commit: f4449b8ff9220f2c57f1ebe5ecad2fd86cd98ac2 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Wed Jul 9 23:38:57 2014 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Wed Jul 9 23:38:57 2014 +0000 URL: http://git.overlays.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=f4449b8f
Linux patch 3.10.48 --- 0000_README | 4 + 1047_linux-3.10.48.patch | 1525 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 1529 insertions(+) diff --git a/0000_README b/0000_README index 3f75e5c..7ca8043 100644 --- a/0000_README +++ b/0000_README @@ -230,6 +230,10 @@ Patch: 1046_linux-3.10.47.patch From: http://www.kernel.org Desc: Linux 3.10.47 +Patch: 1047_linux-3.10.48.patch +From: http://www.kernel.org +Desc: Linux 3.10.48 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1047_linux-3.10.48.patch b/1047_linux-3.10.48.patch new file mode 100644 index 0000000..1da735f --- /dev/null +++ b/1047_linux-3.10.48.patch @@ -0,0 +1,1525 @@ +diff --git a/Makefile b/Makefile +index 6a3b46d1863c..f7e5680740f9 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 10 +-SUBLEVEL = 47 ++SUBLEVEL = 48 + EXTRAVERSION = + NAME = TOSSUG Baby Fish + +diff --git a/arch/arm/mach-omap2/mux.c b/arch/arm/mach-omap2/mux.c +index f82cf878d6af..94c2f6d17dae 100644 +--- a/arch/arm/mach-omap2/mux.c ++++ b/arch/arm/mach-omap2/mux.c +@@ -183,8 +183,10 @@ static int __init _omap_mux_get_by_name(struct omap_mux_partition *partition, + m0_entry = mux->muxnames[0]; + + /* First check for full name in mode0.muxmode format */ +- if (mode0_len && strncmp(muxname, m0_entry, mode0_len)) +- continue; ++ if (mode0_len) ++ if (strncmp(muxname, m0_entry, mode0_len) || ++ (strlen(m0_entry) != mode0_len)) ++ continue; + + /* Then check for muxmode only */ + for (i = 0; i < OMAP_MUX_NR_MODES; i++) { +diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S +index 6ad781b21c08..7cd589ebca2a 100644 +--- a/arch/arm64/kernel/entry.S ++++ b/arch/arm64/kernel/entry.S +@@ -275,7 +275,6 @@ el1_sp_pc: + * Stack or PC alignment exception handling + */ + mrs x0, far_el1 +- mov x1, x25 + mov x2, sp + b do_sp_pc_abort + el1_undef: +diff --git a/arch/unicore32/mm/alignment.c b/arch/unicore32/mm/alignment.c +index de7dc5fdd58b..24e836023e6c 100644 +--- a/arch/unicore32/mm/alignment.c ++++ b/arch/unicore32/mm/alignment.c +@@ -21,6 +21,7 @@ + #include <linux/sched.h> + #include <linux/uaccess.h> + ++#include <asm/pgtable.h> + #include <asm/tlbflush.h> + #include <asm/unaligned.h> + +diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h +index 3741c653767c..8b320722de7a 100644 +--- a/arch/x86/include/asm/kvm_host.h ++++ b/arch/x86/include/asm/kvm_host.h +@@ -92,7 +92,7 @@ + #define KVM_REFILL_PAGES 25 + #define KVM_MAX_CPUID_ENTRIES 80 + #define KVM_NR_FIXED_MTRR_REGION 88 +-#define KVM_NR_VAR_MTRR 8 ++#define KVM_NR_VAR_MTRR 10 + + #define ASYNC_PF_PER_VCPU 64 + +@@ -445,7 +445,7 @@ struct kvm_vcpu_arch { + bool nmi_injected; /* Trying to inject an NMI this entry */ + + struct mtrr_state_type mtrr_state; +- u32 pat; ++ u64 pat; + + int switch_db_regs; + unsigned long db[KVM_NR_DB_REGS]; +diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c +index 1e89a3dd3d51..07caf44d5755 100644 +--- a/drivers/block/rbd.c ++++ b/drivers/block/rbd.c +@@ -1385,6 +1385,14 @@ static bool obj_request_exists_test(struct rbd_obj_request *obj_request) + return test_bit(OBJ_REQ_EXISTS, &obj_request->flags) != 0; + } + ++static bool obj_request_overlaps_parent(struct rbd_obj_request *obj_request) ++{ ++ struct rbd_device *rbd_dev = obj_request->img_request->rbd_dev; ++ ++ return obj_request->img_offset < ++ round_up(rbd_dev->parent_overlap, rbd_obj_bytes(&rbd_dev->header)); ++} ++ + static void rbd_obj_request_get(struct rbd_obj_request *obj_request) + { + dout("%s: obj %p (was %d)\n", __func__, obj_request, +@@ -1401,6 +1409,13 @@ static void rbd_obj_request_put(struct rbd_obj_request *obj_request) + kref_put(&obj_request->kref, rbd_obj_request_destroy); + } + ++static void rbd_img_request_get(struct rbd_img_request *img_request) ++{ ++ dout("%s: img %p (was %d)\n", __func__, img_request, ++ atomic_read(&img_request->kref.refcount)); ++ kref_get(&img_request->kref); ++} ++ + static bool img_request_child_test(struct rbd_img_request *img_request); + static void rbd_parent_request_destroy(struct kref *kref); + static void rbd_img_request_destroy(struct kref *kref); +@@ -2154,6 +2169,7 @@ static void rbd_img_obj_callback(struct rbd_obj_request *obj_request) + img_request->next_completion = which; + out: + spin_unlock_irq(&img_request->completion_lock); ++ rbd_img_request_put(img_request); + + if (!more) + rbd_img_request_complete(img_request); +@@ -2250,6 +2266,7 @@ static int rbd_img_request_fill(struct rbd_img_request *img_request, + goto out_partial; + obj_request->osd_req = osd_req; + obj_request->callback = rbd_img_obj_callback; ++ rbd_img_request_get(img_request); + + osd_req_op_extent_init(osd_req, 0, opcode, offset, length, + 0, 0); +@@ -2673,7 +2690,7 @@ static int rbd_img_obj_request_submit(struct rbd_obj_request *obj_request) + */ + if (!img_request_write_test(img_request) || + !img_request_layered_test(img_request) || +- rbd_dev->parent_overlap <= obj_request->img_offset || ++ !obj_request_overlaps_parent(obj_request) || + ((known = obj_request_known_test(obj_request)) && + obj_request_exists_test(obj_request))) { + +diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c +index a56d0199e334..971dd8795b68 100644 +--- a/drivers/gpu/drm/radeon/atombios_crtc.c ++++ b/drivers/gpu/drm/radeon/atombios_crtc.c +@@ -839,14 +839,16 @@ static void atombios_crtc_program_pll(struct drm_crtc *crtc, + args.v5.ucMiscInfo = 0; /* HDMI depth, etc. */ + if (ss_enabled && (ss->type & ATOM_EXTERNAL_SS_MASK)) + args.v5.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_REF_DIV_SRC; +- switch (bpc) { +- case 8: +- default: +- args.v5.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_HDMI_24BPP; +- break; +- case 10: +- args.v5.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_HDMI_30BPP; +- break; ++ if (encoder_mode == ATOM_ENCODER_MODE_HDMI) { ++ switch (bpc) { ++ case 8: ++ default: ++ args.v5.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_HDMI_24BPP; ++ break; ++ case 10: ++ args.v5.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_HDMI_30BPP; ++ break; ++ } + } + args.v5.ucTransmitterID = encoder_id; + args.v5.ucEncoderMode = encoder_mode; +@@ -861,20 +863,22 @@ static void atombios_crtc_program_pll(struct drm_crtc *crtc, + args.v6.ucMiscInfo = 0; /* HDMI depth, etc. */ + if (ss_enabled && (ss->type & ATOM_EXTERNAL_SS_MASK)) + args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_REF_DIV_SRC; +- switch (bpc) { +- case 8: +- default: +- args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_24BPP; +- break; +- case 10: +- args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_30BPP; +- break; +- case 12: +- args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_36BPP; +- break; +- case 16: +- args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_48BPP; +- break; ++ if (encoder_mode == ATOM_ENCODER_MODE_HDMI) { ++ switch (bpc) { ++ case 8: ++ default: ++ args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_24BPP; ++ break; ++ case 10: ++ args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_30BPP; ++ break; ++ case 12: ++ args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_36BPP; ++ break; ++ case 16: ++ args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_48BPP; ++ break; ++ } + } + args.v6.ucTransmitterID = encoder_id; + args.v6.ucEncoderMode = encoder_mode; +diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c +index 16023986d301..4c05f2b015cf 100644 +--- a/drivers/gpu/drm/radeon/atombios_dp.c ++++ b/drivers/gpu/drm/radeon/atombios_dp.c +@@ -384,6 +384,19 @@ static int dp_get_max_dp_pix_clock(int link_rate, + + /***** radeon specific DP functions *****/ + ++static int radeon_dp_get_max_link_rate(struct drm_connector *connector, ++ u8 dpcd[DP_DPCD_SIZE]) ++{ ++ int max_link_rate; ++ ++ if (radeon_connector_is_dp12_capable(connector)) ++ max_link_rate = min(drm_dp_max_link_rate(dpcd), 540000); ++ else ++ max_link_rate = min(drm_dp_max_link_rate(dpcd), 270000); ++ ++ return max_link_rate; ++} ++ + /* First get the min lane# when low rate is used according to pixel clock + * (prefer low rate), second check max lane# supported by DP panel, + * if the max lane# < low rate lane# then use max lane# instead. +@@ -393,7 +406,7 @@ static int radeon_dp_get_dp_lane_number(struct drm_connector *connector, + int pix_clock) + { + int bpp = convert_bpc_to_bpp(radeon_get_monitor_bpc(connector)); +- int max_link_rate = drm_dp_max_link_rate(dpcd); ++ int max_link_rate = radeon_dp_get_max_link_rate(connector, dpcd); + int max_lane_num = drm_dp_max_lane_count(dpcd); + int lane_num; + int max_dp_pix_clock; +@@ -431,7 +444,7 @@ static int radeon_dp_get_dp_link_clock(struct drm_connector *connector, + return 540000; + } + +- return drm_dp_max_link_rate(dpcd); ++ return radeon_dp_get_max_link_rate(connector, dpcd); + } + + static u8 radeon_dp_encoder_service(struct radeon_device *rdev, +diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c +index 1f7f3ce875c8..5802d7486354 100644 +--- a/drivers/gpu/drm/radeon/atombios_encoders.c ++++ b/drivers/gpu/drm/radeon/atombios_encoders.c +@@ -1877,8 +1877,11 @@ atombios_set_encoder_crtc_source(struct drm_encoder *encoder) + args.v2.ucEncodeMode = ATOM_ENCODER_MODE_CRT; + else + args.v2.ucEncodeMode = atombios_get_encoder_mode(encoder); +- } else ++ } else if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT)) { ++ args.v2.ucEncodeMode = ATOM_ENCODER_MODE_LVDS; ++ } else { + args.v2.ucEncodeMode = atombios_get_encoder_mode(encoder); ++ } + switch (radeon_encoder->encoder_id) { + case ENCODER_OBJECT_ID_INTERNAL_UNIPHY: + case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1: +diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c +index 5a87c9fc78d3..fc604fc75797 100644 +--- a/drivers/gpu/drm/radeon/radeon_connectors.c ++++ b/drivers/gpu/drm/radeon/radeon_connectors.c +@@ -1345,7 +1345,7 @@ bool radeon_connector_is_dp12_capable(struct drm_connector *connector) + struct radeon_device *rdev = dev->dev_private; + + if (ASIC_IS_DCE5(rdev) && +- (rdev->clock.dp_extclk >= 53900) && ++ (rdev->clock.default_dispclk >= 53900) && + radeon_connector_encoder_is_hbr2(connector)) { + return true; + } +diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c +index fe36f1d9496d..60af3cda587b 100644 +--- a/drivers/gpu/drm/radeon/radeon_cs.c ++++ b/drivers/gpu/drm/radeon/radeon_cs.c +@@ -96,6 +96,12 @@ static int radeon_cs_parser_relocs(struct radeon_cs_parser *p) + uint32_t domain = r->write_domain ? + r->write_domain : r->read_domains; + ++ if (domain & RADEON_GEM_DOMAIN_CPU) { ++ DRM_ERROR("RADEON_GEM_DOMAIN_CPU is not valid " ++ "for command submission\n"); ++ return -EINVAL; ++ } ++ + p->relocs[i].lobj.domain = domain; + if (domain == RADEON_GEM_DOMAIN_VRAM) + domain |= RADEON_GEM_DOMAIN_GTT; +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c +index 021b5227e783..1b0f34bd3a03 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c +@@ -179,7 +179,6 @@ static int vmw_fb_set_par(struct fb_info *info) + vmw_write(vmw_priv, SVGA_REG_DISPLAY_POSITION_Y, info->var.yoffset); + vmw_write(vmw_priv, SVGA_REG_DISPLAY_WIDTH, info->var.xres); + vmw_write(vmw_priv, SVGA_REG_DISPLAY_HEIGHT, info->var.yres); +- vmw_write(vmw_priv, SVGA_REG_BYTES_PER_LINE, info->fix.line_length); + vmw_write(vmw_priv, SVGA_REG_DISPLAY_ID, SVGA_ID_INVALID); + } + +diff --git a/drivers/hwmon/ina2xx.c b/drivers/hwmon/ina2xx.c +index 4958b2f89dce..371c1ee233b7 100644 +--- a/drivers/hwmon/ina2xx.c ++++ b/drivers/hwmon/ina2xx.c +@@ -147,7 +147,8 @@ static int ina2xx_get_value(struct ina2xx_data *data, u8 reg) + + switch (reg) { + case INA2XX_SHUNT_VOLTAGE: +- val = DIV_ROUND_CLOSEST(data->regs[reg], ++ /* signed register */ ++ val = DIV_ROUND_CLOSEST((s16)data->regs[reg], + data->config->shunt_div); + break; + case INA2XX_BUS_VOLTAGE: +@@ -159,8 +160,8 @@ static int ina2xx_get_value(struct ina2xx_data *data, u8 reg) + val = data->regs[reg] * data->config->power_lsb; + break; + case INA2XX_CURRENT: +- /* LSB=1mA (selected). Is in mA */ +- val = data->regs[reg]; ++ /* signed register, LSB=1mA (selected), in mA */ ++ val = (s16)data->regs[reg]; + break; + default: + /* programmer goofed */ +diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c +index 0cf5f8e06cfc..1e8e94d4db7d 100644 +--- a/drivers/iio/inkern.c ++++ b/drivers/iio/inkern.c +@@ -183,7 +183,7 @@ static struct iio_channel *of_iio_channel_get_by_name(struct device_node *np, + else if (name && index >= 0) { + pr_err("ERROR: could not get IIO channel %s:%s(%i)\n", + np->full_name, name ? name : "", index); +- return chan; ++ return NULL; + } + + /* +@@ -193,8 +193,9 @@ static struct iio_channel *of_iio_channel_get_by_name(struct device_node *np, + */ + np = np->parent; + if (np && !of_get_property(np, "io-channel-ranges", NULL)) +- break; ++ return NULL; + } ++ + return chan; + } + +@@ -317,6 +318,7 @@ struct iio_channel *iio_channel_get(struct device *dev, + if (channel != NULL) + return channel; + } ++ + return iio_channel_get_sys(name, channel_name); + } + EXPORT_SYMBOL_GPL(iio_channel_get); +diff --git a/drivers/irqchip/spear-shirq.c b/drivers/irqchip/spear-shirq.c +index 8527743b5cef..391b9cea73ed 100644 +--- a/drivers/irqchip/spear-shirq.c ++++ b/drivers/irqchip/spear-shirq.c +@@ -125,7 +125,7 @@ static struct spear_shirq spear320_shirq_ras2 = { + }; + + static struct spear_shirq spear320_shirq_ras3 = { +- .irq_nr = 3, ++ .irq_nr = 7, + .irq_bit_off = 0, + .invalid_irq = 1, + .regs = { +diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c +index 7d0ac0a6e724..86a2a5e3b26b 100644 +--- a/drivers/md/dm-thin.c ++++ b/drivers/md/dm-thin.c +@@ -2647,7 +2647,8 @@ static void set_discard_limits(struct pool_c *pt, struct queue_limits *limits) + */ + if (pt->adjusted_pf.discard_passdown) { + data_limits = &bdev_get_queue(pt->data_dev->bdev)->limits; +- limits->discard_granularity = data_limits->discard_granularity; ++ limits->discard_granularity = max(data_limits->discard_granularity, ++ pool->sectors_per_block << SECTOR_SHIFT); + } else + limits->discard_granularity = pool->sectors_per_block << SECTOR_SHIFT; + } +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 963fa59be9b3..aaf77b07bb72 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -7447,6 +7447,19 @@ void md_do_sync(struct md_thread *thread) + rdev->recovery_offset < j) + j = rdev->recovery_offset; + rcu_read_unlock(); ++ ++ /* If there is a bitmap, we need to make sure all ++ * writes that started before we added a spare ++ * complete before we start doing a recovery. ++ * Otherwise the write might complete and (via ++ * bitmap_endwrite) set a bit in the bitmap after the ++ * recovery has checked that bit and skipped that ++ * region. ++ */ ++ if (mddev->bitmap) { ++ mddev->pers->quiesce(mddev, 1); ++ mddev->pers->quiesce(mddev, 0); ++ } + } + + printk(KERN_INFO "md: %s of RAID array %s\n", desc, mdname(mddev)); +diff --git a/drivers/mmc/host/rtsx_pci_sdmmc.c b/drivers/mmc/host/rtsx_pci_sdmmc.c +index ad13f4240c49..7ffb5cba30a9 100644 +--- a/drivers/mmc/host/rtsx_pci_sdmmc.c ++++ b/drivers/mmc/host/rtsx_pci_sdmmc.c +@@ -247,6 +247,9 @@ static void sd_send_cmd_get_rsp(struct realtek_pci_sdmmc *host, + case MMC_RSP_R1: + rsp_type = SD_RSP_TYPE_R1; + break; ++ case MMC_RSP_R1 & ~MMC_RSP_CRC: ++ rsp_type = SD_RSP_TYPE_R1 | SD_NO_CHECK_CRC7; ++ break; + case MMC_RSP_R1B: + rsp_type = SD_RSP_TYPE_R1b; + break; +diff --git a/drivers/mtd/nand/fsl_elbc_nand.c b/drivers/mtd/nand/fsl_elbc_nand.c +index 20657209a472..c31d183820c5 100644 +--- a/drivers/mtd/nand/fsl_elbc_nand.c ++++ b/drivers/mtd/nand/fsl_elbc_nand.c +@@ -725,6 +725,19 @@ static int fsl_elbc_write_page(struct mtd_info *mtd, struct nand_chip *chip, + return 0; + } + ++/* ECC will be calculated automatically, and errors will be detected in ++ * waitfunc. ++ */ ++static int fsl_elbc_write_subpage(struct mtd_info *mtd, struct nand_chip *chip, ++ uint32_t offset, uint32_t data_len, ++ const uint8_t *buf, int oob_required) ++{ ++ fsl_elbc_write_buf(mtd, buf, mtd->writesize); ++ fsl_elbc_write_buf(mtd, chip->oob_poi, mtd->oobsize); ++ ++ return 0; ++} ++ + static int fsl_elbc_chip_init(struct fsl_elbc_mtd *priv) + { + struct fsl_lbc_ctrl *ctrl = priv->ctrl; +@@ -763,6 +776,7 @@ static int fsl_elbc_chip_init(struct fsl_elbc_mtd *priv) + + chip->ecc.read_page = fsl_elbc_read_page; + chip->ecc.write_page = fsl_elbc_write_page; ++ chip->ecc.write_subpage = fsl_elbc_write_subpage; + + /* If CS Base Register selects full hardware ECC then use it */ + if ((in_be32(&lbc->bank[priv->bank].br) & BR_DECC) == +diff --git a/drivers/mtd/nand/omap2.c b/drivers/mtd/nand/omap2.c +index 81b80af55872..8c4eb287bbdb 100644 +--- a/drivers/mtd/nand/omap2.c ++++ b/drivers/mtd/nand/omap2.c +@@ -1463,7 +1463,7 @@ static int omap_elm_correct_data(struct mtd_info *mtd, u_char *data, + + /* Check if any error reported */ + if (!is_error_reported) +- return 0; ++ return stat; + + /* Decode BCH error using ELM module */ + elm_decode_bch_error_page(info->elm_dev, ecc_vec, err_vec); +diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c +index e85d34b76039..ebcce00ce067 100644 +--- a/drivers/net/wireless/b43/xmit.c ++++ b/drivers/net/wireless/b43/xmit.c +@@ -810,9 +810,13 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr) + break; + case B43_PHYTYPE_G: + status.band = IEEE80211_BAND_2GHZ; +- /* chanid is the radio channel cookie value as used +- * to tune the radio. */ +- status.freq = chanid + 2400; ++ /* Somewhere between 478.104 and 508.1084 firmware for G-PHY ++ * has been modified to be compatible with N-PHY and others. ++ */ ++ if (dev->fw.rev >= 508) ++ status.freq = ieee80211_channel_to_frequency(chanid, status.band); ++ else ++ status.freq = chanid + 2400; + break; + case B43_PHYTYPE_N: + case B43_PHYTYPE_LP: +diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c +index 4088dd5e9244..ff04135d37af 100644 +--- a/drivers/net/wireless/iwlwifi/pcie/trans.c ++++ b/drivers/net/wireless/iwlwifi/pcie/trans.c +@@ -339,6 +339,7 @@ static int iwl_pcie_prepare_card_hw(struct iwl_trans *trans) + { + int ret; + int t = 0; ++ int iter; + + IWL_DEBUG_INFO(trans, "iwl_trans_prepare_card_hw enter\n"); + +@@ -347,18 +348,23 @@ static int iwl_pcie_prepare_card_hw(struct iwl_trans *trans) + if (ret >= 0) + return 0; + +- /* If HW is not ready, prepare the conditions to check again */ +- iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG, +- CSR_HW_IF_CONFIG_REG_PREPARE); ++ for (iter = 0; iter < 10; iter++) { ++ /* If HW is not ready, prepare the conditions to check again */ ++ iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG, ++ CSR_HW_IF_CONFIG_REG_PREPARE); ++ ++ do { ++ ret = iwl_pcie_set_hw_ready(trans); ++ if (ret >= 0) ++ return 0; + +- do { +- ret = iwl_pcie_set_hw_ready(trans); +- if (ret >= 0) +- return 0; ++ usleep_range(200, 1000); ++ t += 200; ++ } while (t < 150000); ++ msleep(25); ++ } + +- usleep_range(200, 1000); +- t += 200; +- } while (t < 150000); ++ IWL_DEBUG_INFO(trans, "got NIC after %d iterations\n", iter); + + return ret; + } +diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c +index 77e45b223d15..d582febbfba2 100644 +--- a/drivers/net/wireless/rt2x00/rt2500pci.c ++++ b/drivers/net/wireless/rt2x00/rt2500pci.c +@@ -1684,8 +1684,13 @@ static int rt2500pci_init_eeprom(struct rt2x00_dev *rt2x00dev) + /* + * Detect if this device has an hardware controlled radio. + */ +- if (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_HARDWARE_RADIO)) ++ if (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_HARDWARE_RADIO)) { + __set_bit(CAPABILITY_HW_BUTTON, &rt2x00dev->cap_flags); ++ /* ++ * On this device RFKILL initialized during probe does not work. ++ */ ++ __set_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags); ++ } + + /* + * Check if the BBP tuning should be enabled. +diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h +index 7510723a8c37..1e716ff0f19e 100644 +--- a/drivers/net/wireless/rt2x00/rt2x00.h ++++ b/drivers/net/wireless/rt2x00/rt2x00.h +@@ -708,6 +708,7 @@ enum rt2x00_capability_flags { + REQUIRE_SW_SEQNO, + REQUIRE_HT_TX_DESC, + REQUIRE_PS_AUTOWAKE, ++ REQUIRE_DELAYED_RFKILL, + + /* + * Capabilities +diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c +index a2889d1cfe37..e22942bc2bb1 100644 +--- a/drivers/net/wireless/rt2x00/rt2x00dev.c ++++ b/drivers/net/wireless/rt2x00/rt2x00dev.c +@@ -1128,9 +1128,10 @@ static void rt2x00lib_uninitialize(struct rt2x00_dev *rt2x00dev) + return; + + /* +- * Unregister extra components. ++ * Stop rfkill polling. + */ +- rt2x00rfkill_unregister(rt2x00dev); ++ if (test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags)) ++ rt2x00rfkill_unregister(rt2x00dev); + + /* + * Allow the HW to uninitialize. +@@ -1168,6 +1169,12 @@ static int rt2x00lib_initialize(struct rt2x00_dev *rt2x00dev) + + set_bit(DEVICE_STATE_INITIALIZED, &rt2x00dev->flags); + ++ /* ++ * Start rfkill polling. ++ */ ++ if (test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags)) ++ rt2x00rfkill_register(rt2x00dev); ++ + return 0; + } + +@@ -1363,7 +1370,12 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev) + rt2x00link_register(rt2x00dev); + rt2x00leds_register(rt2x00dev); + rt2x00debug_register(rt2x00dev); +- rt2x00rfkill_register(rt2x00dev); ++ ++ /* ++ * Start rfkill polling. ++ */ ++ if (!test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags)) ++ rt2x00rfkill_register(rt2x00dev); + + return 0; + +@@ -1379,6 +1391,12 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev) + clear_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags); + + /* ++ * Stop rfkill polling. ++ */ ++ if (!test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags)) ++ rt2x00rfkill_unregister(rt2x00dev); ++ ++ /* + * Disable radio. + */ + rt2x00lib_disable_radio(rt2x00dev); +diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c +index 2b724fc4e306..c03748dafd49 100644 +--- a/drivers/net/wireless/rt2x00/rt2x00mac.c ++++ b/drivers/net/wireless/rt2x00/rt2x00mac.c +@@ -489,6 +489,8 @@ int rt2x00mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, + crypto.cipher = rt2x00crypto_key_to_cipher(key); + if (crypto.cipher == CIPHER_NONE) + return -EOPNOTSUPP; ++ if (crypto.cipher == CIPHER_TKIP && rt2x00_is_usb(rt2x00dev)) ++ return -EOPNOTSUPP; + + crypto.cmd = cmd; + +diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c +index d0fa4b6c551f..c62b3e5d44bd 100644 +--- a/drivers/scsi/ibmvscsi/ibmvscsi.c ++++ b/drivers/scsi/ibmvscsi/ibmvscsi.c +@@ -185,6 +185,11 @@ static struct viosrp_crq *crq_queue_next_crq(struct crq_queue *queue) + if (crq->valid & 0x80) { + if (++queue->cur == queue->size) + queue->cur = 0; ++ ++ /* Ensure the read of the valid bit occurs before reading any ++ * other bits of the CRQ entry ++ */ ++ rmb(); + } else + crq = NULL; + spin_unlock_irqrestore(&queue->lock, flags); +@@ -203,6 +208,11 @@ static int ibmvscsi_send_crq(struct ibmvscsi_host_data *hostdata, + { + struct vio_dev *vdev = to_vio_dev(hostdata->dev); + ++ /* ++ * Ensure the command buffer is flushed to memory before handing it ++ * over to the VIOS to prevent it from fetching any stale data. ++ */ ++ mb(); + return plpar_hcall_norets(H_SEND_CRQ, vdev->unit_address, word1, word2); + } + +@@ -794,7 +804,8 @@ static void purge_requests(struct ibmvscsi_host_data *hostdata, int error_code) + evt->hostdata->dev); + if (evt->cmnd_done) + evt->cmnd_done(evt->cmnd); +- } else if (evt->done) ++ } else if (evt->done && evt->crq.format != VIOSRP_MAD_FORMAT && ++ evt->iu.srp.login_req.opcode != SRP_LOGIN_REQ) + evt->done(evt); + free_event_struct(&evt->hostdata->pool, evt); + spin_lock_irqsave(hostdata->host->host_lock, flags); +diff --git a/drivers/scsi/sym53c8xx_2/sym_hipd.c b/drivers/scsi/sym53c8xx_2/sym_hipd.c +index d92fe4037e94..6b349e301869 100644 +--- a/drivers/scsi/sym53c8xx_2/sym_hipd.c ++++ b/drivers/scsi/sym53c8xx_2/sym_hipd.c +@@ -3000,7 +3000,11 @@ sym_dequeue_from_squeue(struct sym_hcb *np, int i, int target, int lun, int task + if ((target == -1 || cp->target == target) && + (lun == -1 || cp->lun == lun) && + (task == -1 || cp->tag == task)) { ++#ifdef SYM_OPT_HANDLE_DEVICE_QUEUEING + sym_set_cam_status(cp->cmd, DID_SOFT_ERROR); ++#else ++ sym_set_cam_status(cp->cmd, DID_REQUEUE); ++#endif + sym_remque(&cp->link_ccbq); + sym_insque_tail(&cp->link_ccbq, &np->comp_ccbq); + } +diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c +index 95a5d73e675c..11f5326f449f 100644 +--- a/drivers/scsi/virtio_scsi.c ++++ b/drivers/scsi/virtio_scsi.c +@@ -270,6 +270,16 @@ static void virtscsi_req_done(struct virtqueue *vq) + virtscsi_vq_done(vscsi, req_vq, virtscsi_complete_cmd); + }; + ++static void virtscsi_poll_requests(struct virtio_scsi *vscsi) ++{ ++ int i, num_vqs; ++ ++ num_vqs = vscsi->num_queues; ++ for (i = 0; i < num_vqs; i++) ++ virtscsi_vq_done(vscsi, &vscsi->req_vqs[i], ++ virtscsi_complete_cmd); ++} ++ + static void virtscsi_complete_free(struct virtio_scsi *vscsi, void *buf) + { + struct virtio_scsi_cmd *cmd = buf; +@@ -288,6 +298,8 @@ static void virtscsi_ctrl_done(struct virtqueue *vq) + virtscsi_vq_done(vscsi, &vscsi->ctrl_vq, virtscsi_complete_free); + }; + ++static void virtscsi_handle_event(struct work_struct *work); ++ + static int virtscsi_kick_event(struct virtio_scsi *vscsi, + struct virtio_scsi_event_node *event_node) + { +@@ -295,6 +307,7 @@ static int virtscsi_kick_event(struct virtio_scsi *vscsi, + struct scatterlist sg; + unsigned long flags; + ++ INIT_WORK(&event_node->work, virtscsi_handle_event); + sg_init_one(&sg, &event_node->event, sizeof(struct virtio_scsi_event)); + + spin_lock_irqsave(&vscsi->event_vq.vq_lock, flags); +@@ -412,7 +425,6 @@ static void virtscsi_complete_event(struct virtio_scsi *vscsi, void *buf) + { + struct virtio_scsi_event_node *event_node = buf; + +- INIT_WORK(&event_node->work, virtscsi_handle_event); + schedule_work(&event_node->work); + } + +@@ -602,6 +614,18 @@ static int virtscsi_tmf(struct virtio_scsi *vscsi, struct virtio_scsi_cmd *cmd) + cmd->resp.tmf.response == VIRTIO_SCSI_S_FUNCTION_SUCCEEDED) + ret = SUCCESS; + ++ /* ++ * The spec guarantees that all requests related to the TMF have ++ * been completed, but the callback might not have run yet if ++ * we're using independent interrupts (e.g. MSI). Poll the ++ * virtqueues once. ++ * ++ * In the abort case, sc->scsi_done will do nothing, because ++ * the block layer must have detected a timeout and as a result ++ * REQ_ATOM_COMPLETE has been set. ++ */ ++ virtscsi_poll_requests(vscsi); ++ + out: + mempool_free(cmd, virtscsi_cmd_pool); + return ret; +diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c +index 5d880917850f..345b5ddcb1a0 100644 +--- a/drivers/tty/serial/8250/8250_dw.c ++++ b/drivers/tty/serial/8250/8250_dw.c +@@ -54,58 +54,100 @@ + + + struct dw8250_data { +- int last_lcr; ++ int last_mcr; + int line; + struct clk *clk; + }; + ++static inline int dw8250_modify_msr(struct uart_port *p, int offset, int value) ++{ ++ struct dw8250_data *d = p->private_data; ++ ++ /* If reading MSR, report CTS asserted when auto-CTS/RTS enabled */ ++ if (offset == UART_MSR && d->last_mcr & UART_MCR_AFE) { ++ value |= UART_MSR_CTS; ++ value &= ~UART_MSR_DCTS; ++ } ++ ++ return value; ++} ++ ++static void dw8250_force_idle(struct uart_port *p) ++{ ++ serial8250_clear_and_reinit_fifos(container_of ++ (p, struct uart_8250_port, port)); ++ (void)p->serial_in(p, UART_RX); ++} ++ + static void dw8250_serial_out(struct uart_port *p, int offset, int value) + { + struct dw8250_data *d = p->private_data; + +- if (offset == UART_LCR) +- d->last_lcr = value; ++ if (offset == UART_MCR) ++ d->last_mcr = value; ++ ++ writeb(value, p->membase + (offset << p->regshift)); + +- offset <<= p->regshift; +- writeb(value, p->membase + offset); ++ /* Make sure LCR write wasn't ignored */ ++ if (offset == UART_LCR) { ++ int tries = 1000; ++ while (tries--) { ++ unsigned int lcr = p->serial_in(p, UART_LCR); ++ if ((value & ~UART_LCR_SPAR) == (lcr & ~UART_LCR_SPAR)) ++ return; ++ dw8250_force_idle(p); ++ writeb(value, p->membase + (UART_LCR << p->regshift)); ++ } ++ dev_err(p->dev, "Couldn't set LCR to %d\n", value); ++ } + } + + static unsigned int dw8250_serial_in(struct uart_port *p, int offset) + { +- offset <<= p->regshift; ++ unsigned int value = readb(p->membase + (offset << p->regshift)); + +- return readb(p->membase + offset); ++ return dw8250_modify_msr(p, offset, value); + } + + static void dw8250_serial_out32(struct uart_port *p, int offset, int value) + { + struct dw8250_data *d = p->private_data; + +- if (offset == UART_LCR) +- d->last_lcr = value; ++ if (offset == UART_MCR) ++ d->last_mcr = value; + +- offset <<= p->regshift; +- writel(value, p->membase + offset); ++ writel(value, p->membase + (offset << p->regshift)); ++ ++ /* Make sure LCR write wasn't ignored */ ++ if (offset == UART_LCR) { ++ int tries = 1000; ++ while (tries--) { ++ unsigned int lcr = p->serial_in(p, UART_LCR); ++ if ((value & ~UART_LCR_SPAR) == (lcr & ~UART_LCR_SPAR)) ++ return; ++ dw8250_force_idle(p); ++ writel(value, p->membase + (UART_LCR << p->regshift)); ++ } ++ dev_err(p->dev, "Couldn't set LCR to %d\n", value); ++ } + } + + static unsigned int dw8250_serial_in32(struct uart_port *p, int offset) + { +- offset <<= p->regshift; ++ unsigned int value = readl(p->membase + (offset << p->regshift)); + +- return readl(p->membase + offset); ++ return dw8250_modify_msr(p, offset, value); + } + + static int dw8250_handle_irq(struct uart_port *p) + { +- struct dw8250_data *d = p->private_data; + unsigned int iir = p->serial_in(p, UART_IIR); + + if (serial8250_handle_irq(p, iir)) { + return 1; + } else if ((iir & UART_IIR_BUSY) == UART_IIR_BUSY) { +- /* Clear the USR and write the LCR again. */ ++ /* Clear the USR */ + (void)p->serial_in(p, DW_UART_USR); +- p->serial_out(p, UART_LCR, d->last_lcr); + + return 1; + } +diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c +index b6e9d917221e..84219f656051 100644 +--- a/drivers/usb/gadget/f_fs.c ++++ b/drivers/usb/gadget/f_fs.c +@@ -1389,11 +1389,13 @@ static int functionfs_bind(struct ffs_data *ffs, struct usb_composite_dev *cdev) + ffs->ep0req->context = ffs; + + lang = ffs->stringtabs; +- for (lang = ffs->stringtabs; *lang; ++lang) { +- struct usb_string *str = (*lang)->strings; +- int id = first_id; +- for (; str->s; ++id, ++str) +- str->id = id; ++ if (lang) { ++ for (; *lang; ++lang) { ++ struct usb_string *str = (*lang)->strings; ++ int id = first_id; ++ for (; str->s; ++id, ++str) ++ str->id = id; ++ } + } + + ffs->gadget = cdev->gadget; +diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c +index bcfb08e41eb6..fe42cae6d1ef 100644 +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -3590,7 +3590,7 @@ static unsigned int xhci_get_burst_count(struct xhci_hcd *xhci, + return 0; + + max_burst = urb->ep->ss_ep_comp.bMaxBurst; +- return roundup(total_packet_count, max_burst + 1) - 1; ++ return DIV_ROUND_UP(total_packet_count, max_burst + 1) - 1; + } + + /* +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 4b46de842175..9a7088bc634d 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -960,7 +960,7 @@ int xhci_suspend(struct xhci_hcd *xhci) + */ + int xhci_resume(struct xhci_hcd *xhci, bool hibernated) + { +- u32 command, temp = 0; ++ u32 command, temp = 0, status; + struct usb_hcd *hcd = xhci_to_hcd(xhci); + struct usb_hcd *secondary_hcd; + int retval = 0; +@@ -1084,8 +1084,12 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated) + + done: + if (retval == 0) { +- usb_hcd_resume_root_hub(hcd); +- usb_hcd_resume_root_hub(xhci->shared_hcd); ++ /* Resume root hubs only when have pending events. */ ++ status = readl(&xhci->op_regs->status); ++ if (status & STS_EINT) { ++ usb_hcd_resume_root_hub(hcd); ++ usb_hcd_resume_root_hub(xhci->shared_hcd); ++ } + } + + /* +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index b9e663ac9a35..3e315de9bbd4 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -1577,14 +1577,17 @@ static void ftdi_set_max_packet_size(struct usb_serial_port *port) + struct usb_device *udev = serial->dev; + + struct usb_interface *interface = serial->interface; +- struct usb_endpoint_descriptor *ep_desc = &interface->cur_altsetting->endpoint[1].desc; ++ struct usb_endpoint_descriptor *ep_desc; + + unsigned num_endpoints; +- int i; ++ unsigned i; + + num_endpoints = interface->cur_altsetting->desc.bNumEndpoints; + dev_info(&udev->dev, "Number of endpoints %d\n", num_endpoints); + ++ if (!num_endpoints) ++ return; ++ + /* NOTE: some customers have programmed FT232R/FT245R devices + * with an endpoint size of 0 - not good. In this case, we + * want to override the endpoint descriptor setting and use a +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 70ede84f4f6b..e25e8ca09fe2 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -352,6 +352,9 @@ static void option_instat_callback(struct urb *urb); + /* Zoom */ + #define ZOOM_PRODUCT_4597 0x9607 + ++/* SpeedUp SU9800 usb 3g modem */ ++#define SPEEDUP_PRODUCT_SU9800 0x9800 ++ + /* Haier products */ + #define HAIER_VENDOR_ID 0x201e + #define HAIER_PRODUCT_CE100 0x2009 +@@ -372,8 +375,12 @@ static void option_instat_callback(struct urb *urb); + /* Olivetti products */ + #define OLIVETTI_VENDOR_ID 0x0b3c + #define OLIVETTI_PRODUCT_OLICARD100 0xc000 ++#define OLIVETTI_PRODUCT_OLICARD120 0xc001 ++#define OLIVETTI_PRODUCT_OLICARD140 0xc002 + #define OLIVETTI_PRODUCT_OLICARD145 0xc003 ++#define OLIVETTI_PRODUCT_OLICARD155 0xc004 + #define OLIVETTI_PRODUCT_OLICARD200 0xc005 ++#define OLIVETTI_PRODUCT_OLICARD160 0xc00a + #define OLIVETTI_PRODUCT_OLICARD500 0xc00b + + /* Celot products */ +@@ -1577,6 +1584,7 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14), + .driver_info = (kernel_ulong_t)&four_g_w14_blacklist + }, ++ { USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, SPEEDUP_PRODUCT_SU9800, 0xff) }, + { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) }, + { USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) }, + { USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) }, +@@ -1611,15 +1619,21 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDMNET) }, + { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, /* HC28 enumerates with Siemens or Cinterion VID depending on FW revision */ + { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) }, +- +- { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) }, ++ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100), ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, ++ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD120), ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, ++ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD140), ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD145) }, ++ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD155), ++ .driver_info = (kernel_ulong_t)&net_intf6_blacklist }, + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD200), +- .driver_info = (kernel_ulong_t)&net_intf6_blacklist +- }, ++ .driver_info = (kernel_ulong_t)&net_intf6_blacklist }, ++ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD160), ++ .driver_info = (kernel_ulong_t)&net_intf6_blacklist }, + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD500), +- .driver_info = (kernel_ulong_t)&net_intf4_blacklist +- }, ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */ + { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/ + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM600) }, +diff --git a/drivers/video/fb-puv3.c b/drivers/video/fb-puv3.c +index 27fc956166fa..520112531eb0 100644 +--- a/drivers/video/fb-puv3.c ++++ b/drivers/video/fb-puv3.c +@@ -18,8 +18,10 @@ + #include <linux/fb.h> + #include <linux/init.h> + #include <linux/console.h> ++#include <linux/mm.h> + + #include <asm/sizes.h> ++#include <asm/pgtable.h> + #include <mach/hardware.h> + + /* Platform_data reserved for unifb registers. */ +diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c +index 0227b45ef00a..15e9505aa35f 100644 +--- a/fs/cifs/cifs_unicode.c ++++ b/fs/cifs/cifs_unicode.c +@@ -290,7 +290,8 @@ int + cifsConvertToUTF16(__le16 *target, const char *source, int srclen, + const struct nls_table *cp, int mapChars) + { +- int i, j, charlen; ++ int i, charlen; ++ int j = 0; + char src_char; + __le16 dst_char; + wchar_t tmp; +@@ -298,12 +299,11 @@ cifsConvertToUTF16(__le16 *target, const char *source, int srclen, + if (!mapChars) + return cifs_strtoUTF16(target, source, PATH_MAX, cp); + +- for (i = 0, j = 0; i < srclen; j++) { ++ for (i = 0; i < srclen; j++) { + src_char = source[i]; + charlen = 1; + switch (src_char) { + case 0: +- put_unaligned(0, &target[j]); + goto ctoUTF16_out; + case ':': + dst_char = cpu_to_le16(UNI_COLON); +@@ -350,6 +350,7 @@ cifsConvertToUTF16(__le16 *target, const char *source, int srclen, + } + + ctoUTF16_out: ++ put_unaligned(0, &target[j]); /* Null terminate target unicode string */ + return j; + } + +diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c +index b8d5d351e24f..589061469687 100644 +--- a/fs/ext4/indirect.c ++++ b/fs/ext4/indirect.c +@@ -390,7 +390,13 @@ static int ext4_alloc_branch(handle_t *handle, struct inode *inode, + return 0; + failed: + for (; i >= 0; i--) { +- if (i != indirect_blks && branch[i].bh) ++ /* ++ * We want to ext4_forget() only freshly allocated indirect ++ * blocks. Buffer for new_blocks[i-1] is at branch[i].bh and ++ * buffer at branch[0].bh is indirect block / inode already ++ * existing before ext4_alloc_branch() was called. ++ */ ++ if (i > 0 && i != indirect_blks && branch[i].bh) + ext4_forget(handle, 1, inode, branch[i].bh, + branch[i].bh->b_blocknr); + ext4_free_blocks(handle, inode, NULL, new_blocks[i], +@@ -1325,16 +1331,24 @@ static int free_hole_blocks(handle_t *handle, struct inode *inode, + blk = *i_data; + if (level > 0) { + ext4_lblk_t first2; ++ ext4_lblk_t count2; ++ + bh = sb_bread(inode->i_sb, le32_to_cpu(blk)); + if (!bh) { + EXT4_ERROR_INODE_BLOCK(inode, le32_to_cpu(blk), + "Read failure"); + return -EIO; + } +- first2 = (first > offset) ? first - offset : 0; ++ if (first > offset) { ++ first2 = first - offset; ++ count2 = count; ++ } else { ++ first2 = 0; ++ count2 = count - (offset - first); ++ } + ret = free_hole_blocks(handle, inode, bh, + (__le32 *)bh->b_data, level - 1, +- first2, count - offset, ++ first2, count2, + inode->i_sb->s_blocksize >> 2); + if (ret) { + brelse(bh); +diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c +index f7d7d04674fb..0f9ce13972d0 100644 +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -576,15 +576,6 @@ nfsd4_create(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, + + switch (create->cr_type) { + case NF4LNK: +- /* ugh! we have to null-terminate the linktext, or +- * vfs_symlink() will choke. it is always safe to +- * null-terminate by brute force, since at worst we +- * will overwrite the first byte of the create namelen +- * in the XDR buffer, which has already been extracted +- * during XDR decode. +- */ +- create->cr_linkname[create->cr_linklen] = 0; +- + status = nfsd_symlink(rqstp, &cstate->current_fh, + create->cr_name, create->cr_namelen, + create->cr_linkname, create->cr_linklen, +diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c +index d4890a96421e..9b45f0666cfc 100644 +--- a/fs/nfsd/nfs4xdr.c ++++ b/fs/nfsd/nfs4xdr.c +@@ -553,7 +553,18 @@ nfsd4_decode_create(struct nfsd4_compoundargs *argp, struct nfsd4_create *create + READ_BUF(4); + READ32(create->cr_linklen); + READ_BUF(create->cr_linklen); +- SAVEMEM(create->cr_linkname, create->cr_linklen); ++ /* ++ * The VFS will want a null-terminated string, and ++ * null-terminating in place isn't safe since this might ++ * end on a page boundary: ++ */ ++ create->cr_linkname = ++ kmalloc(create->cr_linklen + 1, GFP_KERNEL); ++ if (!create->cr_linkname) ++ return nfserr_jukebox; ++ memcpy(create->cr_linkname, p, create->cr_linklen); ++ create->cr_linkname[create->cr_linklen] = '\0'; ++ defer_free(argp, kfree, create->cr_linkname); + break; + case NF4BLK: + case NF4CHR: +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 60f49637b4d5..21920add7972 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -1306,7 +1306,6 @@ void tracing_start(void) + + arch_spin_unlock(&ftrace_max_lock); + +- ftrace_start(); + out: + raw_spin_unlock_irqrestore(&global_trace.start_lock, flags); + } +@@ -1353,7 +1352,6 @@ void tracing_stop(void) + struct ring_buffer *buffer; + unsigned long flags; + +- ftrace_stop(); + raw_spin_lock_irqsave(&global_trace.start_lock, flags); + if (global_trace.stop_count++) + goto out; +diff --git a/mm/hugetlb.c b/mm/hugetlb.c +index de73c9d144e1..dbc949c409c7 100644 +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -2328,6 +2328,31 @@ static void set_huge_ptep_writable(struct vm_area_struct *vma, + update_mmu_cache(vma, address, ptep); + } + ++static int is_hugetlb_entry_migration(pte_t pte) ++{ ++ swp_entry_t swp; ++ ++ if (huge_pte_none(pte) || pte_present(pte)) ++ return 0; ++ swp = pte_to_swp_entry(pte); ++ if (non_swap_entry(swp) && is_migration_entry(swp)) ++ return 1; ++ else ++ return 0; ++} ++ ++static int is_hugetlb_entry_hwpoisoned(pte_t pte) ++{ ++ swp_entry_t swp; ++ ++ if (huge_pte_none(pte) || pte_present(pte)) ++ return 0; ++ swp = pte_to_swp_entry(pte); ++ if (non_swap_entry(swp) && is_hwpoison_entry(swp)) ++ return 1; ++ else ++ return 0; ++} + + int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src, + struct vm_area_struct *vma) +@@ -2355,10 +2380,26 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src, + + spin_lock(&dst->page_table_lock); + spin_lock_nested(&src->page_table_lock, SINGLE_DEPTH_NESTING); +- if (!huge_pte_none(huge_ptep_get(src_pte))) { ++ entry = huge_ptep_get(src_pte); ++ if (huge_pte_none(entry)) { /* skip none entry */ ++ ; ++ } else if (unlikely(is_hugetlb_entry_migration(entry) || ++ is_hugetlb_entry_hwpoisoned(entry))) { ++ swp_entry_t swp_entry = pte_to_swp_entry(entry); ++ ++ if (is_write_migration_entry(swp_entry) && cow) { ++ /* ++ * COW mappings require pages in both ++ * parent and child to be set to read. ++ */ ++ make_migration_entry_read(&swp_entry); ++ entry = swp_entry_to_pte(swp_entry); ++ set_huge_pte_at(src, addr, src_pte, entry); ++ } ++ set_huge_pte_at(dst, addr, dst_pte, entry); ++ } else { + if (cow) + huge_ptep_set_wrprotect(src, addr, src_pte); +- entry = huge_ptep_get(src_pte); + ptepage = pte_page(entry); + get_page(ptepage); + page_dup_rmap(ptepage); +@@ -2373,32 +2414,6 @@ nomem: + return -ENOMEM; + } + +-static int is_hugetlb_entry_migration(pte_t pte) +-{ +- swp_entry_t swp; +- +- if (huge_pte_none(pte) || pte_present(pte)) +- return 0; +- swp = pte_to_swp_entry(pte); +- if (non_swap_entry(swp) && is_migration_entry(swp)) +- return 1; +- else +- return 0; +-} +- +-static int is_hugetlb_entry_hwpoisoned(pte_t pte) +-{ +- swp_entry_t swp; +- +- if (huge_pte_none(pte) || pte_present(pte)) +- return 0; +- swp = pte_to_swp_entry(pte); +- if (non_swap_entry(swp) && is_hwpoison_entry(swp)) +- return 1; +- else +- return 0; +-} +- + void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma, + unsigned long start, unsigned long end, + struct page *ref_page) +diff --git a/mm/mempolicy.c b/mm/mempolicy.c +index 6c2dace665aa..1124d5fc06e9 100644 +--- a/mm/mempolicy.c ++++ b/mm/mempolicy.c +@@ -608,19 +608,18 @@ static unsigned long change_prot_numa(struct vm_area_struct *vma, + * If pagelist != NULL then isolate pages from the LRU and + * put them on the pagelist. + */ +-static struct vm_area_struct * ++static int + check_range(struct mm_struct *mm, unsigned long start, unsigned long end, + const nodemask_t *nodes, unsigned long flags, void *private) + { +- int err; +- struct vm_area_struct *first, *vma, *prev; +- ++ int err = 0; ++ struct vm_area_struct *vma, *prev; + +- first = find_vma(mm, start); +- if (!first) +- return ERR_PTR(-EFAULT); ++ vma = find_vma(mm, start); ++ if (!vma) ++ return -EFAULT; + prev = NULL; +- for (vma = first; vma && vma->vm_start < end; vma = vma->vm_next) { ++ for (; vma && vma->vm_start < end; vma = vma->vm_next) { + unsigned long endvma = vma->vm_end; + + if (endvma > end) +@@ -630,9 +629,9 @@ check_range(struct mm_struct *mm, unsigned long start, unsigned long end, + + if (!(flags & MPOL_MF_DISCONTIG_OK)) { + if (!vma->vm_next && vma->vm_end < end) +- return ERR_PTR(-EFAULT); ++ return -EFAULT; + if (prev && prev->vm_end < vma->vm_start) +- return ERR_PTR(-EFAULT); ++ return -EFAULT; + } + + if (is_vm_hugetlb_page(vma)) +@@ -649,15 +648,13 @@ check_range(struct mm_struct *mm, unsigned long start, unsigned long end, + + err = check_pgd_range(vma, start, endvma, nodes, + flags, private); +- if (err) { +- first = ERR_PTR(err); ++ if (err) + break; +- } + } + next: + prev = vma; + } +- return first; ++ return err; + } + + /* +@@ -1138,16 +1135,17 @@ out: + + /* + * Allocate a new page for page migration based on vma policy. +- * Start assuming that page is mapped by vma pointed to by @private. ++ * Start by assuming the page is mapped by the same vma as contains @start. + * Search forward from there, if not. N.B., this assumes that the + * list of pages handed to migrate_pages()--which is how we get here-- + * is in virtual address order. + */ +-static struct page *new_vma_page(struct page *page, unsigned long private, int **x) ++static struct page *new_page(struct page *page, unsigned long start, int **x) + { +- struct vm_area_struct *vma = (struct vm_area_struct *)private; ++ struct vm_area_struct *vma; + unsigned long uninitialized_var(address); + ++ vma = find_vma(current->mm, start); + while (vma) { + address = page_address_in_vma(page, vma); + if (address != -EFAULT) +@@ -1173,7 +1171,7 @@ int do_migrate_pages(struct mm_struct *mm, const nodemask_t *from, + return -ENOSYS; + } + +-static struct page *new_vma_page(struct page *page, unsigned long private, int **x) ++static struct page *new_page(struct page *page, unsigned long start, int **x) + { + return NULL; + } +@@ -1183,7 +1181,6 @@ static long do_mbind(unsigned long start, unsigned long len, + unsigned short mode, unsigned short mode_flags, + nodemask_t *nmask, unsigned long flags) + { +- struct vm_area_struct *vma; + struct mm_struct *mm = current->mm; + struct mempolicy *new; + unsigned long end; +@@ -1249,11 +1246,9 @@ static long do_mbind(unsigned long start, unsigned long len, + if (err) + goto mpol_out; + +- vma = check_range(mm, start, end, nmask, ++ err = check_range(mm, start, end, nmask, + flags | MPOL_MF_INVERT, &pagelist); +- +- err = PTR_ERR(vma); /* maybe ... */ +- if (!IS_ERR(vma)) ++ if (!err) + err = mbind_range(mm, start, end, new); + + if (!err) { +@@ -1261,9 +1256,8 @@ static long do_mbind(unsigned long start, unsigned long len, + + if (!list_empty(&pagelist)) { + WARN_ON_ONCE(flags & MPOL_MF_LAZY); +- nr_failed = migrate_pages(&pagelist, new_vma_page, +- (unsigned long)vma, +- MIGRATE_SYNC, MR_MEMPOLICY_MBIND); ++ nr_failed = migrate_pages(&pagelist, new_page, ++ start, MIGRATE_SYNC, MR_MEMPOLICY_MBIND); + if (nr_failed) + putback_lru_pages(&pagelist); + } +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index 4c51c055d00f..8e7290aea8f8 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -659,7 +659,7 @@ static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type) + /* If we're already encrypted set the REAUTH_PEND flag, + * otherwise set the ENCRYPT_PEND. + */ +- if (conn->key_type != 0xff) ++ if (conn->link_mode & HCI_LM_ENCRYPT) + set_bit(HCI_CONN_REAUTH_PEND, &conn->flags); + else + set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags); +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index ab2ec7c414cb..5daf7ab26710 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -3218,8 +3218,11 @@ static void hci_user_confirm_request_evt(struct hci_dev *hdev, + + /* If we're not the initiators request authorization to + * proceed from user space (mgmt_user_confirm with +- * confirm_hint set to 1). */ +- if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags)) { ++ * confirm_hint set to 1). The exception is if neither ++ * side had MITM in which case we do auto-accept. ++ */ ++ if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ++ (loc_mitm || rem_mitm)) { + BT_DBG("Confirming auto-accept as acceptor"); + confirm_hint = 1; + goto confirm; +diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c +index f8ecbc70293d..8208a13a9837 100644 +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -2333,8 +2333,13 @@ static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev, + } + + if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) { +- /* Continue with pairing via SMP */ ++ /* Continue with pairing via SMP. The hdev lock must be ++ * released as SMP may try to recquire it for crypto ++ * purposes. ++ */ ++ hci_dev_unlock(hdev); + err = smp_user_confirm_reply(conn, mgmt_op, passkey); ++ hci_dev_lock(hdev); + + if (!err) + err = cmd_complete(sk, hdev->id, mgmt_op, +diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c +index 14abcf44f974..2d5b4f65c519 100644 +--- a/net/mac80211/debugfs_netdev.c ++++ b/net/mac80211/debugfs_netdev.c +@@ -34,8 +34,7 @@ static ssize_t ieee80211_if_read( + ssize_t ret = -EINVAL; + + read_lock(&dev_base_lock); +- if (sdata->dev->reg_state == NETREG_REGISTERED) +- ret = (*format)(sdata, buf, sizeof(buf)); ++ ret = (*format)(sdata, buf, sizeof(buf)); + read_unlock(&dev_base_lock); + + if (ret >= 0) +@@ -62,8 +61,7 @@ static ssize_t ieee80211_if_write( + + ret = -ENODEV; + rtnl_lock(); +- if (sdata->dev->reg_state == NETREG_REGISTERED) +- ret = (*write)(sdata, buf, count); ++ ret = (*write)(sdata, buf, count); + rtnl_unlock(); + + return ret; +diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c +index 0418777c361f..557a5760f9f6 100644 +--- a/net/mac80211/sta_info.c ++++ b/net/mac80211/sta_info.c +@@ -270,6 +270,7 @@ void sta_info_free(struct ieee80211_local *local, struct sta_info *sta) + + sta_dbg(sta->sdata, "Destroyed STA %pM\n", sta->sta.addr); + ++ kfree(rcu_dereference_raw(sta->sta.rates)); + kfree(sta); + } + +diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c +index 93b6e32cfead..0d7a872dab36 100644 +--- a/sound/usb/pcm.c ++++ b/sound/usb/pcm.c +@@ -1420,7 +1420,8 @@ static void retire_playback_urb(struct snd_usb_substream *subs, + * on two reads of a counter updated every ms. + */ + if (abs(est_delay - subs->last_delay) * 1000 > runtime->rate * 2) +- snd_printk(KERN_DEBUG "delay: estimated %d, actual %d\n", ++ dev_dbg_ratelimited(&subs->dev->dev, ++ "delay: estimated %d, actual %d\n", + est_delay, subs->last_delay); + + if (!subs->running) { +diff --git a/tools/usb/ffs-test.c b/tools/usb/ffs-test.c +index fe1e66b6ef40..a87e99f37c52 100644 +--- a/tools/usb/ffs-test.c ++++ b/tools/usb/ffs-test.c +@@ -116,8 +116,8 @@ static const struct { + .header = { + .magic = cpu_to_le32(FUNCTIONFS_DESCRIPTORS_MAGIC), + .length = cpu_to_le32(sizeof descriptors), +- .fs_count = 3, +- .hs_count = 3, ++ .fs_count = cpu_to_le32(3), ++ .hs_count = cpu_to_le32(3), + }, + .fs_descs = { + .intf = {
