From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id 23043138A1A for ; Wed, 28 Jan 2015 22:01:35 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id DD174E0788; Wed, 28 Jan 2015 22:01:33 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 6286EE0788 for ; Wed, 28 Jan 2015 22:01:33 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id C94BA3406C1 for ; Wed, 28 Jan 2015 22:01:29 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 9BA751081C for ; Wed, 28 Jan 2015 22:01:27 +0000 (UTC) From: "Anthony G. Basile" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Anthony G. Basile" Message-ID: <1422482576.b821cf4a2c525cf4101fdd015272504def813009.blueness@gentoo> Subject: [gentoo-commits] proj/linux-patches:3.14 commit in: / X-VCS-Repository: proj/linux-patches X-VCS-Files: 1029_linux-3.14.30.patch X-VCS-Directories: / X-VCS-Committer: blueness X-VCS-Committer-Name: Anthony G. Basile X-VCS-Revision: b821cf4a2c525cf4101fdd015272504def813009 X-VCS-Branch: 3.14 Date: Wed, 28 Jan 2015 22:01:27 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 3d17f83f-d5af-49d8-ad0b-8e26bfb0f82f X-Archives-Hash: 7a36daa95bae8ab24d59b33c33480218 commit: b821cf4a2c525cf4101fdd015272504def813009 Author: Anthony G. Basile gentoo org> AuthorDate: Wed Jan 28 22:02:56 2015 +0000 Commit: Anthony G. Basile gentoo org> CommitDate: Wed Jan 28 22:02:56 2015 +0000 URL: http://sources.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=b821cf4a Linux patch 3.14.30 --- 1029_linux-3.14.30.patch | 4387 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 4387 insertions(+) diff --git a/1029_linux-3.14.30.patch b/1029_linux-3.14.30.patch new file mode 100644 index 0000000..c5db3c7 --- /dev/null +++ b/1029_linux-3.14.30.patch @@ -0,0 +1,4387 @@ +diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt +index 7116fda7077f..5d91ba1606bb 100644 +--- a/Documentation/kernel-parameters.txt ++++ b/Documentation/kernel-parameters.txt +@@ -1172,6 +1172,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted. + i8042.notimeout [HW] Ignore timeout condition signalled by controller + i8042.reset [HW] Reset the controller during init and cleanup + i8042.unlock [HW] Unlock (ignore) the keylock ++ i8042.kbdreset [HW] Reset device connected to KBD port + + i810= [HW,DRM] + +diff --git a/Makefile b/Makefile +index 7aff64ee4fb6..5b94752a85e3 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 14 +-SUBLEVEL = 29 ++SUBLEVEL = 30 + EXTRAVERSION = + NAME = Remembering Coco + +diff --git a/arch/arc/boot/dts/nsimosci.dts b/arch/arc/boot/dts/nsimosci.dts +index 398064cef746..4c169d825415 100644 +--- a/arch/arc/boot/dts/nsimosci.dts ++++ b/arch/arc/boot/dts/nsimosci.dts +@@ -20,7 +20,7 @@ + /* this is for console on PGU */ + /* bootargs = "console=tty0 consoleblank=0"; */ + /* this is for console on serial */ +- bootargs = "earlycon=uart8250,mmio32,0xc0000000,115200n8 console=tty0 console=ttyS0,115200n8 consoleblank=0 debug"; ++ bootargs = "earlycon=uart8250,mmio32,0xf0000000,115200n8 console=tty0 console=ttyS0,115200n8 consoleblank=0 debug"; + }; + + aliases { +@@ -46,9 +46,9 @@ + #interrupt-cells = <1>; + }; + +- uart0: serial@c0000000 { ++ uart0: serial@f0000000 { + compatible = "ns8250"; +- reg = <0xc0000000 0x2000>; ++ reg = <0xf0000000 0x2000>; + interrupts = <11>; + clock-frequency = <3686400>; + baud = <115200>; +@@ -57,21 +57,21 @@ + no-loopback-test = <1>; + }; + +- pgu0: pgu@c9000000 { ++ pgu0: pgu@f9000000 { + compatible = "snps,arcpgufb"; +- reg = <0xc9000000 0x400>; ++ reg = <0xf9000000 0x400>; + }; + +- ps2: ps2@c9001000 { ++ ps2: ps2@f9001000 { + compatible = "snps,arc_ps2"; +- reg = <0xc9000400 0x14>; ++ reg = <0xf9000400 0x14>; + interrupts = <13>; + interrupt-names = "arc_ps2_irq"; + }; + +- eth0: ethernet@c0003000 { ++ eth0: ethernet@f0003000 { + compatible = "snps,oscilan"; +- reg = <0xc0003000 0x44>; ++ reg = <0xf0003000 0x44>; + interrupts = <7>, <8>; + interrupt-names = "rx", "tx"; + }; +diff --git a/arch/arc/include/asm/linkage.h b/arch/arc/include/asm/linkage.h +index 66ee5527aefc..5faad17118b4 100644 +--- a/arch/arc/include/asm/linkage.h ++++ b/arch/arc/include/asm/linkage.h +@@ -13,20 +13,6 @@ + + #define ASM_NL ` /* use '`' to mark new line in macro */ + +-/* Can't use the ENTRY macro in linux/linkage.h +- * gas considers ';' as comment vs. newline +- */ +-.macro ARC_ENTRY name +- .global \name +- .align 4 +- \name: +-.endm +- +-.macro ARC_EXIT name +-#define ASM_PREV_SYM_ADDR(name) .-##name +- .size \ name, ASM_PREV_SYM_ADDR(\name) +-.endm +- + /* annotation for data we want in DCCM - if enabled in .config */ + .macro ARCFP_DATA nm + #ifdef CONFIG_ARC_HAS_DCCM +diff --git a/arch/arc/kernel/ctx_sw_asm.S b/arch/arc/kernel/ctx_sw_asm.S +index 65690e7fcc8c..2ff0347a2fd7 100644 +--- a/arch/arc/kernel/ctx_sw_asm.S ++++ b/arch/arc/kernel/ctx_sw_asm.S +@@ -62,4 +62,4 @@ __switch_to: + ld.ab blink, [sp, 4] + j [blink] + +-ARC_EXIT __switch_to ++END(__switch_to) +diff --git a/arch/arc/kernel/entry.S b/arch/arc/kernel/entry.S +index 6e8f83a32522..29b82adbf0b4 100644 +--- a/arch/arc/kernel/entry.S ++++ b/arch/arc/kernel/entry.S +@@ -141,7 +141,7 @@ VECTOR EV_Extension ; 0x130, Extn Intruction Excp (0x26) + VECTOR reserved ; Reserved Exceptions + .endr + +-#include /* ARC_{EXTRY,EXIT} */ ++#include /* {EXTRY,EXIT} */ + #include /* SAVE_ALL_{INT1,INT2,SYS...} */ + #include + #include +@@ -184,7 +184,7 @@ reserved: ; processor restart + ; --------------------------------------------- + ; Level 2 ISR: Can interrupt a Level 1 ISR + ; --------------------------------------------- +-ARC_ENTRY handle_interrupt_level2 ++ENTRY(handle_interrupt_level2) + + ; TODO-vineetg for SMP this wont work + ; free up r9 as scratchpad +@@ -225,14 +225,14 @@ ARC_ENTRY handle_interrupt_level2 + + b ret_from_exception + +-ARC_EXIT handle_interrupt_level2 ++END(handle_interrupt_level2) + + #endif + + ; --------------------------------------------- + ; Level 1 ISR + ; --------------------------------------------- +-ARC_ENTRY handle_interrupt_level1 ++ENTRY(handle_interrupt_level1) + + /* free up r9 as scratchpad */ + #ifdef CONFIG_SMP +@@ -265,7 +265,7 @@ ARC_ENTRY handle_interrupt_level1 + sr r8, [AUX_IRQ_LV12] ; clear bit in Sticky Status Reg + + b ret_from_exception +-ARC_EXIT handle_interrupt_level1 ++END(handle_interrupt_level1) + + ;################### Non TLB Exception Handling ############################# + +@@ -273,7 +273,7 @@ ARC_EXIT handle_interrupt_level1 + ; Instruction Error Exception Handler + ; --------------------------------------------- + +-ARC_ENTRY instr_service ++ENTRY(instr_service) + + EXCEPTION_PROLOGUE + +@@ -284,13 +284,13 @@ ARC_ENTRY instr_service + + bl do_insterror_or_kprobe + b ret_from_exception +-ARC_EXIT instr_service ++END(instr_service) + + ; --------------------------------------------- + ; Memory Error Exception Handler + ; --------------------------------------------- + +-ARC_ENTRY mem_service ++ENTRY(mem_service) + + EXCEPTION_PROLOGUE + +@@ -301,13 +301,13 @@ ARC_ENTRY mem_service + + bl do_memory_error + b ret_from_exception +-ARC_EXIT mem_service ++END(mem_service) + + ; --------------------------------------------- + ; Machine Check Exception Handler + ; --------------------------------------------- + +-ARC_ENTRY EV_MachineCheck ++ENTRY(EV_MachineCheck) + + EXCEPTION_PROLOGUE + +@@ -331,13 +331,13 @@ ARC_ENTRY EV_MachineCheck + + j do_machine_check_fault + +-ARC_EXIT EV_MachineCheck ++END(EV_MachineCheck) + + ; --------------------------------------------- + ; Protection Violation Exception Handler + ; --------------------------------------------- + +-ARC_ENTRY EV_TLBProtV ++ENTRY(EV_TLBProtV) + + EXCEPTION_PROLOGUE + +@@ -385,12 +385,12 @@ ARC_ENTRY EV_TLBProtV + + b ret_from_exception + +-ARC_EXIT EV_TLBProtV ++END(EV_TLBProtV) + + ; --------------------------------------------- + ; Privilege Violation Exception Handler + ; --------------------------------------------- +-ARC_ENTRY EV_PrivilegeV ++ENTRY(EV_PrivilegeV) + + EXCEPTION_PROLOGUE + +@@ -401,12 +401,12 @@ ARC_ENTRY EV_PrivilegeV + + bl do_privilege_fault + b ret_from_exception +-ARC_EXIT EV_PrivilegeV ++END(EV_PrivilegeV) + + ; --------------------------------------------- + ; Extension Instruction Exception Handler + ; --------------------------------------------- +-ARC_ENTRY EV_Extension ++ENTRY(EV_Extension) + + EXCEPTION_PROLOGUE + +@@ -417,7 +417,7 @@ ARC_ENTRY EV_Extension + + bl do_extension_fault + b ret_from_exception +-ARC_EXIT EV_Extension ++END(EV_Extension) + + ;######################### System Call Tracing ######################### + +@@ -504,7 +504,7 @@ trap_with_param: + ; (2) Break Points + ;------------------------------------------------------------------ + +-ARC_ENTRY EV_Trap ++ENTRY(EV_Trap) + + EXCEPTION_PROLOGUE + +@@ -534,9 +534,9 @@ ARC_ENTRY EV_Trap + jl [r9] ; Entry into Sys Call Handler + + ; fall through to ret_from_system_call +-ARC_EXIT EV_Trap ++END(EV_Trap) + +-ARC_ENTRY ret_from_system_call ++ENTRY(ret_from_system_call) + + st r0, [sp, PT_r0] ; sys call return value in pt_regs + +@@ -546,7 +546,7 @@ ARC_ENTRY ret_from_system_call + ; + ; If ret to user mode do we need to handle signals, schedule() et al. + +-ARC_ENTRY ret_from_exception ++ENTRY(ret_from_exception) + + ; Pre-{IRQ,Trap,Exception} K/U mode from pt_regs->status32 + ld r8, [sp, PT_status32] ; returning to User/Kernel Mode +@@ -728,9 +728,9 @@ not_level1_interrupt: + debug_marker_syscall: + rtie + +-ARC_EXIT ret_from_exception ++END(ret_from_exception) + +-ARC_ENTRY ret_from_fork ++ENTRY(ret_from_fork) + ; when the forked child comes here from the __switch_to function + ; r0 has the last task pointer. + ; put last task in scheduler queue +@@ -747,11 +747,11 @@ ARC_ENTRY ret_from_fork + ; special case of kernel_thread entry point returning back due to + ; kernel_execve() - pretend return from syscall to ret to userland + b ret_from_exception +-ARC_EXIT ret_from_fork ++END(ret_from_fork) + + ;################### Special Sys Call Wrappers ########################## + +-ARC_ENTRY sys_clone_wrapper ++ENTRY(sys_clone_wrapper) + SAVE_CALLEE_SAVED_USER + bl @sys_clone + DISCARD_CALLEE_SAVED_USER +@@ -761,7 +761,7 @@ ARC_ENTRY sys_clone_wrapper + bnz tracesys_exit + + b ret_from_system_call +-ARC_EXIT sys_clone_wrapper ++END(sys_clone_wrapper) + + #ifdef CONFIG_ARC_DW2_UNWIND + ; Workaround for bug 94179 (STAR ): +diff --git a/arch/arc/lib/memcmp.S b/arch/arc/lib/memcmp.S +index bc813d55b6c3..978bf8314dfb 100644 +--- a/arch/arc/lib/memcmp.S ++++ b/arch/arc/lib/memcmp.S +@@ -6,7 +6,7 @@ + * published by the Free Software Foundation. + */ + +-#include ++#include + + #ifdef __LITTLE_ENDIAN__ + #define WORD2 r2 +@@ -16,7 +16,7 @@ + #define SHIFT r2 + #endif + +-ARC_ENTRY memcmp ++ENTRY(memcmp) + or r12,r0,r1 + asl_s r12,r12,30 + sub r3,r2,1 +@@ -121,4 +121,4 @@ ARC_ENTRY memcmp + .Lnil: + j_s.d [blink] + mov r0,0 +-ARC_EXIT memcmp ++END(memcmp) +diff --git a/arch/arc/lib/memcpy-700.S b/arch/arc/lib/memcpy-700.S +index b64cc10ac918..3222573e50de 100644 +--- a/arch/arc/lib/memcpy-700.S ++++ b/arch/arc/lib/memcpy-700.S +@@ -6,9 +6,9 @@ + * published by the Free Software Foundation. + */ + +-#include ++#include + +-ARC_ENTRY memcpy ++ENTRY(memcpy) + or r3,r0,r1 + asl_s r3,r3,30 + mov_s r5,r0 +@@ -63,4 +63,4 @@ ARC_ENTRY memcpy + .Lendbloop: + j_s.d [blink] + stb r12,[r5,0] +-ARC_EXIT memcpy ++END(memcpy) +diff --git a/arch/arc/lib/memset.S b/arch/arc/lib/memset.S +index 9b2d88d2e141..d36bd43fc98d 100644 +--- a/arch/arc/lib/memset.S ++++ b/arch/arc/lib/memset.S +@@ -6,11 +6,11 @@ + * published by the Free Software Foundation. + */ + +-#include ++#include + + #define SMALL 7 /* Must be at least 6 to deal with alignment/loop issues. */ + +-ARC_ENTRY memset ++ENTRY(memset) + mov_s r4,r0 + or r12,r0,r2 + bmsk.f r12,r12,1 +@@ -46,14 +46,14 @@ ARC_ENTRY memset + stb.ab r1,[r4,1] + .Ltiny_end: + j_s [blink] +-ARC_EXIT memset ++END(memset) + + ; memzero: @r0 = mem, @r1 = size_t + ; memset: @r0 = mem, @r1 = char, @r2 = size_t + +-ARC_ENTRY memzero ++ENTRY(memzero) + ; adjust bzero args to memset args + mov r2, r1 + mov r1, 0 + b memset ;tail call so need to tinker with blink +-ARC_EXIT memzero ++END(memzero) +diff --git a/arch/arc/lib/strchr-700.S b/arch/arc/lib/strchr-700.S +index 9c548c7cf001..b725d5862107 100644 +--- a/arch/arc/lib/strchr-700.S ++++ b/arch/arc/lib/strchr-700.S +@@ -11,9 +11,9 @@ + presence of the norm instruction makes it easier to operate on whole + words branch-free. */ + +-#include ++#include + +-ARC_ENTRY strchr ++ENTRY(strchr) + extb_s r1,r1 + asl r5,r1,8 + bmsk r2,r0,1 +@@ -130,4 +130,4 @@ ARC_ENTRY strchr + j_s.d [blink] + mov.mi r0,0 + #endif /* ENDIAN */ +-ARC_EXIT strchr ++END(strchr) +diff --git a/arch/arc/lib/strcmp.S b/arch/arc/lib/strcmp.S +index 5dc802b45cf3..3544600fefe6 100644 +--- a/arch/arc/lib/strcmp.S ++++ b/arch/arc/lib/strcmp.S +@@ -13,9 +13,9 @@ + source 1; however, that would increase the overhead for loop setup / finish, + and strcmp might often terminate early. */ + +-#include ++#include + +-ARC_ENTRY strcmp ++ENTRY(strcmp) + or r2,r0,r1 + bmsk_s r2,r2,1 + brne r2,0,.Lcharloop +@@ -93,4 +93,4 @@ ARC_ENTRY strcmp + .Lcmpend: + j_s.d [blink] + sub r0,r2,r3 +-ARC_EXIT strcmp ++END(strcmp) +diff --git a/arch/arc/lib/strcpy-700.S b/arch/arc/lib/strcpy-700.S +index b7ca4ae81d88..8422f38e1218 100644 +--- a/arch/arc/lib/strcpy-700.S ++++ b/arch/arc/lib/strcpy-700.S +@@ -16,9 +16,9 @@ + there, but the it is not likely to be taken often, and it + would also be likey to cost an unaligned mispredict at the next call. */ + +-#include ++#include + +-ARC_ENTRY strcpy ++ENTRY(strcpy) + or r2,r0,r1 + bmsk_s r2,r2,1 + brne.d r2,0,charloop +@@ -67,4 +67,4 @@ charloop: + brne.d r3,0,charloop + stb.ab r3,[r10,1] + j [blink] +-ARC_EXIT strcpy ++END(strcpy) +diff --git a/arch/arc/lib/strlen.S b/arch/arc/lib/strlen.S +index 39759e099696..53cfd5685a5f 100644 +--- a/arch/arc/lib/strlen.S ++++ b/arch/arc/lib/strlen.S +@@ -6,9 +6,9 @@ + * published by the Free Software Foundation. + */ + +-#include ++#include + +-ARC_ENTRY strlen ++ENTRY(strlen) + or r3,r0,7 + ld r2,[r3,-7] + ld.a r6,[r3,-3] +@@ -80,4 +80,4 @@ ARC_ENTRY strlen + .Learly_end: + b.d .Lend + sub_s.ne r1,r1,r1 +-ARC_EXIT strlen ++END(strlen) +diff --git a/arch/arc/mm/tlbex.S b/arch/arc/mm/tlbex.S +index 3fcfdb38d242..79bfc81358c9 100644 +--- a/arch/arc/mm/tlbex.S ++++ b/arch/arc/mm/tlbex.S +@@ -260,7 +260,7 @@ ARCFP_CODE ;Fast Path Code, candidate for ICCM + ; I-TLB Miss Exception Handler + ;----------------------------------------------------------------------------- + +-ARC_ENTRY EV_TLBMissI ++ENTRY(EV_TLBMissI) + + TLBMISS_FREEUP_REGS + +@@ -293,13 +293,13 @@ ARC_ENTRY EV_TLBMissI + TLBMISS_RESTORE_REGS + rtie + +-ARC_EXIT EV_TLBMissI ++END(EV_TLBMissI) + + ;----------------------------------------------------------------------------- + ; D-TLB Miss Exception Handler + ;----------------------------------------------------------------------------- + +-ARC_ENTRY EV_TLBMissD ++ENTRY(EV_TLBMissD) + + TLBMISS_FREEUP_REGS + +@@ -381,6 +381,4 @@ do_slow_path_pf: + bl do_page_fault + b ret_from_exception + +-ARC_EXIT EV_TLBMissD +- +-ARC_ENTRY EV_TLBMissB ; Bogus entry to measure sz of DTLBMiss hdlr ++END(EV_TLBMissD) +diff --git a/arch/arm/boot/dts/imx25.dtsi b/arch/arm/boot/dts/imx25.dtsi +index de1611966d8b..6a26e79f0ef4 100644 +--- a/arch/arm/boot/dts/imx25.dtsi ++++ b/arch/arm/boot/dts/imx25.dtsi +@@ -158,7 +158,7 @@ + #size-cells = <0>; + compatible = "fsl,imx25-cspi", "fsl,imx35-cspi"; + reg = <0x43fa4000 0x4000>; +- clocks = <&clks 62>, <&clks 62>; ++ clocks = <&clks 78>, <&clks 78>; + clock-names = "ipg", "per"; + interrupts = <14>; + status = "disabled"; +diff --git a/arch/arm/mach-imx/clk-imx6q.c b/arch/arm/mach-imx/clk-imx6q.c +index 4d677f442539..01a5765a8b26 100644 +--- a/arch/arm/mach-imx/clk-imx6q.c ++++ b/arch/arm/mach-imx/clk-imx6q.c +@@ -161,8 +161,8 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node) + post_div_table[1].div = 1; + post_div_table[2].div = 1; + video_div_table[1].div = 1; +- video_div_table[2].div = 1; +- }; ++ video_div_table[3].div = 1; ++ } + + /* type name parent_name base div_mask */ + clk[pll1_sys] = imx_clk_pllv3(IMX_PLLV3_SYS, "pll1_sys", "osc", base, 0x7f); +diff --git a/arch/arm/mach-omap2/timer.c b/arch/arm/mach-omap2/timer.c +index 74044aaf438b..73d80b8576c3 100644 +--- a/arch/arm/mach-omap2/timer.c ++++ b/arch/arm/mach-omap2/timer.c +@@ -513,11 +513,11 @@ static void __init realtime_counter_init(void) + rate = clk_get_rate(sys_clk); + /* Numerator/denumerator values refer TRM Realtime Counter section */ + switch (rate) { +- case 1200000: ++ case 12000000: + num = 64; + den = 125; + break; +- case 1300000: ++ case 13000000: + num = 768; + den = 1625; + break; +@@ -529,11 +529,11 @@ static void __init realtime_counter_init(void) + num = 192; + den = 625; + break; +- case 2600000: ++ case 26000000: + num = 384; + den = 1625; + break; +- case 2700000: ++ case 27000000: + num = 256; + den = 1125; + break; +diff --git a/arch/arm/mach-shmobile/setup-sh73a0.c b/arch/arm/mach-shmobile/setup-sh73a0.c +index f74ab530c71d..2b73c8a0c244 100644 +--- a/arch/arm/mach-shmobile/setup-sh73a0.c ++++ b/arch/arm/mach-shmobile/setup-sh73a0.c +@@ -617,6 +617,7 @@ static struct platform_device ipmmu_device = { + + static struct renesas_intc_irqpin_config irqpin0_platform_data = { + .irq_base = irq_pin(0), /* IRQ0 -> IRQ7 */ ++ .control_parent = true, + }; + + static struct resource irqpin0_resources[] = { +@@ -678,6 +679,7 @@ static struct platform_device irqpin1_device = { + + static struct renesas_intc_irqpin_config irqpin2_platform_data = { + .irq_base = irq_pin(16), /* IRQ16 -> IRQ23 */ ++ .control_parent = true, + }; + + static struct resource irqpin2_resources[] = { +@@ -708,6 +710,7 @@ static struct platform_device irqpin2_device = { + + static struct renesas_intc_irqpin_config irqpin3_platform_data = { + .irq_base = irq_pin(24), /* IRQ24 -> IRQ31 */ ++ .control_parent = true, + }; + + static struct resource irqpin3_resources[] = { +diff --git a/arch/parisc/include/asm/ldcw.h b/arch/parisc/include/asm/ldcw.h +index d2d11b7055ba..8121aa6db2ff 100644 +--- a/arch/parisc/include/asm/ldcw.h ++++ b/arch/parisc/include/asm/ldcw.h +@@ -33,11 +33,18 @@ + + #endif /*!CONFIG_PA20*/ + +-/* LDCW, the only atomic read-write operation PA-RISC has. *sigh*. */ ++/* LDCW, the only atomic read-write operation PA-RISC has. *sigh*. ++ We don't explicitly expose that "*a" may be written as reload ++ fails to find a register in class R1_REGS when "a" needs to be ++ reloaded when generating 64-bit PIC code. Instead, we clobber ++ memory to indicate to the compiler that the assembly code reads ++ or writes to items other than those listed in the input and output ++ operands. This may pessimize the code somewhat but __ldcw is ++ usually used within code blocks surrounded by memory barriors. */ + #define __ldcw(a) ({ \ + unsigned __ret; \ +- __asm__ __volatile__(__LDCW " 0(%2),%0" \ +- : "=r" (__ret), "+m" (*(a)) : "r" (a)); \ ++ __asm__ __volatile__(__LDCW " 0(%1),%0" \ ++ : "=r" (__ret) : "r" (a) : "memory"); \ + __ret; \ + }) + +diff --git a/arch/um/Kconfig.common b/arch/um/Kconfig.common +index 21ca44c4f6d5..1f0ea5537e8a 100644 +--- a/arch/um/Kconfig.common ++++ b/arch/um/Kconfig.common +@@ -2,6 +2,7 @@ config UML + bool + default y + select HAVE_UID16 ++ select HAVE_FUTEX_CMPXCHG if FUTEX + select GENERIC_IRQ_SHOW + select GENERIC_CPU_DEVICES + select GENERIC_IO +diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c +index 79a3f9682871..a1f5b1866cbe 100644 +--- a/arch/x86/kernel/kprobes/core.c ++++ b/arch/x86/kernel/kprobes/core.c +@@ -1017,6 +1017,15 @@ int __kprobes setjmp_pre_handler(struct kprobe *p, struct pt_regs *regs) + regs->flags &= ~X86_EFLAGS_IF; + trace_hardirqs_off(); + regs->ip = (unsigned long)(jp->entry); ++ ++ /* ++ * jprobes use jprobe_return() which skips the normal return ++ * path of the function, and this messes up the accounting of the ++ * function graph tracer to get messed up. ++ * ++ * Pause function graph tracing while performing the jprobe function. ++ */ ++ pause_graph_tracing(); + return 1; + } + +@@ -1042,24 +1051,25 @@ int __kprobes longjmp_break_handler(struct kprobe *p, struct pt_regs *regs) + struct kprobe_ctlblk *kcb = get_kprobe_ctlblk(); + u8 *addr = (u8 *) (regs->ip - 1); + struct jprobe *jp = container_of(p, struct jprobe, kp); ++ void *saved_sp = kcb->jprobe_saved_sp; + + if ((addr > (u8 *) jprobe_return) && + (addr < (u8 *) jprobe_return_end)) { +- if (stack_addr(regs) != kcb->jprobe_saved_sp) { ++ if (stack_addr(regs) != saved_sp) { + struct pt_regs *saved_regs = &kcb->jprobe_saved_regs; + printk(KERN_ERR + "current sp %p does not match saved sp %p\n", +- stack_addr(regs), kcb->jprobe_saved_sp); ++ stack_addr(regs), saved_sp); + printk(KERN_ERR "Saved registers for jprobe %p\n", jp); + show_regs(saved_regs); + printk(KERN_ERR "Current registers\n"); + show_regs(regs); + BUG(); + } ++ /* It's OK to start function graph tracing again */ ++ unpause_graph_tracing(); + *regs = kcb->jprobe_saved_regs; +- memcpy((kprobe_opcode_t *)(kcb->jprobe_saved_sp), +- kcb->jprobes_stack, +- MIN_STACK_SIZE(kcb->jprobe_saved_sp)); ++ memcpy(saved_sp, kcb->jprobes_stack, MIN_STACK_SIZE(saved_sp)); + preempt_enable_no_resched(); + return 1; + } +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index 0c90f4b3f835..de426887b359 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -2320,12 +2320,12 @@ static __init void nested_vmx_setup_ctls_msrs(void) + nested_vmx_secondary_ctls_low = 0; + nested_vmx_secondary_ctls_high &= + SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES | +- SECONDARY_EXEC_UNRESTRICTED_GUEST | + SECONDARY_EXEC_WBINVD_EXITING; + + if (enable_ept) { + /* nested EPT: emulate EPT also to L1 */ +- nested_vmx_secondary_ctls_high |= SECONDARY_EXEC_ENABLE_EPT; ++ nested_vmx_secondary_ctls_high |= SECONDARY_EXEC_ENABLE_EPT | ++ SECONDARY_EXEC_UNRESTRICTED_GUEST; + nested_vmx_ept_caps = VMX_EPT_PAGE_WALK_4_BIT | + VMX_EPTP_WB_BIT | VMX_EPT_2MB_PAGE_BIT | + VMX_EPT_INVEPT_BIT; +diff --git a/arch/x86/um/sys_call_table_32.c b/arch/x86/um/sys_call_table_32.c +index 531d4269e2e3..bd16d6c370ec 100644 +--- a/arch/x86/um/sys_call_table_32.c ++++ b/arch/x86/um/sys_call_table_32.c +@@ -34,7 +34,7 @@ typedef asmlinkage void (*sys_call_ptr_t)(void); + + extern asmlinkage void sys_ni_syscall(void); + +-const sys_call_ptr_t sys_call_table[] __cacheline_aligned = { ++const sys_call_ptr_t sys_call_table[] ____cacheline_aligned = { + /* + * Smells like a compiler bug -- it doesn't work + * when the & below is removed. +diff --git a/arch/x86/um/sys_call_table_64.c b/arch/x86/um/sys_call_table_64.c +index f2f0723070ca..95783087f0d3 100644 +--- a/arch/x86/um/sys_call_table_64.c ++++ b/arch/x86/um/sys_call_table_64.c +@@ -46,7 +46,7 @@ typedef void (*sys_call_ptr_t)(void); + + extern void sys_ni_syscall(void); + +-const sys_call_ptr_t sys_call_table[] __cacheline_aligned = { ++const sys_call_ptr_t sys_call_table[] ____cacheline_aligned = { + /* + * Smells like a compiler bug -- it doesn't work + * when the & below is removed. +diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c +index f9c4632d4dd3..7145f6d93567 100644 +--- a/drivers/clk/clk.c ++++ b/drivers/clk/clk.c +@@ -2232,14 +2232,17 @@ int __clk_get(struct clk *clk) + + void __clk_put(struct clk *clk) + { ++ struct module *owner; ++ + if (!clk || WARN_ON_ONCE(IS_ERR(clk))) + return; + + clk_prepare_lock(); ++ owner = clk->owner; + kref_put(&clk->ref, __clk_release); + clk_prepare_unlock(); + +- module_put(clk->owner); ++ module_put(owner); + } + + /*** clk rate change notifiers ***/ +diff --git a/drivers/clk/samsung/clk-exynos-audss.c b/drivers/clk/samsung/clk-exynos-audss.c +index 884187fbfe00..7f30b94c00a5 100644 +--- a/drivers/clk/samsung/clk-exynos-audss.c ++++ b/drivers/clk/samsung/clk-exynos-audss.c +@@ -210,6 +210,10 @@ static int exynos_audss_clk_remove(struct platform_device *pdev) + { + int i; + ++#ifdef CONFIG_PM_SLEEP ++ unregister_syscore_ops(&exynos_audss_clk_syscore_ops); ++#endif ++ + of_clk_del_provider(pdev->dev.of_node); + + for (i = 0; i < clk_data.clk_num; i++) { +diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c +index e0a98f581f58..74ed17d6cfa1 100644 +--- a/drivers/gpio/gpiolib-of.c ++++ b/drivers/gpio/gpiolib-of.c +@@ -44,8 +44,14 @@ static int of_gpiochip_find_and_xlate(struct gpio_chip *gc, void *data) + return false; + + ret = gc->of_xlate(gc, &gg_data->gpiospec, gg_data->flags); +- if (ret < 0) +- return false; ++ if (ret < 0) { ++ /* We've found the gpio chip, but the translation failed. ++ * Return true to stop looking and return the translation ++ * error via out_gpio ++ */ ++ gg_data->out_gpio = ERR_PTR(ret); ++ return true; ++ } + + gg_data->out_gpio = gpio_to_desc(ret + gc->base); + return true; +diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c +index 50c4922fe53a..5b88c83888d1 100644 +--- a/drivers/gpio/gpiolib.c ++++ b/drivers/gpio/gpiolib.c +@@ -1222,6 +1222,9 @@ int gpiochip_add(struct gpio_chip *chip) + + spin_unlock_irqrestore(&gpio_lock, flags); + ++ if (status) ++ goto fail; ++ + #ifdef CONFIG_PINCTRL + INIT_LIST_HEAD(&chip->pin_ranges); + #endif +@@ -1229,12 +1232,12 @@ int gpiochip_add(struct gpio_chip *chip) + of_gpiochip_add(chip); + acpi_gpiochip_add(chip); + +- if (status) +- goto fail; +- + status = gpiochip_export(chip); +- if (status) ++ if (status) { ++ acpi_gpiochip_remove(chip); ++ of_gpiochip_remove(chip); + goto fail; ++ } + + pr_debug("%s: registered GPIOs %d to %d on device: %s\n", __func__, + chip->base, chip->base + chip->ngpio - 1, +diff --git a/drivers/gpu/drm/i915/i915_gem_stolen.c b/drivers/gpu/drm/i915/i915_gem_stolen.c +index 3c78b2268209..800e06c28018 100644 +--- a/drivers/gpu/drm/i915/i915_gem_stolen.c ++++ b/drivers/gpu/drm/i915/i915_gem_stolen.c +@@ -137,7 +137,11 @@ static unsigned long i915_stolen_to_physical(struct drm_device *dev) + r = devm_request_mem_region(dev->dev, base + 1, + dev_priv->gtt.stolen_size - 1, + "Graphics Stolen Memory"); +- if (r == NULL) { ++ /* ++ * GEN3 firmware likes to smash pci bridges into the stolen ++ * range. Apparently this works. ++ */ ++ if (r == NULL && !IS_GEN3(dev)) { + DRM_ERROR("conflict detected with stolen region: [0x%08x - 0x%08x]\n", + base, base + (uint32_t)dev_priv->gtt.stolen_size); + base = 0; +diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h +index 0a3b9386eb43..0c83b3dab58c 100644 +--- a/drivers/gpu/drm/i915/i915_reg.h ++++ b/drivers/gpu/drm/i915/i915_reg.h +@@ -320,6 +320,7 @@ + #define PIPE_CONTROL_GLOBAL_GTT_IVB (1<<24) /* gen7+ */ + #define PIPE_CONTROL_CS_STALL (1<<20) + #define PIPE_CONTROL_TLB_INVALIDATE (1<<18) ++#define PIPE_CONTROL_MEDIA_STATE_CLEAR (1<<16) + #define PIPE_CONTROL_QW_WRITE (1<<14) + #define PIPE_CONTROL_DEPTH_STALL (1<<13) + #define PIPE_CONTROL_WRITE_FLUSH (1<<12) +diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c +index d488fc71ef49..d2af1e138c91 100644 +--- a/drivers/gpu/drm/i915/intel_ringbuffer.c ++++ b/drivers/gpu/drm/i915/intel_ringbuffer.c +@@ -334,12 +334,15 @@ gen7_render_ring_flush(struct intel_ring_buffer *ring, + flags |= PIPE_CONTROL_VF_CACHE_INVALIDATE; + flags |= PIPE_CONTROL_CONST_CACHE_INVALIDATE; + flags |= PIPE_CONTROL_STATE_CACHE_INVALIDATE; ++ flags |= PIPE_CONTROL_MEDIA_STATE_CLEAR; + /* + * TLB invalidate requires a post-sync write. + */ + flags |= PIPE_CONTROL_QW_WRITE; + flags |= PIPE_CONTROL_GLOBAL_GTT_IVB; + ++ flags |= PIPE_CONTROL_STALL_AT_SCOREBOARD; ++ + /* Workaround: we must issue a pipe_control with CS-stall bit + * set before a pipe_control command that has the state cache + * invalidate bit set. */ +diff --git a/drivers/gpu/drm/i915/intel_uncore.c b/drivers/gpu/drm/i915/intel_uncore.c +index c8796316d242..b6c063cad59b 100644 +--- a/drivers/gpu/drm/i915/intel_uncore.c ++++ b/drivers/gpu/drm/i915/intel_uncore.c +@@ -451,8 +451,8 @@ hsw_unclaimed_reg_check(struct drm_i915_private *dev_priv, u32 reg) + static void + assert_device_not_suspended(struct drm_i915_private *dev_priv) + { +- WARN(HAS_RUNTIME_PM(dev_priv->dev) && dev_priv->pm.suspended, +- "Device suspended\n"); ++ WARN_ONCE(HAS_RUNTIME_PM(dev_priv->dev) && dev_priv->pm.suspended, ++ "Device suspended\n"); + } + + #define REG_READ_HEADER(x) \ +diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv4c.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nv4c.c +index a75c35ccf25c..165401c4045c 100644 +--- a/drivers/gpu/drm/nouveau/core/subdev/mc/nv4c.c ++++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv4c.c +@@ -24,13 +24,6 @@ + + #include "nv04.h" + +-static void +-nv4c_mc_msi_rearm(struct nouveau_mc *pmc) +-{ +- struct nv04_mc_priv *priv = (void *)pmc; +- nv_wr08(priv, 0x088050, 0xff); +-} +- + struct nouveau_oclass * + nv4c_mc_oclass = &(struct nouveau_mc_oclass) { + .base.handle = NV_SUBDEV(MC, 0x4c), +@@ -41,5 +34,4 @@ nv4c_mc_oclass = &(struct nouveau_mc_oclass) { + .fini = _nouveau_mc_fini, + }, + .intr = nv04_mc_intr, +- .msi_rearm = nv4c_mc_msi_rearm, + }.base; +diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c +index 5727dbdeda7f..b4dbaded2caf 100644 +--- a/drivers/gpu/drm/radeon/atombios_dp.c ++++ b/drivers/gpu/drm/radeon/atombios_dp.c +@@ -576,6 +576,10 @@ int radeon_dp_mode_valid_helper(struct drm_connector *connector, + struct radeon_connector_atom_dig *dig_connector; + int dp_clock; + ++ if ((mode->clock > 340000) && ++ (!radeon_connector_is_dp12_capable(connector))) ++ return MODE_CLOCK_HIGH; ++ + if (!radeon_connector->con_priv) + return MODE_CLOCK_HIGH; + dig_connector = radeon_connector->con_priv; +diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c +index 543ba2d4a659..c7c285646857 100644 +--- a/drivers/gpu/drm/radeon/ci_dpm.c ++++ b/drivers/gpu/drm/radeon/ci_dpm.c +@@ -4733,7 +4733,7 @@ void ci_dpm_disable(struct radeon_device *rdev) + ci_enable_spread_spectrum(rdev, false); + ci_enable_auto_throttle_source(rdev, RADEON_DPM_AUTO_THROTTLE_SRC_THERMAL, false); + ci_stop_dpm(rdev); +- ci_enable_ds_master_switch(rdev, true); ++ ci_enable_ds_master_switch(rdev, false); + ci_enable_ulv(rdev, false); + ci_clear_vc(rdev); + ci_reset_to_default(rdev); +diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c +index ddf70d6c0270..8ef67cb4ef1e 100644 +--- a/drivers/gpu/drm/radeon/cik.c ++++ b/drivers/gpu/drm/radeon/cik.c +@@ -5879,6 +5879,7 @@ static void cik_enable_mgcg(struct radeon_device *rdev, bool enable) + } + + orig = data = RREG32(RLC_CGTT_MGCG_OVERRIDE); ++ data |= 0x00000001; + data &= 0xfffffffd; + if (orig != data) + WREG32(RLC_CGTT_MGCG_OVERRIDE, data); +@@ -5910,7 +5911,7 @@ static void cik_enable_mgcg(struct radeon_device *rdev, bool enable) + } + } else { + orig = data = RREG32(RLC_CGTT_MGCG_OVERRIDE); +- data |= 0x00000002; ++ data |= 0x00000003; + if (orig != data) + WREG32(RLC_CGTT_MGCG_OVERRIDE, data); + +diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c +index 040a2a10ea17..45a9a03efc06 100644 +--- a/drivers/gpu/drm/radeon/radeon_ttm.c ++++ b/drivers/gpu/drm/radeon/radeon_ttm.c +@@ -191,7 +191,7 @@ static void radeon_evict_flags(struct ttm_buffer_object *bo, + rbo = container_of(bo, struct radeon_bo, tbo); + switch (bo->mem.mem_type) { + case TTM_PL_VRAM: +- if (rbo->rdev->ring[RADEON_RING_TYPE_GFX_INDEX].ready == false) ++ if (rbo->rdev->ring[radeon_copy_ring_index(rbo->rdev)].ready == false) + radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_CPU); + else + radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_GTT); +diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c +index cf4bad2c1d59..76329d27385b 100644 +--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c ++++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c +@@ -297,11 +297,12 @@ static void ttm_pool_update_free_locked(struct ttm_page_pool *pool, + * + * @pool: to free the pages from + * @free_all: If set to true will free all pages in pool +- * @gfp: GFP flags. ++ * @use_static: Safe to use static buffer + **/ + static int ttm_page_pool_free(struct ttm_page_pool *pool, unsigned nr_free, +- gfp_t gfp) ++ bool use_static) + { ++ static struct page *static_buf[NUM_PAGES_TO_ALLOC]; + unsigned long irq_flags; + struct page *p; + struct page **pages_to_free; +@@ -311,7 +312,11 @@ static int ttm_page_pool_free(struct ttm_page_pool *pool, unsigned nr_free, + if (NUM_PAGES_TO_ALLOC < nr_free) + npages_to_free = NUM_PAGES_TO_ALLOC; + +- pages_to_free = kmalloc(npages_to_free * sizeof(struct page *), gfp); ++ if (use_static) ++ pages_to_free = static_buf; ++ else ++ pages_to_free = kmalloc(npages_to_free * sizeof(struct page *), ++ GFP_KERNEL); + if (!pages_to_free) { + pr_err("Failed to allocate memory for pool free operation\n"); + return 0; +@@ -374,7 +379,8 @@ restart: + if (freed_pages) + ttm_pages_put(pages_to_free, freed_pages); + out: +- kfree(pages_to_free); ++ if (pages_to_free != static_buf) ++ kfree(pages_to_free); + return nr_free; + } + +@@ -383,8 +389,6 @@ out: + * + * XXX: (dchinner) Deadlock warning! + * +- * We need to pass sc->gfp_mask to ttm_page_pool_free(). +- * + * This code is crying out for a shrinker per pool.... + */ + static unsigned long +@@ -407,8 +411,8 @@ ttm_pool_shrink_scan(struct shrinker *shrink, struct shrink_control *sc) + if (shrink_pages == 0) + break; + pool = &_manager->pools[(i + pool_offset)%NUM_POOLS]; +- shrink_pages = ttm_page_pool_free(pool, nr_free, +- sc->gfp_mask); ++ /* OK to use static buffer since global mutex is held. */ ++ shrink_pages = ttm_page_pool_free(pool, nr_free, true); + freed += nr_free - shrink_pages; + } + mutex_unlock(&lock); +@@ -710,7 +714,7 @@ static void ttm_put_pages(struct page **pages, unsigned npages, int flags, + } + spin_unlock_irqrestore(&pool->lock, irq_flags); + if (npages) +- ttm_page_pool_free(pool, npages, GFP_KERNEL); ++ ttm_page_pool_free(pool, npages, false); + } + + /* +@@ -849,9 +853,9 @@ void ttm_page_alloc_fini(void) + pr_info("Finalizing pool allocator\n"); + ttm_pool_mm_shrink_fini(_manager); + ++ /* OK to use static buffer since global mutex is no longer used. */ + for (i = 0; i < NUM_POOLS; ++i) +- ttm_page_pool_free(&_manager->pools[i], FREE_ALL_PAGES, +- GFP_KERNEL); ++ ttm_page_pool_free(&_manager->pools[i], FREE_ALL_PAGES, true); + + kobject_put(&_manager->kobj); + _manager = NULL; +diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c +index ca65df144765..3dfa97d04e51 100644 +--- a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c ++++ b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c +@@ -411,11 +411,12 @@ static void ttm_dma_page_put(struct dma_pool *pool, struct dma_page *d_page) + * + * @pool: to free the pages from + * @nr_free: If set to true will free all pages in pool +- * @gfp: GFP flags. ++ * @use_static: Safe to use static buffer + **/ + static unsigned ttm_dma_page_pool_free(struct dma_pool *pool, unsigned nr_free, +- gfp_t gfp) ++ bool use_static) + { ++ static struct page *static_buf[NUM_PAGES_TO_ALLOC]; + unsigned long irq_flags; + struct dma_page *dma_p, *tmp; + struct page **pages_to_free; +@@ -432,7 +433,11 @@ static unsigned ttm_dma_page_pool_free(struct dma_pool *pool, unsigned nr_free, + npages_to_free, nr_free); + } + #endif +- pages_to_free = kmalloc(npages_to_free * sizeof(struct page *), gfp); ++ if (use_static) ++ pages_to_free = static_buf; ++ else ++ pages_to_free = kmalloc(npages_to_free * sizeof(struct page *), ++ GFP_KERNEL); + + if (!pages_to_free) { + pr_err("%s: Failed to allocate memory for pool free operation\n", +@@ -502,7 +507,8 @@ restart: + if (freed_pages) + ttm_dma_pages_put(pool, &d_pages, pages_to_free, freed_pages); + out: +- kfree(pages_to_free); ++ if (pages_to_free != static_buf) ++ kfree(pages_to_free); + return nr_free; + } + +@@ -531,7 +537,8 @@ static void ttm_dma_free_pool(struct device *dev, enum pool_type type) + if (pool->type != type) + continue; + /* Takes a spinlock.. */ +- ttm_dma_page_pool_free(pool, FREE_ALL_PAGES, GFP_KERNEL); ++ /* OK to use static buffer since global mutex is held. */ ++ ttm_dma_page_pool_free(pool, FREE_ALL_PAGES, true); + WARN_ON(((pool->npages_in_use + pool->npages_free) != 0)); + /* This code path is called after _all_ references to the + * struct device has been dropped - so nobody should be +@@ -984,7 +991,7 @@ void ttm_dma_unpopulate(struct ttm_dma_tt *ttm_dma, struct device *dev) + + /* shrink pool if necessary (only on !is_cached pools)*/ + if (npages) +- ttm_dma_page_pool_free(pool, npages, GFP_KERNEL); ++ ttm_dma_page_pool_free(pool, npages, false); + ttm->state = tt_unpopulated; + } + EXPORT_SYMBOL_GPL(ttm_dma_unpopulate); +@@ -994,8 +1001,6 @@ EXPORT_SYMBOL_GPL(ttm_dma_unpopulate); + * + * XXX: (dchinner) Deadlock warning! + * +- * We need to pass sc->gfp_mask to ttm_dma_page_pool_free(). +- * + * I'm getting sadder as I hear more pathetical whimpers about needing per-pool + * shrinkers + */ +@@ -1028,8 +1033,8 @@ ttm_dma_pool_shrink_scan(struct shrinker *shrink, struct shrink_control *sc) + if (++idx < pool_offset) + continue; + nr_free = shrink_pages; +- shrink_pages = ttm_dma_page_pool_free(p->pool, nr_free, +- sc->gfp_mask); ++ /* OK to use static buffer since global mutex is held. */ ++ shrink_pages = ttm_dma_page_pool_free(p->pool, nr_free, true); + freed += nr_free - shrink_pages; + + pr_debug("%s: (%s:%d) Asked to shrink %d, have %d more to go\n", +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c +index 436b013b4231..b65272d7ea56 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c +@@ -1049,6 +1049,8 @@ static int vmw_event_fence_action_create(struct drm_file *file_priv, + if (ret != 0) + goto out_no_queue; + ++ return 0; ++ + out_no_queue: + event->base.destroy(&event->base); + out_no_event: +@@ -1124,17 +1126,10 @@ int vmw_fence_event_ioctl(struct drm_device *dev, void *data, + + BUG_ON(fence == NULL); + +- if (arg->flags & DRM_VMW_FE_FLAG_REQ_TIME) +- ret = vmw_event_fence_action_create(file_priv, fence, +- arg->flags, +- arg->user_data, +- true); +- else +- ret = vmw_event_fence_action_create(file_priv, fence, +- arg->flags, +- arg->user_data, +- true); +- ++ ret = vmw_event_fence_action_create(file_priv, fence, ++ arg->flags, ++ arg->user_data, ++ true); + if (unlikely(ret != 0)) { + if (ret != -ERESTARTSYS) + DRM_ERROR("Failed to attach event to fence.\n"); +diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c +index a96cfc31372e..60142274fe4b 100644 +--- a/drivers/infiniband/ulp/isert/ib_isert.c ++++ b/drivers/infiniband/ulp/isert/ib_isert.c +@@ -41,6 +41,7 @@ static DEFINE_MUTEX(device_list_mutex); + static LIST_HEAD(device_list); + static struct workqueue_struct *isert_rx_wq; + static struct workqueue_struct *isert_comp_wq; ++static struct workqueue_struct *isert_release_wq; + + static void + isert_unmap_cmd(struct isert_cmd *isert_cmd, struct isert_conn *isert_conn); +@@ -52,6 +53,11 @@ isert_unreg_rdma(struct isert_cmd *isert_cmd, struct isert_conn *isert_conn); + static int + isert_reg_rdma(struct iscsi_conn *conn, struct iscsi_cmd *cmd, + struct isert_rdma_wr *wr); ++static int ++isert_rdma_post_recvl(struct isert_conn *isert_conn); ++static int ++isert_rdma_accept(struct isert_conn *isert_conn); ++struct rdma_cm_id *isert_setup_id(struct isert_np *isert_np); + + static void + isert_qp_event_callback(struct ib_event *e, void *context) +@@ -132,12 +138,18 @@ isert_conn_setup_qp(struct isert_conn *isert_conn, struct rdma_cm_id *cma_id) + ret = rdma_create_qp(cma_id, isert_conn->conn_pd, &attr); + if (ret) { + pr_err("rdma_create_qp failed for cma_id %d\n", ret); +- return ret; ++ goto err; + } + isert_conn->conn_qp = cma_id->qp; + pr_debug("rdma_create_qp() returned success >>>>>>>>>>>>>>>>>>>>>>>>>.\n"); + + return 0; ++err: ++ mutex_lock(&device_list_mutex); ++ device->cq_active_qps[min_index]--; ++ mutex_unlock(&device_list_mutex); ++ ++ return ret; + } + + static void +@@ -489,8 +501,8 @@ err: + static int + isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event) + { +- struct iscsi_np *np = cma_id->context; +- struct isert_np *isert_np = np->np_context; ++ struct isert_np *isert_np = cma_id->context; ++ struct iscsi_np *np = isert_np->np; + struct isert_conn *isert_conn; + struct isert_device *device; + struct ib_device *ib_dev = cma_id->device; +@@ -515,6 +527,7 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event) + isert_conn->state = ISER_CONN_INIT; + INIT_LIST_HEAD(&isert_conn->conn_accept_node); + init_completion(&isert_conn->conn_login_comp); ++ init_completion(&isert_conn->login_req_comp); + init_completion(&isert_conn->conn_wait); + init_completion(&isert_conn->conn_wait_comp_err); + kref_init(&isert_conn->conn_kref); +@@ -522,7 +535,6 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event) + spin_lock_init(&isert_conn->conn_lock); + INIT_LIST_HEAD(&isert_conn->conn_fr_pool); + +- cma_id->context = isert_conn; + isert_conn->conn_cm_id = cma_id; + isert_conn->responder_resources = event->param.conn.responder_resources; + isert_conn->initiator_depth = event->param.conn.initiator_depth; +@@ -596,6 +608,14 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event) + if (ret) + goto out_conn_dev; + ++ ret = isert_rdma_post_recvl(isert_conn); ++ if (ret) ++ goto out_conn_dev; ++ ++ ret = isert_rdma_accept(isert_conn); ++ if (ret) ++ goto out_conn_dev; ++ + mutex_lock(&isert_np->np_accept_mutex); + list_add_tail(&isert_conn->conn_accept_node, &isert_np->np_accept_list); + mutex_unlock(&isert_np->np_accept_mutex); +@@ -620,6 +640,7 @@ out_login_buf: + kfree(isert_conn->login_buf); + out: + kfree(isert_conn); ++ rdma_reject(cma_id, NULL, 0); + return ret; + } + +@@ -635,18 +656,20 @@ isert_connect_release(struct isert_conn *isert_conn) + if (device && device->use_fastreg) + isert_conn_free_fastreg_pool(isert_conn); + ++ isert_free_rx_descriptors(isert_conn); ++ rdma_destroy_id(isert_conn->conn_cm_id); ++ + if (isert_conn->conn_qp) { + cq_index = ((struct isert_cq_desc *) + isert_conn->conn_qp->recv_cq->cq_context)->cq_index; + pr_debug("isert_connect_release: cq_index: %d\n", cq_index); ++ mutex_lock(&device_list_mutex); + isert_conn->conn_device->cq_active_qps[cq_index]--; ++ mutex_unlock(&device_list_mutex); + +- rdma_destroy_qp(isert_conn->conn_cm_id); ++ ib_destroy_qp(isert_conn->conn_qp); + } + +- isert_free_rx_descriptors(isert_conn); +- rdma_destroy_id(isert_conn->conn_cm_id); +- + ib_dereg_mr(isert_conn->conn_mr); + ib_dealloc_pd(isert_conn->conn_pd); + +@@ -669,9 +692,19 @@ isert_connect_release(struct isert_conn *isert_conn) + static void + isert_connected_handler(struct rdma_cm_id *cma_id) + { +- struct isert_conn *isert_conn = cma_id->context; ++ struct isert_conn *isert_conn = cma_id->qp->qp_context; ++ ++ pr_info("conn %p\n", isert_conn); + +- kref_get(&isert_conn->conn_kref); ++ if (!kref_get_unless_zero(&isert_conn->conn_kref)) { ++ pr_warn("conn %p connect_release is running\n", isert_conn); ++ return; ++ } ++ ++ mutex_lock(&isert_conn->conn_mutex); ++ if (isert_conn->state != ISER_CONN_FULL_FEATURE) ++ isert_conn->state = ISER_CONN_UP; ++ mutex_unlock(&isert_conn->conn_mutex); + } + + static void +@@ -692,65 +725,108 @@ isert_put_conn(struct isert_conn *isert_conn) + kref_put(&isert_conn->conn_kref, isert_release_conn_kref); + } + ++/** ++ * isert_conn_terminate() - Initiate connection termination ++ * @isert_conn: isert connection struct ++ * ++ * Notes: ++ * In case the connection state is FULL_FEATURE, move state ++ * to TEMINATING and start teardown sequence (rdma_disconnect). ++ * In case the connection state is UP, complete flush as well. ++ * ++ * This routine must be called with conn_mutex held. Thus it is ++ * safe to call multiple times. ++ */ + static void +-isert_disconnect_work(struct work_struct *work) ++isert_conn_terminate(struct isert_conn *isert_conn) + { +- struct isert_conn *isert_conn = container_of(work, +- struct isert_conn, conn_logout_work); ++ int err; + +- pr_debug("isert_disconnect_work(): >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n"); +- mutex_lock(&isert_conn->conn_mutex); +- if (isert_conn->state == ISER_CONN_UP) ++ switch (isert_conn->state) { ++ case ISER_CONN_TERMINATING: ++ break; ++ case ISER_CONN_UP: ++ /* ++ * No flush completions will occur as we didn't ++ * get to ISER_CONN_FULL_FEATURE yet, complete ++ * to allow teardown progress. ++ */ ++ complete(&isert_conn->conn_wait_comp_err); ++ case ISER_CONN_FULL_FEATURE: /* FALLTHRU */ ++ pr_info("Terminating conn %p state %d\n", ++ isert_conn, isert_conn->state); + isert_conn->state = ISER_CONN_TERMINATING; +- +- if (isert_conn->post_recv_buf_count == 0 && +- atomic_read(&isert_conn->post_send_buf_count) == 0) { +- mutex_unlock(&isert_conn->conn_mutex); +- goto wake_up; +- } +- if (!isert_conn->conn_cm_id) { +- mutex_unlock(&isert_conn->conn_mutex); +- isert_put_conn(isert_conn); +- return; ++ err = rdma_disconnect(isert_conn->conn_cm_id); ++ if (err) ++ pr_warn("Failed rdma_disconnect isert_conn %p\n", ++ isert_conn); ++ break; ++ default: ++ pr_warn("conn %p teminating in state %d\n", ++ isert_conn, isert_conn->state); + } ++} + +- if (isert_conn->disconnect) { +- /* Send DREQ/DREP towards our initiator */ +- rdma_disconnect(isert_conn->conn_cm_id); +- } ++static int ++isert_np_cma_handler(struct isert_np *isert_np, ++ enum rdma_cm_event_type event) ++{ ++ pr_debug("isert np %p, handling event %d\n", isert_np, event); + +- mutex_unlock(&isert_conn->conn_mutex); ++ switch (event) { ++ case RDMA_CM_EVENT_DEVICE_REMOVAL: ++ isert_np->np_cm_id = NULL; ++ break; ++ case RDMA_CM_EVENT_ADDR_CHANGE: ++ isert_np->np_cm_id = isert_setup_id(isert_np); ++ if (IS_ERR(isert_np->np_cm_id)) { ++ pr_err("isert np %p setup id failed: %ld\n", ++ isert_np, PTR_ERR(isert_np->np_cm_id)); ++ isert_np->np_cm_id = NULL; ++ } ++ break; ++ default: ++ pr_err("isert np %p Unexpected event %d\n", ++ isert_np, event); ++ } + +-wake_up: +- complete(&isert_conn->conn_wait); ++ return -1; + } + + static int +-isert_disconnected_handler(struct rdma_cm_id *cma_id, bool disconnect) ++isert_disconnected_handler(struct rdma_cm_id *cma_id, ++ enum rdma_cm_event_type event) + { ++ struct isert_np *isert_np = cma_id->context; + struct isert_conn *isert_conn; + +- if (!cma_id->qp) { +- struct isert_np *isert_np = cma_id->context; ++ if (isert_np->np_cm_id == cma_id) ++ return isert_np_cma_handler(cma_id->context, event); + +- isert_np->np_cm_id = NULL; +- return -1; +- } ++ isert_conn = cma_id->qp->qp_context; + +- isert_conn = (struct isert_conn *)cma_id->context; ++ mutex_lock(&isert_conn->conn_mutex); ++ isert_conn_terminate(isert_conn); ++ mutex_unlock(&isert_conn->conn_mutex); + +- isert_conn->disconnect = disconnect; +- INIT_WORK(&isert_conn->conn_logout_work, isert_disconnect_work); +- schedule_work(&isert_conn->conn_logout_work); ++ pr_info("conn %p completing conn_wait\n", isert_conn); ++ complete(&isert_conn->conn_wait); + + return 0; + } + ++static void ++isert_connect_error(struct rdma_cm_id *cma_id) ++{ ++ struct isert_conn *isert_conn = cma_id->qp->qp_context; ++ ++ isert_put_conn(isert_conn); ++} ++ + static int + isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event) + { + int ret = 0; +- bool disconnect = false; + + pr_debug("isert_cma_handler: event %d status %d conn %p id %p\n", + event->event, event->status, cma_id->context, cma_id); +@@ -768,11 +844,14 @@ isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event) + case RDMA_CM_EVENT_ADDR_CHANGE: /* FALLTHRU */ + case RDMA_CM_EVENT_DISCONNECTED: /* FALLTHRU */ + case RDMA_CM_EVENT_DEVICE_REMOVAL: /* FALLTHRU */ +- disconnect = true; + case RDMA_CM_EVENT_TIMEWAIT_EXIT: /* FALLTHRU */ +- ret = isert_disconnected_handler(cma_id, disconnect); ++ ret = isert_disconnected_handler(cma_id, event->event); + break; ++ case RDMA_CM_EVENT_REJECTED: /* FALLTHRU */ ++ case RDMA_CM_EVENT_UNREACHABLE: /* FALLTHRU */ + case RDMA_CM_EVENT_CONNECT_ERROR: ++ isert_connect_error(cma_id); ++ break; + default: + pr_err("Unhandled RDMA CMA event: %d\n", event->event); + break; +@@ -906,7 +985,7 @@ isert_init_send_wr(struct isert_conn *isert_conn, struct isert_cmd *isert_cmd, + * bit for every ISERT_COMP_BATCH_COUNT number of ib_post_send() calls. + */ + mutex_lock(&isert_conn->conn_mutex); +- if (coalesce && isert_conn->state == ISER_CONN_UP && ++ if (coalesce && isert_conn->state == ISER_CONN_FULL_FEATURE && + ++isert_conn->conn_comp_batch < ISERT_COMP_BATCH_COUNT) { + tx_desc->llnode_active = true; + llist_add(&tx_desc->comp_llnode, &isert_conn->conn_comp_llist); +@@ -1003,7 +1082,10 @@ isert_put_login_tx(struct iscsi_conn *conn, struct iscsi_login *login, + if (ret) + return ret; + +- isert_conn->state = ISER_CONN_UP; ++ /* Now we are in FULL_FEATURE phase */ ++ mutex_lock(&isert_conn->conn_mutex); ++ isert_conn->state = ISER_CONN_FULL_FEATURE; ++ mutex_unlock(&isert_conn->conn_mutex); + goto post_send; + } + +@@ -1020,18 +1102,17 @@ post_send: + } + + static void +-isert_rx_login_req(struct iser_rx_desc *rx_desc, int rx_buflen, +- struct isert_conn *isert_conn) ++isert_rx_login_req(struct isert_conn *isert_conn) + { ++ struct iser_rx_desc *rx_desc = (void *)isert_conn->login_req_buf; ++ int rx_buflen = isert_conn->login_req_len; + struct iscsi_conn *conn = isert_conn->conn; + struct iscsi_login *login = conn->conn_login; + int size; + +- if (!login) { +- pr_err("conn->conn_login is NULL\n"); +- dump_stack(); +- return; +- } ++ pr_info("conn %p\n", isert_conn); ++ ++ WARN_ON_ONCE(!login); + + if (login->first_request) { + struct iscsi_login_req *login_req = +@@ -1394,11 +1475,20 @@ isert_rx_completion(struct iser_rx_desc *desc, struct isert_conn *isert_conn, + hdr->opcode, hdr->itt, hdr->flags, + (int)(xfer_len - ISER_HEADERS_LEN)); + +- if ((char *)desc == isert_conn->login_req_buf) +- isert_rx_login_req(desc, xfer_len - ISER_HEADERS_LEN, +- isert_conn); +- else ++ if ((char *)desc == isert_conn->login_req_buf) { ++ isert_conn->login_req_len = xfer_len - ISER_HEADERS_LEN; ++ if (isert_conn->conn) { ++ struct iscsi_login *login = isert_conn->conn->conn_login; ++ ++ if (login && !login->first_request) ++ isert_rx_login_req(isert_conn); ++ } ++ mutex_lock(&isert_conn->conn_mutex); ++ complete(&isert_conn->login_req_comp); ++ mutex_unlock(&isert_conn->conn_mutex); ++ } else { + isert_rx_do_work(desc, isert_conn); ++ } + + ib_dma_sync_single_for_device(ib_dev, rx_dma, rx_buflen, + DMA_FROM_DEVICE); +@@ -1799,7 +1889,7 @@ isert_cq_rx_comp_err(struct isert_conn *isert_conn) + msleep(3000); + + mutex_lock(&isert_conn->conn_mutex); +- isert_conn->state = ISER_CONN_DOWN; ++ isert_conn_terminate(isert_conn); + mutex_unlock(&isert_conn->conn_mutex); + + iscsit_cause_connection_reinstatement(isert_conn->conn, 0); +@@ -2579,13 +2669,51 @@ isert_response_queue(struct iscsi_conn *conn, struct iscsi_cmd *cmd, int state) + return ret; + } + ++struct rdma_cm_id * ++isert_setup_id(struct isert_np *isert_np) ++{ ++ struct iscsi_np *np = isert_np->np; ++ struct rdma_cm_id *id; ++ struct sockaddr *sa; ++ int ret; ++ ++ sa = (struct sockaddr *)&np->np_sockaddr; ++ pr_debug("ksockaddr: %p, sa: %p\n", &np->np_sockaddr, sa); ++ ++ id = rdma_create_id(isert_cma_handler, isert_np, ++ RDMA_PS_TCP, IB_QPT_RC); ++ if (IS_ERR(id)) { ++ pr_err("rdma_create_id() failed: %ld\n", PTR_ERR(id)); ++ ret = PTR_ERR(id); ++ goto out; ++ } ++ pr_debug("id %p context %p\n", id, id->context); ++ ++ ret = rdma_bind_addr(id, sa); ++ if (ret) { ++ pr_err("rdma_bind_addr() failed: %d\n", ret); ++ goto out_id; ++ } ++ ++ ret = rdma_listen(id, ISERT_RDMA_LISTEN_BACKLOG); ++ if (ret) { ++ pr_err("rdma_listen() failed: %d\n", ret); ++ goto out_id; ++ } ++ ++ return id; ++out_id: ++ rdma_destroy_id(id); ++out: ++ return ERR_PTR(ret); ++} ++ + static int + isert_setup_np(struct iscsi_np *np, + struct __kernel_sockaddr_storage *ksockaddr) + { + struct isert_np *isert_np; + struct rdma_cm_id *isert_lid; +- struct sockaddr *sa; + int ret; + + isert_np = kzalloc(sizeof(struct isert_np), GFP_KERNEL); +@@ -2597,9 +2725,8 @@ isert_setup_np(struct iscsi_np *np, + mutex_init(&isert_np->np_accept_mutex); + INIT_LIST_HEAD(&isert_np->np_accept_list); + init_completion(&isert_np->np_login_comp); ++ isert_np->np = np; + +- sa = (struct sockaddr *)ksockaddr; +- pr_debug("ksockaddr: %p, sa: %p\n", ksockaddr, sa); + /* + * Setup the np->np_sockaddr from the passed sockaddr setup + * in iscsi_target_configfs.c code.. +@@ -2607,37 +2734,20 @@ isert_setup_np(struct iscsi_np *np, + memcpy(&np->np_sockaddr, ksockaddr, + sizeof(struct __kernel_sockaddr_storage)); + +- isert_lid = rdma_create_id(isert_cma_handler, np, RDMA_PS_TCP, +- IB_QPT_RC); ++ isert_lid = isert_setup_id(isert_np); + if (IS_ERR(isert_lid)) { +- pr_err("rdma_create_id() for isert_listen_handler failed: %ld\n", +- PTR_ERR(isert_lid)); + ret = PTR_ERR(isert_lid); + goto out; + } + +- ret = rdma_bind_addr(isert_lid, sa); +- if (ret) { +- pr_err("rdma_bind_addr() for isert_lid failed: %d\n", ret); +- goto out_lid; +- } +- +- ret = rdma_listen(isert_lid, ISERT_RDMA_LISTEN_BACKLOG); +- if (ret) { +- pr_err("rdma_listen() for isert_lid failed: %d\n", ret); +- goto out_lid; +- } +- + isert_np->np_cm_id = isert_lid; + np->np_context = isert_np; +- pr_debug("Setup isert_lid->context: %p\n", isert_lid->context); + + return 0; + +-out_lid: +- rdma_destroy_id(isert_lid); + out: + kfree(isert_np); ++ + return ret; + } + +@@ -2673,7 +2783,15 @@ isert_get_login_rx(struct iscsi_conn *conn, struct iscsi_login *login) + struct isert_conn *isert_conn = (struct isert_conn *)conn->context; + int ret; + +- pr_debug("isert_get_login_rx before conn_login_comp conn: %p\n", conn); ++ pr_info("before login_req comp conn: %p\n", isert_conn); ++ ret = wait_for_completion_interruptible(&isert_conn->login_req_comp); ++ if (ret) { ++ pr_err("isert_conn %p interrupted before got login req\n", ++ isert_conn); ++ return ret; ++ } ++ reinit_completion(&isert_conn->login_req_comp); ++ + /* + * For login requests after the first PDU, isert_rx_login_req() will + * kick schedule_delayed_work(&conn->login_work) as the packet is +@@ -2683,11 +2801,15 @@ isert_get_login_rx(struct iscsi_conn *conn, struct iscsi_login *login) + if (!login->first_request) + return 0; + ++ isert_rx_login_req(isert_conn); ++ ++ pr_info("before conn_login_comp conn: %p\n", conn); + ret = wait_for_completion_interruptible(&isert_conn->conn_login_comp); + if (ret) + return ret; + +- pr_debug("isert_get_login_rx processing login->req: %p\n", login->req); ++ pr_info("processing login->req: %p\n", login->req); ++ + return 0; + } + +@@ -2765,17 +2887,10 @@ accept_wait: + isert_conn->conn = conn; + max_accept = 0; + +- ret = isert_rdma_post_recvl(isert_conn); +- if (ret) +- return ret; +- +- ret = isert_rdma_accept(isert_conn); +- if (ret) +- return ret; +- + isert_set_conn_info(np, conn, isert_conn); + +- pr_debug("Processing isert_accept_np: isert_conn: %p\n", isert_conn); ++ pr_debug("Processing isert_conn: %p\n", isert_conn); ++ + return 0; + } + +@@ -2791,6 +2906,24 @@ isert_free_np(struct iscsi_np *np) + kfree(isert_np); + } + ++static void isert_release_work(struct work_struct *work) ++{ ++ struct isert_conn *isert_conn = container_of(work, ++ struct isert_conn, ++ release_work); ++ ++ pr_info("Starting release conn %p\n", isert_conn); ++ ++ wait_for_completion(&isert_conn->conn_wait); ++ ++ mutex_lock(&isert_conn->conn_mutex); ++ isert_conn->state = ISER_CONN_DOWN; ++ mutex_unlock(&isert_conn->conn_mutex); ++ ++ pr_info("Destroying conn %p\n", isert_conn); ++ isert_put_conn(isert_conn); ++} ++ + static void isert_wait_conn(struct iscsi_conn *conn) + { + struct isert_conn *isert_conn = conn->context; +@@ -2798,10 +2931,6 @@ static void isert_wait_conn(struct iscsi_conn *conn) + pr_debug("isert_wait_conn: Starting \n"); + + mutex_lock(&isert_conn->conn_mutex); +- if (isert_conn->conn_cm_id) { +- pr_debug("Calling rdma_disconnect from isert_wait_conn\n"); +- rdma_disconnect(isert_conn->conn_cm_id); +- } + /* + * Only wait for conn_wait_comp_err if the isert_conn made it + * into full feature phase.. +@@ -2810,14 +2939,13 @@ static void isert_wait_conn(struct iscsi_conn *conn) + mutex_unlock(&isert_conn->conn_mutex); + return; + } +- if (isert_conn->state == ISER_CONN_UP) +- isert_conn->state = ISER_CONN_TERMINATING; ++ isert_conn_terminate(isert_conn); + mutex_unlock(&isert_conn->conn_mutex); + + wait_for_completion(&isert_conn->conn_wait_comp_err); + +- wait_for_completion(&isert_conn->conn_wait); +- isert_put_conn(isert_conn); ++ INIT_WORK(&isert_conn->release_work, isert_release_work); ++ queue_work(isert_release_wq, &isert_conn->release_work); + } + + static void isert_free_conn(struct iscsi_conn *conn) +@@ -2863,10 +2991,21 @@ static int __init isert_init(void) + goto destroy_rx_wq; + } + ++ isert_release_wq = alloc_workqueue("isert_release_wq", WQ_UNBOUND, ++ WQ_UNBOUND_MAX_ACTIVE); ++ if (!isert_release_wq) { ++ pr_err("Unable to allocate isert_release_wq\n"); ++ ret = -ENOMEM; ++ goto destroy_comp_wq; ++ } ++ + iscsit_register_transport(&iser_target_transport); +- pr_debug("iSER_TARGET[0] - Loaded iser_target_transport\n"); ++ pr_info("iSER_TARGET[0] - Loaded iser_target_transport\n"); ++ + return 0; + ++destroy_comp_wq: ++ destroy_workqueue(isert_comp_wq); + destroy_rx_wq: + destroy_workqueue(isert_rx_wq); + return ret; +@@ -2875,6 +3014,7 @@ destroy_rx_wq: + static void __exit isert_exit(void) + { + flush_scheduled_work(); ++ destroy_workqueue(isert_release_wq); + destroy_workqueue(isert_comp_wq); + destroy_workqueue(isert_rx_wq); + iscsit_unregister_transport(&iser_target_transport); +diff --git a/drivers/infiniband/ulp/isert/ib_isert.h b/drivers/infiniband/ulp/isert/ib_isert.h +index cbecaabe90b9..1178c5b6800c 100644 +--- a/drivers/infiniband/ulp/isert/ib_isert.h ++++ b/drivers/infiniband/ulp/isert/ib_isert.h +@@ -23,6 +23,7 @@ enum iser_ib_op_code { + enum iser_conn_state { + ISER_CONN_INIT, + ISER_CONN_UP, ++ ISER_CONN_FULL_FEATURE, + ISER_CONN_TERMINATING, + ISER_CONN_DOWN, + }; +@@ -102,6 +103,7 @@ struct isert_conn { + char *login_req_buf; + char *login_rsp_buf; + u64 login_req_dma; ++ int login_req_len; + u64 login_rsp_dma; + unsigned int conn_rx_desc_head; + struct iser_rx_desc *conn_rx_descs; +@@ -109,13 +111,13 @@ struct isert_conn { + struct iscsi_conn *conn; + struct list_head conn_accept_node; + struct completion conn_login_comp; ++ struct completion login_req_comp; + struct iser_tx_desc conn_login_tx_desc; + struct rdma_cm_id *conn_cm_id; + struct ib_pd *conn_pd; + struct ib_mr *conn_mr; + struct ib_qp *conn_qp; + struct isert_device *conn_device; +- struct work_struct conn_logout_work; + struct mutex conn_mutex; + struct completion conn_wait; + struct completion conn_wait_comp_err; +@@ -124,10 +126,10 @@ struct isert_conn { + int conn_fr_pool_size; + /* lock to protect fastreg pool */ + spinlock_t conn_lock; ++ struct work_struct release_work; + #define ISERT_COMP_BATCH_COUNT 8 + int conn_comp_batch; + struct llist_head conn_comp_llist; +- bool disconnect; + }; + + #define ISERT_MAX_CQ 64 +@@ -158,6 +160,7 @@ struct isert_device { + }; + + struct isert_np { ++ struct iscsi_np *np; + struct semaphore np_sem; + struct rdma_cm_id *np_cm_id; + struct mutex np_accept_mutex; +diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h +index 8fca488fdc15..c43c46f7dcd0 100644 +--- a/drivers/input/serio/i8042-x86ia64io.h ++++ b/drivers/input/serio/i8042-x86ia64io.h +@@ -408,6 +408,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = { + }, + }, + { ++ /* Acer Aspire 7738 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 7738"), ++ }, ++ }, ++ { + /* Gericom Bellagio */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Gericom"), +@@ -721,6 +728,35 @@ static const struct dmi_system_id __initconst i8042_dmi_dritek_table[] = { + { } + }; + ++/* ++ * Some laptops need keyboard reset before probing for the trackpad to get ++ * it detected, initialised & finally work. ++ */ ++static const struct dmi_system_id __initconst i8042_dmi_kbdreset_table[] = { ++ { ++ /* Gigabyte P35 v2 - Elantech touchpad */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "P35V2"), ++ }, ++ }, ++ { ++ /* Aorus branded Gigabyte X3 Plus - Elantech touchpad */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "X3"), ++ }, ++ }, ++ { ++ /* Gigabyte P34 - Elantech touchpad */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "P34"), ++ }, ++ }, ++ { } ++}; ++ + #endif /* CONFIG_X86 */ + + #ifdef CONFIG_PNP +@@ -1016,6 +1052,9 @@ static int __init i8042_platform_init(void) + if (dmi_check_system(i8042_dmi_dritek_table)) + i8042_dritek = true; + ++ if (dmi_check_system(i8042_dmi_kbdreset_table)) ++ i8042_kbdreset = true; ++ + /* + * A20 was already enabled during early kernel init. But some buggy + * BIOSes (in MSI Laptops) require A20 to be enabled using 8042 to +diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c +index 3807c3e971cc..eb796fff9e62 100644 +--- a/drivers/input/serio/i8042.c ++++ b/drivers/input/serio/i8042.c +@@ -67,6 +67,10 @@ static bool i8042_notimeout; + module_param_named(notimeout, i8042_notimeout, bool, 0); + MODULE_PARM_DESC(notimeout, "Ignore timeouts signalled by i8042"); + ++static bool i8042_kbdreset; ++module_param_named(kbdreset, i8042_kbdreset, bool, 0); ++MODULE_PARM_DESC(kbdreset, "Reset device connected to KBD port"); ++ + #ifdef CONFIG_X86 + static bool i8042_dritek; + module_param_named(dritek, i8042_dritek, bool, 0); +@@ -790,6 +794,16 @@ static int __init i8042_check_aux(void) + return -1; + + /* ++ * Reset keyboard (needed on some laptops to successfully detect ++ * touchpad, e.g., some Gigabyte laptop models with Elantech ++ * touchpads). ++ */ ++ if (i8042_kbdreset) { ++ pr_warn("Attempting to reset device connected to KBD port\n"); ++ i8042_kbd_write(NULL, (unsigned char) 0xff); ++ } ++ ++/* + * Test AUX IRQ delivery to make sure BIOS did not grab the IRQ and + * used it for a PCI card or somethig else. + */ +diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c +index 5f9c2a665ca5..fbcb6225f794 100644 +--- a/drivers/md/bcache/btree.c ++++ b/drivers/md/bcache/btree.c +@@ -199,7 +199,7 @@ void bch_btree_node_read_done(struct btree *b) + struct bset *i = btree_bset_first(b); + struct btree_iter *iter; + +- iter = mempool_alloc(b->c->fill_iter, GFP_NOWAIT); ++ iter = mempool_alloc(b->c->fill_iter, GFP_NOIO); + iter->size = b->c->sb.bucket_size / b->c->sb.block_size; + iter->used = 0; + +diff --git a/drivers/media/i2c/smiapp-pll.c b/drivers/media/i2c/smiapp-pll.c +index 2335529b195c..ab5d9a3adebf 100644 +--- a/drivers/media/i2c/smiapp-pll.c ++++ b/drivers/media/i2c/smiapp-pll.c +@@ -67,7 +67,7 @@ static void print_pll(struct device *dev, struct smiapp_pll *pll) + { + dev_dbg(dev, "pre_pll_clk_div\t%d\n", pll->pre_pll_clk_div); + dev_dbg(dev, "pll_multiplier \t%d\n", pll->pll_multiplier); +- if (pll->flags != SMIAPP_PLL_FLAG_NO_OP_CLOCKS) { ++ if (!(pll->flags & SMIAPP_PLL_FLAG_NO_OP_CLOCKS)) { + dev_dbg(dev, "op_sys_clk_div \t%d\n", pll->op_sys_clk_div); + dev_dbg(dev, "op_pix_clk_div \t%d\n", pll->op_pix_clk_div); + } +@@ -77,7 +77,7 @@ static void print_pll(struct device *dev, struct smiapp_pll *pll) + dev_dbg(dev, "ext_clk_freq_hz \t%d\n", pll->ext_clk_freq_hz); + dev_dbg(dev, "pll_ip_clk_freq_hz \t%d\n", pll->pll_ip_clk_freq_hz); + dev_dbg(dev, "pll_op_clk_freq_hz \t%d\n", pll->pll_op_clk_freq_hz); +- if (pll->flags & SMIAPP_PLL_FLAG_NO_OP_CLOCKS) { ++ if (!(pll->flags & SMIAPP_PLL_FLAG_NO_OP_CLOCKS)) { + dev_dbg(dev, "op_sys_clk_freq_hz \t%d\n", + pll->op_sys_clk_freq_hz); + dev_dbg(dev, "op_pix_clk_freq_hz \t%d\n", +diff --git a/drivers/media/i2c/smiapp/smiapp-core.c b/drivers/media/i2c/smiapp/smiapp-core.c +index 7026ab08ec91..873d0627a75b 100644 +--- a/drivers/media/i2c/smiapp/smiapp-core.c ++++ b/drivers/media/i2c/smiapp/smiapp-core.c +@@ -2624,7 +2624,9 @@ static int smiapp_registered(struct v4l2_subdev *subdev) + pll->flags |= SMIAPP_PLL_FLAG_OP_PIX_CLOCK_PER_LANE; + pll->scale_n = sensor->limits[SMIAPP_LIMIT_SCALER_N_MIN]; + ++ mutex_lock(&sensor->mutex); + rval = smiapp_update_mode(sensor); ++ mutex_unlock(&sensor->mutex); + if (rval) { + dev_err(&client->dev, "update mode failed\n"); + goto out_nvm_release; +diff --git a/drivers/media/usb/au0828/au0828-cards.c b/drivers/media/usb/au0828/au0828-cards.c +index dd32decb237d..1d4b11038958 100644 +--- a/drivers/media/usb/au0828/au0828-cards.c ++++ b/drivers/media/usb/au0828/au0828-cards.c +@@ -36,6 +36,11 @@ static void hvr950q_cs5340_audio(void *priv, int enable) + au0828_clear(dev, REG_000, 0x10); + } + ++/* ++ * WARNING: There's a quirks table at sound/usb/quirks-table.h ++ * that should also be updated every time a new device with V4L2 support ++ * is added here. ++ */ + struct au0828_board au0828_boards[] = { + [AU0828_BOARD_UNKNOWN] = { + .name = "Unknown board", +diff --git a/drivers/media/usb/dvb-usb/af9005.c b/drivers/media/usb/dvb-usb/af9005.c +index af176b6ce738..e6d3561eea47 100644 +--- a/drivers/media/usb/dvb-usb/af9005.c ++++ b/drivers/media/usb/dvb-usb/af9005.c +@@ -1081,9 +1081,12 @@ static int __init af9005_usb_module_init(void) + err("usb_register failed. (%d)", result); + return result; + } ++#if IS_MODULE(CONFIG_DVB_USB_AF9005) || defined(CONFIG_DVB_USB_AF9005_REMOTE) ++ /* FIXME: convert to todays kernel IR infrastructure */ + rc_decode = symbol_request(af9005_rc_decode); + rc_keys = symbol_request(rc_map_af9005_table); + rc_keys_size = symbol_request(rc_map_af9005_table_size); ++#endif + if (rc_decode == NULL || rc_keys == NULL || rc_keys_size == NULL) { + err("af9005_rc_decode function not found, disabling remote"); + af9005_properties.rc.legacy.rc_query = NULL; +diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c +index 753ad4cfc118..45314412b4a3 100644 +--- a/drivers/media/usb/uvc/uvc_driver.c ++++ b/drivers/media/usb/uvc/uvc_driver.c +@@ -1603,12 +1603,12 @@ static void uvc_delete(struct uvc_device *dev) + { + struct list_head *p, *n; + +- usb_put_intf(dev->intf); +- usb_put_dev(dev->udev); +- + uvc_status_cleanup(dev); + uvc_ctrl_cleanup_device(dev); + ++ usb_put_intf(dev->intf); ++ usb_put_dev(dev->udev); ++ + if (dev->vdev.dev) + v4l2_device_unregister(&dev->vdev); + #ifdef CONFIG_MEDIA_CONTROLLER +diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c +index e77d11049747..4e65b35bebc0 100644 +--- a/drivers/net/can/usb/kvaser_usb.c ++++ b/drivers/net/can/usb/kvaser_usb.c +@@ -1237,6 +1237,9 @@ static int kvaser_usb_close(struct net_device *netdev) + if (err) + netdev_warn(netdev, "Cannot stop device, error %d\n", err); + ++ /* reset tx contexts */ ++ kvaser_usb_unlink_tx_urbs(priv); ++ + priv->can.state = CAN_STATE_STOPPED; + close_candev(priv->netdev); + +@@ -1285,12 +1288,14 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb, + if (!urb) { + netdev_err(netdev, "No memory left for URBs\n"); + stats->tx_dropped++; +- goto nourbmem; ++ dev_kfree_skb(skb); ++ return NETDEV_TX_OK; + } + + buf = kmalloc(sizeof(struct kvaser_msg), GFP_ATOMIC); + if (!buf) { + stats->tx_dropped++; ++ dev_kfree_skb(skb); + goto nobufmem; + } + +@@ -1325,6 +1330,7 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb, + } + } + ++ /* This should never happen; it implies a flow control bug */ + if (!context) { + netdev_warn(netdev, "cannot find free context\n"); + ret = NETDEV_TX_BUSY; +@@ -1355,9 +1361,6 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb, + if (unlikely(err)) { + can_free_echo_skb(netdev, context->echo_index); + +- skb = NULL; /* set to NULL to avoid double free in +- * dev_kfree_skb(skb) */ +- + atomic_dec(&priv->active_tx_urbs); + usb_unanchor_urb(urb); + +@@ -1379,8 +1382,6 @@ releasebuf: + kfree(buf); + nobufmem: + usb_free_urb(urb); +-nourbmem: +- dev_kfree_skb(skb); + return ret; + } + +@@ -1492,6 +1493,10 @@ static int kvaser_usb_init_one(struct usb_interface *intf, + struct kvaser_usb_net_priv *priv; + int i, err; + ++ err = kvaser_usb_send_simple_msg(dev, CMD_RESET_CHIP, channel); ++ if (err) ++ return err; ++ + netdev = alloc_candev(sizeof(*priv), MAX_TX_URBS); + if (!netdev) { + dev_err(&intf->dev, "Cannot alloc candev\n"); +@@ -1595,9 +1600,6 @@ static int kvaser_usb_probe(struct usb_interface *intf, + + usb_set_intfdata(intf, dev); + +- for (i = 0; i < MAX_NET_DEVICES; i++) +- kvaser_usb_send_simple_msg(dev, CMD_RESET_CHIP, i); +- + err = kvaser_usb_get_software_info(dev); + if (err) { + dev_err(&intf->dev, +diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c +index 380d24922049..3e1d7d29b4ec 100644 +--- a/drivers/net/ethernet/atheros/alx/main.c ++++ b/drivers/net/ethernet/atheros/alx/main.c +@@ -184,15 +184,16 @@ static void alx_schedule_reset(struct alx_priv *alx) + schedule_work(&alx->reset_wk); + } + +-static bool alx_clean_rx_irq(struct alx_priv *alx, int budget) ++static int alx_clean_rx_irq(struct alx_priv *alx, int budget) + { + struct alx_rx_queue *rxq = &alx->rxq; + struct alx_rrd *rrd; + struct alx_buffer *rxb; + struct sk_buff *skb; + u16 length, rfd_cleaned = 0; ++ int work = 0; + +- while (budget > 0) { ++ while (work < budget) { + rrd = &rxq->rrd[rxq->rrd_read_idx]; + if (!(rrd->word3 & cpu_to_le32(1 << RRD_UPDATED_SHIFT))) + break; +@@ -203,7 +204,7 @@ static bool alx_clean_rx_irq(struct alx_priv *alx, int budget) + ALX_GET_FIELD(le32_to_cpu(rrd->word0), + RRD_NOR) != 1) { + alx_schedule_reset(alx); +- return 0; ++ return work; + } + + rxb = &rxq->bufs[rxq->read_idx]; +@@ -243,7 +244,7 @@ static bool alx_clean_rx_irq(struct alx_priv *alx, int budget) + } + + napi_gro_receive(&alx->napi, skb); +- budget--; ++ work++; + + next_pkt: + if (++rxq->read_idx == alx->rx_ringsz) +@@ -258,21 +259,22 @@ next_pkt: + if (rfd_cleaned) + alx_refill_rx_ring(alx, GFP_ATOMIC); + +- return budget > 0; ++ return work; + } + + static int alx_poll(struct napi_struct *napi, int budget) + { + struct alx_priv *alx = container_of(napi, struct alx_priv, napi); + struct alx_hw *hw = &alx->hw; +- bool complete = true; + unsigned long flags; ++ bool tx_complete; ++ int work; + +- complete = alx_clean_tx_irq(alx) && +- alx_clean_rx_irq(alx, budget); ++ tx_complete = alx_clean_tx_irq(alx); ++ work = alx_clean_rx_irq(alx, budget); + +- if (!complete) +- return 1; ++ if (!tx_complete || work == budget) ++ return budget; + + napi_complete(&alx->napi); + +@@ -284,7 +286,7 @@ static int alx_poll(struct napi_struct *napi, int budget) + + alx_post_write(hw); + +- return 0; ++ return work; + } + + static irqreturn_t alx_intr_handle(struct alx_priv *alx, u32 intr) +diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c +index 086eac5af5c2..82061139b215 100644 +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -17731,23 +17731,6 @@ static int tg3_init_one(struct pci_dev *pdev, + goto err_out_apeunmap; + } + +- /* +- * Reset chip in case UNDI or EFI driver did not shutdown +- * DMA self test will enable WDMAC and we'll see (spurious) +- * pending DMA on the PCI bus at that point. +- */ +- if ((tr32(HOSTCC_MODE) & HOSTCC_MODE_ENABLE) || +- (tr32(WDMAC_MODE) & WDMAC_MODE_ENABLE)) { +- tw32(MEMARB_MODE, MEMARB_MODE_ENABLE); +- tg3_halt(tp, RESET_KIND_SHUTDOWN, 1); +- } +- +- err = tg3_test_dma(tp); +- if (err) { +- dev_err(&pdev->dev, "DMA engine test failed, aborting\n"); +- goto err_out_apeunmap; +- } +- + intmbx = MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW; + rcvmbx = MAILBOX_RCVRET_CON_IDX_0 + TG3_64BIT_REG_LOW; + sndmbx = MAILBOX_SNDHOST_PROD_IDX_0 + TG3_64BIT_REG_LOW; +@@ -17792,6 +17775,23 @@ static int tg3_init_one(struct pci_dev *pdev, + sndmbx += 0xc; + } + ++ /* ++ * Reset chip in case UNDI or EFI driver did not shutdown ++ * DMA self test will enable WDMAC and we'll see (spurious) ++ * pending DMA on the PCI bus at that point. ++ */ ++ if ((tr32(HOSTCC_MODE) & HOSTCC_MODE_ENABLE) || ++ (tr32(WDMAC_MODE) & WDMAC_MODE_ENABLE)) { ++ tw32(MEMARB_MODE, MEMARB_MODE_ENABLE); ++ tg3_halt(tp, RESET_KIND_SHUTDOWN, 1); ++ } ++ ++ err = tg3_test_dma(tp); ++ if (err) { ++ dev_err(&pdev->dev, "DMA engine test failed, aborting\n"); ++ goto err_out_apeunmap; ++ } ++ + tg3_init_coal(tp); + + pci_set_drvdata(pdev, dev); +diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c +index b740bfce72ef..ff9b423805a0 100644 +--- a/drivers/net/ethernet/cisco/enic/enic_main.c ++++ b/drivers/net/ethernet/cisco/enic/enic_main.c +@@ -1044,10 +1044,14 @@ static void enic_rq_indicate_buf(struct vnic_rq *rq, + PKT_HASH_TYPE_L4 : PKT_HASH_TYPE_L3); + } + +- if ((netdev->features & NETIF_F_RXCSUM) && !csum_not_calc) { +- skb->csum = htons(checksum); +- skb->ip_summed = CHECKSUM_COMPLETE; +- } ++ /* Hardware does not provide whole packet checksum. It only ++ * provides pseudo checksum. Since hw validates the packet ++ * checksum but not provide us the checksum value. use ++ * CHECSUM_UNNECESSARY. ++ */ ++ if ((netdev->features & NETIF_F_RXCSUM) && tcp_udp_csum_ok && ++ ipv4_csum_ok) ++ skb->ip_summed = CHECKSUM_UNNECESSARY; + + if (vlan_stripped) + __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), vlan_tci); +diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c +index 921b9df2faca..316650c3b5d7 100644 +--- a/drivers/net/ethernet/ti/cpsw.c ++++ b/drivers/net/ethernet/ti/cpsw.c +@@ -596,7 +596,7 @@ static void cpsw_set_promiscious(struct net_device *ndev, bool enable) + + /* Clear all mcast from ALE */ + cpsw_ale_flush_multicast(ale, ALE_ALL_PORTS << +- priv->host_port); ++ priv->host_port, -1); + + /* Flood All Unicast Packets to Host port */ + cpsw_ale_control_set(ale, 0, ALE_P0_UNI_FLOOD, 1); +@@ -620,6 +620,12 @@ static void cpsw_set_promiscious(struct net_device *ndev, bool enable) + static void cpsw_ndo_set_rx_mode(struct net_device *ndev) + { + struct cpsw_priv *priv = netdev_priv(ndev); ++ int vid; ++ ++ if (priv->data.dual_emac) ++ vid = priv->slaves[priv->emac_port].port_vlan; ++ else ++ vid = priv->data.default_vlan; + + if (ndev->flags & IFF_PROMISC) { + /* Enable promiscuous mode */ +@@ -631,7 +637,8 @@ static void cpsw_ndo_set_rx_mode(struct net_device *ndev) + } + + /* Clear all mcast from ALE */ +- cpsw_ale_flush_multicast(priv->ale, ALE_ALL_PORTS << priv->host_port); ++ cpsw_ale_flush_multicast(priv->ale, ALE_ALL_PORTS << priv->host_port, ++ vid); + + if (!netdev_mc_empty(ndev)) { + struct netdev_hw_addr *ha; +@@ -716,6 +723,14 @@ static void cpsw_rx_handler(void *token, int len, int status) + static irqreturn_t cpsw_interrupt(int irq, void *dev_id) + { + struct cpsw_priv *priv = dev_id; ++ int value = irq - priv->irqs_table[0]; ++ ++ /* NOTICE: Ending IRQ here. The trick with the 'value' variable above ++ * is to make sure we will always write the correct value to the EOI ++ * register. Namely 0 for RX_THRESH Interrupt, 1 for RX Interrupt, 2 ++ * for TX Interrupt and 3 for MISC Interrupt. ++ */ ++ cpdma_ctlr_eoi(priv->dma, value); + + cpsw_intr_disable(priv); + if (priv->irq_enabled == true) { +@@ -745,8 +760,6 @@ static int cpsw_poll(struct napi_struct *napi, int budget) + int num_tx, num_rx; + + num_tx = cpdma_chan_process(priv->txch, 128); +- if (num_tx) +- cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_TX); + + num_rx = cpdma_chan_process(priv->rxch, budget); + if (num_rx < budget) { +@@ -754,7 +767,6 @@ static int cpsw_poll(struct napi_struct *napi, int budget) + + napi_complete(napi); + cpsw_intr_enable(priv); +- cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_RX); + prim_cpsw = cpsw_get_slave_priv(priv, 0); + if (prim_cpsw->irq_enabled == false) { + prim_cpsw->irq_enabled = true; +@@ -1265,8 +1277,6 @@ static int cpsw_ndo_open(struct net_device *ndev) + napi_enable(&priv->napi); + cpdma_ctlr_start(priv->dma); + cpsw_intr_enable(priv); +- cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_RX); +- cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_TX); + + if (priv->data.dual_emac) + priv->slaves[priv->emac_port].open_stat = true; +@@ -1512,9 +1522,6 @@ static void cpsw_ndo_tx_timeout(struct net_device *ndev) + cpdma_chan_start(priv->txch); + cpdma_ctlr_int_ctrl(priv->dma, true); + cpsw_intr_enable(priv); +- cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_RX); +- cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_TX); +- + } + + static int cpsw_ndo_set_mac_address(struct net_device *ndev, void *p) +@@ -1560,9 +1567,6 @@ static void cpsw_ndo_poll_controller(struct net_device *ndev) + cpsw_interrupt(ndev->irq, priv); + cpdma_ctlr_int_ctrl(priv->dma, true); + cpsw_intr_enable(priv); +- cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_RX); +- cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_TX); +- + } + #endif + +diff --git a/drivers/net/ethernet/ti/cpsw_ale.c b/drivers/net/ethernet/ti/cpsw_ale.c +index 7f893069c418..4eceb7e42c80 100644 +--- a/drivers/net/ethernet/ti/cpsw_ale.c ++++ b/drivers/net/ethernet/ti/cpsw_ale.c +@@ -236,7 +236,7 @@ static void cpsw_ale_flush_mcast(struct cpsw_ale *ale, u32 *ale_entry, + cpsw_ale_set_entry_type(ale_entry, ALE_TYPE_FREE); + } + +-int cpsw_ale_flush_multicast(struct cpsw_ale *ale, int port_mask) ++int cpsw_ale_flush_multicast(struct cpsw_ale *ale, int port_mask, int vid) + { + u32 ale_entry[ALE_ENTRY_WORDS]; + int ret, idx; +@@ -247,6 +247,14 @@ int cpsw_ale_flush_multicast(struct cpsw_ale *ale, int port_mask) + if (ret != ALE_TYPE_ADDR && ret != ALE_TYPE_VLAN_ADDR) + continue; + ++ /* if vid passed is -1 then remove all multicast entry from ++ * the table irrespective of vlan id, if a valid vlan id is ++ * passed then remove only multicast added to that vlan id. ++ * if vlan id doesn't match then move on to next entry. ++ */ ++ if (vid != -1 && cpsw_ale_get_vlan_id(ale_entry) != vid) ++ continue; ++ + if (cpsw_ale_get_mcast(ale_entry)) { + u8 addr[6]; + +diff --git a/drivers/net/ethernet/ti/cpsw_ale.h b/drivers/net/ethernet/ti/cpsw_ale.h +index de409c33b250..e701358fd00b 100644 +--- a/drivers/net/ethernet/ti/cpsw_ale.h ++++ b/drivers/net/ethernet/ti/cpsw_ale.h +@@ -88,7 +88,7 @@ void cpsw_ale_stop(struct cpsw_ale *ale); + + int cpsw_ale_set_ageout(struct cpsw_ale *ale, int ageout); + int cpsw_ale_flush(struct cpsw_ale *ale, int port_mask); +-int cpsw_ale_flush_multicast(struct cpsw_ale *ale, int port_mask); ++int cpsw_ale_flush_multicast(struct cpsw_ale *ale, int port_mask, int vid); + int cpsw_ale_add_ucast(struct cpsw_ale *ale, u8 *addr, int port, + int flags, u16 vid); + int cpsw_ale_del_ucast(struct cpsw_ale *ale, u8 *addr, int port, +diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c +index 979fe433278c..32efe8371ff8 100644 +--- a/drivers/net/team/team.c ++++ b/drivers/net/team/team.c +@@ -629,6 +629,7 @@ static int team_change_mode(struct team *team, const char *kind) + static void team_notify_peers_work(struct work_struct *work) + { + struct team *team; ++ int val; + + team = container_of(work, struct team, notify_peers.dw.work); + +@@ -636,9 +637,14 @@ static void team_notify_peers_work(struct work_struct *work) + schedule_delayed_work(&team->notify_peers.dw, 0); + return; + } ++ val = atomic_dec_if_positive(&team->notify_peers.count_pending); ++ if (val < 0) { ++ rtnl_unlock(); ++ return; ++ } + call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, team->dev); + rtnl_unlock(); +- if (!atomic_dec_and_test(&team->notify_peers.count_pending)) ++ if (val) + schedule_delayed_work(&team->notify_peers.dw, + msecs_to_jiffies(team->notify_peers.interval)); + } +@@ -669,6 +675,7 @@ static void team_notify_peers_fini(struct team *team) + static void team_mcast_rejoin_work(struct work_struct *work) + { + struct team *team; ++ int val; + + team = container_of(work, struct team, mcast_rejoin.dw.work); + +@@ -676,9 +683,14 @@ static void team_mcast_rejoin_work(struct work_struct *work) + schedule_delayed_work(&team->mcast_rejoin.dw, 0); + return; + } ++ val = atomic_dec_if_positive(&team->mcast_rejoin.count_pending); ++ if (val < 0) { ++ rtnl_unlock(); ++ return; ++ } + call_netdevice_notifiers(NETDEV_RESEND_IGMP, team->dev); + rtnl_unlock(); +- if (!atomic_dec_and_test(&team->mcast_rejoin.count_pending)) ++ if (val) + schedule_delayed_work(&team->mcast_rejoin.dw, + msecs_to_jiffies(team->mcast_rejoin.interval)); + } +diff --git a/drivers/platform/x86/hp_accel.c b/drivers/platform/x86/hp_accel.c +index 3dc934438c28..07fbcb0fb646 100644 +--- a/drivers/platform/x86/hp_accel.c ++++ b/drivers/platform/x86/hp_accel.c +@@ -237,6 +237,7 @@ static struct dmi_system_id lis3lv02d_dmi_ids[] = { + AXIS_DMI_MATCH("HPB64xx", "HP ProBook 64", xy_swap), + AXIS_DMI_MATCH("HPB64xx", "HP EliteBook 84", xy_swap), + AXIS_DMI_MATCH("HPB65xx", "HP ProBook 65", x_inverted), ++ AXIS_DMI_MATCH("HPZBook15", "HP ZBook 15", x_inverted), + { NULL, } + /* Laptop models without axis info (yet): + * "NC6910" "HP Compaq 6910" +diff --git a/drivers/s390/char/con3215.c b/drivers/s390/char/con3215.c +index bb86494e2b7b..19915c5b256f 100644 +--- a/drivers/s390/char/con3215.c ++++ b/drivers/s390/char/con3215.c +@@ -288,12 +288,16 @@ static void raw3215_timeout(unsigned long __data) + unsigned long flags; + + spin_lock_irqsave(get_ccwdev_lock(raw->cdev), flags); +- if (raw->flags & RAW3215_TIMER_RUNS) { +- del_timer(&raw->timer); +- raw->flags &= ~RAW3215_TIMER_RUNS; +- if (!(raw->port.flags & ASYNC_SUSPENDED)) { +- raw3215_mk_write_req(raw); +- raw3215_start_io(raw); ++ raw->flags &= ~RAW3215_TIMER_RUNS; ++ if (!(raw->port.flags & ASYNC_SUSPENDED)) { ++ raw3215_mk_write_req(raw); ++ raw3215_start_io(raw); ++ if ((raw->queued_read || raw->queued_write) && ++ !(raw->flags & RAW3215_WORKING) && ++ !(raw->flags & RAW3215_TIMER_RUNS)) { ++ raw->timer.expires = RAW3215_TIMEOUT + jiffies; ++ add_timer(&raw->timer); ++ raw->flags |= RAW3215_TIMER_RUNS; + } + } + spin_unlock_irqrestore(get_ccwdev_lock(raw->cdev), flags); +@@ -317,17 +321,15 @@ static inline void raw3215_try_io(struct raw3215_info *raw) + (raw->flags & RAW3215_FLUSHING)) { + /* execute write requests bigger than minimum size */ + raw3215_start_io(raw); +- if (raw->flags & RAW3215_TIMER_RUNS) { +- del_timer(&raw->timer); +- raw->flags &= ~RAW3215_TIMER_RUNS; +- } +- } else if (!(raw->flags & RAW3215_TIMER_RUNS)) { +- /* delay small writes */ +- raw->timer.expires = RAW3215_TIMEOUT + jiffies; +- add_timer(&raw->timer); +- raw->flags |= RAW3215_TIMER_RUNS; + } + } ++ if ((raw->queued_read || raw->queued_write) && ++ !(raw->flags & RAW3215_WORKING) && ++ !(raw->flags & RAW3215_TIMER_RUNS)) { ++ raw->timer.expires = RAW3215_TIMEOUT + jiffies; ++ add_timer(&raw->timer); ++ raw->flags |= RAW3215_TIMER_RUNS; ++ } + } + + /* +@@ -1027,12 +1029,26 @@ static int tty3215_write(struct tty_struct * tty, + const unsigned char *buf, int count) + { + struct raw3215_info *raw; ++ int i, written; + + if (!tty) + return 0; + raw = (struct raw3215_info *) tty->driver_data; +- raw3215_write(raw, buf, count); +- return count; ++ written = count; ++ while (count > 0) { ++ for (i = 0; i < count; i++) ++ if (buf[i] == '\t' || buf[i] == '\n') ++ break; ++ raw3215_write(raw, buf, i); ++ count -= i; ++ buf += i; ++ if (count > 0) { ++ raw3215_putchar(raw, *buf); ++ count--; ++ buf++; ++ } ++ } ++ return written; + } + + /* +@@ -1180,7 +1196,7 @@ static int __init tty3215_init(void) + driver->subtype = SYSTEM_TYPE_TTY; + driver->init_termios = tty_std_termios; + driver->init_termios.c_iflag = IGNBRK | IGNPAR; +- driver->init_termios.c_oflag = ONLCR | XTABS; ++ driver->init_termios.c_oflag = ONLCR; + driver->init_termios.c_lflag = ISIG; + driver->flags = TTY_DRIVER_REAL_RAW; + tty_set_operations(driver, &tty3215_ops); +diff --git a/drivers/scsi/mpt2sas/mpt2sas_transport.c b/drivers/scsi/mpt2sas/mpt2sas_transport.c +index 410f4a3e8888..72f9c55d0e00 100644 +--- a/drivers/scsi/mpt2sas/mpt2sas_transport.c ++++ b/drivers/scsi/mpt2sas/mpt2sas_transport.c +@@ -1006,12 +1006,9 @@ mpt2sas_transport_update_links(struct MPT2SAS_ADAPTER *ioc, + &mpt2sas_phy->remote_identify); + _transport_add_phy_to_an_existing_port(ioc, sas_node, + mpt2sas_phy, mpt2sas_phy->remote_identify.sas_address); +- } else { ++ } else + memset(&mpt2sas_phy->remote_identify, 0 , sizeof(struct + sas_identify)); +- _transport_del_phy_from_an_existing_port(ioc, sas_node, +- mpt2sas_phy); +- } + + if (mpt2sas_phy->phy) + mpt2sas_phy->phy->negotiated_linkrate = +diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c +index 65170cb1a00f..55aa597eb229 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_transport.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c +@@ -1003,12 +1003,9 @@ mpt3sas_transport_update_links(struct MPT3SAS_ADAPTER *ioc, + &mpt3sas_phy->remote_identify); + _transport_add_phy_to_an_existing_port(ioc, sas_node, + mpt3sas_phy, mpt3sas_phy->remote_identify.sas_address); +- } else { ++ } else + memset(&mpt3sas_phy->remote_identify, 0 , sizeof(struct + sas_identify)); +- _transport_del_phy_from_an_existing_port(ioc, sas_node, +- mpt3sas_phy); +- } + + if (mpt3sas_phy->phy) + mpt3sas_phy->phy->negotiated_linkrate = +diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c +index c1d04d4d3c6c..262ab837a704 100644 +--- a/drivers/scsi/scsi_devinfo.c ++++ b/drivers/scsi/scsi_devinfo.c +@@ -211,6 +211,7 @@ static struct { + {"Medion", "Flash XL MMC/SD", "2.6D", BLIST_FORCELUN}, + {"MegaRAID", "LD", NULL, BLIST_FORCELUN}, + {"MICROP", "4110", NULL, BLIST_NOTQ}, ++ {"MSFT", "Virtual HD", NULL, BLIST_NO_RSOC}, + {"MYLEX", "DACARMRB", "*", BLIST_REPORTLUN2}, + {"nCipher", "Fastness Crypto", NULL, BLIST_FORCELUN}, + {"NAKAMICH", "MJ-4.8S", NULL, BLIST_FORCELUN | BLIST_SINGLELUN}, +diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c +index ed0f899e8aa5..86b05151fdab 100644 +--- a/drivers/scsi/storvsc_drv.c ++++ b/drivers/scsi/storvsc_drv.c +@@ -1690,13 +1690,12 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd) + if (ret == -EAGAIN) { + /* no more space */ + +- if (cmd_request->bounce_sgl_count) { ++ if (cmd_request->bounce_sgl_count) + destroy_bounce_buffer(cmd_request->bounce_sgl, + cmd_request->bounce_sgl_count); + +- ret = SCSI_MLQUEUE_DEVICE_BUSY; +- goto queue_error; +- } ++ ret = SCSI_MLQUEUE_DEVICE_BUSY; ++ goto queue_error; + } + + return 0; +diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c +index d509aa74cfa1..c5d3811a7b8c 100644 +--- a/drivers/target/iscsi/iscsi_target_login.c ++++ b/drivers/target/iscsi/iscsi_target_login.c +@@ -1186,6 +1186,9 @@ old_sess_out: + conn->sock = NULL; + } + ++ if (conn->conn_transport->iscsit_wait_conn) ++ conn->conn_transport->iscsit_wait_conn(conn); ++ + if (conn->conn_transport->iscsit_free_conn) + conn->conn_transport->iscsit_free_conn(conn); + +diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c +index ab77f80ead2b..1e406af4ee47 100644 +--- a/drivers/target/iscsi/iscsi_target_util.c ++++ b/drivers/target/iscsi/iscsi_target_util.c +@@ -1356,15 +1356,15 @@ static int iscsit_do_tx_data( + struct iscsi_conn *conn, + struct iscsi_data_count *count) + { +- int data = count->data_length, total_tx = 0, tx_loop = 0, iov_len; ++ int ret, iov_len; + struct kvec *iov_p; + struct msghdr msg; + + if (!conn || !conn->sock || !conn->conn_ops) + return -1; + +- if (data <= 0) { +- pr_err("Data length is: %d\n", data); ++ if (count->data_length <= 0) { ++ pr_err("Data length is: %d\n", count->data_length); + return -1; + } + +@@ -1373,20 +1373,16 @@ static int iscsit_do_tx_data( + iov_p = count->iov; + iov_len = count->iov_count; + +- while (total_tx < data) { +- tx_loop = kernel_sendmsg(conn->sock, &msg, iov_p, iov_len, +- (data - total_tx)); +- if (tx_loop <= 0) { +- pr_debug("tx_loop: %d total_tx %d\n", +- tx_loop, total_tx); +- return tx_loop; +- } +- total_tx += tx_loop; +- pr_debug("tx_loop: %d, total_tx: %d, data: %d\n", +- tx_loop, total_tx, data); ++ ret = kernel_sendmsg(conn->sock, &msg, iov_p, iov_len, ++ count->data_length); ++ if (ret != count->data_length) { ++ pr_err("Unexpected ret: %d send data %d\n", ++ ret, count->data_length); ++ return -EPIPE; + } ++ pr_debug("ret: %d, sent data: %d\n", ret, count->data_length); + +- return total_tx; ++ return ret; + } + + int rx_data( +diff --git a/drivers/target/loopback/tcm_loop.c b/drivers/target/loopback/tcm_loop.c +index fadad7c5f635..67c802c93ef3 100644 +--- a/drivers/target/loopback/tcm_loop.c ++++ b/drivers/target/loopback/tcm_loop.c +@@ -153,18 +153,11 @@ static int tcm_loop_change_queue_type(struct scsi_device *sdev, int tag) + /* + * Locate the SAM Task Attr from struct scsi_cmnd * + */ +-static int tcm_loop_sam_attr(struct scsi_cmnd *sc) +-{ +- if (sc->device->tagged_supported) { +- switch (sc->tag) { +- case HEAD_OF_QUEUE_TAG: +- return MSG_HEAD_TAG; +- case ORDERED_QUEUE_TAG: +- return MSG_ORDERED_TAG; +- default: +- break; +- } +- } ++static int tcm_loop_sam_attr(struct scsi_cmnd *sc, int tag) ++{ ++ if (sc->device->tagged_supported && ++ sc->device->ordered_tags && tag >= 0) ++ return MSG_ORDERED_TAG; + + return MSG_SIMPLE_TAG; + } +@@ -197,7 +190,7 @@ static void tcm_loop_submission_work(struct work_struct *work) + set_host_byte(sc, DID_TRANSPORT_DISRUPTED); + goto out_done; + } +- tl_nexus = tl_hba->tl_nexus; ++ tl_nexus = tl_tpg->tl_nexus; + if (!tl_nexus) { + scmd_printk(KERN_ERR, sc, "TCM_Loop I_T Nexus" + " does not exist\n"); +@@ -214,7 +207,7 @@ static void tcm_loop_submission_work(struct work_struct *work) + } + rc = target_submit_cmd_map_sgls(se_cmd, tl_nexus->se_sess, sc->cmnd, + &tl_cmd->tl_sense_buf[0], tl_cmd->sc->device->lun, +- scsi_bufflen(sc), tcm_loop_sam_attr(sc), ++ scsi_bufflen(sc), tcm_loop_sam_attr(sc, tl_cmd->sc_cmd_tag), + sc->sc_data_direction, 0, + scsi_sglist(sc), scsi_sg_count(sc), + sgl_bidi, sgl_bidi_count, +@@ -252,7 +245,7 @@ static int tcm_loop_queuecommand(struct Scsi_Host *sh, struct scsi_cmnd *sc) + } + + tl_cmd->sc = sc; +- tl_cmd->sc_cmd_tag = sc->tag; ++ tl_cmd->sc_cmd_tag = sc->request->tag; + INIT_WORK(&tl_cmd->work, tcm_loop_submission_work); + queue_work(tcm_loop_workqueue, &tl_cmd->work); + return 0; +@@ -263,16 +256,26 @@ static int tcm_loop_queuecommand(struct Scsi_Host *sh, struct scsi_cmnd *sc) + * to struct scsi_device + */ + static int tcm_loop_issue_tmr(struct tcm_loop_tpg *tl_tpg, +- struct tcm_loop_nexus *tl_nexus, + int lun, int task, enum tcm_tmreq_table tmr) + { + struct se_cmd *se_cmd = NULL; + struct se_session *se_sess; + struct se_portal_group *se_tpg; ++ struct tcm_loop_nexus *tl_nexus; + struct tcm_loop_cmd *tl_cmd = NULL; + struct tcm_loop_tmr *tl_tmr = NULL; + int ret = TMR_FUNCTION_FAILED, rc; + ++ /* ++ * Locate the tl_nexus and se_sess pointers ++ */ ++ tl_nexus = tl_tpg->tl_nexus; ++ if (!tl_nexus) { ++ pr_err("Unable to perform device reset without" ++ " active I_T Nexus\n"); ++ return ret; ++ } ++ + tl_cmd = kmem_cache_zalloc(tcm_loop_cmd_cache, GFP_KERNEL); + if (!tl_cmd) { + pr_err("Unable to allocate memory for tl_cmd\n"); +@@ -288,7 +291,7 @@ static int tcm_loop_issue_tmr(struct tcm_loop_tpg *tl_tpg, + + se_cmd = &tl_cmd->tl_se_cmd; + se_tpg = &tl_tpg->tl_se_tpg; +- se_sess = tl_nexus->se_sess; ++ se_sess = tl_tpg->tl_nexus->se_sess; + /* + * Initialize struct se_cmd descriptor from target_core_mod infrastructure + */ +@@ -333,7 +336,6 @@ release: + static int tcm_loop_abort_task(struct scsi_cmnd *sc) + { + struct tcm_loop_hba *tl_hba; +- struct tcm_loop_nexus *tl_nexus; + struct tcm_loop_tpg *tl_tpg; + int ret = FAILED; + +@@ -341,22 +343,9 @@ static int tcm_loop_abort_task(struct scsi_cmnd *sc) + * Locate the tcm_loop_hba_t pointer + */ + tl_hba = *(struct tcm_loop_hba **)shost_priv(sc->device->host); +- /* +- * Locate the tl_nexus and se_sess pointers +- */ +- tl_nexus = tl_hba->tl_nexus; +- if (!tl_nexus) { +- pr_err("Unable to perform device reset without" +- " active I_T Nexus\n"); +- return FAILED; +- } +- +- /* +- * Locate the tl_tpg pointer from TargetID in sc->device->id +- */ + tl_tpg = &tl_hba->tl_hba_tpgs[sc->device->id]; +- ret = tcm_loop_issue_tmr(tl_tpg, tl_nexus, sc->device->lun, +- sc->tag, TMR_ABORT_TASK); ++ ret = tcm_loop_issue_tmr(tl_tpg, sc->device->lun, ++ sc->request->tag, TMR_ABORT_TASK); + return (ret == TMR_FUNCTION_COMPLETE) ? SUCCESS : FAILED; + } + +@@ -367,7 +356,6 @@ static int tcm_loop_abort_task(struct scsi_cmnd *sc) + static int tcm_loop_device_reset(struct scsi_cmnd *sc) + { + struct tcm_loop_hba *tl_hba; +- struct tcm_loop_nexus *tl_nexus; + struct tcm_loop_tpg *tl_tpg; + int ret = FAILED; + +@@ -375,20 +363,9 @@ static int tcm_loop_device_reset(struct scsi_cmnd *sc) + * Locate the tcm_loop_hba_t pointer + */ + tl_hba = *(struct tcm_loop_hba **)shost_priv(sc->device->host); +- /* +- * Locate the tl_nexus and se_sess pointers +- */ +- tl_nexus = tl_hba->tl_nexus; +- if (!tl_nexus) { +- pr_err("Unable to perform device reset without" +- " active I_T Nexus\n"); +- return FAILED; +- } +- /* +- * Locate the tl_tpg pointer from TargetID in sc->device->id +- */ + tl_tpg = &tl_hba->tl_hba_tpgs[sc->device->id]; +- ret = tcm_loop_issue_tmr(tl_tpg, tl_nexus, sc->device->lun, ++ ++ ret = tcm_loop_issue_tmr(tl_tpg, sc->device->lun, + 0, TMR_LUN_RESET); + return (ret == TMR_FUNCTION_COMPLETE) ? SUCCESS : FAILED; + } +@@ -995,8 +972,8 @@ static int tcm_loop_make_nexus( + struct tcm_loop_nexus *tl_nexus; + int ret = -ENOMEM; + +- if (tl_tpg->tl_hba->tl_nexus) { +- pr_debug("tl_tpg->tl_hba->tl_nexus already exists\n"); ++ if (tl_tpg->tl_nexus) { ++ pr_debug("tl_tpg->tl_nexus already exists\n"); + return -EEXIST; + } + se_tpg = &tl_tpg->tl_se_tpg; +@@ -1031,7 +1008,7 @@ static int tcm_loop_make_nexus( + */ + __transport_register_session(se_tpg, tl_nexus->se_sess->se_node_acl, + tl_nexus->se_sess, tl_nexus); +- tl_tpg->tl_hba->tl_nexus = tl_nexus; ++ tl_tpg->tl_nexus = tl_nexus; + pr_debug("TCM_Loop_ConfigFS: Established I_T Nexus to emulated" + " %s Initiator Port: %s\n", tcm_loop_dump_proto_id(tl_hba), + name); +@@ -1047,12 +1024,8 @@ static int tcm_loop_drop_nexus( + { + struct se_session *se_sess; + struct tcm_loop_nexus *tl_nexus; +- struct tcm_loop_hba *tl_hba = tpg->tl_hba; + +- if (!tl_hba) +- return -ENODEV; +- +- tl_nexus = tl_hba->tl_nexus; ++ tl_nexus = tpg->tl_nexus; + if (!tl_nexus) + return -ENODEV; + +@@ -1068,13 +1041,13 @@ static int tcm_loop_drop_nexus( + } + + pr_debug("TCM_Loop_ConfigFS: Removing I_T Nexus to emulated" +- " %s Initiator Port: %s\n", tcm_loop_dump_proto_id(tl_hba), ++ " %s Initiator Port: %s\n", tcm_loop_dump_proto_id(tpg->tl_hba), + tl_nexus->se_sess->se_node_acl->initiatorname); + /* + * Release the SCSI I_T Nexus to the emulated SAS Target Port + */ + transport_deregister_session(tl_nexus->se_sess); +- tpg->tl_hba->tl_nexus = NULL; ++ tpg->tl_nexus = NULL; + kfree(tl_nexus); + return 0; + } +@@ -1090,7 +1063,7 @@ static ssize_t tcm_loop_tpg_show_nexus( + struct tcm_loop_nexus *tl_nexus; + ssize_t ret; + +- tl_nexus = tl_tpg->tl_hba->tl_nexus; ++ tl_nexus = tl_tpg->tl_nexus; + if (!tl_nexus) + return -ENODEV; + +diff --git a/drivers/target/loopback/tcm_loop.h b/drivers/target/loopback/tcm_loop.h +index 54c59d0b6608..6ae49f272ba6 100644 +--- a/drivers/target/loopback/tcm_loop.h ++++ b/drivers/target/loopback/tcm_loop.h +@@ -27,11 +27,6 @@ struct tcm_loop_tmr { + }; + + struct tcm_loop_nexus { +- int it_nexus_active; +- /* +- * Pointer to Linux/SCSI HBA from linux/include/scsi_host.h +- */ +- struct scsi_host *sh; + /* + * Pointer to TCM session for I_T Nexus + */ +@@ -51,6 +46,7 @@ struct tcm_loop_tpg { + atomic_t tl_tpg_port_count; + struct se_portal_group tl_se_tpg; + struct tcm_loop_hba *tl_hba; ++ struct tcm_loop_nexus *tl_nexus; + }; + + struct tcm_loop_hba { +@@ -59,7 +55,6 @@ struct tcm_loop_hba { + struct se_hba_s *se_hba; + struct se_lun *tl_hba_lun; + struct se_port *tl_hba_lun_sep; +- struct tcm_loop_nexus *tl_nexus; + struct device dev; + struct Scsi_Host *sh; + struct tcm_loop_tpg tl_hba_tpgs[TL_TPGS_PER_HBA]; +diff --git a/drivers/thermal/intel_powerclamp.c b/drivers/thermal/intel_powerclamp.c +index a084325f1386..6e75177915fa 100644 +--- a/drivers/thermal/intel_powerclamp.c ++++ b/drivers/thermal/intel_powerclamp.c +@@ -435,7 +435,6 @@ static int clamp_thread(void *arg) + * allowed. thus jiffies are updated properly. + */ + preempt_disable(); +- tick_nohz_idle_enter(); + /* mwait until target jiffies is reached */ + while (time_before(jiffies, target_jiffies)) { + unsigned long ecx = 1; +@@ -451,7 +450,6 @@ static int clamp_thread(void *arg) + start_critical_timings(); + atomic_inc(&idle_wakeup_counter); + } +- tick_nohz_idle_exit(); + preempt_enable(); + } + del_timer_sync(&wakeup_timer); +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index d90c70c23adb..8f6738d46b14 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -887,8 +887,7 @@ static void dwc3_prepare_trbs(struct dwc3_ep *dep, bool starting) + + if (i == (request->num_mapped_sgs - 1) || + sg_is_last(s)) { +- if (list_is_last(&req->list, +- &dep->request_list)) ++ if (list_empty(&dep->request_list)) + last_one = true; + chain = false; + } +@@ -906,6 +905,9 @@ static void dwc3_prepare_trbs(struct dwc3_ep *dep, bool starting) + if (last_one) + break; + } ++ ++ if (last_one) ++ break; + } else { + dma = req->request.dma; + length = req->request.length; +diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c +index e113fd73aeae..c399606f154e 100644 +--- a/drivers/usb/host/ehci-sched.c ++++ b/drivers/usb/host/ehci-sched.c +@@ -1581,6 +1581,10 @@ iso_stream_schedule ( + else + next = (now + 2 + 7) & ~0x07; /* full frame cache */ + ++ /* If needed, initialize last_iso_frame so that this URB will be seen */ ++ if (ehci->isoc_count == 0) ++ ehci->last_iso_frame = now >> 3; ++ + /* + * Use ehci->last_iso_frame as the base. There can't be any + * TDs scheduled for earlier than that. +@@ -1671,10 +1675,6 @@ iso_stream_schedule ( + urb->start_frame = start & (mod - 1); + if (!stream->highspeed) + urb->start_frame >>= 3; +- +- /* Make sure scan_isoc() sees these */ +- if (ehci->isoc_count == 0) +- ehci->last_iso_frame = now >> 3; + return status; + + fail: +diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c +index 2f3acebb577a..f4e6b945136c 100644 +--- a/drivers/usb/host/pci-quirks.c ++++ b/drivers/usb/host/pci-quirks.c +@@ -571,7 +571,8 @@ static void quirk_usb_handoff_ohci(struct pci_dev *pdev) + { + void __iomem *base; + u32 control; +- u32 fminterval; ++ u32 fminterval = 0; ++ bool no_fminterval = false; + int cnt; + + if (!mmio_resource_enabled(pdev, 0)) +@@ -581,6 +582,13 @@ static void quirk_usb_handoff_ohci(struct pci_dev *pdev) + if (base == NULL) + return; + ++ /* ++ * ULi M5237 OHCI controller locks the whole system when accessing ++ * the OHCI_FMINTERVAL offset. ++ */ ++ if (pdev->vendor == PCI_VENDOR_ID_AL && pdev->device == 0x5237) ++ no_fminterval = true; ++ + control = readl(base + OHCI_CONTROL); + + /* On PA-RISC, PDC can leave IR set incorrectly; ignore it there. */ +@@ -619,7 +627,9 @@ static void quirk_usb_handoff_ohci(struct pci_dev *pdev) + } + + /* software reset of the controller, preserving HcFmInterval */ +- fminterval = readl(base + OHCI_FMINTERVAL); ++ if (!no_fminterval) ++ fminterval = readl(base + OHCI_FMINTERVAL); ++ + writel(OHCI_HCR, base + OHCI_CMDSTATUS); + + /* reset requires max 10 us delay */ +@@ -628,7 +638,9 @@ static void quirk_usb_handoff_ohci(struct pci_dev *pdev) + break; + udelay(1); + } +- writel(fminterval, base + OHCI_FMINTERVAL); ++ ++ if (!no_fminterval) ++ writel(fminterval, base + OHCI_FMINTERVAL); + + /* Now the controller is safely in SUSPEND and nothing can wake it up */ + iounmap(base); +diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c +index abb38c3833ef..6b0fb6af6815 100644 +--- a/drivers/usb/musb/musb_host.c ++++ b/drivers/usb/musb/musb_host.c +@@ -2640,7 +2640,6 @@ void musb_host_cleanup(struct musb *musb) + if (musb->port_mode == MUSB_PORT_MODE_GADGET) + return; + usb_remove_hcd(musb->hcd); +- musb->hcd = NULL; + } + + void musb_host_free(struct musb *musb) +diff --git a/drivers/usb/serial/console.c b/drivers/usb/serial/console.c +index 8d7fc48b1f30..29fa1c3d0089 100644 +--- a/drivers/usb/serial/console.c ++++ b/drivers/usb/serial/console.c +@@ -46,6 +46,8 @@ static struct console usbcons; + * ------------------------------------------------------------ + */ + ++static const struct tty_operations usb_console_fake_tty_ops = { ++}; + + /* + * The parsing of the command line works exactly like the +@@ -137,13 +139,17 @@ static int usb_console_setup(struct console *co, char *options) + goto reset_open_count; + } + kref_init(&tty->kref); +- tty_port_tty_set(&port->port, tty); + tty->driver = usb_serial_tty_driver; + tty->index = co->index; ++ init_ldsem(&tty->ldisc_sem); ++ INIT_LIST_HEAD(&tty->tty_files); ++ kref_get(&tty->driver->kref); ++ tty->ops = &usb_console_fake_tty_ops; + if (tty_init_termios(tty)) { + retval = -ENOMEM; +- goto free_tty; ++ goto put_tty; + } ++ tty_port_tty_set(&port->port, tty); + } + + /* only call the device specific open if this +@@ -161,7 +167,7 @@ static int usb_console_setup(struct console *co, char *options) + serial->type->set_termios(tty, port, &dummy); + + tty_port_tty_set(&port->port, NULL); +- kfree(tty); ++ tty_kref_put(tty); + } + set_bit(ASYNCB_INITIALIZED, &port->port.flags); + } +@@ -177,8 +183,8 @@ static int usb_console_setup(struct console *co, char *options) + + fail: + tty_port_tty_set(&port->port, NULL); +- free_tty: +- kfree(tty); ++ put_tty: ++ tty_kref_put(tty); + reset_open_count: + port->port.count = 0; + usb_autopm_put_interface(serial->interface); +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index 5741e9405069..9e8708c5cbfa 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -120,10 +120,12 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */ + { USB_DEVICE(0x10C4, 0x8664) }, /* AC-Services CAN-IF */ + { USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */ +- { USB_DEVICE(0x10C4, 0x8875) }, /* CEL MeshConnect USB Stick */ ++ { USB_DEVICE(0x10C4, 0x8856) }, /* CEL EM357 ZigBee USB Stick - LR */ ++ { USB_DEVICE(0x10C4, 0x8857) }, /* CEL EM357 ZigBee USB Stick */ + { USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */ + { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */ + { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */ ++ { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */ + { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */ + { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */ + { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */ +diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c +index 49101fe45d38..35297a845a63 100644 +--- a/drivers/usb/serial/keyspan.c ++++ b/drivers/usb/serial/keyspan.c +@@ -421,6 +421,8 @@ static void usa26_instat_callback(struct urb *urb) + } + port = serial->port[msg->port]; + p_priv = usb_get_serial_port_data(port); ++ if (!p_priv) ++ goto resubmit; + + /* Update handshaking pin state information */ + old_dcd_state = p_priv->dcd_state; +@@ -431,7 +433,7 @@ static void usa26_instat_callback(struct urb *urb) + + if (old_dcd_state != p_priv->dcd_state) + tty_port_tty_hangup(&port->port, true); +- ++resubmit: + /* Resubmit urb so we continue receiving */ + err = usb_submit_urb(urb, GFP_ATOMIC); + if (err != 0) +@@ -541,6 +543,8 @@ static void usa28_instat_callback(struct urb *urb) + } + port = serial->port[msg->port]; + p_priv = usb_get_serial_port_data(port); ++ if (!p_priv) ++ goto resubmit; + + /* Update handshaking pin state information */ + old_dcd_state = p_priv->dcd_state; +@@ -551,7 +555,7 @@ static void usa28_instat_callback(struct urb *urb) + + if (old_dcd_state != p_priv->dcd_state && old_dcd_state) + tty_port_tty_hangup(&port->port, true); +- ++resubmit: + /* Resubmit urb so we continue receiving */ + err = usb_submit_urb(urb, GFP_ATOMIC); + if (err != 0) +@@ -624,6 +628,8 @@ static void usa49_instat_callback(struct urb *urb) + } + port = serial->port[msg->portNumber]; + p_priv = usb_get_serial_port_data(port); ++ if (!p_priv) ++ goto resubmit; + + /* Update handshaking pin state information */ + old_dcd_state = p_priv->dcd_state; +@@ -634,7 +640,7 @@ static void usa49_instat_callback(struct urb *urb) + + if (old_dcd_state != p_priv->dcd_state && old_dcd_state) + tty_port_tty_hangup(&port->port, true); +- ++resubmit: + /* Resubmit urb so we continue receiving */ + err = usb_submit_urb(urb, GFP_ATOMIC); + if (err != 0) +@@ -872,6 +878,8 @@ static void usa90_instat_callback(struct urb *urb) + + port = serial->port[0]; + p_priv = usb_get_serial_port_data(port); ++ if (!p_priv) ++ goto resubmit; + + /* Update handshaking pin state information */ + old_dcd_state = p_priv->dcd_state; +@@ -882,7 +890,7 @@ static void usa90_instat_callback(struct urb *urb) + + if (old_dcd_state != p_priv->dcd_state && old_dcd_state) + tty_port_tty_hangup(&port->port, true); +- ++resubmit: + /* Resubmit urb so we continue receiving */ + err = usb_submit_urb(urb, GFP_ATOMIC); + if (err != 0) +@@ -943,6 +951,8 @@ static void usa67_instat_callback(struct urb *urb) + + port = serial->port[msg->port]; + p_priv = usb_get_serial_port_data(port); ++ if (!p_priv) ++ goto resubmit; + + /* Update handshaking pin state information */ + old_dcd_state = p_priv->dcd_state; +@@ -951,7 +961,7 @@ static void usa67_instat_callback(struct urb *urb) + + if (old_dcd_state != p_priv->dcd_state && old_dcd_state) + tty_port_tty_hangup(&port->port, true); +- ++resubmit: + /* Resubmit urb so we continue receiving */ + err = usb_submit_urb(urb, GFP_ATOMIC); + if (err != 0) +diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c +index 7ba042498857..75e1d03b8da3 100644 +--- a/drivers/vfio/pci/vfio_pci.c ++++ b/drivers/vfio/pci/vfio_pci.c +@@ -810,13 +810,11 @@ static const struct vfio_device_ops vfio_pci_ops = { + + static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) + { +- u8 type; + struct vfio_pci_device *vdev; + struct iommu_group *group; + int ret; + +- pci_read_config_byte(pdev, PCI_HEADER_TYPE, &type); +- if ((type & PCI_HEADER_TYPE) != PCI_HEADER_TYPE_NORMAL) ++ if (pdev->hdr_type != PCI_HEADER_TYPE_NORMAL) + return -EINVAL; + + group = iommu_group_get(&pdev->dev); +diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c +index 5d0b7b846440..486d710a5293 100644 +--- a/drivers/vhost/scsi.c ++++ b/drivers/vhost/scsi.c +@@ -861,6 +861,23 @@ vhost_scsi_map_iov_to_sgl(struct tcm_vhost_cmd *cmd, + return 0; + } + ++static int vhost_scsi_to_tcm_attr(int attr) ++{ ++ switch (attr) { ++ case VIRTIO_SCSI_S_SIMPLE: ++ return MSG_SIMPLE_TAG; ++ case VIRTIO_SCSI_S_ORDERED: ++ return MSG_ORDERED_TAG; ++ case VIRTIO_SCSI_S_HEAD: ++ return MSG_HEAD_TAG; ++ case VIRTIO_SCSI_S_ACA: ++ return MSG_ACA_TAG; ++ default: ++ break; ++ } ++ return MSG_SIMPLE_TAG; ++} ++ + static void tcm_vhost_submission_work(struct work_struct *work) + { + struct tcm_vhost_cmd *cmd = +@@ -887,9 +904,10 @@ static void tcm_vhost_submission_work(struct work_struct *work) + rc = target_submit_cmd_map_sgls(se_cmd, tv_nexus->tvn_se_sess, + cmd->tvc_cdb, &cmd->tvc_sense_buf[0], + cmd->tvc_lun, cmd->tvc_exp_data_len, +- cmd->tvc_task_attr, cmd->tvc_data_direction, +- TARGET_SCF_ACK_KREF, sg_ptr, cmd->tvc_sgl_count, +- sg_bidi_ptr, sg_no_bidi, NULL, 0); ++ vhost_scsi_to_tcm_attr(cmd->tvc_task_attr), ++ cmd->tvc_data_direction, TARGET_SCF_ACK_KREF, ++ sg_ptr, cmd->tvc_sgl_count, sg_bidi_ptr, sg_no_bidi, ++ NULL, 0); + if (rc < 0) { + transport_send_check_condition_and_sense(se_cmd, + TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE, 0); +diff --git a/drivers/video/logo/logo.c b/drivers/video/logo/logo.c +index b670cbda38e3..ffe024b830fc 100644 +--- a/drivers/video/logo/logo.c ++++ b/drivers/video/logo/logo.c +@@ -21,6 +21,21 @@ static bool nologo; + module_param(nologo, bool, 0); + MODULE_PARM_DESC(nologo, "Disables startup logo"); + ++/* ++ * Logos are located in the initdata, and will be freed in kernel_init. ++ * Use late_init to mark the logos as freed to prevent any further use. ++ */ ++ ++static bool logos_freed; ++ ++static int __init fb_logo_late_init(void) ++{ ++ logos_freed = true; ++ return 0; ++} ++ ++late_initcall(fb_logo_late_init); ++ + /* logo's are marked __initdata. Use __init_refok to tell + * modpost that it is intended that this function uses data + * marked __initdata. +@@ -29,7 +44,7 @@ const struct linux_logo * __init_refok fb_find_logo(int depth) + { + const struct linux_logo *logo = NULL; + +- if (nologo) ++ if (nologo || logos_freed) + return NULL; + + if (depth >= 1) { +diff --git a/fs/lockd/svc.c b/fs/lockd/svc.c +index 223e1cb14345..59a53f664005 100644 +--- a/fs/lockd/svc.c ++++ b/fs/lockd/svc.c +@@ -137,10 +137,6 @@ lockd(void *vrqstp) + + dprintk("NFS locking service started (ver " LOCKD_VERSION ").\n"); + +- if (!nlm_timeout) +- nlm_timeout = LOCKD_DFLT_TIMEO; +- nlmsvc_timeout = nlm_timeout * HZ; +- + /* + * The main request loop. We don't terminate until the last + * NFS mount or NFS daemon has gone away. +@@ -346,6 +342,10 @@ static struct svc_serv *lockd_create_svc(void) + printk(KERN_WARNING + "lockd_up: no pid, %d users??\n", nlmsvc_users); + ++ if (!nlm_timeout) ++ nlm_timeout = LOCKD_DFLT_TIMEO; ++ nlmsvc_timeout = nlm_timeout * HZ; ++ + serv = svc_create(&nlmsvc_program, LOCKD_BUFSIZE, NULL); + if (!serv) { + printk(KERN_WARNING "lockd_up: create service failed\n"); +diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c +index 1abe4f55dea2..037f9572b94c 100644 +--- a/fs/nfs/nfs4client.c ++++ b/fs/nfs/nfs4client.c +@@ -565,20 +565,14 @@ static bool nfs4_match_clientids(struct nfs_client *a, struct nfs_client *b) + } + + /* +- * Returns true if the server owners match ++ * Returns true if the server major ids match + */ + static bool +-nfs4_match_serverowners(struct nfs_client *a, struct nfs_client *b) ++nfs4_check_clientid_trunking(struct nfs_client *a, struct nfs_client *b) + { + struct nfs41_server_owner *o1 = a->cl_serverowner; + struct nfs41_server_owner *o2 = b->cl_serverowner; + +- if (o1->minor_id != o2->minor_id) { +- dprintk("NFS: --> %s server owner minor IDs do not match\n", +- __func__); +- return false; +- } +- + if (o1->major_id_sz != o2->major_id_sz) + goto out_major_mismatch; + if (memcmp(o1->major_id, o2->major_id, o1->major_id_sz) != 0) +@@ -654,7 +648,12 @@ int nfs41_walk_client_list(struct nfs_client *new, + if (!nfs4_match_clientids(pos, new)) + continue; + +- if (!nfs4_match_serverowners(pos, new)) ++ /* ++ * Note that session trunking is just a special subcase of ++ * client id trunking. In either case, we want to fall back ++ * to using the existing nfs_client. ++ */ ++ if (!nfs4_check_clientid_trunking(pos, new)) + continue; + + atomic_inc(&pos->cl_count); +diff --git a/fs/notify/inode_mark.c b/fs/notify/inode_mark.c +index 74825be65b7b..fbb9dfb7b1d2 100644 +--- a/fs/notify/inode_mark.c ++++ b/fs/notify/inode_mark.c +@@ -288,20 +288,25 @@ void fsnotify_unmount_inodes(struct list_head *list) + spin_unlock(&inode->i_lock); + + /* In case the dropping of a reference would nuke next_i. */ +- if ((&next_i->i_sb_list != list) && +- atomic_read(&next_i->i_count)) { ++ while (&next_i->i_sb_list != list) { + spin_lock(&next_i->i_lock); +- if (!(next_i->i_state & (I_FREEING | I_WILL_FREE))) { ++ if (!(next_i->i_state & (I_FREEING | I_WILL_FREE)) && ++ atomic_read(&next_i->i_count)) { + __iget(next_i); + need_iput = next_i; ++ spin_unlock(&next_i->i_lock); ++ break; + } + spin_unlock(&next_i->i_lock); ++ next_i = list_entry(next_i->i_sb_list.next, ++ struct inode, i_sb_list); + } + + /* +- * We can safely drop inode_sb_list_lock here because we hold +- * references on both inode and next_i. Also no new inodes +- * will be added since the umount has begun. ++ * We can safely drop inode_sb_list_lock here because either ++ * we actually hold references on both inode and next_i or ++ * end of list. Also no new inodes will be added since the ++ * umount has begun. + */ + spin_unlock(&inode_sb_list_lock); + +diff --git a/fs/proc/stat.c b/fs/proc/stat.c +index 6f599c62f0cc..dbd027235440 100644 +--- a/fs/proc/stat.c ++++ b/fs/proc/stat.c +@@ -159,7 +159,7 @@ static int show_stat(struct seq_file *p, void *v) + + /* sum again ? it could be updated? */ + for_each_irq_nr(j) +- seq_put_decimal_ull(p, ' ', kstat_irqs(j)); ++ seq_put_decimal_ull(p, ' ', kstat_irqs_usr(j)); + + seq_printf(p, + "\nctxt %llu\n" +diff --git a/include/linux/kernel_stat.h b/include/linux/kernel_stat.h +index 51c72be4a7c3..4b2053a232c9 100644 +--- a/include/linux/kernel_stat.h ++++ b/include/linux/kernel_stat.h +@@ -74,6 +74,7 @@ static inline unsigned int kstat_softirqs_cpu(unsigned int irq, int cpu) + * Number of interrupts per specific IRQ source, since bootup + */ + extern unsigned int kstat_irqs(unsigned int irq); ++extern unsigned int kstat_irqs_usr(unsigned int irq); + + /* + * Number of interrupts per cpu, since bootup +diff --git a/include/uapi/linux/in6.h b/include/uapi/linux/in6.h +index e9a1d2d973b6..4c399ae04677 100644 +--- a/include/uapi/linux/in6.h ++++ b/include/uapi/linux/in6.h +@@ -149,7 +149,7 @@ struct in6_flowlabel_req { + /* + * IPV6 socket options + */ +- ++#if __UAPI_DEF_IPV6_OPTIONS + #define IPV6_ADDRFORM 1 + #define IPV6_2292PKTINFO 2 + #define IPV6_2292HOPOPTS 3 +@@ -192,6 +192,7 @@ struct in6_flowlabel_req { + + #define IPV6_IPSEC_POLICY 34 + #define IPV6_XFRM_POLICY 35 ++#endif + + /* + * Multicast: +diff --git a/include/uapi/linux/libc-compat.h b/include/uapi/linux/libc-compat.h +index c140620dad92..e28807ad17fa 100644 +--- a/include/uapi/linux/libc-compat.h ++++ b/include/uapi/linux/libc-compat.h +@@ -69,6 +69,7 @@ + #define __UAPI_DEF_SOCKADDR_IN6 0 + #define __UAPI_DEF_IPV6_MREQ 0 + #define __UAPI_DEF_IPPROTO_V6 0 ++#define __UAPI_DEF_IPV6_OPTIONS 0 + + #else + +@@ -82,6 +83,7 @@ + #define __UAPI_DEF_SOCKADDR_IN6 1 + #define __UAPI_DEF_IPV6_MREQ 1 + #define __UAPI_DEF_IPPROTO_V6 1 ++#define __UAPI_DEF_IPV6_OPTIONS 1 + + #endif /* _NETINET_IN_H */ + +@@ -103,6 +105,7 @@ + #define __UAPI_DEF_SOCKADDR_IN6 1 + #define __UAPI_DEF_IPV6_MREQ 1 + #define __UAPI_DEF_IPPROTO_V6 1 ++#define __UAPI_DEF_IPV6_OPTIONS 1 + + /* Definitions for xattr.h */ + #define __UAPI_DEF_XATTR 1 +diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h +index 001fa5bab490..8a160e8a44e8 100644 +--- a/kernel/irq/internals.h ++++ b/kernel/irq/internals.h +@@ -74,6 +74,14 @@ extern void irq_percpu_disable(struct irq_desc *desc, unsigned int cpu); + extern void mask_irq(struct irq_desc *desc); + extern void unmask_irq(struct irq_desc *desc); + ++#ifdef CONFIG_SPARSE_IRQ ++extern void irq_lock_sparse(void); ++extern void irq_unlock_sparse(void); ++#else ++static inline void irq_lock_sparse(void) { } ++static inline void irq_unlock_sparse(void) { } ++#endif ++ + extern void init_kstat_irqs(struct irq_desc *desc, int node, int nr); + + irqreturn_t handle_irq_event_percpu(struct irq_desc *desc, struct irqaction *action); +diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c +index 8ab8e9390297..07d45516b540 100644 +--- a/kernel/irq/irqdesc.c ++++ b/kernel/irq/irqdesc.c +@@ -131,6 +131,16 @@ static void free_masks(struct irq_desc *desc) + static inline void free_masks(struct irq_desc *desc) { } + #endif + ++void irq_lock_sparse(void) ++{ ++ mutex_lock(&sparse_irq_lock); ++} ++ ++void irq_unlock_sparse(void) ++{ ++ mutex_unlock(&sparse_irq_lock); ++} ++ + static struct irq_desc *alloc_desc(int irq, int node, struct module *owner) + { + struct irq_desc *desc; +@@ -167,6 +177,12 @@ static void free_desc(unsigned int irq) + + unregister_irq_proc(irq, desc); + ++ /* ++ * sparse_irq_lock protects also show_interrupts() and ++ * kstat_irq_usr(). Once we deleted the descriptor from the ++ * sparse tree we can free it. Access in proc will fail to ++ * lookup the descriptor. ++ */ + mutex_lock(&sparse_irq_lock); + delete_irq_desc(irq); + mutex_unlock(&sparse_irq_lock); +@@ -489,6 +505,15 @@ void dynamic_irq_cleanup(unsigned int irq) + raw_spin_unlock_irqrestore(&desc->lock, flags); + } + ++/** ++ * kstat_irqs_cpu - Get the statistics for an interrupt on a cpu ++ * @irq: The interrupt number ++ * @cpu: The cpu number ++ * ++ * Returns the sum of interrupt counts on @cpu since boot for ++ * @irq. The caller must ensure that the interrupt is not removed ++ * concurrently. ++ */ + unsigned int kstat_irqs_cpu(unsigned int irq, int cpu) + { + struct irq_desc *desc = irq_to_desc(irq); +@@ -497,6 +522,14 @@ unsigned int kstat_irqs_cpu(unsigned int irq, int cpu) + *per_cpu_ptr(desc->kstat_irqs, cpu) : 0; + } + ++/** ++ * kstat_irqs - Get the statistics for an interrupt ++ * @irq: The interrupt number ++ * ++ * Returns the sum of interrupt counts on all cpus since boot for ++ * @irq. The caller must ensure that the interrupt is not removed ++ * concurrently. ++ */ + unsigned int kstat_irqs(unsigned int irq) + { + struct irq_desc *desc = irq_to_desc(irq); +@@ -509,3 +542,22 @@ unsigned int kstat_irqs(unsigned int irq) + sum += *per_cpu_ptr(desc->kstat_irqs, cpu); + return sum; + } ++ ++/** ++ * kstat_irqs_usr - Get the statistics for an interrupt ++ * @irq: The interrupt number ++ * ++ * Returns the sum of interrupt counts on all cpus since boot for ++ * @irq. Contrary to kstat_irqs() this can be called from any ++ * preemptible context. It's protected against concurrent removal of ++ * an interrupt descriptor when sparse irqs are enabled. ++ */ ++unsigned int kstat_irqs_usr(unsigned int irq) ++{ ++ int sum; ++ ++ irq_lock_sparse(); ++ sum = kstat_irqs(irq); ++ irq_unlock_sparse(); ++ return sum; ++} +diff --git a/kernel/irq/proc.c b/kernel/irq/proc.c +index 36f6ee181b0c..095cd7230aef 100644 +--- a/kernel/irq/proc.c ++++ b/kernel/irq/proc.c +@@ -15,6 +15,23 @@ + + #include "internals.h" + ++/* ++ * Access rules: ++ * ++ * procfs protects read/write of /proc/irq/N/ files against a ++ * concurrent free of the interrupt descriptor. remove_proc_entry() ++ * immediately prevents new read/writes to happen and waits for ++ * already running read/write functions to complete. ++ * ++ * We remove the proc entries first and then delete the interrupt ++ * descriptor from the radix tree and free it. So it is guaranteed ++ * that irq_to_desc(N) is valid as long as the read/writes are ++ * permitted by procfs. ++ * ++ * The read from /proc/interrupts is a different problem because there ++ * is no protection. So the lookup and the access to irqdesc ++ * information must be protected by sparse_irq_lock. ++ */ + static struct proc_dir_entry *root_irq_dir; + + #ifdef CONFIG_SMP +@@ -437,9 +454,10 @@ int show_interrupts(struct seq_file *p, void *v) + seq_putc(p, '\n'); + } + ++ irq_lock_sparse(); + desc = irq_to_desc(i); + if (!desc) +- return 0; ++ goto outsparse; + + raw_spin_lock_irqsave(&desc->lock, flags); + for_each_online_cpu(j) +@@ -479,6 +497,8 @@ int show_interrupts(struct seq_file *p, void *v) + seq_putc(p, '\n'); + out: + raw_spin_unlock_irqrestore(&desc->lock, flags); ++outsparse: ++ irq_unlock_sparse(); + return 0; + } + #endif +diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c +index 6558b7ac112d..8c08a6f9cca0 100644 +--- a/kernel/time/tick-sched.c ++++ b/kernel/time/tick-sched.c +@@ -807,7 +807,6 @@ void tick_nohz_idle_enter(void) + + local_irq_enable(); + } +-EXPORT_SYMBOL_GPL(tick_nohz_idle_enter); + + /** + * tick_nohz_irq_exit - update next tick event from interrupt exit +@@ -934,7 +933,6 @@ void tick_nohz_idle_exit(void) + + local_irq_enable(); + } +-EXPORT_SYMBOL_GPL(tick_nohz_idle_exit); + + static int tick_nohz_reprogram(struct tick_sched *ts, ktime_t now) + { +diff --git a/lib/decompress_bunzip2.c b/lib/decompress_bunzip2.c +index 31c5f7675fbf..f504027d66a8 100644 +--- a/lib/decompress_bunzip2.c ++++ b/lib/decompress_bunzip2.c +@@ -184,7 +184,7 @@ static int INIT get_next_block(struct bunzip_data *bd) + if (get_bits(bd, 1)) + return RETVAL_OBSOLETE_INPUT; + origPtr = get_bits(bd, 24); +- if (origPtr > dbufSize) ++ if (origPtr >= dbufSize) + return RETVAL_DATA_ERROR; + /* mapping table: if some byte values are never used (encoding things + like ascii text), the compression code removes the gaps to have fewer +diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c +index c46387a46535..e5c5f573c0d4 100644 +--- a/net/batman-adv/fragmentation.c ++++ b/net/batman-adv/fragmentation.c +@@ -251,7 +251,7 @@ batadv_frag_merge_packets(struct hlist_head *chain, struct sk_buff *skb) + kfree(entry); + + /* Make room for the rest of the fragments. */ +- if (pskb_expand_head(skb_out, 0, size - skb->len, GFP_ATOMIC) < 0) { ++ if (pskb_expand_head(skb_out, 0, size - skb_out->len, GFP_ATOMIC) < 0) { + kfree_skb(skb_out); + skb_out = NULL; + goto free; +@@ -434,7 +434,7 @@ bool batadv_frag_send_packet(struct sk_buff *skb, + * fragments larger than BATADV_FRAG_MAX_FRAG_SIZE + */ + mtu = min_t(unsigned, mtu, BATADV_FRAG_MAX_FRAG_SIZE); +- max_fragment_size = (mtu - header_size - ETH_HLEN); ++ max_fragment_size = mtu - header_size; + max_packet_size = max_fragment_size * BATADV_FRAG_MAX_FRAGMENTS; + + /* Don't even try to fragment, if we need more than 16 fragments */ +diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c +index 36b9ae61f5e8..2393ea72d65f 100644 +--- a/net/batman-adv/gateway_client.c ++++ b/net/batman-adv/gateway_client.c +@@ -812,7 +812,7 @@ bool batadv_gw_out_of_range(struct batadv_priv *bat_priv, + goto out; + + gw_node = batadv_gw_node_get(bat_priv, orig_dst_node); +- if (!gw_node->bandwidth_down == 0) ++ if (!gw_node) + goto out; + + switch (atomic_read(&bat_priv->gw_mode)) { +diff --git a/net/core/dev.c b/net/core/dev.c +index 3ed11a555834..86bb9cc81f02 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -1709,6 +1709,7 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb) + + skb_scrub_packet(skb, true); + skb->protocol = eth_type_trans(skb, dev); ++ skb_postpull_rcsum(skb, eth_hdr(skb), ETH_HLEN); + + return netif_rx_internal(skb); + } +@@ -2529,11 +2530,14 @@ netdev_features_t netif_skb_dev_features(struct sk_buff *skb, + if (skb_shinfo(skb)->gso_segs > dev->gso_max_segs) + features &= ~NETIF_F_GSO_MASK; + +- if (protocol == htons(ETH_P_8021Q) || protocol == htons(ETH_P_8021AD)) { +- struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data; +- protocol = veh->h_vlan_encapsulated_proto; +- } else if (!vlan_tx_tag_present(skb)) { +- return harmonize_features(skb, dev, features); ++ if (!vlan_tx_tag_present(skb)) { ++ if (unlikely(protocol == htons(ETH_P_8021Q) || ++ protocol == htons(ETH_P_8021AD))) { ++ struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data; ++ protocol = veh->h_vlan_encapsulated_proto; ++ } else { ++ return harmonize_features(skb, dev, features); ++ } + } + + features &= (dev->vlan_features | NETIF_F_HW_VLAN_CTAG_TX | +@@ -4701,9 +4705,14 @@ static void netdev_adjacent_sysfs_del(struct net_device *dev, + sysfs_remove_link(&(dev->dev.kobj), linkname); + } + +-#define netdev_adjacent_is_neigh_list(dev, dev_list) \ +- (dev_list == &dev->adj_list.upper || \ +- dev_list == &dev->adj_list.lower) ++static inline bool netdev_adjacent_is_neigh_list(struct net_device *dev, ++ struct net_device *adj_dev, ++ struct list_head *dev_list) ++{ ++ return (dev_list == &dev->adj_list.upper || ++ dev_list == &dev->adj_list.lower) && ++ net_eq(dev_net(dev), dev_net(adj_dev)); ++} + + static int __netdev_adjacent_dev_insert(struct net_device *dev, + struct net_device *adj_dev, +@@ -4733,7 +4742,7 @@ static int __netdev_adjacent_dev_insert(struct net_device *dev, + pr_debug("dev_hold for %s, because of link added from %s to %s\n", + adj_dev->name, dev->name, adj_dev->name); + +- if (netdev_adjacent_is_neigh_list(dev, dev_list)) { ++ if (netdev_adjacent_is_neigh_list(dev, adj_dev, dev_list)) { + ret = netdev_adjacent_sysfs_add(dev, adj_dev, dev_list); + if (ret) + goto free_adj; +@@ -4754,7 +4763,7 @@ static int __netdev_adjacent_dev_insert(struct net_device *dev, + return 0; + + remove_symlinks: +- if (netdev_adjacent_is_neigh_list(dev, dev_list)) ++ if (netdev_adjacent_is_neigh_list(dev, adj_dev, dev_list)) + netdev_adjacent_sysfs_del(dev, adj_dev->name, dev_list); + free_adj: + kfree(adj); +@@ -4787,7 +4796,7 @@ static void __netdev_adjacent_dev_remove(struct net_device *dev, + if (adj->master) + sysfs_remove_link(&(dev->dev.kobj), "master"); + +- if (netdev_adjacent_is_neigh_list(dev, dev_list)) ++ if (netdev_adjacent_is_neigh_list(dev, adj_dev, dev_list)) + netdev_adjacent_sysfs_del(dev, adj_dev->name, dev_list); + + list_del_rcu(&adj->list); +@@ -5057,11 +5066,65 @@ void netdev_upper_dev_unlink(struct net_device *dev, + } + EXPORT_SYMBOL(netdev_upper_dev_unlink); + ++void netdev_adjacent_add_links(struct net_device *dev) ++{ ++ struct netdev_adjacent *iter; ++ ++ struct net *net = dev_net(dev); ++ ++ list_for_each_entry(iter, &dev->adj_list.upper, list) { ++ if (!net_eq(net,dev_net(iter->dev))) ++ continue; ++ netdev_adjacent_sysfs_add(iter->dev, dev, ++ &iter->dev->adj_list.lower); ++ netdev_adjacent_sysfs_add(dev, iter->dev, ++ &dev->adj_list.upper); ++ } ++ ++ list_for_each_entry(iter, &dev->adj_list.lower, list) { ++ if (!net_eq(net,dev_net(iter->dev))) ++ continue; ++ netdev_adjacent_sysfs_add(iter->dev, dev, ++ &iter->dev->adj_list.upper); ++ netdev_adjacent_sysfs_add(dev, iter->dev, ++ &dev->adj_list.lower); ++ } ++} ++ ++void netdev_adjacent_del_links(struct net_device *dev) ++{ ++ struct netdev_adjacent *iter; ++ ++ struct net *net = dev_net(dev); ++ ++ list_for_each_entry(iter, &dev->adj_list.upper, list) { ++ if (!net_eq(net,dev_net(iter->dev))) ++ continue; ++ netdev_adjacent_sysfs_del(iter->dev, dev->name, ++ &iter->dev->adj_list.lower); ++ netdev_adjacent_sysfs_del(dev, iter->dev->name, ++ &dev->adj_list.upper); ++ } ++ ++ list_for_each_entry(iter, &dev->adj_list.lower, list) { ++ if (!net_eq(net,dev_net(iter->dev))) ++ continue; ++ netdev_adjacent_sysfs_del(iter->dev, dev->name, ++ &iter->dev->adj_list.upper); ++ netdev_adjacent_sysfs_del(dev, iter->dev->name, ++ &dev->adj_list.lower); ++ } ++} ++ + void netdev_adjacent_rename_links(struct net_device *dev, char *oldname) + { + struct netdev_adjacent *iter; + ++ struct net *net = dev_net(dev); ++ + list_for_each_entry(iter, &dev->adj_list.upper, list) { ++ if (!net_eq(net,dev_net(iter->dev))) ++ continue; + netdev_adjacent_sysfs_del(iter->dev, oldname, + &iter->dev->adj_list.lower); + netdev_adjacent_sysfs_add(iter->dev, dev, +@@ -5069,6 +5132,8 @@ void netdev_adjacent_rename_links(struct net_device *dev, char *oldname) + } + + list_for_each_entry(iter, &dev->adj_list.lower, list) { ++ if (!net_eq(net,dev_net(iter->dev))) ++ continue; + netdev_adjacent_sysfs_del(iter->dev, oldname, + &iter->dev->adj_list.upper); + netdev_adjacent_sysfs_add(iter->dev, dev, +@@ -6675,6 +6740,7 @@ int dev_change_net_namespace(struct net_device *dev, struct net *net, const char + + /* Send a netdev-removed uevent to the old namespace */ + kobject_uevent(&dev->dev.kobj, KOBJ_REMOVE); ++ netdev_adjacent_del_links(dev); + + /* Actually switch the network namespace */ + dev_net_set(dev, net); +@@ -6689,6 +6755,7 @@ int dev_change_net_namespace(struct net_device *dev, struct net *net, const char + + /* Send a netdev-add uevent to the new namespace */ + kobject_uevent(&dev->dev.kobj, KOBJ_ADD); ++ netdev_adjacent_add_links(dev); + + /* Fixup kobjects */ + err = device_rename(&dev->dev, dev->name); +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index baf6fc457df9..e2b1bba69882 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -3937,6 +3937,7 @@ void skb_scrub_packet(struct sk_buff *skb, bool xnet) + skb->local_df = 0; + skb_dst_drop(skb); + skb->mark = 0; ++ skb_init_secmark(skb); + secpath_reset(skb); + nf_reset(skb); + nf_reset_trace(skb); +diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c +index 94213c891565..b40b90d3bd2b 100644 +--- a/net/ipv4/ip_gre.c ++++ b/net/ipv4/ip_gre.c +@@ -250,10 +250,6 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb, + struct ip_tunnel *tunnel = netdev_priv(dev); + const struct iphdr *tnl_params; + +- skb = gre_handle_offloads(skb, !!(tunnel->parms.o_flags&TUNNEL_CSUM)); +- if (IS_ERR(skb)) +- goto out; +- + if (dev->header_ops) { + /* Need space for new headers */ + if (skb_cow_head(skb, dev->needed_headroom - +@@ -266,6 +262,7 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb, + * to gre header. + */ + skb_pull(skb, tunnel->hlen + sizeof(struct iphdr)); ++ skb_reset_mac_header(skb); + } else { + if (skb_cow_head(skb, dev->needed_headroom)) + goto free_skb; +@@ -273,6 +270,10 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb, + tnl_params = &tunnel->parms.iph; + } + ++ skb = gre_handle_offloads(skb, !!(tunnel->parms.o_flags&TUNNEL_CSUM)); ++ if (IS_ERR(skb)) ++ goto out; ++ + __gre_xmit(skb, dev, tnl_params, skb->protocol); + + return NETDEV_TX_OK; +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 91b98e5a17aa..7efa26bb872c 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -1894,7 +1894,7 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle, + if (unlikely(!tcp_snd_wnd_test(tp, skb, mss_now))) + break; + +- if (tso_segs == 1) { ++ if (tso_segs == 1 || !sk->sk_gso_max_segs) { + if (unlikely(!tcp_nagle_test(tp, skb, mss_now, + (tcp_skb_is_last(sk, skb) ? + nonagle : TCP_NAGLE_PUSH)))) +@@ -1931,7 +1931,7 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle, + } + + limit = mss_now; +- if (tso_segs > 1 && !tcp_urg_mode(tp)) ++ if (tso_segs > 1 && sk->sk_gso_max_segs && !tcp_urg_mode(tp)) + limit = tcp_mss_split_point(sk, skb, mss_now, + min_t(unsigned int, + cwnd_quota, +diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c +index cf9937743abb..53ea1644a297 100644 +--- a/net/netfilter/ipset/ip_set_core.c ++++ b/net/netfilter/ipset/ip_set_core.c +@@ -1839,6 +1839,12 @@ ip_set_sockfn_get(struct sock *sk, int optval, void __user *user, int *len) + if (*op < IP_SET_OP_VERSION) { + /* Check the version at the beginning of operations */ + struct ip_set_req_version *req_version = data; ++ ++ if (*len < sizeof(struct ip_set_req_version)) { ++ ret = -EINVAL; ++ goto done; ++ } ++ + if (req_version->version != IPSET_PROTOCOL) { + ret = -EPROTO; + goto done; +diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c +index 7c177bc43806..1d52506bda14 100644 +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -510,14 +510,14 @@ out: + return err; + } + +-static void netlink_frame_flush_dcache(const struct nl_mmap_hdr *hdr) ++static void netlink_frame_flush_dcache(const struct nl_mmap_hdr *hdr, unsigned int nm_len) + { + #if ARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE == 1 + struct page *p_start, *p_end; + + /* First page is flushed through netlink_{get,set}_status */ + p_start = pgvec_to_page(hdr + PAGE_SIZE); +- p_end = pgvec_to_page((void *)hdr + NL_MMAP_HDRLEN + hdr->nm_len - 1); ++ p_end = pgvec_to_page((void *)hdr + NL_MMAP_HDRLEN + nm_len - 1); + while (p_start <= p_end) { + flush_dcache_page(p_start); + p_start++; +@@ -535,9 +535,9 @@ static enum nl_mmap_status netlink_get_status(const struct nl_mmap_hdr *hdr) + static void netlink_set_status(struct nl_mmap_hdr *hdr, + enum nl_mmap_status status) + { ++ smp_mb(); + hdr->nm_status = status; + flush_dcache_page(pgvec_to_page(hdr)); +- smp_wmb(); + } + + static struct nl_mmap_hdr * +@@ -699,24 +699,16 @@ static int netlink_mmap_sendmsg(struct sock *sk, struct msghdr *msg, + struct nl_mmap_hdr *hdr; + struct sk_buff *skb; + unsigned int maxlen; +- bool excl = true; + int err = 0, len = 0; + +- /* Netlink messages are validated by the receiver before processing. +- * In order to avoid userspace changing the contents of the message +- * after validation, the socket and the ring may only be used by a +- * single process, otherwise we fall back to copying. +- */ +- if (atomic_long_read(&sk->sk_socket->file->f_count) > 1 || +- atomic_read(&nlk->mapped) > 1) +- excl = false; +- + mutex_lock(&nlk->pg_vec_lock); + + ring = &nlk->tx_ring; + maxlen = ring->frame_size - NL_MMAP_HDRLEN; + + do { ++ unsigned int nm_len; ++ + hdr = netlink_current_frame(ring, NL_MMAP_STATUS_VALID); + if (hdr == NULL) { + if (!(msg->msg_flags & MSG_DONTWAIT) && +@@ -724,35 +716,23 @@ static int netlink_mmap_sendmsg(struct sock *sk, struct msghdr *msg, + schedule(); + continue; + } +- if (hdr->nm_len > maxlen) { ++ ++ nm_len = ACCESS_ONCE(hdr->nm_len); ++ if (nm_len > maxlen) { + err = -EINVAL; + goto out; + } + +- netlink_frame_flush_dcache(hdr); ++ netlink_frame_flush_dcache(hdr, nm_len); + +- if (likely(dst_portid == 0 && dst_group == 0 && excl)) { +- skb = alloc_skb_head(GFP_KERNEL); +- if (skb == NULL) { +- err = -ENOBUFS; +- goto out; +- } +- sock_hold(sk); +- netlink_ring_setup_skb(skb, sk, ring, hdr); +- NETLINK_CB(skb).flags |= NETLINK_SKB_TX; +- __skb_put(skb, hdr->nm_len); +- netlink_set_status(hdr, NL_MMAP_STATUS_RESERVED); +- atomic_inc(&ring->pending); +- } else { +- skb = alloc_skb(hdr->nm_len, GFP_KERNEL); +- if (skb == NULL) { +- err = -ENOBUFS; +- goto out; +- } +- __skb_put(skb, hdr->nm_len); +- memcpy(skb->data, (void *)hdr + NL_MMAP_HDRLEN, hdr->nm_len); +- netlink_set_status(hdr, NL_MMAP_STATUS_UNUSED); ++ skb = alloc_skb(nm_len, GFP_KERNEL); ++ if (skb == NULL) { ++ err = -ENOBUFS; ++ goto out; + } ++ __skb_put(skb, nm_len); ++ memcpy(skb->data, (void *)hdr + NL_MMAP_HDRLEN, nm_len); ++ netlink_set_status(hdr, NL_MMAP_STATUS_UNUSED); + + netlink_increment_head(ring); + +@@ -798,7 +778,7 @@ static void netlink_queue_mmaped_skb(struct sock *sk, struct sk_buff *skb) + hdr->nm_pid = NETLINK_CB(skb).creds.pid; + hdr->nm_uid = from_kuid(sk_user_ns(sk), NETLINK_CB(skb).creds.uid); + hdr->nm_gid = from_kgid(sk_user_ns(sk), NETLINK_CB(skb).creds.gid); +- netlink_frame_flush_dcache(hdr); ++ netlink_frame_flush_dcache(hdr, hdr->nm_len); + netlink_set_status(hdr, NL_MMAP_STATUS_VALID); + + NETLINK_CB(skb).flags |= NETLINK_SKB_DELIVERED; +diff --git a/net/wireless/chan.c b/net/wireless/chan.c +index 78559b5bbd1f..27157a7801e8 100644 +--- a/net/wireless/chan.c ++++ b/net/wireless/chan.c +@@ -516,7 +516,7 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy, + { + struct ieee80211_sta_ht_cap *ht_cap; + struct ieee80211_sta_vht_cap *vht_cap; +- u32 width, control_freq; ++ u32 width, control_freq, cap; + + if (WARN_ON(!cfg80211_chandef_valid(chandef))) + return false; +@@ -554,7 +554,8 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy, + return false; + break; + case NL80211_CHAN_WIDTH_80P80: +- if (!(vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ)) ++ cap = vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK; ++ if (cap != IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ) + return false; + case NL80211_CHAN_WIDTH_80: + if (!vht_cap->vht_supported) +@@ -565,7 +566,9 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy, + case NL80211_CHAN_WIDTH_160: + if (!vht_cap->vht_supported) + return false; +- if (!(vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ)) ++ cap = vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK; ++ if (cap != IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ && ++ cap != IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ) + return false; + prohibited_flags |= IEEE80211_CHAN_NO_160MHZ; + width = 160; +diff --git a/net/wireless/reg.c b/net/wireless/reg.c +index 338794ea44d1..04d530560ec8 100644 +--- a/net/wireless/reg.c ++++ b/net/wireless/reg.c +@@ -1547,7 +1547,7 @@ static enum reg_request_treatment + reg_process_hint_driver(struct wiphy *wiphy, + struct regulatory_request *driver_request) + { +- const struct ieee80211_regdomain *regd; ++ const struct ieee80211_regdomain *regd, *tmp; + enum reg_request_treatment treatment; + + treatment = __reg_process_hint_driver(driver_request); +@@ -1566,7 +1566,10 @@ reg_process_hint_driver(struct wiphy *wiphy, + kfree(driver_request); + return REG_REQ_IGNORE; + } ++ ++ tmp = get_wiphy_regdom(wiphy); + rcu_assign_pointer(wiphy->regd, regd); ++ rcu_free_regdom(tmp); + } + + +@@ -1625,11 +1628,8 @@ __reg_process_hint_country_ie(struct wiphy *wiphy, + return REG_REQ_IGNORE; + return REG_REQ_ALREADY_SET; + } +- /* +- * Two consecutive Country IE hints on the same wiphy. +- * This should be picked up early by the driver/stack +- */ +- if (WARN_ON(regdom_changes(country_ie_request->alpha2))) ++ ++ if (regdom_changes(country_ie_request->alpha2)) + return REG_REQ_OK; + return REG_REQ_ALREADY_SET; + } +diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h +index c657752a420c..83bddbdb90e9 100644 +--- a/sound/usb/quirks-table.h ++++ b/sound/usb/quirks-table.h +@@ -2804,133 +2804,45 @@ YAMAHA_DEVICE(0x7010, "UB99"), + } + }, + +-/* Hauppauge HVR-950Q and HVR-850 */ +-{ +- USB_DEVICE_VENDOR_SPEC(0x2040, 0x7200), +- .match_flags = USB_DEVICE_ID_MATCH_DEVICE | +- USB_DEVICE_ID_MATCH_INT_CLASS | +- USB_DEVICE_ID_MATCH_INT_SUBCLASS, +- .bInterfaceClass = USB_CLASS_AUDIO, +- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL, +- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { +- .vendor_name = "Hauppauge", +- .product_name = "HVR-950Q", +- .ifnum = QUIRK_ANY_INTERFACE, +- .type = QUIRK_AUDIO_ALIGN_TRANSFER, +- } +-}, +-{ +- USB_DEVICE_VENDOR_SPEC(0x2040, 0x7210), +- .match_flags = USB_DEVICE_ID_MATCH_DEVICE | +- USB_DEVICE_ID_MATCH_INT_CLASS | +- USB_DEVICE_ID_MATCH_INT_SUBCLASS, +- .bInterfaceClass = USB_CLASS_AUDIO, +- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL, +- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { +- .vendor_name = "Hauppauge", +- .product_name = "HVR-950Q", +- .ifnum = QUIRK_ANY_INTERFACE, +- .type = QUIRK_AUDIO_ALIGN_TRANSFER, +- } +-}, +-{ +- USB_DEVICE_VENDOR_SPEC(0x2040, 0x7217), +- .match_flags = USB_DEVICE_ID_MATCH_DEVICE | +- USB_DEVICE_ID_MATCH_INT_CLASS | +- USB_DEVICE_ID_MATCH_INT_SUBCLASS, +- .bInterfaceClass = USB_CLASS_AUDIO, +- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL, +- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { +- .vendor_name = "Hauppauge", +- .product_name = "HVR-950Q", +- .ifnum = QUIRK_ANY_INTERFACE, +- .type = QUIRK_AUDIO_ALIGN_TRANSFER, +- } +-}, +-{ +- USB_DEVICE_VENDOR_SPEC(0x2040, 0x721b), +- .match_flags = USB_DEVICE_ID_MATCH_DEVICE | +- USB_DEVICE_ID_MATCH_INT_CLASS | +- USB_DEVICE_ID_MATCH_INT_SUBCLASS, +- .bInterfaceClass = USB_CLASS_AUDIO, +- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL, +- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { +- .vendor_name = "Hauppauge", +- .product_name = "HVR-950Q", +- .ifnum = QUIRK_ANY_INTERFACE, +- .type = QUIRK_AUDIO_ALIGN_TRANSFER, +- } +-}, +-{ +- USB_DEVICE_VENDOR_SPEC(0x2040, 0x721e), +- .match_flags = USB_DEVICE_ID_MATCH_DEVICE | +- USB_DEVICE_ID_MATCH_INT_CLASS | +- USB_DEVICE_ID_MATCH_INT_SUBCLASS, +- .bInterfaceClass = USB_CLASS_AUDIO, +- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL, +- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { +- .vendor_name = "Hauppauge", +- .product_name = "HVR-950Q", +- .ifnum = QUIRK_ANY_INTERFACE, +- .type = QUIRK_AUDIO_ALIGN_TRANSFER, +- } +-}, +-{ +- USB_DEVICE_VENDOR_SPEC(0x2040, 0x721f), +- .match_flags = USB_DEVICE_ID_MATCH_DEVICE | +- USB_DEVICE_ID_MATCH_INT_CLASS | +- USB_DEVICE_ID_MATCH_INT_SUBCLASS, +- .bInterfaceClass = USB_CLASS_AUDIO, +- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL, +- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { +- .vendor_name = "Hauppauge", +- .product_name = "HVR-950Q", +- .ifnum = QUIRK_ANY_INTERFACE, +- .type = QUIRK_AUDIO_ALIGN_TRANSFER, +- } +-}, +-{ +- USB_DEVICE_VENDOR_SPEC(0x2040, 0x7240), +- .match_flags = USB_DEVICE_ID_MATCH_DEVICE | +- USB_DEVICE_ID_MATCH_INT_CLASS | +- USB_DEVICE_ID_MATCH_INT_SUBCLASS, +- .bInterfaceClass = USB_CLASS_AUDIO, +- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL, +- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { +- .vendor_name = "Hauppauge", +- .product_name = "HVR-850", +- .ifnum = QUIRK_ANY_INTERFACE, +- .type = QUIRK_AUDIO_ALIGN_TRANSFER, +- } +-}, +-{ +- USB_DEVICE_VENDOR_SPEC(0x2040, 0x7280), +- .match_flags = USB_DEVICE_ID_MATCH_DEVICE | +- USB_DEVICE_ID_MATCH_INT_CLASS | +- USB_DEVICE_ID_MATCH_INT_SUBCLASS, +- .bInterfaceClass = USB_CLASS_AUDIO, +- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL, +- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { +- .vendor_name = "Hauppauge", +- .product_name = "HVR-950Q", +- .ifnum = QUIRK_ANY_INTERFACE, +- .type = QUIRK_AUDIO_ALIGN_TRANSFER, +- } +-}, +-{ +- USB_DEVICE_VENDOR_SPEC(0x0fd9, 0x0008), +- .match_flags = USB_DEVICE_ID_MATCH_DEVICE | +- USB_DEVICE_ID_MATCH_INT_CLASS | +- USB_DEVICE_ID_MATCH_INT_SUBCLASS, +- .bInterfaceClass = USB_CLASS_AUDIO, +- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL, +- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { +- .vendor_name = "Hauppauge", +- .product_name = "HVR-950Q", +- .ifnum = QUIRK_ANY_INTERFACE, +- .type = QUIRK_AUDIO_ALIGN_TRANSFER, +- } +-}, ++/* ++ * Auvitek au0828 devices with audio interface. ++ * This should be kept in sync with drivers/media/usb/au0828/au0828-cards.c ++ * Please notice that some drivers are DVB only, and don't need to be ++ * here. That's the case, for example, of DVICO_FUSIONHDTV7. ++ */ ++ ++#define AU0828_DEVICE(vid, pid, vname, pname) { \ ++ USB_DEVICE_VENDOR_SPEC(vid, pid), \ ++ .match_flags = USB_DEVICE_ID_MATCH_DEVICE | \ ++ USB_DEVICE_ID_MATCH_INT_CLASS | \ ++ USB_DEVICE_ID_MATCH_INT_SUBCLASS, \ ++ .bInterfaceClass = USB_CLASS_AUDIO, \ ++ .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL, \ ++ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { \ ++ .vendor_name = vname, \ ++ .product_name = pname, \ ++ .ifnum = QUIRK_ANY_INTERFACE, \ ++ .type = QUIRK_AUDIO_ALIGN_TRANSFER, \ ++ } \ ++} ++ ++AU0828_DEVICE(0x2040, 0x7200, "Hauppauge", "HVR-950Q"), ++AU0828_DEVICE(0x2040, 0x7240, "Hauppauge", "HVR-850"), ++AU0828_DEVICE(0x2040, 0x7210, "Hauppauge", "HVR-950Q"), ++AU0828_DEVICE(0x2040, 0x7217, "Hauppauge", "HVR-950Q"), ++AU0828_DEVICE(0x2040, 0x721b, "Hauppauge", "HVR-950Q"), ++AU0828_DEVICE(0x2040, 0x721e, "Hauppauge", "HVR-950Q"), ++AU0828_DEVICE(0x2040, 0x721f, "Hauppauge", "HVR-950Q"), ++AU0828_DEVICE(0x2040, 0x7280, "Hauppauge", "HVR-950Q"), ++AU0828_DEVICE(0x0fd9, 0x0008, "Hauppauge", "HVR-950Q"), ++AU0828_DEVICE(0x2040, 0x7201, "Hauppauge", "HVR-950Q-MXL"), ++AU0828_DEVICE(0x2040, 0x7211, "Hauppauge", "HVR-950Q-MXL"), ++AU0828_DEVICE(0x2040, 0x7281, "Hauppauge", "HVR-950Q-MXL"), ++AU0828_DEVICE(0x05e1, 0x0480, "Hauppauge", "Woodbury"), ++AU0828_DEVICE(0x2040, 0x8200, "Hauppauge", "Woodbury"), ++AU0828_DEVICE(0x2040, 0x7260, "Hauppauge", "HVR-950Q"), ++AU0828_DEVICE(0x2040, 0x7213, "Hauppauge", "HVR-950Q"), ++AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"), + + /* Digidesign Mbox */ + {