S +@@ -477,21 +477,22 @@ is486: + __INIT + setup_once: + /* +- * Set up a idt with 256 entries pointing to ignore_int, +- * interrupt gates. It doesn't actually load idt - that needs +- * to be done on each CPU. Interrupts are enabled elsewhere, +- * when we can be relatively sure everything is ok. ++ * Set up a idt with 256 interrupt gates that push zero if there ++ * is no error code and then jump to early_idt_handler_common. ++ * It doesn't actually load the idt - that needs to be done on ++ * each CPU. Interrupts are enabled elsewhere, when we can be ++ * relatively sure everything is ok. + */ + + movl $idt_table,%edi +- movl $early_idt_handlers,%eax ++ movl $early_idt_handler_array,%eax + movl $NUM_EXCEPTION_VECTORS,%ecx + 1: + movl %eax,(%edi) + movl %eax,4(%edi) + /* interrupt gate, dpl=0, present */ + movl $(0x8E000000 + __KERNEL_CS),2(%edi) +- addl $9,%eax ++ addl $EARLY_IDT_HANDLER_SIZE,%eax + addl $8,%edi + loop 1b + +@@ -523,26 +524,28 @@ setup_once: + andl $0,setup_once_ref /* Once is enough, thanks */ + ret + +-ENTRY(early_idt_handlers) ++ENTRY(early_idt_handler_array) + # 36(%esp) %eflags + # 32(%esp) %cs + # 28(%esp) %eip + # 24(%rsp) error code + i = 0 + .rept NUM_EXCEPTION_VECTORS +- .if (EXCEPTION_ERRCODE_MASK >> i) & 1 +- ASM_NOP2 +- .else ++ .ifeq (EXCEPTION_ERRCODE_MASK >> i) & 1 + pushl $0 # Dummy error code, to make stack frame uniform + .endif + pushl $i # 20(%esp) Vector number +- jmp early_idt_handler ++ jmp early_idt_handler_common + i = i + 1 ++ .fill early_idt_handler_array + i*EARLY_IDT_HANDLER_SIZE - ., 1, 0xcc + .endr +-ENDPROC(early_idt_handlers) ++ENDPROC(early_idt_handler_array) + +- /* This is global to keep gas from relaxing the jumps */ +-ENTRY(early_idt_handler) ++early_idt_handler_common: ++ /* ++ * The stack is the hardware frame, an error code or zero, and the ++ * vector number. ++ */ + cld + + cmpl $2,(%esp) # X86_TRAP_NMI +@@ -602,7 +605,7 @@ ex_entry: + is_nmi: + addl $8,%esp /* drop vector number and error code */ + iret +-ENDPROC(early_idt_handler) ++ENDPROC(early_idt_handler_common) + + /* This is the default interrupt "handler" :-) */ + ALIGN +diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S +index a468c0a..a2dc0ad 100644 +--- a/arch/x86/kernel/head_64.S ++++ b/arch/x86/kernel/head_64.S +@@ -321,26 +321,28 @@ bad_address: + jmp bad_address + + __INIT +- .globl early_idt_handlers +-early_idt_handlers: ++ENTRY(early_idt_handler_array) + # 104(%rsp) %rflags + # 96(%rsp) %cs + # 88(%rsp) %rip + # 80(%rsp) error code + i = 0 + .rept NUM_EXCEPTION_VECTORS +- .if (EXCEPTION_ERRCODE_MASK >> i) & 1 +- ASM_NOP2 +- .else ++ .ifeq (EXCEPTION_ERRCODE_MASK >> i) & 1 + pushq $0 # Dummy error code, to make stack frame uniform + .endif + pushq $i # 72(%rsp) Vector number +- jmp early_idt_handler ++ jmp early_idt_handler_common + i = i + 1 ++ .fill early_idt_handler_array + i*EARLY_IDT_HANDLER_SIZE - ., 1, 0xcc + .endr ++ENDPROC(early_idt_handler_array) + +-/* This is global to keep gas from relaxing the jumps */ +-ENTRY(early_idt_handler) ++early_idt_handler_common: ++ /* ++ * The stack is the hardware frame, an error code or zero, and the ++ * vector number. ++ */ + cld + + cmpl $2,(%rsp) # X86_TRAP_NMI +@@ -412,7 +414,7 @@ ENTRY(early_idt_handler) + is_nmi: + addq $16,%rsp # drop vector number and error code + INTERRUPT_RETURN +-ENDPROC(early_idt_handler) ++ENDPROC(early_idt_handler_common) + + __INITDATA + +diff --git a/arch/x86/kernel/i387.c b/arch/x86/kernel/i387.c +index a9a4229..ae0fdc8 100644 +--- a/arch/x86/kernel/i387.c ++++ b/arch/x86/kernel/i387.c +@@ -155,6 +155,21 @@ static void init_thread_xstate(void) + xstate_size = sizeof(struct i387_fxsave_struct); + else + xstate_size = sizeof(struct i387_fsave_struct); ++ ++ /* ++ * Quirk: we don't yet handle the XSAVES* instructions ++ * correctly, as we don't correctly convert between ++ * standard and compacted format when interfacing ++ * with user-space - so disable it for now. ++ * ++ * The difference is small: with recent CPUs the ++ * compacted format is only marginally smaller than ++ * the standard FPU state format. ++ * ++ * ( This is easy to backport while we are fixing ++ * XSAVES* support. ) ++ */ ++ setup_clear_cpu_cap(X86_FEATURE_XSAVES); + } + + /* +diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c +index d52dcf0..5ee4e1f 100644 +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -1072,6 +1072,17 @@ static void update_divide_count(struct kvm_lapic *apic) + apic->divide_count); + } + ++static void apic_update_lvtt(struct kvm_lapic *apic) ++{ ++ u32 timer_mode = kvm_apic_get_reg(apic, APIC_LVTT) & ++ apic->lapic_timer.timer_mode_mask; ++ ++ if (apic->lapic_timer.timer_mode != timer_mode) { ++ apic->lapic_timer.timer_mode = timer_mode; ++ hrtimer_cancel(&apic->lapic_timer.timer); ++ } ++} ++ + static void apic_timer_expired(struct kvm_lapic *apic) + { + struct kvm_vcpu *vcpu = apic->vcpu; +@@ -1230,6 +1241,7 @@ static int apic_reg_write(struct kvm_lapic *apic, u32 reg, u32 val) + apic_set_reg(apic, APIC_LVTT + 0x10 * i, + lvt_val | APIC_LVT_MASKED); + } ++ apic_update_lvtt(apic); + atomic_set(&apic->lapic_timer.pending, 0); + + } +@@ -1262,20 +1274,13 @@ static int apic_reg_write(struct kvm_lapic *apic, u32 reg, u32 val) + + break; + +- case APIC_LVTT: { +- u32 timer_mode = val & apic->lapic_timer.timer_mode_mask; +- +- if (apic->lapic_timer.timer_mode != timer_mode) { +- apic->lapic_timer.timer_mode = timer_mode; +- hrtimer_cancel(&apic->lapic_timer.timer); +- } +- ++ case APIC_LVTT: + if (!kvm_apic_sw_enabled(apic)) + val |= APIC_LVT_MASKED; + val &= (apic_lvt_mask[0] | apic->lapic_timer.timer_mode_mask); + apic_set_reg(apic, APIC_LVTT, val); ++ apic_update_lvtt(apic); + break; +- } + + case APIC_TMICT: + if (apic_lvtt_tscdeadline(apic)) +@@ -1510,7 +1515,7 @@ void kvm_lapic_reset(struct kvm_vcpu *vcpu) + + for (i = 0; i < APIC_LVT_NUM; i++) + apic_set_reg(apic, APIC_LVTT + 0x10 * i, APIC_LVT_MASKED); +- apic->lapic_timer.timer_mode = 0; ++ apic_update_lvtt(apic); + apic_set_reg(apic, APIC_LVT0, + SET_APIC_DELIVERY_MODE(0, APIC_MODE_EXTINT)); + +@@ -1736,6 +1741,7 @@ void kvm_apic_post_state_restore(struct kvm_vcpu *vcpu, + + apic_update_ppr(apic); + hrtimer_cancel(&apic->lapic_timer.timer); ++ apic_update_lvtt(apic); + update_divide_count(apic); + start_apic_timer(apic); + apic->irr_pending = true; +diff --git a/arch/x86/kvm/lapic.h b/arch/x86/kvm/lapic.h +index c674fce..d3d6e92 100644 +--- a/arch/x86/kvm/lapic.h ++++ b/arch/x86/kvm/lapic.h +@@ -165,7 +165,7 @@ static inline u16 apic_logical_id(struct kvm_apic_map *map, u32 ldr) + + static inline bool kvm_apic_has_events(struct kvm_vcpu *vcpu) + { +- return vcpu->arch.apic->pending_events; ++ return kvm_vcpu_has_lapic(vcpu) && vcpu->arch.apic->pending_events; + } + + bool kvm_apic_pending_eoi(struct kvm_vcpu *vcpu, int vector); +diff --git a/block/genhd.c b/block/genhd.c +index 0a536dc..c2fb3f7 100644 +--- a/block/genhd.c ++++ b/block/genhd.c +@@ -422,9 +422,9 @@ int blk_alloc_devt(struct hd_struct *part, dev_t *devt) + /* allocate ext devt */ + idr_preload(GFP_KERNEL); + +- spin_lock(&ext_devt_lock); ++ spin_lock_bh(&ext_devt_lock); + idx = idr_alloc(&ext_devt_idr, part, 0, NR_EXT_DEVT, GFP_NOWAIT); +- spin_unlock(&ext_devt_lock); ++ spin_unlock_bh(&ext_devt_lock); + + idr_preload_end(); + if (idx < 0) +@@ -449,9 +449,9 @@ void blk_free_devt(dev_t devt) + return; + + if (MAJOR(devt) == BLOCK_EXT_MAJOR) { +- spin_lock(&ext_devt_lock); ++ spin_lock_bh(&ext_devt_lock); + idr_remove(&ext_devt_idr, blk_mangle_minor(MINOR(devt))); +- spin_unlock(&ext_devt_lock); ++ spin_unlock_bh(&ext_devt_lock); + } + } + +@@ -691,13 +691,13 @@ struct gendisk *get_gendisk(dev_t devt, int *partno) + } else { + struct hd_struct *part; + +- spin_lock(&ext_devt_lock); ++ spin_lock_bh(&ext_devt_lock); + part = idr_find(&ext_devt_idr, blk_mangle_minor(MINOR(devt))); + if (part && get_disk(part_to_disk(part))) { + *partno = part->partno; + disk = part_to_disk(part); + } +- spin_unlock(&ext_devt_lock); ++ spin_unlock_bh(&ext_devt_lock); + } + + return disk; +diff --git a/drivers/ata/ahci_mvebu.c b/drivers/ata/ahci_mvebu.c +index 64bb084..0f20074 100644 +--- a/drivers/ata/ahci_mvebu.c ++++ b/drivers/ata/ahci_mvebu.c +@@ -43,7 +43,7 @@ static void ahci_mvebu_mbus_config(struct ahci_host_priv *hpriv, + writel((cs->mbus_attr << 8) | + (dram->mbus_dram_target_id << 4) | 1, + hpriv->mmio + AHCI_WINDOW_CTRL(i)); +- writel(cs->base, hpriv->mmio + AHCI_WINDOW_BASE(i)); ++ writel(cs->base >> 16, hpriv->mmio + AHCI_WINDOW_BASE(i)); + writel(((cs->size - 1) & 0xffff0000), + hpriv->mmio + AHCI_WINDOW_SIZE(i)); + } +diff --git a/drivers/ata/pata_octeon_cf.c b/drivers/ata/pata_octeon_cf.c +index 80a8054..2724595 100644 +--- a/drivers/ata/pata_octeon_cf.c ++++ b/drivers/ata/pata_octeon_cf.c +@@ -1053,7 +1053,7 @@ static struct of_device_id octeon_cf_match[] = { + }, + {}, + }; +-MODULE_DEVICE_TABLE(of, octeon_i2c_match); ++MODULE_DEVICE_TABLE(of, octeon_cf_match); + + static struct platform_driver octeon_cf_driver = { + .probe = octeon_cf_probe, +diff --git a/drivers/base/cacheinfo.c b/drivers/base/cacheinfo.c +index 9c2ba1c..df0c66c 100644 +--- a/drivers/base/cacheinfo.c ++++ b/drivers/base/cacheinfo.c +@@ -179,7 +179,7 @@ static int detect_cache_attributes(unsigned int cpu) + { + int ret; + +- if (init_cache_level(cpu)) ++ if (init_cache_level(cpu) || !cache_leaves(cpu)) + return -ENOENT; + + per_cpu_cacheinfo(cpu) = kcalloc(cache_leaves(cpu), +diff --git a/drivers/clk/at91/clk-pll.c b/drivers/clk/at91/clk-pll.c +index 6ec79db..cbbe403 100644 +--- a/drivers/clk/at91/clk-pll.c ++++ b/drivers/clk/at91/clk-pll.c +@@ -173,8 +173,7 @@ static long clk_pll_get_best_div_mul(struct clk_pll *pll, unsigned long rate, + int i = 0; + + /* Check if parent_rate is a valid input rate */ +- if (parent_rate < characteristics->input.min || +- parent_rate > characteristics->input.max) ++ if (parent_rate < characteristics->input.min) + return -ERANGE; + + /* +@@ -187,6 +186,15 @@ static long clk_pll_get_best_div_mul(struct clk_pll *pll, unsigned long rate, + if (!mindiv) + mindiv = 1; + ++ if (parent_rate > characteristics->input.max) { ++ tmpdiv = DIV_ROUND_UP(parent_rate, characteristics->input.max); ++ if (tmpdiv > PLL_DIV_MAX) ++ return -ERANGE; ++ ++ if (tmpdiv > mindiv) ++ mindiv = tmpdiv; ++ } ++ + /* + * Calculate the maximum divider which is limited by PLL register + * layout (limited by the MUL or DIV field size). +diff --git a/drivers/clk/at91/pmc.h b/drivers/clk/at91/pmc.h +index 52d2041..af2c991 100644 +--- a/drivers/clk/at91/pmc.h ++++ b/drivers/clk/at91/pmc.h +@@ -120,7 +120,7 @@ extern void __init of_at91sam9x5_clk_smd_setup(struct device_node *np, + struct at91_pmc *pmc); + #endif + +-#if defined(CONFIG_HAVE_AT91_SMD) ++#if defined(CONFIG_HAVE_AT91_H32MX) + extern void __init of_sama5d4_clk_h32mx_setup(struct device_node *np, + struct at91_pmc *pmc); + #endif +diff --git a/drivers/crypto/caam/caamhash.c b/drivers/crypto/caam/caamhash.c +index f347ab7..08b0da2 100644 +--- a/drivers/crypto/caam/caamhash.c ++++ b/drivers/crypto/caam/caamhash.c +@@ -1543,6 +1543,8 @@ static int ahash_init(struct ahash_request *req) + + state->current_buf = 0; + state->buf_dma = 0; ++ state->buflen_0 = 0; ++ state->buflen_1 = 0; + + return 0; + } +diff --git a/drivers/crypto/caam/caamrng.c b/drivers/crypto/caam/caamrng.c +index ae31e55..a48dc25 100644 +--- a/drivers/crypto/caam/caamrng.c ++++ b/drivers/crypto/caam/caamrng.c +@@ -56,7 +56,7 @@ + + /* Buffer, its dma address and lock */ + struct buf_data { +- u8 buf[RN_BUF_SIZE]; ++ u8 buf[RN_BUF_SIZE] ____cacheline_aligned; + dma_addr_t addr; + struct completion filled; + u32 hw_desc[DESC_JOB_O_LEN]; +diff --git a/drivers/gpio/gpio-kempld.c b/drivers/gpio/gpio-kempld.c +index 443518f..a6b0def 100644 +--- a/drivers/gpio/gpio-kempld.c ++++ b/drivers/gpio/gpio-kempld.c +@@ -117,7 +117,7 @@ static int kempld_gpio_get_direction(struct gpio_chip *chip, unsigned offset) + = container_of(chip, struct kempld_gpio_data, chip); + struct kempld_device_data *pld = gpio->pld; + +- return kempld_gpio_get_bit(pld, KEMPLD_GPIO_DIR_NUM(offset), offset); ++ return !kempld_gpio_get_bit(pld, KEMPLD_GPIO_DIR_NUM(offset), offset); + } + + static int kempld_gpio_pincount(struct kempld_device_data *pld) +diff --git a/drivers/gpu/drm/drm_plane_helper.c b/drivers/gpu/drm/drm_plane_helper.c +index 18a1ac6..811902e 100644 +--- a/drivers/gpu/drm/drm_plane_helper.c ++++ b/drivers/gpu/drm/drm_plane_helper.c +@@ -454,6 +454,9 @@ int drm_plane_helper_commit(struct drm_plane *plane, + if (!crtc[i]) + continue; + ++ if (crtc[i]->cursor == plane) ++ continue; ++ + /* There's no other way to figure out whether the crtc is running. */ + ret = drm_crtc_vblank_get(crtc[i]); + if (ret == 0) { +diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c +index 00c8ee9..035a458 100644 +--- a/drivers/gpu/drm/i915/intel_dp.c ++++ b/drivers/gpu/drm/i915/intel_dp.c +@@ -880,10 +880,8 @@ intel_dp_aux_ch(struct intel_dp *intel_dp, + DP_AUX_CH_CTL_RECEIVE_ERROR)) + continue; + if (status & DP_AUX_CH_CTL_DONE) +- break; ++ goto done; + } +- if (status & DP_AUX_CH_CTL_DONE) +- break; + } + + if ((status & DP_AUX_CH_CTL_DONE) == 0) { +@@ -892,6 +890,7 @@ intel_dp_aux_ch(struct intel_dp *intel_dp, + goto out; + } + ++done: + /* Check for timeout or receive error. + * Timeouts occur when the sink is not connected + */ +diff --git a/drivers/gpu/drm/i915/intel_i2c.c b/drivers/gpu/drm/i915/intel_i2c.c +index 56e437e..ae62800 100644 +--- a/drivers/gpu/drm/i915/intel_i2c.c ++++ b/drivers/gpu/drm/i915/intel_i2c.c +@@ -435,7 +435,7 @@ gmbus_xfer(struct i2c_adapter *adapter, + struct intel_gmbus, + adapter); + struct drm_i915_private *dev_priv = bus->dev_priv; +- int i, reg_offset; ++ int i = 0, inc, try = 0, reg_offset; + int ret = 0; + + intel_aux_display_runtime_get(dev_priv); +@@ -448,12 +448,14 @@ gmbus_xfer(struct i2c_adapter *adapter, + + reg_offset = dev_priv->gpio_mmio_base; + ++retry: + I915_WRITE(GMBUS0 + reg_offset, bus->reg0); + +- for (i = 0; i < num; i++) { ++ for (; i < num; i += inc) { ++ inc = 1; + if (gmbus_is_index_read(msgs, i, num)) { + ret = gmbus_xfer_index_read(dev_priv, &msgs[i]); +- i += 1; /* set i to the index of the read xfer */ ++ inc = 2; /* an index read is two msgs */ + } else if (msgs[i].flags & I2C_M_RD) { + ret = gmbus_xfer_read(dev_priv, &msgs[i], 0); + } else { +@@ -525,6 +527,18 @@ clear_err: + adapter->name, msgs[i].addr, + (msgs[i].flags & I2C_M_RD) ? 'r' : 'w', msgs[i].len); + ++ /* ++ * Passive adapters sometimes NAK the first probe. Retry the first ++ * message once on -ENXIO for GMBUS transfers; the bit banging algorithm ++ * has retries internally. See also the retry loop in ++ * drm_do_probe_ddc_edid, which bails out on the first -ENXIO. ++ */ ++ if (ret == -ENXIO && i == 0 && try++ == 0) { ++ DRM_DEBUG_KMS("GMBUS [%s] NAK on first message, retry\n", ++ adapter->name); ++ goto retry; ++ } ++ + goto out; + + timeout: +diff --git a/drivers/gpu/drm/mgag200/mgag200_mode.c b/drivers/gpu/drm/mgag200/mgag200_mode.c +index 9872ba9..2ffeda3 100644 +--- a/drivers/gpu/drm/mgag200/mgag200_mode.c ++++ b/drivers/gpu/drm/mgag200/mgag200_mode.c +@@ -1526,6 +1526,11 @@ static int mga_vga_mode_valid(struct drm_connector *connector, + return MODE_BANDWIDTH; + } + ++ if ((mode->hdisplay % 8) != 0 || (mode->hsync_start % 8) != 0 || ++ (mode->hsync_end % 8) != 0 || (mode->htotal % 8) != 0) { ++ return MODE_H_ILLEGAL; ++ } ++ + if (mode->crtc_hdisplay > 2048 || mode->crtc_hsync_start > 4096 || + mode->crtc_hsync_end > 4096 || mode->crtc_htotal > 4096 || + mode->crtc_vdisplay > 2048 || mode->crtc_vsync_start > 4096 || +diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c +index 1afc0b4..9bd5611 100644 +--- a/drivers/gpu/drm/radeon/atombios_crtc.c ++++ b/drivers/gpu/drm/radeon/atombios_crtc.c +@@ -580,9 +580,6 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc, + else + radeon_crtc->pll_flags |= RADEON_PLL_PREFER_LOW_REF_DIV; + +- /* if there is no audio, set MINM_OVER_MAXP */ +- if (!drm_detect_monitor_audio(radeon_connector_edid(connector))) +- radeon_crtc->pll_flags |= RADEON_PLL_PREFER_MINM_OVER_MAXP; + if (rdev->family < CHIP_RV770) + radeon_crtc->pll_flags |= RADEON_PLL_PREFER_MINM_OVER_MAXP; + /* use frac fb div on APUs */ +diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c +index bd7519f..aa232fd 100644 +--- a/drivers/gpu/drm/radeon/radeon_device.c ++++ b/drivers/gpu/drm/radeon/radeon_device.c +@@ -1458,6 +1458,21 @@ int radeon_device_init(struct radeon_device *rdev, + if (r) + DRM_ERROR("ib ring test failed (%d).\n", r); + ++ /* ++ * Turks/Thames GPU will freeze whole laptop if DPM is not restarted ++ * after the CP ring have chew one packet at least. Hence here we stop ++ * and restart DPM after the radeon_ib_ring_tests(). ++ */ ++ if (rdev->pm.dpm_enabled && ++ (rdev->pm.pm_method == PM_METHOD_DPM) && ++ (rdev->family == CHIP_TURKS) && ++ (rdev->flags & RADEON_IS_MOBILITY)) { ++ mutex_lock(&rdev->pm.mutex); ++ radeon_dpm_disable(rdev); ++ radeon_dpm_enable(rdev); ++ mutex_unlock(&rdev->pm.mutex); ++ } ++ + if ((radeon_testing & 1)) { + if (rdev->accel_working) + radeon_test_moves(rdev); +diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c +index 686411e..b82f2dd 100644 +--- a/drivers/gpu/drm/radeon/radeon_kms.c ++++ b/drivers/gpu/drm/radeon/radeon_kms.c +@@ -547,6 +547,9 @@ static int radeon_info_ioctl(struct drm_device *dev, void *data, struct drm_file + else + *value = 1; + break; ++ case RADEON_INFO_VA_UNMAP_WORKING: ++ *value = true; ++ break; + default: + DRM_DEBUG_KMS("Invalid request %d\n", info->request); + return -EINVAL; +diff --git a/drivers/gpu/drm/radeon/radeon_vm.c b/drivers/gpu/drm/radeon/radeon_vm.c +index de42fc4..9c3377c 100644 +--- a/drivers/gpu/drm/radeon/radeon_vm.c ++++ b/drivers/gpu/drm/radeon/radeon_vm.c +@@ -458,14 +458,16 @@ int radeon_vm_bo_set_addr(struct radeon_device *rdev, + /* make sure object fit at this offset */ + eoffset = soffset + size; + if (soffset >= eoffset) { +- return -EINVAL; ++ r = -EINVAL; ++ goto error_unreserve; + } + + last_pfn = eoffset / RADEON_GPU_PAGE_SIZE; + if (last_pfn > rdev->vm_manager.max_pfn) { + dev_err(rdev->dev, "va above limit (0x%08X > 0x%08X)\n", + last_pfn, rdev->vm_manager.max_pfn); +- return -EINVAL; ++ r = -EINVAL; ++ goto error_unreserve; + } + + } else { +@@ -486,7 +488,8 @@ int radeon_vm_bo_set_addr(struct radeon_device *rdev, + "(bo %p 0x%010lx 0x%010lx)\n", bo_va->bo, + soffset, tmp->bo, tmp->it.start, tmp->it.last); + mutex_unlock(&vm->mutex); +- return -EINVAL; ++ r = -EINVAL; ++ goto error_unreserve; + } + } + +@@ -497,7 +500,8 @@ int radeon_vm_bo_set_addr(struct radeon_device *rdev, + tmp = kzalloc(sizeof(struct radeon_bo_va), GFP_KERNEL); + if (!tmp) { + mutex_unlock(&vm->mutex); +- return -ENOMEM; ++ r = -ENOMEM; ++ goto error_unreserve; + } + tmp->it.start = bo_va->it.start; + tmp->it.last = bo_va->it.last; +@@ -555,7 +559,6 @@ int radeon_vm_bo_set_addr(struct radeon_device *rdev, + r = radeon_vm_clear_bo(rdev, pt); + if (r) { + radeon_bo_unref(&pt); +- radeon_bo_reserve(bo_va->bo, false); + return r; + } + +@@ -575,6 +578,10 @@ int radeon_vm_bo_set_addr(struct radeon_device *rdev, + + mutex_unlock(&vm->mutex); + return 0; ++ ++error_unreserve: ++ radeon_bo_unreserve(bo_va->bo); ++ return r; + } + + /** +diff --git a/drivers/hv/hyperv_vmbus.h b/drivers/hv/hyperv_vmbus.h +index ce49de7..c386d8d 100644 +--- a/drivers/hv/hyperv_vmbus.h ++++ b/drivers/hv/hyperv_vmbus.h +@@ -49,17 +49,6 @@ enum hv_cpuid_function { + HVCPUID_IMPLEMENTATION_LIMITS = 0x40000005, + }; + +-#define HV_FEATURE_GUEST_CRASH_MSR_AVAILABLE 0x400 +- +-#define HV_X64_MSR_CRASH_P0 0x40000100 +-#define HV_X64_MSR_CRASH_P1 0x40000101 +-#define HV_X64_MSR_CRASH_P2 0x40000102 +-#define HV_X64_MSR_CRASH_P3 0x40000103 +-#define HV_X64_MSR_CRASH_P4 0x40000104 +-#define HV_X64_MSR_CRASH_CTL 0x40000105 +- +-#define HV_CRASH_CTL_CRASH_NOTIFY (1ULL << 63) +- + /* Define version of the synthetic interrupt controller. */ + #define HV_SYNIC_VERSION (1) + +diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c +index 3d2d710..4d6b269 100644 +--- a/drivers/hv/vmbus_drv.c ++++ b/drivers/hv/vmbus_drv.c +@@ -35,8 +35,6 @@ + #include <asm/hyperv.h> + #include <asm/hypervisor.h> + #include <asm/mshyperv.h> +-#include <linux/notifier.h> +-#include <linux/ptrace.h> + #include "hyperv_vmbus.h" + + static struct acpi_device *hv_acpi_dev; +@@ -45,31 +43,6 @@ static struct tasklet_struct msg_dpc; + static struct completion probe_event; + static int irq; + +- +-int hyperv_panic_event(struct notifier_block *nb, +- unsigned long event, void *ptr) +-{ +- struct pt_regs *regs; +- +- regs = current_pt_regs(); +- +- wrmsrl(HV_X64_MSR_CRASH_P0, regs->ip); +- wrmsrl(HV_X64_MSR_CRASH_P1, regs->ax); +- wrmsrl(HV_X64_MSR_CRASH_P2, regs->bx); +- wrmsrl(HV_X64_MSR_CRASH_P3, regs->cx); +- wrmsrl(HV_X64_MSR_CRASH_P4, regs->dx); +- +- /* +- * Let Hyper-V know there is crash data available +- */ +- wrmsrl(HV_X64_MSR_CRASH_CTL, HV_CRASH_CTL_CRASH_NOTIFY); +- return NOTIFY_DONE; +-} +- +-static struct notifier_block hyperv_panic_block = { +- .notifier_call = hyperv_panic_event, +-}; +- + struct resource hyperv_mmio = { + .name = "hyperv mmio", + .flags = IORESOURCE_MEM, +@@ -738,14 +711,6 @@ static int vmbus_bus_init(int irq) + if (ret) + goto err_alloc; + +- /* +- * Only register if the crash MSRs are available +- */ +- if (ms_hyperv.features & HV_FEATURE_GUEST_CRASH_MSR_AVAILABLE) { +- atomic_notifier_chain_register(&panic_notifier_list, +- &hyperv_panic_block); +- } +- + vmbus_request_offers(); + + return 0; +diff --git a/drivers/hwmon/nct6683.c b/drivers/hwmon/nct6683.c +index f3830db..37f0170 100644 +--- a/drivers/hwmon/nct6683.c ++++ b/drivers/hwmon/nct6683.c +@@ -439,6 +439,7 @@ nct6683_create_attr_group(struct device *dev, struct sensor_template_group *tg, + (*t)->dev_attr.attr.name, tg->base + i); + if ((*t)->s2) { + a2 = &su->u.a2; ++ sysfs_attr_init(&a2->dev_attr.attr); + a2->dev_attr.attr.name = su->name; + a2->nr = (*t)->u.s.nr + i; + a2->index = (*t)->u.s.index; +@@ -449,6 +450,7 @@ nct6683_create_attr_group(struct device *dev, struct sensor_template_group *tg, + *attrs = &a2->dev_attr.attr; + } else { + a = &su->u.a1; ++ sysfs_attr_init(&a->dev_attr.attr); + a->dev_attr.attr.name = su->name; + a->index = (*t)->u.index + i; + a->dev_attr.attr.mode = +diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c +index 1be4117..0773930 100644 +--- a/drivers/hwmon/nct6775.c ++++ b/drivers/hwmon/nct6775.c +@@ -994,6 +994,7 @@ nct6775_create_attr_group(struct device *dev, struct sensor_template_group *tg, + (*t)->dev_attr.attr.name, tg->base + i); + if ((*t)->s2) { + a2 = &su->u.a2; ++ sysfs_attr_init(&a2->dev_attr.attr); + a2->dev_attr.attr.name = su->name; + a2->nr = (*t)->u.s.nr + i; + a2->index = (*t)->u.s.index; +@@ -1004,6 +1005,7 @@ nct6775_create_attr_group(struct device *dev, struct sensor_template_group *tg, + *attrs = &a2->dev_attr.attr; + } else { + a = &su->u.a1; ++ sysfs_attr_init(&a->dev_attr.attr); + a->dev_attr.attr.name = su->name; + a->index = (*t)->u.index + i; + a->dev_attr.attr.mode = +diff --git a/drivers/hwmon/ntc_thermistor.c b/drivers/hwmon/ntc_thermistor.c +index 112e4d4..6880011 100644 +--- a/drivers/hwmon/ntc_thermistor.c ++++ b/drivers/hwmon/ntc_thermistor.c +@@ -239,8 +239,10 @@ static struct ntc_thermistor_platform_data * + ntc_thermistor_parse_dt(struct platform_device *pdev) + { + struct iio_channel *chan; ++ enum iio_chan_type type; + struct device_node *np = pdev->dev.of_node; + struct ntc_thermistor_platform_data *pdata; ++ int ret; + + if (!np) + return NULL; +@@ -253,6 +255,13 @@ ntc_thermistor_parse_dt(struct platform_device *pdev) + if (IS_ERR(chan)) + return ERR_CAST(chan); + ++ ret = iio_get_channel_type(chan, &type); ++ if (ret < 0) ++ return ERR_PTR(ret); ++ ++ if (type != IIO_VOLTAGE) ++ return ERR_PTR(-EINVAL); ++ + if (of_property_read_u32(np, "pullup-uv", &pdata->pullup_uv)) + return ERR_PTR(-ENODEV); + if (of_property_read_u32(np, "pullup-ohm", &pdata->pullup_ohm)) +diff --git a/drivers/i2c/busses/i2c-hix5hd2.c b/drivers/i2c/busses/i2c-hix5hd2.c +index 8fe78d0..7c69664 100644 +--- a/drivers/i2c/busses/i2c-hix5hd2.c ++++ b/drivers/i2c/busses/i2c-hix5hd2.c +@@ -554,4 +554,4 @@ module_platform_driver(hix5hd2_i2c_driver); + MODULE_DESCRIPTION("Hix5hd2 I2C Bus driver"); + MODULE_AUTHOR("Wei Yan <sledge.yan...@huawei.com>"); + MODULE_LICENSE("GPL"); +-MODULE_ALIAS("platform:i2c-hix5hd2"); ++MODULE_ALIAS("platform:hix5hd2-i2c"); +diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c +index 958c8db..297e9c9 100644 +--- a/drivers/i2c/busses/i2c-s3c2410.c ++++ b/drivers/i2c/busses/i2c-s3c2410.c +@@ -1143,6 +1143,7 @@ static int s3c24xx_i2c_probe(struct platform_device *pdev) + return -ENOMEM; + + i2c->quirks = s3c24xx_get_device_quirks(pdev); ++ i2c->sysreg = ERR_PTR(-ENOENT); + if (pdata) + memcpy(i2c->pdata, pdata, sizeof(*pdata)); + else +diff --git a/drivers/iio/adc/twl6030-gpadc.c b/drivers/iio/adc/twl6030-gpadc.c +index 89d8aa1..df12c57e 100644 +--- a/drivers/iio/adc/twl6030-gpadc.c ++++ b/drivers/iio/adc/twl6030-gpadc.c +@@ -1001,7 +1001,7 @@ static struct platform_driver twl6030_gpadc_driver = { + + module_platform_driver(twl6030_gpadc_driver); + +-MODULE_ALIAS("platform: " DRIVER_NAME); ++MODULE_ALIAS("platform:" DRIVER_NAME); + MODULE_AUTHOR("Balaji T K <balaj...@ti.com>"); + MODULE_AUTHOR("Graeme Gregory <g...@slimlogic.co.uk>"); + MODULE_AUTHOR("Oleksandr Kozaruk <oleksandr.koza...@ti.com"); +diff --git a/drivers/iio/imu/adis16400.h b/drivers/iio/imu/adis16400.h +index 0916bf6..73b189c 100644 +--- a/drivers/iio/imu/adis16400.h ++++ b/drivers/iio/imu/adis16400.h +@@ -139,6 +139,7 @@ + #define ADIS16400_NO_BURST BIT(1) + #define ADIS16400_HAS_SLOW_MODE BIT(2) + #define ADIS16400_HAS_SERIAL_NUMBER BIT(3) ++#define ADIS16400_BURST_DIAG_STAT BIT(4) + + struct adis16400_state; + +@@ -165,6 +166,7 @@ struct adis16400_state { + int filt_int; + + struct adis adis; ++ unsigned long avail_scan_mask[2]; + }; + + /* At the moment triggers are only used for ring buffer +diff --git a/drivers/iio/imu/adis16400_buffer.c b/drivers/iio/imu/adis16400_buffer.c +index 6e727ff..90c24a2 100644 +--- a/drivers/iio/imu/adis16400_buffer.c ++++ b/drivers/iio/imu/adis16400_buffer.c +@@ -18,7 +18,8 @@ int adis16400_update_scan_mode(struct iio_dev *indio_dev, + { + struct adis16400_state *st = iio_priv(indio_dev); + struct adis *adis = &st->adis; +- uint16_t *tx; ++ unsigned int burst_length; ++ u8 *tx; + + if (st->variant->flags & ADIS16400_NO_BURST) + return adis_update_scan_mode(indio_dev, scan_mask); +@@ -26,26 +27,29 @@ int adis16400_update_scan_mode(struct iio_dev *indio_dev, + kfree(adis->xfer); + kfree(adis->buffer); + ++ /* All but the timestamp channel */ ++ burst_length = (indio_dev->num_channels - 1) * sizeof(u16); ++ if (st->variant->flags & ADIS16400_BURST_DIAG_STAT) ++ burst_length += sizeof(u16); ++ + adis->xfer = kcalloc(2, sizeof(*adis->xfer), GFP_KERNEL); + if (!adis->xfer) + return -ENOMEM; + +- adis->buffer = kzalloc(indio_dev->scan_bytes + sizeof(u16), +- GFP_KERNEL); ++ adis->buffer = kzalloc(burst_length + sizeof(u16), GFP_KERNEL); + if (!adis->buffer) + return -ENOMEM; + +- tx = adis->buffer + indio_dev->scan_bytes; +- ++ tx = adis->buffer + burst_length; + tx[0] = ADIS_READ_REG(ADIS16400_GLOB_CMD); + tx[1] = 0; + + adis->xfer[0].tx_buf = tx; + adis->xfer[0].bits_per_word = 8; + adis->xfer[0].len = 2; +- adis->xfer[1].tx_buf = tx; ++ adis->xfer[1].rx_buf = adis->buffer; + adis->xfer[1].bits_per_word = 8; +- adis->xfer[1].len = indio_dev->scan_bytes; ++ adis->xfer[1].len = burst_length; + + spi_message_init(&adis->msg); + spi_message_add_tail(&adis->xfer[0], &adis->msg); +@@ -61,6 +65,7 @@ irqreturn_t adis16400_trigger_handler(int irq, void *p) + struct adis16400_state *st = iio_priv(indio_dev); + struct adis *adis = &st->adis; + u32 old_speed_hz = st->adis.spi->max_speed_hz; ++ void *buffer; + int ret; + + if (!adis->buffer) +@@ -81,7 +86,12 @@ irqreturn_t adis16400_trigger_handler(int irq, void *p) + spi_setup(st->adis.spi); + } + +- iio_push_to_buffers_with_timestamp(indio_dev, adis->buffer, ++ if (st->variant->flags & ADIS16400_BURST_DIAG_STAT) ++ buffer = adis->buffer + sizeof(u16); ++ else ++ buffer = adis->buffer; ++ ++ iio_push_to_buffers_with_timestamp(indio_dev, buffer, + pf->timestamp); + + iio_trigger_notify_done(indio_dev->trig); +diff --git a/drivers/iio/imu/adis16400_core.c b/drivers/iio/imu/adis16400_core.c +index fa795dc..2fd68f2 100644 +--- a/drivers/iio/imu/adis16400_core.c ++++ b/drivers/iio/imu/adis16400_core.c +@@ -405,6 +405,11 @@ static int adis16400_read_raw(struct iio_dev *indio_dev, + *val = st->variant->temp_scale_nano / 1000000; + *val2 = (st->variant->temp_scale_nano % 1000000); + return IIO_VAL_INT_PLUS_MICRO; ++ case IIO_PRESSURE: ++ /* 20 uBar = 0.002kPascal */ ++ *val = 0; ++ *val2 = 2000; ++ return IIO_VAL_INT_PLUS_MICRO; + default: + return -EINVAL; + } +@@ -454,10 +459,10 @@ static int adis16400_read_raw(struct iio_dev *indio_dev, + } + } + +-#define ADIS16400_VOLTAGE_CHAN(addr, bits, name, si) { \ ++#define ADIS16400_VOLTAGE_CHAN(addr, bits, name, si, chn) { \ + .type = IIO_VOLTAGE, \ + .indexed = 1, \ +- .channel = 0, \ ++ .channel = chn, \ + .extend_name = name, \ + .info_mask_separate = BIT(IIO_CHAN_INFO_RAW) | \ + BIT(IIO_CHAN_INFO_SCALE), \ +@@ -474,10 +479,10 @@ static int adis16400_read_raw(struct iio_dev *indio_dev, + } + + #define ADIS16400_SUPPLY_CHAN(addr, bits) \ +- ADIS16400_VOLTAGE_CHAN(addr, bits, "supply", ADIS16400_SCAN_SUPPLY) ++ ADIS16400_VOLTAGE_CHAN(addr, bits, "supply", ADIS16400_SCAN_SUPPLY, 0) + + #define ADIS16400_AUX_ADC_CHAN(addr, bits) \ +- ADIS16400_VOLTAGE_CHAN(addr, bits, NULL, ADIS16400_SCAN_ADC) ++ ADIS16400_VOLTAGE_CHAN(addr, bits, NULL, ADIS16400_SCAN_ADC, 1) + + #define ADIS16400_GYRO_CHAN(mod, addr, bits) { \ + .type = IIO_ANGL_VEL, \ +@@ -773,7 +778,8 @@ static struct adis16400_chip_info adis16400_chips[] = { + .channels = adis16448_channels, + .num_channels = ARRAY_SIZE(adis16448_channels), + .flags = ADIS16400_HAS_PROD_ID | +- ADIS16400_HAS_SERIAL_NUMBER, ++ ADIS16400_HAS_SERIAL_NUMBER | ++ ADIS16400_BURST_DIAG_STAT, + .gyro_scale_micro = IIO_DEGREE_TO_RAD(10000), /* 0.01 deg/s */ + .accel_scale_micro = IIO_G_TO_M_S_2(833), /* 1/1200 g */ + .temp_scale_nano = 73860000, /* 0.07386 C */ +@@ -791,11 +797,6 @@ static const struct iio_info adis16400_info = { + .debugfs_reg_access = adis_debugfs_reg_access, + }; + +-static const unsigned long adis16400_burst_scan_mask[] = { +- ~0UL, +- 0, +-}; +- + static const char * const adis16400_status_error_msgs[] = { + [ADIS16400_DIAG_STAT_ZACCL_FAIL] = "Z-axis accelerometer self-test failure", + [ADIS16400_DIAG_STAT_YACCL_FAIL] = "Y-axis accelerometer self-test failure", +@@ -843,6 +844,20 @@ static const struct adis_data adis16400_data = { + BIT(ADIS16400_DIAG_STAT_POWER_LOW), + }; + ++static void adis16400_setup_chan_mask(struct adis16400_state *st) ++{ ++ const struct adis16400_chip_info *chip_info = st->variant; ++ unsigned i; ++ ++ for (i = 0; i < chip_info->num_channels; i++) { ++ const struct iio_chan_spec *ch = &chip_info->channels[i]; ++ ++ if (ch->scan_index >= 0 && ++ ch->scan_index != ADIS16400_SCAN_TIMESTAMP) ++ st->avail_scan_mask[0] |= BIT(ch->scan_index); ++ } ++} ++ + static int adis16400_probe(struct spi_device *spi) + { + struct adis16400_state *st; +@@ -866,8 +881,10 @@ static int adis16400_probe(struct spi_device *spi) + indio_dev->info = &adis16400_info; + indio_dev->modes = INDIO_DIRECT_MODE; + +- if (!(st->variant->flags & ADIS16400_NO_BURST)) +- indio_dev->available_scan_masks = adis16400_burst_scan_mask; ++ if (!(st->variant->flags & ADIS16400_NO_BURST)) { ++ adis16400_setup_chan_mask(st); ++ indio_dev->available_scan_masks = st->avail_scan_mask; ++ } + + ret = adis_init(&st->adis, indio_dev, spi, &adis16400_data); + if (ret) +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c +index 72626c34..cb02466 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c +@@ -659,6 +659,24 @@ void ipoib_reap_ah(struct work_struct *work) + round_jiffies_relative(HZ)); + } + ++static void ipoib_flush_ah(struct net_device *dev, int flush) ++{ ++ struct ipoib_dev_priv *priv = netdev_priv(dev); ++ ++ cancel_delayed_work(&priv->ah_reap_task); ++ if (flush) ++ flush_workqueue(ipoib_workqueue); ++ ipoib_reap_ah(&priv->ah_reap_task.work); ++} ++ ++static void ipoib_stop_ah(struct net_device *dev, int flush) ++{ ++ struct ipoib_dev_priv *priv = netdev_priv(dev); ++ ++ set_bit(IPOIB_STOP_REAPER, &priv->flags); ++ ipoib_flush_ah(dev, flush); ++} ++ + static void ipoib_ib_tx_timer_func(unsigned long ctx) + { + drain_tx_cq((struct net_device *)ctx); +@@ -877,24 +895,7 @@ timeout: + if (ib_modify_qp(priv->qp, &qp_attr, IB_QP_STATE)) + ipoib_warn(priv, "Failed to modify QP to RESET state\n"); + +- /* Wait for all AHs to be reaped */ +- set_bit(IPOIB_STOP_REAPER, &priv->flags); +- cancel_delayed_work(&priv->ah_reap_task); +- if (flush) +- flush_workqueue(ipoib_workqueue); +- +- begin = jiffies; +- +- while (!list_empty(&priv->dead_ahs)) { +- __ipoib_reap_ah(dev); +- +- if (time_after(jiffies, begin + HZ)) { +- ipoib_warn(priv, "timing out; will leak address handles\n"); +- break; +- } +- +- msleep(1); +- } ++ ipoib_flush_ah(dev, flush); + + ib_req_notify_cq(priv->recv_cq, IB_CQ_NEXT_COMP); + +@@ -1037,6 +1038,7 @@ static void __ipoib_ib_dev_flush(struct ipoib_dev_priv *priv, + if (level == IPOIB_FLUSH_LIGHT) { + ipoib_mark_paths_invalid(dev); + ipoib_mcast_dev_flush(dev); ++ ipoib_flush_ah(dev, 0); + } + + if (level >= IPOIB_FLUSH_NORMAL) +@@ -1100,6 +1102,14 @@ void ipoib_ib_dev_cleanup(struct net_device *dev) + ipoib_mcast_stop_thread(dev, 1); + ipoib_mcast_dev_flush(dev); + ++ /* ++ * All of our ah references aren't free until after ++ * ipoib_mcast_dev_flush(), ipoib_flush_paths, and ++ * the neighbor garbage collection is stopped and reaped. ++ * That should all be done now, so make a final ah flush. ++ */ ++ ipoib_stop_ah(dev, 1); ++ + ipoib_transport_dev_cleanup(dev); + } + +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c +index 58b5aa3..002ff0d 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c +@@ -1262,15 +1262,13 @@ int ipoib_dev_init(struct net_device *dev, struct ib_device *ca, int port) + { + struct ipoib_dev_priv *priv = netdev_priv(dev); + +- if (ipoib_neigh_hash_init(priv) < 0) +- goto out; + /* Allocate RX/TX "rings" to hold queued skbs */ + priv->rx_ring = kzalloc(ipoib_recvq_size * sizeof *priv->rx_ring, + GFP_KERNEL); + if (!priv->rx_ring) { + printk(KERN_WARNING "%s: failed to allocate RX ring (%d entries)\n", + ca->name, ipoib_recvq_size); +- goto out_neigh_hash_cleanup; ++ goto out; + } + + priv->tx_ring = vzalloc(ipoib_sendq_size * sizeof *priv->tx_ring); +@@ -1285,16 +1283,24 @@ int ipoib_dev_init(struct net_device *dev, struct ib_device *ca, int port) + if (ipoib_ib_dev_init(dev, ca, port)) + goto out_tx_ring_cleanup; + ++ /* ++ * Must be after ipoib_ib_dev_init so we can allocate a per ++ * device wq there and use it here ++ */ ++ if (ipoib_neigh_hash_init(priv) < 0) ++ goto out_dev_uninit; ++ + return 0; + ++out_dev_uninit: ++ ipoib_ib_dev_cleanup(dev); ++ + out_tx_ring_cleanup: + vfree(priv->tx_ring); + + out_rx_ring_cleanup: + kfree(priv->rx_ring); + +-out_neigh_hash_cleanup: +- ipoib_neigh_hash_uninit(dev); + out: + return -ENOMEM; + } +@@ -1317,6 +1323,12 @@ void ipoib_dev_cleanup(struct net_device *dev) + } + unregister_netdevice_many(&head); + ++ /* ++ * Must be before ipoib_ib_dev_cleanup or we delete an in use ++ * work queue ++ */ ++ ipoib_neigh_hash_uninit(dev); ++ + ipoib_ib_dev_cleanup(dev); + + kfree(priv->rx_ring); +@@ -1324,8 +1336,6 @@ void ipoib_dev_cleanup(struct net_device *dev) + + priv->rx_ring = NULL; + priv->tx_ring = NULL; +- +- ipoib_neigh_hash_uninit(dev); + } + + static const struct header_ops ipoib_header_ops = { +diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c +index 0b57ba2..b7350d5 100644 +--- a/drivers/infiniband/ulp/isert/ib_isert.c ++++ b/drivers/infiniband/ulp/isert/ib_isert.c +@@ -65,6 +65,8 @@ static int + isert_rdma_accept(struct isert_conn *isert_conn); + struct rdma_cm_id *isert_setup_id(struct isert_np *isert_np); + ++static void isert_release_work(struct work_struct *work); ++ + static inline bool + isert_prot_cmd(struct isert_conn *conn, struct se_cmd *cmd) + { +@@ -604,6 +606,7 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event) + mutex_init(&isert_conn->conn_mutex); + spin_lock_init(&isert_conn->conn_lock); + INIT_LIST_HEAD(&isert_conn->conn_fr_pool); ++ INIT_WORK(&isert_conn->release_work, isert_release_work); + + isert_conn->conn_cm_id = cma_id; + +@@ -863,6 +866,7 @@ isert_disconnected_handler(struct rdma_cm_id *cma_id, + { + struct isert_np *isert_np = cma_id->context; + struct isert_conn *isert_conn; ++ bool terminating = false; + + if (isert_np->np_cm_id == cma_id) + return isert_np_cma_handler(cma_id->context, event); +@@ -870,12 +874,25 @@ isert_disconnected_handler(struct rdma_cm_id *cma_id, + isert_conn = cma_id->qp->qp_context; + + mutex_lock(&isert_conn->conn_mutex); ++ terminating = (isert_conn->state == ISER_CONN_TERMINATING); + isert_conn_terminate(isert_conn); + mutex_unlock(&isert_conn->conn_mutex); + + isert_info("conn %p completing conn_wait\n", isert_conn); + complete(&isert_conn->conn_wait); + ++ if (terminating) ++ goto out; ++ ++ mutex_lock(&isert_np->np_accept_mutex); ++ if (!list_empty(&isert_conn->conn_accept_node)) { ++ list_del_init(&isert_conn->conn_accept_node); ++ isert_put_conn(isert_conn); ++ queue_work(isert_release_wq, &isert_conn->release_work); ++ } ++ mutex_unlock(&isert_np->np_accept_mutex); ++ ++out: + return 0; + } + +@@ -2303,7 +2320,6 @@ isert_build_rdma_wr(struct isert_conn *isert_conn, struct isert_cmd *isert_cmd, + page_off = offset % PAGE_SIZE; + + send_wr->sg_list = ib_sge; +- send_wr->num_sge = sg_nents; + send_wr->wr_id = (uintptr_t)&isert_cmd->tx_desc; + /* + * Perform mapping of TCM scatterlist memory ib_sge dma_addr. +@@ -2323,14 +2339,17 @@ isert_build_rdma_wr(struct isert_conn *isert_conn, struct isert_cmd *isert_cmd, + ib_sge->addr, ib_sge->length, ib_sge->lkey); + page_off = 0; + data_left -= ib_sge->length; ++ if (!data_left) ++ break; + ib_sge++; + isert_dbg("Incrementing ib_sge pointer to %p\n", ib_sge); + } + ++ send_wr->num_sge = ++i; + isert_dbg("Set outgoing sg_list: %p num_sg: %u from TCM SGLs\n", + send_wr->sg_list, send_wr->num_sge); + +- return sg_nents; ++ return send_wr->num_sge; + } + + static int +@@ -3290,7 +3309,6 @@ static void isert_wait_conn(struct iscsi_conn *conn) + isert_wait4flush(isert_conn); + isert_wait4logout(isert_conn); + +- INIT_WORK(&isert_conn->release_work, isert_release_work); + queue_work(isert_release_wq, &isert_conn->release_work); + } + +@@ -3298,6 +3316,7 @@ static void isert_free_conn(struct iscsi_conn *conn) + { + struct isert_conn *isert_conn = conn->context; + ++ isert_wait4flush(isert_conn); + isert_put_conn(isert_conn); + } + +diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c +index d88d73d..7dc514f 100644 +--- a/drivers/input/mouse/alps.c ++++ b/drivers/input/mouse/alps.c +@@ -1046,9 +1046,8 @@ static void alps_process_trackstick_packet_v7(struct psmouse *psmouse) + right = (packet[1] & 0x02) >> 1; + middle = (packet[1] & 0x04) >> 2; + +- /* Divide 2 since trackpoint's speed is too fast */ +- input_report_rel(dev2, REL_X, (char)x / 2); +- input_report_rel(dev2, REL_Y, -((char)y / 2)); ++ input_report_rel(dev2, REL_X, (char)x); ++ input_report_rel(dev2, REL_Y, -((char)y)); + + input_report_key(dev2, BTN_LEFT, left); + input_report_key(dev2, BTN_RIGHT, right); +diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c +index 79363b6..ce3d400 100644 +--- a/drivers/input/mouse/elantech.c ++++ b/drivers/input/mouse/elantech.c +@@ -1376,10 +1376,11 @@ static bool elantech_is_signature_valid(const unsigned char *param) + return true; + + /* +- * Some models have a revision higher then 20. Meaning param[2] may +- * be 10 or 20, skip the rates check for these. ++ * Some hw_version >= 4 models have a revision higher then 20. Meaning ++ * that param[2] may be 10 or 20, skip the rates check for these. + */ +- if (param[0] == 0x46 && (param[1] & 0xef) == 0x0f && param[2] < 40) ++ if ((param[0] & 0x0f) >= 0x06 && (param[1] & 0xaf) == 0x0f && ++ param[2] < 40) + return true; + + for (i = 0; i < ARRAY_SIZE(rates); i++) +@@ -1555,6 +1556,7 @@ static int elantech_set_properties(struct elantech_data *etd) + case 9: + case 10: + case 13: ++ case 14: + etd->hw_version = 4; + break; + default: +diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c +index 2176874..826ef3d 100644 +--- a/drivers/input/mouse/synaptics.c ++++ b/drivers/input/mouse/synaptics.c +@@ -148,6 +148,11 @@ static const struct min_max_quirk min_max_pnpid_table[] = { + 1024, 5112, 2024, 4832 + }, + { ++ (const char * const []){"LEN2000", NULL}, ++ {ANY_BOARD_ID, ANY_BOARD_ID}, ++ 1024, 5113, 2021, 4832 ++ }, ++ { + (const char * const []){"LEN2001", NULL}, + {ANY_BOARD_ID, ANY_BOARD_ID}, + 1024, 5022, 2508, 4832 +@@ -185,7 +190,7 @@ static const char * const topbuttonpad_pnp_ids[] = { + "LEN0047", + "LEN0048", + "LEN0049", +- "LEN2000", ++ "LEN2000", /* S540 */ + "LEN2001", /* Edge E431 */ + "LEN2002", /* Edge E531 */ + "LEN2003", +diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c +index 8dd078b..39b4dfd 100644 +--- a/drivers/iommu/intel-iommu.c ++++ b/drivers/iommu/intel-iommu.c +@@ -50,6 +50,7 @@ + #define CONTEXT_SIZE VTD_PAGE_SIZE + + #define IS_GFX_DEVICE(pdev) ((pdev->class >> 16) == PCI_BASE_CLASS_DISPLAY) ++#define IS_USB_DEVICE(pdev) ((pdev->class >> 8) == PCI_CLASS_SERIAL_USB) + #define IS_ISA_DEVICE(pdev) ((pdev->class >> 8) == PCI_CLASS_BRIDGE_ISA) + #define IS_AZALIA(pdev) ((pdev)->vendor == 0x8086 && (pdev)->device == 0x3a3e) + +@@ -680,6 +681,11 @@ static void domain_update_iommu_cap(struct dmar_domain *domain) + domain->iommu_superpage = domain_update_iommu_superpage(NULL); + } + ++static int iommu_dummy(struct device *dev) ++{ ++ return dev->archdata.iommu == DUMMY_DEVICE_DOMAIN_INFO; ++} ++ + static struct intel_iommu *device_to_iommu(struct device *dev, u8 *bus, u8 *devfn) + { + struct dmar_drhd_unit *drhd = NULL; +@@ -689,6 +695,9 @@ static struct intel_iommu *device_to_iommu(struct device *dev, u8 *bus, u8 *devf + u16 segment = 0; + int i; + ++ if (iommu_dummy(dev)) ++ return NULL; ++ + if (dev_is_pci(dev)) { + pdev = to_pci_dev(dev); + segment = pci_domain_nr(pdev->bus); +@@ -2561,6 +2570,10 @@ static bool device_has_rmrr(struct device *dev) + * In both cases we assume that PCI USB devices with RMRRs have them largely + * for historical reasons and that the RMRR space is not actively used post + * boot. This exclusion may change if vendors begin to abuse it. ++ * ++ * The same exception is made for graphics devices, with the requirement that ++ * any use of the RMRR regions will be torn down before assigning the device ++ * to a guest. + */ + static bool device_is_rmrr_locked(struct device *dev) + { +@@ -2570,7 +2583,7 @@ static bool device_is_rmrr_locked(struct device *dev) + if (dev_is_pci(dev)) { + struct pci_dev *pdev = to_pci_dev(dev); + +- if ((pdev->class >> 8) == PCI_CLASS_SERIAL_USB) ++ if (IS_USB_DEVICE(pdev) || IS_GFX_DEVICE(pdev)) + return false; + } + +@@ -2976,11 +2989,6 @@ static inline struct dmar_domain *get_valid_domain_for_dev(struct device *dev) + return __get_valid_domain_for_dev(dev); + } + +-static int iommu_dummy(struct device *dev) +-{ +- return dev->archdata.iommu == DUMMY_DEVICE_DOMAIN_INFO; +-} +- + /* Check if the dev needs to go through non-identity map and unmap process.*/ + static int iommu_no_mapping(struct device *dev) + { +diff --git a/drivers/irqchip/irq-sunxi-nmi.c b/drivers/irqchip/irq-sunxi-nmi.c +index 4a9ce5b..6b2b582 100644 +--- a/drivers/irqchip/irq-sunxi-nmi.c ++++ b/drivers/irqchip/irq-sunxi-nmi.c +@@ -104,7 +104,7 @@ static int sunxi_sc_nmi_set_type(struct irq_data *data, unsigned int flow_type) + irqd_set_trigger_type(data, flow_type); + irq_setup_alt_chip(data, flow_type); + +- for (i = 0; i <= gc->num_ct; i++, ct++) ++ for (i = 0; i < gc->num_ct; i++, ct++) + if (ct->type & flow_type) + ctrl_off = ct->regs.type; + +diff --git a/drivers/lguest/core.c b/drivers/lguest/core.c +index 6590558..ed70f1e 100644 +--- a/drivers/lguest/core.c ++++ b/drivers/lguest/core.c +@@ -173,7 +173,7 @@ static void unmap_switcher(void) + bool lguest_address_ok(const struct lguest *lg, + unsigned long addr, unsigned long len) + { +- return (addr+len) / PAGE_SIZE < lg->pfn_limit && (addr+len >= addr); ++ return addr+len <= lg->pfn_limit * PAGE_SIZE && (addr+len >= addr); + } + + /* +diff --git a/drivers/md/dm.c b/drivers/md/dm.c +index b71c600..a367a17 100644 +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -1596,8 +1596,7 @@ static int dm_merge_bvec(struct request_queue *q, + struct mapped_device *md = q->queuedata; + struct dm_table *map = dm_get_live_table_fast(md); + struct dm_target *ti; +- sector_t max_sectors; +- int max_size = 0; ++ sector_t max_sectors, max_size = 0; + + if (unlikely(!map)) + goto out; +@@ -1612,8 +1611,16 @@ static int dm_merge_bvec(struct request_queue *q, + max_sectors = min(max_io_len(bvm->bi_sector, ti), + (sector_t) queue_max_sectors(q)); + max_size = (max_sectors << SECTOR_SHIFT) - bvm->bi_size; +- if (unlikely(max_size < 0)) /* this shouldn't _ever_ happen */ +- max_size = 0; ++ ++ /* ++ * FIXME: this stop-gap fix _must_ be cleaned up (by passing a sector_t ++ * to the targets' merge function since it holds sectors not bytes). ++ * Just doing this as an interim fix for stable@ because the more ++ * comprehensive cleanup of switching to sector_t will impact every ++ * DM target that implements a ->merge hook. ++ */ ++ if (max_size > INT_MAX) ++ max_size = INT_MAX; + + /* + * merge_bvec_fn() returns number of bytes +@@ -1621,7 +1628,7 @@ static int dm_merge_bvec(struct request_queue *q, + * max is precomputed maximal io size + */ + if (max_size && ti->type->merge) +- max_size = ti->type->merge(ti, bvm, biovec, max_size); ++ max_size = ti->type->merge(ti, bvm, biovec, (int) max_size); + /* + * If the target doesn't support merge method and some of the devices + * provided their merge_bvec method (we know this by looking for the +diff --git a/drivers/mfd/da9052-core.c b/drivers/mfd/da9052-core.c +index ae498b5..46e3840 100644 +--- a/drivers/mfd/da9052-core.c ++++ b/drivers/mfd/da9052-core.c +@@ -433,6 +433,10 @@ EXPORT_SYMBOL_GPL(da9052_adc_read_temp); + static const struct mfd_cell da9052_subdev_info[] = { + { + .name = "da9052-regulator", ++ .id = 0, ++ }, ++ { ++ .name = "da9052-regulator", + .id = 1, + }, + { +@@ -484,10 +488,6 @@ static const struct mfd_cell da9052_subdev_info[] = { + .id = 13, + }, + { +- .name = "da9052-regulator", +- .id = 14, +- }, +- { + .name = "da9052-onkey", + }, + { +diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c +index 446889c..f2a8245 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c +@@ -288,9 +288,6 @@ int bcmgenet_mii_config(struct net_device *dev, bool init) + phy_name = "external RGMII (no delay)"; + else + phy_name = "external RGMII (TX delay)"; +- reg = bcmgenet_ext_readl(priv, EXT_RGMII_OOB_CTRL); +- reg |= RGMII_MODE_EN | id_mode_dis; +- bcmgenet_ext_writel(priv, reg, EXT_RGMII_OOB_CTRL); + bcmgenet_sys_writel(priv, + PORT_MODE_EXT_GPHY, SYS_PORT_CTRL); + break; +@@ -299,6 +296,15 @@ int bcmgenet_mii_config(struct net_device *dev, bool init) + return -EINVAL; + } + ++ /* This is an external PHY (xMII), so we need to enable the RGMII ++ * block for the interface to work ++ */ ++ if (priv->ext_phy) { ++ reg = bcmgenet_ext_readl(priv, EXT_RGMII_OOB_CTRL); ++ reg |= RGMII_MODE_EN | id_mode_dis; ++ bcmgenet_ext_writel(priv, reg, EXT_RGMII_OOB_CTRL); ++ } ++ + if (init) + dev_info(kdev, "configuring instance for %s\n", phy_name); + +diff --git a/drivers/net/phy/bcm7xxx.c b/drivers/net/phy/bcm7xxx.c +index 974ec45..a1ea2aa 100644 +--- a/drivers/net/phy/bcm7xxx.c ++++ b/drivers/net/phy/bcm7xxx.c +@@ -403,7 +403,7 @@ static struct phy_driver bcm7xxx_driver[] = { + .name = "Broadcom BCM7425", + .features = PHY_GBIT_FEATURES | + SUPPORTED_Pause | SUPPORTED_Asym_Pause, +- .flags = 0, ++ .flags = PHY_IS_INTERNAL, + .config_init = bcm7xxx_config_init, + .config_aneg = genphy_config_aneg, + .read_status = genphy_read_status, +diff --git a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c +index 456944a..3afddf9 100644 +--- a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c ++++ b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c +@@ -510,11 +510,9 @@ static int brcmf_msgbuf_query_dcmd(struct brcmf_pub *drvr, int ifidx, + msgbuf->rx_pktids, + msgbuf->ioctl_resp_pktid); + if (msgbuf->ioctl_resp_ret_len != 0) { +- if (!skb) { +- brcmf_err("Invalid packet id idx recv'd %d\n", +- msgbuf->ioctl_resp_pktid); ++ if (!skb) + return -EBADF; +- } ++ + memcpy(buf, skb->data, (len < msgbuf->ioctl_resp_ret_len) ? + len : msgbuf->ioctl_resp_ret_len); + } +@@ -865,10 +863,8 @@ brcmf_msgbuf_process_txstatus(struct brcmf_msgbuf *msgbuf, void *buf) + flowid -= BRCMF_NROF_H2D_COMMON_MSGRINGS; + skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev, + msgbuf->tx_pktids, idx); +- if (!skb) { +- brcmf_err("Invalid packet id idx recv'd %d\n", idx); ++ if (!skb) + return; +- } + + set_bit(flowid, msgbuf->txstatus_done_map); + +@@ -1145,6 +1141,8 @@ brcmf_msgbuf_process_rx_complete(struct brcmf_msgbuf *msgbuf, void *buf) + + skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev, + msgbuf->rx_pktids, idx); ++ if (!skb) ++ return; + + if (data_offset) + skb_pull(skb, data_offset); +diff --git a/drivers/net/wireless/iwlwifi/mvm/d3.c b/drivers/net/wireless/iwlwifi/mvm/d3.c +index 744de26..185ff7b 100644 +--- a/drivers/net/wireless/iwlwifi/mvm/d3.c ++++ b/drivers/net/wireless/iwlwifi/mvm/d3.c +@@ -1711,8 +1711,10 @@ static void iwl_mvm_query_netdetect_reasons(struct iwl_mvm *mvm, + int i, j, n_matches, ret; + + fw_status = iwl_mvm_get_wakeup_status(mvm, vif); +- if (!IS_ERR_OR_NULL(fw_status)) ++ if (!IS_ERR_OR_NULL(fw_status)) { + reasons = le32_to_cpu(fw_status->wakeup_reasons); ++ kfree(fw_status); ++ } + + if (reasons & IWL_WOWLAN_WAKEUP_BY_RFKILL_DEASSERTED) + wakeup.rfkill_release = true; +@@ -1829,15 +1831,15 @@ static int __iwl_mvm_resume(struct iwl_mvm *mvm, bool test) + /* get the BSS vif pointer again */ + vif = iwl_mvm_get_bss_vif(mvm); + if (IS_ERR_OR_NULL(vif)) +- goto out_unlock; ++ goto err; + + ret = iwl_trans_d3_resume(mvm->trans, &d3_status, test); + if (ret) +- goto out_unlock; ++ goto err; + + if (d3_status != IWL_D3_STATUS_ALIVE) { + IWL_INFO(mvm, "Device was reset during suspend\n"); +- goto out_unlock; ++ goto err; + } + + /* query SRAM first in case we want event logging */ +@@ -1855,7 +1857,8 @@ static int __iwl_mvm_resume(struct iwl_mvm *mvm, bool test) + /* has unlocked the mutex, so skip that */ + goto out; + +- out_unlock: ++err: ++ iwl_mvm_free_nd(mvm); + mutex_unlock(&mvm->mutex); + + out: +diff --git a/drivers/of/dynamic.c b/drivers/of/dynamic.c +index 3351ef4..53826b8 100644 +--- a/drivers/of/dynamic.c ++++ b/drivers/of/dynamic.c +@@ -225,7 +225,7 @@ void __of_attach_node(struct device_node *np) + phandle = __of_get_property(np, "phandle", &sz); + if (!phandle) + phandle = __of_get_property(np, "linux,phandle", &sz); +- if (IS_ENABLED(PPC_PSERIES) && !phandle) ++ if (IS_ENABLED(CONFIG_PPC_PSERIES) && !phandle) + phandle = __of_get_property(np, "ibm,phandle", &sz); + np->phandle = (phandle && (sz >= 4)) ? be32_to_cpup(phandle) : 0; + +diff --git a/drivers/regulator/da9052-regulator.c b/drivers/regulator/da9052-regulator.c +index 8a4df7a..e628d4c 100644 +--- a/drivers/regulator/da9052-regulator.c ++++ b/drivers/regulator/da9052-regulator.c +@@ -394,6 +394,7 @@ static inline struct da9052_regulator_info *find_regulator_info(u8 chip_id, + + static int da9052_regulator_probe(struct platform_device *pdev) + { ++ const struct mfd_cell *cell = mfd_get_cell(pdev); + struct regulator_config config = { }; + struct da9052_regulator *regulator; + struct da9052 *da9052; +@@ -409,7 +410,7 @@ static int da9052_regulator_probe(struct platform_device *pdev) + regulator->da9052 = da9052; + + regulator->info = find_regulator_info(regulator->da9052->chip_id, +- pdev->id); ++ cell->id); + if (regulator->info == NULL) { + dev_err(&pdev->dev, "invalid regulator ID specified\n"); + return -EINVAL; +@@ -419,7 +420,7 @@ static int da9052_regulator_probe(struct platform_device *pdev) + config.driver_data = regulator; + config.regmap = da9052->regmap; + if (pdata && pdata->regulators) { +- config.init_data = pdata->regulators[pdev->id]; ++ config.init_data = pdata->regulators[cell->id]; + } else { + #ifdef CONFIG_OF + struct device_node *nproot = da9052->dev->of_node; +diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c +index f6c954c..4073869 100644 +--- a/drivers/target/target_core_pscsi.c ++++ b/drivers/target/target_core_pscsi.c +@@ -521,6 +521,7 @@ static int pscsi_configure_device(struct se_device *dev) + " pdv_host_id: %d\n", pdv->pdv_host_id); + return -EINVAL; + } ++ pdv->pdv_lld_host = sh; + } + } else { + if (phv->phv_mode == PHV_VIRTUAL_HOST_ID) { +@@ -603,6 +604,8 @@ static void pscsi_free_device(struct se_device *dev) + if ((phv->phv_mode == PHV_LLD_SCSI_HOST_NO) && + (phv->phv_lld_host != NULL)) + scsi_host_put(phv->phv_lld_host); ++ else if (pdv->pdv_lld_host) ++ scsi_host_put(pdv->pdv_lld_host); + + if ((sd->type == TYPE_DISK) || (sd->type == TYPE_ROM)) + scsi_device_put(sd); +diff --git a/drivers/target/target_core_pscsi.h b/drivers/target/target_core_pscsi.h +index 1bd757d..820d305 100644 +--- a/drivers/target/target_core_pscsi.h ++++ b/drivers/target/target_core_pscsi.h +@@ -45,6 +45,7 @@ struct pscsi_dev_virt { + int pdv_lun_id; + struct block_device *pdv_bd; + struct scsi_device *pdv_sd; ++ struct Scsi_Host *pdv_lld_host; + } ____cacheline_aligned; + + typedef enum phv_modes { +diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c +index f9d9ed3..3ecbd91 100644 +--- a/drivers/tty/n_tty.c ++++ b/drivers/tty/n_tty.c +@@ -161,6 +161,17 @@ static inline int tty_put_user(struct tty_struct *tty, unsigned char x, + return put_user(x, ptr); + } + ++static inline int tty_copy_to_user(struct tty_struct *tty, ++ void __user *to, ++ const void *from, ++ unsigned long n) ++{ ++ struct n_tty_data *ldata = tty->disc_data; ++ ++ tty_audit_add_data(tty, to, n, ldata->icanon); ++ return copy_to_user(to, from, n); ++} ++ + static int receive_room(struct tty_struct *tty) + { + struct n_tty_data *ldata = tty->disc_data; +@@ -2093,12 +2104,12 @@ static int canon_copy_from_read_buf(struct tty_struct *tty, + __func__, eol, found, n, c, size, more); + + if (n > size) { +- ret = copy_to_user(*b, read_buf_addr(ldata, tail), size); ++ ret = tty_copy_to_user(tty, *b, read_buf_addr(ldata, tail), size); + if (ret) + return -EFAULT; +- ret = copy_to_user(*b + size, ldata->read_buf, n - size); ++ ret = tty_copy_to_user(tty, *b + size, ldata->read_buf, n - size); + } else +- ret = copy_to_user(*b, read_buf_addr(ldata, tail), n); ++ ret = tty_copy_to_user(tty, *b, read_buf_addr(ldata, tail), n); + + if (ret) + return -EFAULT; +diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c +index 4c5e909..7c14e40 100644 +--- a/drivers/tty/serial/imx.c ++++ b/drivers/tty/serial/imx.c +@@ -907,6 +907,14 @@ static void dma_rx_callback(void *data) + + status = dmaengine_tx_status(chan, (dma_cookie_t)0, &state); + count = RX_BUF_SIZE - state.residue; ++ ++ if (readl(sport->port.membase + USR2) & USR2_IDLE) { ++ /* In condition [3] the SDMA counted up too early */ ++ count--; ++ ++ writel(USR2_IDLE, sport->port.membase + USR2); ++ } ++ + dev_dbg(sport->port.dev, "We get %d bytes.\n", count); + + if (count) { +diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h +index 4bb9aa6..192396c 100644 +--- a/drivers/usb/dwc3/core.h ++++ b/drivers/usb/dwc3/core.h +@@ -339,7 +339,7 @@ + #define DWC3_DGCMD_SET_ENDPOINT_NRDY 0x0c + #define DWC3_DGCMD_RUN_SOC_BUS_LOOPBACK 0x10 + +-#define DWC3_DGCMD_STATUS(n) (((n) >> 15) & 1) ++#define DWC3_DGCMD_STATUS(n) (((n) >> 12) & 0x0F) + #define DWC3_DGCMD_CMDACT (1 << 10) + #define DWC3_DGCMD_CMDIOC (1 << 8) + +@@ -355,7 +355,7 @@ + #define DWC3_DEPCMD_PARAM_SHIFT 16 + #define DWC3_DEPCMD_PARAM(x) ((x) << DWC3_DEPCMD_PARAM_SHIFT) + #define DWC3_DEPCMD_GET_RSC_IDX(x) (((x) >> DWC3_DEPCMD_PARAM_SHIFT) & 0x7f) +-#define DWC3_DEPCMD_STATUS(x) (((x) >> 15) & 1) ++#define DWC3_DEPCMD_STATUS(x) (((x) >> 12) & 0x0F) + #define DWC3_DEPCMD_HIPRI_FORCERM (1 << 11) + #define DWC3_DEPCMD_CMDACT (1 << 10) + #define DWC3_DEPCMD_CMDIOC (1 << 8) +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index c50d8d2..ee1cc0f 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -3686,18 +3686,21 @@ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev) + { + struct xhci_hcd *xhci = hcd_to_xhci(hcd); + unsigned long flags; +- int ret; ++ int ret, slot_id; + struct xhci_command *command; + + command = xhci_alloc_command(xhci, false, false, GFP_KERNEL); + if (!command) + return 0; + ++ /* xhci->slot_id and xhci->addr_dev are not thread-safe */ ++ mutex_lock(&xhci->mutex); + spin_lock_irqsave(&xhci->lock, flags); + command->completion = &xhci->addr_dev; + ret = xhci_queue_slot_control(xhci, command, TRB_ENABLE_SLOT, 0); + if (ret) { + spin_unlock_irqrestore(&xhci->lock, flags); ++ mutex_unlock(&xhci->mutex); + xhci_dbg(xhci, "FIXME: allocate a command ring segment\n"); + kfree(command); + return 0; +@@ -3706,8 +3709,10 @@ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev) + spin_unlock_irqrestore(&xhci->lock, flags); + + wait_for_completion(command->completion); ++ slot_id = xhci->slot_id; ++ mutex_unlock(&xhci->mutex); + +- if (!xhci->slot_id || command->status != COMP_SUCCESS) { ++ if (!slot_id || command->status != COMP_SUCCESS) { + xhci_err(xhci, "Error while assigning device slot ID\n"); + xhci_err(xhci, "Max number of devices this xHCI host supports is %u.\n", + HCS_MAX_SLOTS( +@@ -3732,11 +3737,11 @@ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev) + * xhci_discover_or_reset_device(), which may be called as part of + * mass storage driver error handling. + */ +- if (!xhci_alloc_virt_device(xhci, xhci->slot_id, udev, GFP_NOIO)) { ++ if (!xhci_alloc_virt_device(xhci, slot_id, udev, GFP_NOIO)) { + xhci_warn(xhci, "Could not allocate xHCI USB device data structures\n"); + goto disable_slot; + } +- udev->slot_id = xhci->slot_id; ++ udev->slot_id = slot_id; + + #ifndef CONFIG_USB_DEFAULT_PERSIST + /* +@@ -3782,12 +3787,15 @@ static int xhci_setup_device(struct usb_hcd *hcd, struct usb_device *udev, + struct xhci_slot_ctx *slot_ctx; + struct xhci_input_control_ctx *ctrl_ctx; + u64 temp_64; +- struct xhci_command *command; ++ struct xhci_command *command = NULL; ++ ++ mutex_lock(&xhci->mutex); + + if (!udev->slot_id) { + xhci_dbg_trace(xhci, trace_xhci_dbg_address, + "Bad Slot ID %d", udev->slot_id); +- return -EINVAL; ++ ret = -EINVAL; ++ goto out; + } + + virt_dev = xhci->devs[udev->slot_id]; +@@ -3800,7 +3808,8 @@ static int xhci_setup_device(struct usb_hcd *hcd, struct usb_device *udev, + */ + xhci_warn(xhci, "Virt dev invalid for slot_id 0x%x!\n", + udev->slot_id); +- return -EINVAL; ++ ret = -EINVAL; ++ goto out; + } + + if (setup == SETUP_CONTEXT_ONLY) { +@@ -3808,13 +3817,15 @@ static int xhci_setup_device(struct usb_hcd *hcd, struct usb_device *udev, + if (GET_SLOT_STATE(le32_to_cpu(slot_ctx->dev_state)) == + SLOT_STATE_DEFAULT) { + xhci_dbg(xhci, "Slot already in default state\n"); +- return 0; ++ goto out; + } + } + + command = xhci_alloc_command(xhci, false, false, GFP_KERNEL); +- if (!command) +- return -ENOMEM; ++ if (!command) { ++ ret = -ENOMEM; ++ goto out; ++ } + + command->in_ctx = virt_dev->in_ctx; + command->completion = &xhci->addr_dev; +@@ -3824,8 +3835,8 @@ static int xhci_setup_device(struct usb_hcd *hcd, struct usb_device *udev, + if (!ctrl_ctx) { + xhci_warn(xhci, "%s: Could not get input context, bad type.\n", + __func__); +- kfree(command); +- return -EINVAL; ++ ret = -EINVAL; ++ goto out; + } + /* + * If this is the first Set Address since device plug-in or +@@ -3852,8 +3863,7 @@ static int xhci_setup_device(struct usb_hcd *hcd, struct usb_device *udev, + spin_unlock_irqrestore(&xhci->lock, flags); + xhci_dbg_trace(xhci, trace_xhci_dbg_address, + "FIXME: allocate a command ring segment"); +- kfree(command); +- return ret; ++ goto out; + } + xhci_ring_cmd_db(xhci); + spin_unlock_irqrestore(&xhci->lock, flags); +@@ -3900,10 +3910,8 @@ static int xhci_setup_device(struct usb_hcd *hcd, struct usb_device *udev, + ret = -EINVAL; + break; + } +- if (ret) { +- kfree(command); +- return ret; +- } ++ if (ret) ++ goto out; + temp_64 = xhci_read_64(xhci, &xhci->op_regs->dcbaa_ptr); + xhci_dbg_trace(xhci, trace_xhci_dbg_address, + "Op regs DCBAA ptr = %#016llx", temp_64); +@@ -3936,8 +3944,10 @@ static int xhci_setup_device(struct usb_hcd *hcd, struct usb_device *udev, + xhci_dbg_trace(xhci, trace_xhci_dbg_address, + "Internal device address = %d", + le32_to_cpu(slot_ctx->dev_state) & DEV_ADDR_MASK); ++out: ++ mutex_unlock(&xhci->mutex); + kfree(command); +- return 0; ++ return ret; + } + + int xhci_address_device(struct usb_hcd *hcd, struct usb_device *udev) +@@ -4859,6 +4869,7 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks) + return 0; + } + ++ mutex_init(&xhci->mutex); + xhci->cap_regs = hcd->regs; + xhci->op_regs = hcd->regs + + HC_LENGTH(readl(&xhci->cap_regs->hc_capbase)); +@@ -5011,4 +5022,12 @@ static int __init xhci_hcd_init(void) + BUILD_BUG_ON(sizeof(struct xhci_run_regs) != (8+8*128)*32/8); + return 0; + } ++ ++/* ++ * If an init function is provided, an exit function must also be provided ++ * to allow module unload. ++ */ ++static void __exit xhci_hcd_fini(void) { } ++ + module_init(xhci_hcd_init); ++module_exit(xhci_hcd_fini); +diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h +index 30d1f97..35a1eaf 100644 +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -1497,6 +1497,8 @@ struct xhci_hcd { + struct list_head lpm_failed_devs; + + /* slot enabling and address device helpers */ ++ /* these are not thread safe so use mutex */ ++ struct mutex mutex; + struct completion addr_dev; + int slot_id; + /* For USB 3.0 LPM enable/disable. */ +diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c +index fa51858..f6cd868 100644 +--- a/drivers/usb/musb/musb_core.c ++++ b/drivers/usb/musb/musb_core.c +@@ -2023,13 +2023,7 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl) + if (musb->ops->quirks) + musb->io.quirks = musb->ops->quirks; + +- /* At least tusb6010 has it's own offsets.. */ +- if (musb->ops->ep_offset) +- musb->io.ep_offset = musb->ops->ep_offset; +- if (musb->ops->ep_select) +- musb->io.ep_select = musb->ops->ep_select; +- +- /* ..and some devices use indexed offset or flat offset */ ++ /* Most devices use indexed offset or flat offset */ + if (musb->io.quirks & MUSB_INDEXED_EP) { + musb->io.ep_offset = musb_indexed_ep_offset; + musb->io.ep_select = musb_indexed_ep_select; +@@ -2038,6 +2032,12 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl) + musb->io.ep_select = musb_flat_ep_select; + } + ++ /* At least tusb6010 has its own offsets */ ++ if (musb->ops->ep_offset) ++ musb->io.ep_offset = musb->ops->ep_offset; ++ if (musb->ops->ep_select) ++ musb->io.ep_select = musb->ops->ep_select; ++ + if (musb->ops->fifo_mode) + fifo_mode = musb->ops->fifo_mode; + else +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index 9031750..ffd739e 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -128,6 +128,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */ + { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */ + { USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */ ++ { USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */ + { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */ + { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */ + { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */ +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index 8eb68a3..4c8b3b8 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -699,6 +699,7 @@ static const struct usb_device_id id_table_combined[] = { + { USB_DEVICE(XSENS_VID, XSENS_AWINDA_DONGLE_PID) }, + { USB_DEVICE(XSENS_VID, XSENS_AWINDA_STATION_PID) }, + { USB_DEVICE(XSENS_VID, XSENS_CONVERTER_PID) }, ++ { USB_DEVICE(XSENS_VID, XSENS_MTDEVBOARD_PID) }, + { USB_DEVICE(XSENS_VID, XSENS_MTW_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_OMNI1509) }, + { USB_DEVICE(MOBILITY_VID, MOBILITY_USB_SERIAL_PID) }, +diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h +index 4e4f46f..792e054 100644 +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -155,6 +155,7 @@ + #define XSENS_AWINDA_STATION_PID 0x0101 + #define XSENS_AWINDA_DONGLE_PID 0x0102 + #define XSENS_MTW_PID 0x0200 /* Xsens MTw */ ++#define XSENS_MTDEVBOARD_PID 0x0300 /* Motion Tracker Development Board */ + #define XSENS_CONVERTER_PID 0xD00D /* Xsens USB-serial converter */ + + /* Xsens devices using FTDI VID */ +diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c +index 9756f21..ea75707 100644 +--- a/drivers/virtio/virtio_pci_common.c ++++ b/drivers/virtio/virtio_pci_common.c +@@ -415,6 +415,7 @@ int vp_set_vq_affinity(struct virtqueue *vq, int cpu) + if (cpu == -1) + irq_set_affinity_hint(irq, NULL); + else { ++ cpumask_clear(mask); + cpumask_set_cpu(cpu, mask); + irq_set_affinity_hint(irq, mask); + } +diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c +index d925f55..8081aba 100644 +--- a/fs/binfmt_elf.c ++++ b/fs/binfmt_elf.c +@@ -928,7 +928,7 @@ static int load_elf_binary(struct linux_binprm *bprm) + total_size = total_mapping_size(elf_phdata, + loc->elf_ex.e_phnum); + if (!total_size) { +- error = -EINVAL; ++ retval = -EINVAL; + goto out_free_dentry; + } + } +diff --git a/fs/dcache.c b/fs/dcache.c +index e368d4f..aa8ff8d 100644 +--- a/fs/dcache.c ++++ b/fs/dcache.c +@@ -1094,13 +1094,13 @@ ascend: + /* might go back up the wrong parent if we have had a rename. */ + if (need_seqretry(&rename_lock, seq)) + goto rename_retry; +- next = child->d_child.next; +- while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) { ++ /* go into the first sibling still alive */ ++ do { ++ next = child->d_child.next; + if (next == &this_parent->d_subdirs) + goto ascend; + child = list_entry(next, struct dentry, d_child); +- next = next->next; +- } ++ } while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)); + rcu_read_unlock(); + goto resume; + } +diff --git a/fs/fhandle.c b/fs/fhandle.c +index 999ff5c..d59712d 100644 +--- a/fs/fhandle.c ++++ b/fs/fhandle.c +@@ -195,8 +195,9 @@ static int handle_to_path(int mountdirfd, struct file_handle __user *ufh, + goto out_err; + } + /* copy the full handle */ +- if (copy_from_user(handle, ufh, +- sizeof(struct file_handle) + ++ *handle = f_handle; ++ if (copy_from_user(&handle->f_handle, ++ &ufh->f_handle, + f_handle.handle_bytes)) { + retval = -EFAULT; + goto out_handle; +diff --git a/fs/omfs/inode.c b/fs/omfs/inode.c +index 138321b..454111a 100644 +--- a/fs/omfs/inode.c ++++ b/fs/omfs/inode.c +@@ -306,7 +306,8 @@ static const struct super_operations omfs_sops = { + */ + static int omfs_get_imap(struct super_block *sb) + { +- unsigned int bitmap_size, count, array_size; ++ unsigned int bitmap_size, array_size; ++ int count; + struct omfs_sb_info *sbi = OMFS_SB(sb); + struct buffer_head *bh; + unsigned long **ptr; +@@ -359,7 +360,7 @@ nomem: + } + + enum { +- Opt_uid, Opt_gid, Opt_umask, Opt_dmask, Opt_fmask ++ Opt_uid, Opt_gid, Opt_umask, Opt_dmask, Opt_fmask, Opt_err + }; + + static const match_table_t tokens = { +@@ -368,6 +369,7 @@ static const match_table_t tokens = { + {Opt_umask, "umask=%o"}, + {Opt_dmask, "dmask=%o"}, + {Opt_fmask, "fmask=%o"}, ++ {Opt_err, NULL}, + }; + + static int parse_options(char *options, struct omfs_sb_info *sbi) +diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c +index 5d38e8b..7f7b183 100644 +--- a/fs/xfs/libxfs/xfs_attr_leaf.c ++++ b/fs/xfs/libxfs/xfs_attr_leaf.c +@@ -498,8 +498,8 @@ xfs_attr_shortform_add(xfs_da_args_t *args, int forkoff) + * After the last attribute is removed revert to original inode format, + * making all literal area available to the data fork once more. + */ +-STATIC void +-xfs_attr_fork_reset( ++void ++xfs_attr_fork_remove( + struct xfs_inode *ip, + struct xfs_trans *tp) + { +@@ -565,7 +565,7 @@ xfs_attr_shortform_remove(xfs_da_args_t *args) + (mp->m_flags & XFS_MOUNT_ATTR2) && + (dp->i_d.di_format != XFS_DINODE_FMT_BTREE) && + !(args->op_flags & XFS_DA_OP_ADDNAME)) { +- xfs_attr_fork_reset(dp, args->trans); ++ xfs_attr_fork_remove(dp, args->trans); + } else { + xfs_idata_realloc(dp, -size, XFS_ATTR_FORK); + dp->i_d.di_forkoff = xfs_attr_shortform_bytesfit(dp, totsize); +@@ -828,7 +828,7 @@ xfs_attr3_leaf_to_shortform( + if (forkoff == -1) { + ASSERT(dp->i_mount->m_flags & XFS_MOUNT_ATTR2); + ASSERT(dp->i_d.di_format != XFS_DINODE_FMT_BTREE); +- xfs_attr_fork_reset(dp, args->trans); ++ xfs_attr_fork_remove(dp, args->trans); + goto out; + } + +diff --git a/fs/xfs/libxfs/xfs_attr_leaf.h b/fs/xfs/libxfs/xfs_attr_leaf.h +index e2929da..4f3a60a 100644 +--- a/fs/xfs/libxfs/xfs_attr_leaf.h ++++ b/fs/xfs/libxfs/xfs_attr_leaf.h +@@ -53,7 +53,7 @@ int xfs_attr_shortform_remove(struct xfs_da_args *args); + int xfs_attr_shortform_list(struct xfs_attr_list_context *context); + int xfs_attr_shortform_allfit(struct xfs_buf *bp, struct xfs_inode *dp); + int xfs_attr_shortform_bytesfit(xfs_inode_t *dp, int bytes); +- ++void xfs_attr_fork_remove(struct xfs_inode *ip, struct xfs_trans *tp); + + /* + * Internal routines when attribute fork size == XFS_LBSIZE(mp). +diff --git a/fs/xfs/xfs_attr_inactive.c b/fs/xfs/xfs_attr_inactive.c +index 83af4c1..aa3e860 100644 +--- a/fs/xfs/xfs_attr_inactive.c ++++ b/fs/xfs/xfs_attr_inactive.c +@@ -379,23 +379,31 @@ xfs_attr3_root_inactive( + return error; + } + ++/* ++ * xfs_attr_inactive kills all traces of an attribute fork on an inode. It ++ * removes both the on-disk and in-memory inode fork. Note that this also has to ++ * handle the condition of inodes without attributes but with an attribute fork ++ * configured, so we can't use xfs_inode_hasattr() here. ++ * ++ * The in-memory attribute fork is removed even on error. ++ */ + int +-xfs_attr_inactive(xfs_inode_t *dp) ++xfs_attr_inactive( ++ struct xfs_inode *dp) + { +- xfs_trans_t *trans; +- xfs_mount_t *mp; +- int error; ++ struct xfs_trans *trans; ++ struct xfs_mount *mp; ++ int cancel_flags = 0; ++ int lock_mode = XFS_ILOCK_SHARED; ++ int error = 0; + + mp = dp->i_mount; + ASSERT(! XFS_NOT_DQATTACHED(mp, dp)); + +- xfs_ilock(dp, XFS_ILOCK_SHARED); +- if (!xfs_inode_hasattr(dp) || +- dp->i_d.di_aformat == XFS_DINODE_FMT_LOCAL) { +- xfs_iunlock(dp, XFS_ILOCK_SHARED); +- return 0; +- } +- xfs_iunlock(dp, XFS_ILOCK_SHARED); ++ xfs_ilock(dp, lock_mode); ++ if (!XFS_IFORK_Q(dp)) ++ goto out_destroy_fork; ++ xfs_iunlock(dp, lock_mode); + + /* + * Start our first transaction of the day. +@@ -407,13 +415,18 @@ xfs_attr_inactive(xfs_inode_t *dp) + * the inode in every transaction to let it float upward through + * the log. + */ ++ lock_mode = 0; + trans = xfs_trans_alloc(mp, XFS_TRANS_ATTRINVAL); + error = xfs_trans_reserve(trans, &M_RES(mp)->tr_attrinval, 0, 0); +- if (error) { +- xfs_trans_cancel(trans, 0); +- return error; +- } +- xfs_ilock(dp, XFS_ILOCK_EXCL); ++ if (error) ++ goto out_cancel; ++ ++ lock_mode = XFS_ILOCK_EXCL; ++ cancel_flags = XFS_TRANS_RELEASE_LOG_RES | XFS_TRANS_ABORT; ++ xfs_ilock(dp, lock_mode); ++ ++ if (!XFS_IFORK_Q(dp)) ++ goto out_cancel; + + /* + * No need to make quota reservations here. We expect to release some +@@ -422,28 +435,36 @@ xfs_attr_inactive(xfs_inode_t *dp) + xfs_trans_ijoin(trans, dp, 0); + + /* +- * Decide on what work routines to call based on the inode size. ++ * Invalidate and truncate the attribute fork extents. Make sure the ++ * fork actually has attributes as otherwise the invalidation has no ++ * blocks to read and returns an error. In this case, just do the fork ++ * removal below. + */ +- if (!xfs_inode_hasattr(dp) || +- dp->i_d.di_aformat == XFS_DINODE_FMT_LOCAL) { +- error = 0; +- goto out; ++ if (xfs_inode_hasattr(dp) && ++ dp->i_d.di_aformat != XFS_DINODE_FMT_LOCAL) { ++ error = xfs_attr3_root_inactive(&trans, dp); ++ if (error) ++ goto out_cancel; ++ ++ error = xfs_itruncate_extents(&trans, dp, XFS_ATTR_FORK, 0); ++ if (error) ++ goto out_cancel; + } +- error = xfs_attr3_root_inactive(&trans, dp); +- if (error) +- goto out; + +- error = xfs_itruncate_extents(&trans, dp, XFS_ATTR_FORK, 0); +- if (error) +- goto out; ++ /* Reset the attribute fork - this also destroys the in-core fork */ ++ xfs_attr_fork_remove(dp, trans); + + error = xfs_trans_commit(trans, XFS_TRANS_RELEASE_LOG_RES); +- xfs_iunlock(dp, XFS_ILOCK_EXCL); +- ++ xfs_iunlock(dp, lock_mode); + return error; + +-out: +- xfs_trans_cancel(trans, XFS_TRANS_RELEASE_LOG_RES|XFS_TRANS_ABORT); +- xfs_iunlock(dp, XFS_ILOCK_EXCL); ++out_cancel: ++ xfs_trans_cancel(trans, cancel_flags); ++out_destroy_fork: ++ /* kill the in-core attr fork before we drop the inode lock */ ++ if (dp->i_afp) ++ xfs_idestroy_fork(dp, XFS_ATTR_FORK); ++ if (lock_mode) ++ xfs_iunlock(dp, lock_mode); + return error; + } +diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c +index 3dd03af..cf4bf1f 100644 +--- a/fs/xfs/xfs_file.c ++++ b/fs/xfs/xfs_file.c +@@ -124,7 +124,7 @@ xfs_iozero( + status = 0; + } while (count); + +- return (-status); ++ return status; + } + + /* +diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c +index d745e1a..1b8451d 100644 +--- a/fs/xfs/xfs_inode.c ++++ b/fs/xfs/xfs_inode.c +@@ -1889,21 +1889,17 @@ xfs_inactive( + /* + * If there are attributes associated with the file then blow them away + * now. The code calls a routine that recursively deconstructs the +- * attribute fork. We need to just commit the current transaction +- * because we can't use it for xfs_attr_inactive(). ++ * attribute fork. If also blows away the in-core attribute fork. + */ +- if (ip->i_d.di_anextents > 0) { +- ASSERT(ip->i_d.di_forkoff != 0); +- ++ if (XFS_IFORK_Q(ip)) { + error = xfs_attr_inactive(ip); + if (error) + return; + } + +- if (ip->i_afp) +- xfs_idestroy_fork(ip, XFS_ATTR_FORK); +- ++ ASSERT(!ip->i_afp); + ASSERT(ip->i_d.di_anextents == 0); ++ ASSERT(ip->i_d.di_forkoff == 0); + + /* + * Free the inode. +diff --git a/include/linux/brcmphy.h b/include/linux/brcmphy.h +index 7ccd928..ac86f94 100644 +--- a/include/linux/brcmphy.h ++++ b/include/linux/brcmphy.h +@@ -16,7 +16,7 @@ + #define PHY_ID_BCM7250 0xae025280 + #define PHY_ID_BCM7364 0xae025260 + #define PHY_ID_BCM7366 0x600d8490 +-#define PHY_ID_BCM7425 0x03625e60 ++#define PHY_ID_BCM7425 0x600d86b0 + #define PHY_ID_BCM7429 0x600d8730 + #define PHY_ID_BCM7439 0x600d8480 + #define PHY_ID_BCM7445 0x600d8510 +diff --git a/include/uapi/drm/radeon_drm.h b/include/uapi/drm/radeon_drm.h +index 50d0fb4..76d2ede 100644 +--- a/include/uapi/drm/radeon_drm.h ++++ b/include/uapi/drm/radeon_drm.h +@@ -1034,6 +1034,7 @@ struct drm_radeon_cs { + #define RADEON_INFO_VRAM_USAGE 0x1e + #define RADEON_INFO_GTT_USAGE 0x1f + #define RADEON_INFO_ACTIVE_CU_COUNT 0x20 ++#define RADEON_INFO_VA_UNMAP_WORKING 0x25 + + struct drm_radeon_info { + uint32_t request; +diff --git a/kernel/module.c b/kernel/module.c +index d856e96..bc8d162 100644 +--- a/kernel/module.c ++++ b/kernel/module.c +@@ -3356,6 +3356,9 @@ static int load_module(struct load_info *info, const char __user *uargs, + module_bug_cleanup(mod); + mutex_unlock(&module_mutex); + ++ blocking_notifier_call_chain(&module_notify_list, ++ MODULE_STATE_GOING, mod); ++ + /* we can't deallocate the module until we clear memory protection */ + unset_module_init_ro_nx(mod); + unset_module_core_ro_nx(mod); +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index fe331fc..44cfeb3 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -2162,8 +2162,10 @@ void task_numa_work(struct callback_head *work) + vma = mm->mmap; + } + for (; vma; vma = vma->vm_next) { +- if (!vma_migratable(vma) || !vma_policy_mof(vma)) ++ if (!vma_migratable(vma) || !vma_policy_mof(vma) || ++ (vma->vm_flags & VM_MIXEDMAP)) { + continue; ++ } + + /* + * Shared library pages mapped by multiple processes are not +diff --git a/kernel/trace/ring_buffer_benchmark.c b/kernel/trace/ring_buffer_benchmark.c +index 3f9e328..728f99b 100644 +--- a/kernel/trace/ring_buffer_benchmark.c ++++ b/kernel/trace/ring_buffer_benchmark.c +@@ -452,7 +452,7 @@ static int __init ring_buffer_benchmark_init(void) + + if (producer_fifo >= 0) { + struct sched_param param = { +- .sched_priority = consumer_fifo ++ .sched_priority = producer_fifo + }; + sched_setscheduler(producer, SCHED_FIFO, ¶m); + } else +diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c +index ced69da..7f2e97c 100644 +--- a/kernel/trace/trace_events_filter.c ++++ b/kernel/trace/trace_events_filter.c +@@ -1369,19 +1369,26 @@ static int check_preds(struct filter_parse_state *ps) + { + int n_normal_preds = 0, n_logical_preds = 0; + struct postfix_elt *elt; ++ int cnt = 0; + + list_for_each_entry(elt, &ps->postfix, list) { +- if (elt->op == OP_NONE) ++ if (elt->op == OP_NONE) { ++ cnt++; + continue; ++ } + + if (elt->op == OP_AND || elt->op == OP_OR) { + n_logical_preds++; ++ cnt--; + continue; + } ++ if (elt->op != OP_NOT) ++ cnt--; + n_normal_preds++; ++ WARN_ON_ONCE(cnt < 0); + } + +- if (!n_normal_preds || n_logical_preds >= n_normal_preds) { ++ if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) { + parse_error(ps, FILT_ERR_INVALID_FILTER, 0); + return -EINVAL; + } +diff --git a/lib/strnlen_user.c b/lib/strnlen_user.c +index a28df52..1164961 100644 +--- a/lib/strnlen_user.c ++++ b/lib/strnlen_user.c +@@ -57,7 +57,8 @@ static inline long do_strnlen_user(const char __user *src, unsigned long count, + return res + find_zero(data) + 1 - align; + } + res += sizeof(unsigned long); +- if (unlikely(max < sizeof(unsigned long))) ++ /* We already handled 'unsigned long' bytes. Did we do it all ? */ ++ if (unlikely(max <= sizeof(unsigned long))) + break; + max -= sizeof(unsigned long); + if (unlikely(__get_user(c,(unsigned long __user *)(src+res)))) +diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c +index 65842d6..93caba7 100644 +--- a/mm/memory_hotplug.c ++++ b/mm/memory_hotplug.c +@@ -1978,8 +1978,10 @@ void try_offline_node(int nid) + * wait_table may be allocated from boot memory, + * here only free if it's allocated by vmalloc. + */ +- if (is_vmalloc_addr(zone->wait_table)) ++ if (is_vmalloc_addr(zone->wait_table)) { + vfree(zone->wait_table); ++ zone->wait_table = NULL; ++ } + } + } + EXPORT_SYMBOL(try_offline_node); +diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c +index 79f59c5..ed1e0fa 100644 +--- a/net/bridge/br_fdb.c ++++ b/net/bridge/br_fdb.c +@@ -569,7 +569,7 @@ void br_fdb_update(struct net_bridge *br, struct net_bridge_port *source, + fdb_notify(br, fdb, RTM_NEWNEIGH); + } + } else { +- spin_lock(&br->hash_lock); ++ spin_lock_bh(&br->hash_lock); + if (likely(!fdb_find(head, addr, vid))) { + fdb = fdb_create(head, source, addr, vid); + if (fdb) { +@@ -581,7 +581,7 @@ void br_fdb_update(struct net_bridge *br, struct net_bridge_port *source, + /* else we lose race and someone else inserts + * it first, don't bother updating + */ +- spin_unlock(&br->hash_lock); ++ spin_unlock_bh(&br->hash_lock); + } + } + +diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c +index b0aee78..c08f510 100644 +--- a/net/bridge/br_multicast.c ++++ b/net/bridge/br_multicast.c +@@ -1166,6 +1166,9 @@ static void br_multicast_add_router(struct net_bridge *br, + struct net_bridge_port *p; + struct hlist_node *slot = NULL; + ++ if (!hlist_unhashed(&port->rlist)) ++ return; ++ + hlist_for_each_entry(p, &br->router_list, rlist) { + if ((unsigned long) port >= (unsigned long) p) + break; +@@ -1193,12 +1196,8 @@ static void br_multicast_mark_router(struct net_bridge *br, + if (port->multicast_router != 1) + return; + +- if (!hlist_unhashed(&port->rlist)) +- goto timer; +- + br_multicast_add_router(br, port); + +-timer: + mod_timer(&port->multicast_router_timer, + now + br->multicast_querier_interval); + } +diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h +index fa7568c..5ab2b63 100644 +--- a/net/mac80211/ieee80211_i.h ++++ b/net/mac80211/ieee80211_i.h +@@ -204,6 +204,8 @@ enum ieee80211_packet_rx_flags { + * @IEEE80211_RX_CMNTR: received on cooked monitor already + * @IEEE80211_RX_BEACON_REPORTED: This frame was already reported + * to cfg80211_report_obss_beacon(). ++ * @IEEE80211_RX_REORDER_TIMER: this frame is released by the ++ * reorder buffer timeout timer, not the normal RX path + * + * These flags are used across handling multiple interfaces + * for a single frame. +@@ -211,6 +213,7 @@ enum ieee80211_packet_rx_flags { + enum ieee80211_rx_flags { + IEEE80211_RX_CMNTR = BIT(0), + IEEE80211_RX_BEACON_REPORTED = BIT(1), ++ IEEE80211_RX_REORDER_TIMER = BIT(2), + }; + + struct ieee80211_rx_data { +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index 909913d..c218688 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -2083,7 +2083,8 @@ ieee80211_deliver_skb(struct ieee80211_rx_data *rx) + /* deliver to local stack */ + skb->protocol = eth_type_trans(skb, dev); + memset(skb->cb, 0, sizeof(skb->cb)); +- if (rx->local->napi) ++ if (!(rx->flags & IEEE80211_RX_REORDER_TIMER) && ++ rx->local->napi) + napi_gro_receive(rx->local->napi, skb); + else + netif_receive_skb(skb); +@@ -3178,7 +3179,7 @@ void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid) + /* This is OK -- must be QoS data frame */ + .security_idx = tid, + .seqno_idx = tid, +- .flags = 0, ++ .flags = IEEE80211_RX_REORDER_TIMER, + }; + struct tid_ampdu_rx *tid_agg_rx; + +diff --git a/net/wireless/wext-compat.c b/net/wireless/wext-compat.c +index 0f47948..d2c77d5 100644 +--- a/net/wireless/wext-compat.c ++++ b/net/wireless/wext-compat.c +@@ -1333,6 +1333,8 @@ static struct iw_statistics *cfg80211_wireless_stats(struct net_device *dev) + memcpy(bssid, wdev->current_bss->pub.bssid, ETH_ALEN); + wdev_unlock(wdev); + ++ memset(&sinfo, 0, sizeof(sinfo)); ++ + if (rdev_get_station(rdev, dev, bssid, &sinfo)) + return NULL; + +diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c +index de971b6..27348f0 100644 +--- a/net/xfrm/xfrm_state.c ++++ b/net/xfrm/xfrm_state.c +@@ -927,8 +927,8 @@ struct xfrm_state *xfrm_state_lookup_byspi(struct net *net, __be32 spi, + x->id.spi != spi) + continue; + +- spin_unlock_bh(&net->xfrm.xfrm_state_lock); + xfrm_state_hold(x); ++ spin_unlock_bh(&net->xfrm.xfrm_state_lock); + return x; + } + spin_unlock_bh(&net->xfrm.xfrm_state_lock); +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index 84bed14..7f66dca 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -2146,6 +2146,8 @@ static const struct pci_device_id azx_ids[] = { + .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS }, + { PCI_DEVICE(0x1002, 0xaab0), + .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS }, ++ { PCI_DEVICE(0x1002, 0xaac8), ++ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS }, + /* VIA VT8251/VT8237A */ + { PCI_DEVICE(0x1106, 0x3288), + .driver_data = AZX_DRIVER_VIA | AZX_DCAPS_POSFIX_VIA }, +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 4cfab09..008f1e6 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -2165,6 +2165,7 @@ static const struct hda_fixup alc882_fixups[] = { + static const struct snd_pci_quirk alc882_fixup_tbl[] = { + SND_PCI_QUIRK(0x1025, 0x006c, "Acer Aspire 9810", ALC883_FIXUP_ACER_EAPD), + SND_PCI_QUIRK(0x1025, 0x0090, "Acer Aspire", ALC883_FIXUP_ACER_EAPD), ++ SND_PCI_QUIRK(0x1025, 0x0107, "Acer Aspire", ALC883_FIXUP_ACER_EAPD), + SND_PCI_QUIRK(0x1025, 0x010a, "Acer Ferrari 5000", ALC883_FIXUP_ACER_EAPD), + SND_PCI_QUIRK(0x1025, 0x0110, "Acer Aspire", ALC883_FIXUP_ACER_EAPD), + SND_PCI_QUIRK(0x1025, 0x0112, "Acer Aspire 9303", ALC883_FIXUP_ACER_EAPD), +diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c +index 87eff31..60b3100 100644 +--- a/sound/pci/hda/patch_sigmatel.c ++++ b/sound/pci/hda/patch_sigmatel.c +@@ -100,6 +100,7 @@ enum { + STAC_HP_ENVY_BASS, + STAC_HP_BNB13_EQ, + STAC_HP_ENVY_TS_BASS, ++ STAC_HP_ENVY_TS_DAC_BIND, + STAC_92HD83XXX_GPIO10_EAPD, + STAC_92HD83XXX_MODELS + }; +@@ -2170,6 +2171,22 @@ static void stac92hd83xxx_fixup_gpio10_eapd(struct hda_codec *codec, + spec->eapd_switch = 0; + } + ++static void hp_envy_ts_fixup_dac_bind(struct hda_codec *codec, ++ const struct hda_fixup *fix, ++ int action) ++{ ++ struct sigmatel_spec *spec = codec->spec; ++ static hda_nid_t preferred_pairs[] = { ++ 0xd, 0x13, ++ 0 ++ }; ++ ++ if (action != HDA_FIXUP_ACT_PRE_PROBE) ++ return; ++ ++ spec->gen.preferred_dacs = preferred_pairs; ++} ++ + static const struct hda_verb hp_bnb13_eq_verbs[] = { + /* 44.1KHz base */ + { 0x22, 0x7A6, 0x3E }, +@@ -2685,6 +2702,12 @@ static const struct hda_fixup stac92hd83xxx_fixups[] = { + {} + }, + }, ++ [STAC_HP_ENVY_TS_DAC_BIND] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = hp_envy_ts_fixup_dac_bind, ++ .chained = true, ++ .chain_id = STAC_HP_ENVY_TS_BASS, ++ }, + [STAC_92HD83XXX_GPIO10_EAPD] = { + .type = HDA_FIXUP_FUNC, + .v.func = stac92hd83xxx_fixup_gpio10_eapd, +@@ -2763,6 +2786,8 @@ static const struct snd_pci_quirk stac92hd83xxx_fixup_tbl[] = { + "HP bNB13", STAC_HP_BNB13_EQ), + SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x190e, + "HP ENVY TS", STAC_HP_ENVY_TS_BASS), ++ SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x1967, ++ "HP ENVY TS", STAC_HP_ENVY_TS_DAC_BIND), + SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x1940, + "HP bNB13", STAC_HP_BNB13_EQ), + SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x1941, +diff --git a/sound/pci/hda/thinkpad_helper.c b/sound/pci/hda/thinkpad_helper.c +index 2341fc3..6ba0b55 100644 +--- a/sound/pci/hda/thinkpad_helper.c ++++ b/sound/pci/hda/thinkpad_helper.c +@@ -72,7 +72,6 @@ static void hda_fixup_thinkpad_acpi(struct hda_codec *codec, + if (led_set_func(TPACPI_LED_MUTE, false) >= 0) { + old_vmaster_hook = spec->vmaster_mute.hook; + spec->vmaster_mute.hook = update_tpacpi_mute_led; +- spec->vmaster_mute_enum = 1; + removefunc = false; + } + if (led_set_func(TPACPI_LED_MICMUTE, false) >= 0) { +diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c +index 3e2ef61..8b7e391 100644 +--- a/sound/usb/mixer.c ++++ b/sound/usb/mixer.c +@@ -918,6 +918,7 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval, + case USB_ID(0x046d, 0x081d): /* HD Webcam c510 */ + case USB_ID(0x046d, 0x0825): /* HD Webcam c270 */ + case USB_ID(0x046d, 0x0826): /* HD Webcam c525 */ ++ case USB_ID(0x046d, 0x08ca): /* Logitech Quickcam Fusion */ + case USB_ID(0x046d, 0x0991): + /* Most audio usb devices lie about volume resolution. + * Most Logitech webcams have res = 384. +@@ -1582,12 +1583,6 @@ static int parse_audio_mixer_unit(struct mixer_build *state, int unitid, + unitid); + return -EINVAL; + } +- /* no bmControls field (e.g. Maya44) -> ignore */ +- if (desc->bLength <= 10 + input_pins) { +- usb_audio_dbg(state->chip, "MU %d has no bmControls field\n", +- unitid); +- return 0; +- } + + num_ins = 0; + ich = 0; +@@ -1595,6 +1590,9 @@ static int parse_audio_mixer_unit(struct mixer_build *state, int unitid, + err = parse_audio_unit(state, desc->baSourceID[pin]); + if (err < 0) + continue; ++ /* no bmControls field (e.g. Maya44) -> ignore */ ++ if (desc->bLength <= 10 + input_pins) ++ continue; + err = check_input_term(state, desc->baSourceID[pin], &iterm); + if (err < 0) + return err; +diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c +index b703cb3..e5000da 100644 +--- a/sound/usb/mixer_maps.c ++++ b/sound/usb/mixer_maps.c +@@ -437,6 +437,11 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = { + .map = ebox44_map, + }, + { ++ /* MAYA44 USB+ */ ++ .id = USB_ID(0x2573, 0x0008), ++ .map = maya44_map, ++ }, ++ { + /* KEF X300A */ + .id = USB_ID(0x27ac, 0x1000), + .map = scms_usb3318_map, +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index a0795ba..1b195af 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1253,8 +1253,9 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip, + if (fp->altsetting == 2) + return SNDRV_PCM_FMTBIT_DSD_U32_BE; + break; +- /* DIYINHK DSD DXD 384kHz USB to I2S/DSD */ +- case USB_ID(0x20b1, 0x2009): ++ ++ case USB_ID(0x20b1, 0x2009): /* DIYINHK DSD DXD 384kHz USB to I2S/DSD */ ++ case USB_ID(0x20b1, 0x2023): /* JLsounds I2SoverUSB */ + if (fp->altsetting == 3) + return SNDRV_PCM_FMTBIT_DSD_U32_BE; + break; +diff --git a/tools/vm/Makefile b/tools/vm/Makefile +index 93aadaf..ac884b6 100644 +--- a/tools/vm/Makefile ++++ b/tools/vm/Makefile +@@ -3,7 +3,7 @@ + TARGETS=page-types slabinfo page_owner_sort + + LIB_DIR = ../lib/api +-LIBS = $(LIB_DIR)/libapi.a ++LIBS = $(LIB_DIR)/libapikfs.a + + CC = $(CROSS_COMPILE)gcc + CFLAGS = -Wall -Wextra -I../lib/ diff --git a/debian/patches/series b/debian/patches/series index 0fbbcc6..0d85b11 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -79,4 +79,4 @@ bugfix/all/stable-3.19.8.patch bugfix/all/stable-3.19.8-ckt1.patch bugfix/all/stable-3.19.8-ckt2.patch - +bugfix/all/stable-3.19.8-ckt3.patch -- To view, visit https://gerrit.wikimedia.org/r/225850 To unsubscribe, visit https://gerrit.wikimedia.org/r/settings Gerrit-MessageType: newchange Gerrit-Change-Id: Iaaa1dd5fa4d31bf35f4f77b2506703ef363da0da Gerrit-PatchSet: 1 Gerrit-Project: operations/debs/linux Gerrit-Branch: master Gerrit-Owner: Muehlenhoff <mmuhlenh...@wikimedia.org> _______________________________________________ MediaWiki-commits mailing list MediaWiki-commits@lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
