diff options
| author |   Anthony G. Basile <blueness@gentoo.org> | 2014-09-17 16:02:32 -0400 |
|---|---|---|
| committer | Anthony G. Basile <blueness@gentoo.org> | 2014-09-17 16:02:32 -0400 |
| commit | 7a597d10fb010f8e24f3b37533d578c6c565794e (patch) | |
| tree | 6e28b164cace02016b13f3d433bb4efafae5cd7e | |
| parent | Linux patch 3.14.18 (diff) | |
| download | linux-patches-7a597d10fb010f8e24f3b37533d578c6c565794e.tar.gz linux-patches-7a597d10fb010f8e24f3b37533d578c6c565794e.tar.bz2 linux-patches-7a597d10fb010f8e24f3b37533d578c6c565794e.zip | |
Linux patch 3.14.193.14-23
| -rw-r--r-- | 0000_README | 4 | ||||
| -rw-r--r-- | 1018_linux-3.14.19.patch | 4843 |
2 files changed, 4847 insertions, 0 deletions
diff --git a/0000_README b/0000_README index 39c9ab68..9001c3ab 100644 --- a/0000_README +++ b/0000_README @@ -114,6 +114,10 @@ Patch: 1017_linux-3.14.18.patch From: http://www.kernel.org Desc: Linux 3.14.18 +Patch: 1018_linux-3.14.19.patch +From: http://www.kernel.org +Desc: Linux 3.14.19 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1018_linux-3.14.19.patch b/1018_linux-3.14.19.patch new file mode 100644 index 00000000..3b52b4ab --- /dev/null +++ b/1018_linux-3.14.19.patch @@ -0,0 +1,4843 @@ +diff --git a/Documentation/devicetree/bindings/sound/adi,axi-spdif-tx.txt b/Documentation/devicetree/bindings/sound/adi,axi-spdif-tx.txt +index 46f344965313..4eb7997674a0 100644 +--- a/Documentation/devicetree/bindings/sound/adi,axi-spdif-tx.txt ++++ b/Documentation/devicetree/bindings/sound/adi,axi-spdif-tx.txt +@@ -1,7 +1,7 @@ + ADI AXI-SPDIF controller + + Required properties: +- - compatible : Must be "adi,axi-spdif-1.00.a" ++ - compatible : Must be "adi,axi-spdif-tx-1.00.a" + - reg : Must contain SPDIF core's registers location and length + - clocks : Pairs of phandle and specifier referencing the controller's clocks. + The controller expects two clocks, the clock used for the AXI interface and +diff --git a/Makefile b/Makefile +index 05279d4f44c9..b1746b486646 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 14 +-SUBLEVEL = 18 ++SUBLEVEL = 19 + EXTRAVERSION = + NAME = Remembering Coco + +diff --git a/arch/mips/cavium-octeon/setup.c b/arch/mips/cavium-octeon/setup.c +index 331b837cec57..270cb3c6c498 100644 +--- a/arch/mips/cavium-octeon/setup.c ++++ b/arch/mips/cavium-octeon/setup.c +@@ -458,6 +458,18 @@ static void octeon_halt(void) + octeon_kill_core(NULL); + } + ++static char __read_mostly octeon_system_type[80]; ++ ++static int __init init_octeon_system_type(void) ++{ ++ snprintf(octeon_system_type, sizeof(octeon_system_type), "%s (%s)", ++ cvmx_board_type_to_string(octeon_bootinfo->board_type), ++ octeon_model_get_string(read_c0_prid())); ++ ++ return 0; ++} ++early_initcall(init_octeon_system_type); ++ + /** + * Return a string representing the system type + * +@@ -465,11 +477,7 @@ static void octeon_halt(void) + */ + const char *octeon_board_type_string(void) + { +- static char name[80]; +- sprintf(name, "%s (%s)", +- cvmx_board_type_to_string(octeon_bootinfo->board_type), +- octeon_model_get_string(read_c0_prid())); +- return name; ++ return octeon_system_type; + } + + const char *get_system_type(void) +diff --git a/arch/mips/include/asm/ptrace.h b/arch/mips/include/asm/ptrace.h +index 7bba9da110af..6d019ca1bead 100644 +--- a/arch/mips/include/asm/ptrace.h ++++ b/arch/mips/include/asm/ptrace.h +@@ -23,7 +23,7 @@ + struct pt_regs { + #ifdef CONFIG_32BIT + /* Pad bytes for argument save space on the stack. */ +- unsigned long pad0[6]; ++ unsigned long pad0[8]; + #endif + + /* Saved main processor registers. */ +diff --git a/arch/mips/include/asm/reg.h b/arch/mips/include/asm/reg.h +index 910e71a12466..b8343ccbc989 100644 +--- a/arch/mips/include/asm/reg.h ++++ b/arch/mips/include/asm/reg.h +@@ -12,116 +12,194 @@ + #ifndef __ASM_MIPS_REG_H + #define __ASM_MIPS_REG_H + +- +-#if defined(CONFIG_32BIT) || defined(WANT_COMPAT_REG_H) +- +-#define EF_R0 6 +-#define EF_R1 7 +-#define EF_R2 8 +-#define EF_R3 9 +-#define EF_R4 10 +-#define EF_R5 11 +-#define EF_R6 12 +-#define EF_R7 13 +-#define EF_R8 14 +-#define EF_R9 15 +-#define EF_R10 16 +-#define EF_R11 17 +-#define EF_R12 18 +-#define EF_R13 19 +-#define EF_R14 20 +-#define EF_R15 21 +-#define EF_R16 22 +-#define EF_R17 23 +-#define EF_R18 24 +-#define EF_R19 25 +-#define EF_R20 26 +-#define EF_R21 27 +-#define EF_R22 28 +-#define EF_R23 29 +-#define EF_R24 30 +-#define EF_R25 31 ++#define MIPS32_EF_R0 6 ++#define MIPS32_EF_R1 7 ++#define MIPS32_EF_R2 8 ++#define MIPS32_EF_R3 9 ++#define MIPS32_EF_R4 10 ++#define MIPS32_EF_R5 11 ++#define MIPS32_EF_R6 12 ++#define MIPS32_EF_R7 13 ++#define MIPS32_EF_R8 14 ++#define MIPS32_EF_R9 15 ++#define MIPS32_EF_R10 16 ++#define MIPS32_EF_R11 17 ++#define MIPS32_EF_R12 18 ++#define MIPS32_EF_R13 19 ++#define MIPS32_EF_R14 20 ++#define MIPS32_EF_R15 21 ++#define MIPS32_EF_R16 22 ++#define MIPS32_EF_R17 23 ++#define MIPS32_EF_R18 24 ++#define MIPS32_EF_R19 25 ++#define MIPS32_EF_R20 26 ++#define MIPS32_EF_R21 27 ++#define MIPS32_EF_R22 28 ++#define MIPS32_EF_R23 29 ++#define MIPS32_EF_R24 30 ++#define MIPS32_EF_R25 31 + + /* + * k0/k1 unsaved + */ +-#define EF_R26 32 +-#define EF_R27 33 ++#define MIPS32_EF_R26 32 ++#define MIPS32_EF_R27 33 + +-#define EF_R28 34 +-#define EF_R29 35 +-#define EF_R30 36 +-#define EF_R31 37 ++#define MIPS32_EF_R28 34 ++#define MIPS32_EF_R29 35 ++#define MIPS32_EF_R30 36 ++#define MIPS32_EF_R31 37 + + /* + * Saved special registers + */ +-#define EF_LO 38 +-#define EF_HI 39 +- +-#define EF_CP0_EPC 40 +-#define EF_CP0_BADVADDR 41 +-#define EF_CP0_STATUS 42 +-#define EF_CP0_CAUSE 43 +-#define EF_UNUSED0 44 +- +-#define EF_SIZE 180 +- +-#endif +- +-#if defined(CONFIG_64BIT) && !defined(WANT_COMPAT_REG_H) +- +-#define EF_R0 0 +-#define EF_R1 1 +-#define EF_R2 2 +-#define EF_R3 3 +-#define EF_R4 4 +-#define EF_R5 5 +-#define EF_R6 6 +-#define EF_R7 7 +-#define EF_R8 8 +-#define EF_R9 9 +-#define EF_R10 10 +-#define EF_R11 11 +-#define EF_R12 12 +-#define EF_R13 13 +-#define EF_R14 14 +-#define EF_R15 15 +-#define EF_R16 16 +-#define EF_R17 17 +-#define EF_R18 18 +-#define EF_R19 19 +-#define EF_R20 20 +-#define EF_R21 21 +-#define EF_R22 22 +-#define EF_R23 23 +-#define EF_R24 24 +-#define EF_R25 25 ++#define MIPS32_EF_LO 38 ++#define MIPS32_EF_HI 39 ++ ++#define MIPS32_EF_CP0_EPC 40 ++#define MIPS32_EF_CP0_BADVADDR 41 ++#define MIPS32_EF_CP0_STATUS 42 ++#define MIPS32_EF_CP0_CAUSE 43 ++#define MIPS32_EF_UNUSED0 44 ++ ++#define MIPS32_EF_SIZE 180 ++ ++#define MIPS64_EF_R0 0 ++#define MIPS64_EF_R1 1 ++#define MIPS64_EF_R2 2 ++#define MIPS64_EF_R3 3 ++#define MIPS64_EF_R4 4 ++#define MIPS64_EF_R5 5 ++#define MIPS64_EF_R6 6 ++#define MIPS64_EF_R7 7 ++#define MIPS64_EF_R8 8 ++#define MIPS64_EF_R9 9 ++#define MIPS64_EF_R10 10 ++#define MIPS64_EF_R11 11 ++#define MIPS64_EF_R12 12 ++#define MIPS64_EF_R13 13 ++#define MIPS64_EF_R14 14 ++#define MIPS64_EF_R15 15 ++#define MIPS64_EF_R16 16 ++#define MIPS64_EF_R17 17 ++#define MIPS64_EF_R18 18 ++#define MIPS64_EF_R19 19 ++#define MIPS64_EF_R20 20 ++#define MIPS64_EF_R21 21 ++#define MIPS64_EF_R22 22 ++#define MIPS64_EF_R23 23 ++#define MIPS64_EF_R24 24 ++#define MIPS64_EF_R25 25 + + /* + * k0/k1 unsaved + */ +-#define EF_R26 26 +-#define EF_R27 27 ++#define MIPS64_EF_R26 26 ++#define MIPS64_EF_R27 27 + + +-#define EF_R28 28 +-#define EF_R29 29 +-#define EF_R30 30 +-#define EF_R31 31 ++#define MIPS64_EF_R28 28 ++#define MIPS64_EF_R29 29 ++#define MIPS64_EF_R30 30 ++#define MIPS64_EF_R31 31 + + /* + * Saved special registers + */ +-#define EF_LO 32 +-#define EF_HI 33 +- +-#define EF_CP0_EPC 34 +-#define EF_CP0_BADVADDR 35 +-#define EF_CP0_STATUS 36 +-#define EF_CP0_CAUSE 37 +- +-#define EF_SIZE 304 /* size in bytes */ ++#define MIPS64_EF_LO 32 ++#define MIPS64_EF_HI 33 ++ ++#define MIPS64_EF_CP0_EPC 34 ++#define MIPS64_EF_CP0_BADVADDR 35 ++#define MIPS64_EF_CP0_STATUS 36 ++#define MIPS64_EF_CP0_CAUSE 37 ++ ++#define MIPS64_EF_SIZE 304 /* size in bytes */ ++ ++#if defined(CONFIG_32BIT) ++ ++#define EF_R0 MIPS32_EF_R0 ++#define EF_R1 MIPS32_EF_R1 ++#define EF_R2 MIPS32_EF_R2 ++#define EF_R3 MIPS32_EF_R3 ++#define EF_R4 MIPS32_EF_R4 ++#define EF_R5 MIPS32_EF_R5 ++#define EF_R6 MIPS32_EF_R6 ++#define EF_R7 MIPS32_EF_R7 ++#define EF_R8 MIPS32_EF_R8 ++#define EF_R9 MIPS32_EF_R9 ++#define EF_R10 MIPS32_EF_R10 ++#define EF_R11 MIPS32_EF_R11 ++#define EF_R12 MIPS32_EF_R12 ++#define EF_R13 MIPS32_EF_R13 ++#define EF_R14 MIPS32_EF_R14 ++#define EF_R15 MIPS32_EF_R15 ++#define EF_R16 MIPS32_EF_R16 ++#define EF_R17 MIPS32_EF_R17 ++#define EF_R18 MIPS32_EF_R18 ++#define EF_R19 MIPS32_EF_R19 ++#define EF_R20 MIPS32_EF_R20 ++#define EF_R21 MIPS32_EF_R21 ++#define EF_R22 MIPS32_EF_R22 ++#define EF_R23 MIPS32_EF_R23 ++#define EF_R24 MIPS32_EF_R24 ++#define EF_R25 MIPS32_EF_R25 ++#define EF_R26 MIPS32_EF_R26 ++#define EF_R27 MIPS32_EF_R27 ++#define EF_R28 MIPS32_EF_R28 ++#define EF_R29 MIPS32_EF_R29 ++#define EF_R30 MIPS32_EF_R30 ++#define EF_R31 MIPS32_EF_R31 ++#define EF_LO MIPS32_EF_LO ++#define EF_HI MIPS32_EF_HI ++#define EF_CP0_EPC MIPS32_EF_CP0_EPC ++#define EF_CP0_BADVADDR MIPS32_EF_CP0_BADVADDR ++#define EF_CP0_STATUS MIPS32_EF_CP0_STATUS ++#define EF_CP0_CAUSE MIPS32_EF_CP0_CAUSE ++#define EF_UNUSED0 MIPS32_EF_UNUSED0 ++#define EF_SIZE MIPS32_EF_SIZE ++ ++#elif defined(CONFIG_64BIT) ++ ++#define EF_R0 MIPS64_EF_R0 ++#define EF_R1 MIPS64_EF_R1 ++#define EF_R2 MIPS64_EF_R2 ++#define EF_R3 MIPS64_EF_R3 ++#define EF_R4 MIPS64_EF_R4 ++#define EF_R5 MIPS64_EF_R5 ++#define EF_R6 MIPS64_EF_R6 ++#define EF_R7 MIPS64_EF_R7 ++#define EF_R8 MIPS64_EF_R8 ++#define EF_R9 MIPS64_EF_R9 ++#define EF_R10 MIPS64_EF_R10 ++#define EF_R11 MIPS64_EF_R11 ++#define EF_R12 MIPS64_EF_R12 ++#define EF_R13 MIPS64_EF_R13 ++#define EF_R14 MIPS64_EF_R14 ++#define EF_R15 MIPS64_EF_R15 ++#define EF_R16 MIPS64_EF_R16 ++#define EF_R17 MIPS64_EF_R17 ++#define EF_R18 MIPS64_EF_R18 ++#define EF_R19 MIPS64_EF_R19 ++#define EF_R20 MIPS64_EF_R20 ++#define EF_R21 MIPS64_EF_R21 ++#define EF_R22 MIPS64_EF_R22 ++#define EF_R23 MIPS64_EF_R23 ++#define EF_R24 MIPS64_EF_R24 ++#define EF_R25 MIPS64_EF_R25 ++#define EF_R26 MIPS64_EF_R26 ++#define EF_R27 MIPS64_EF_R27 ++#define EF_R28 MIPS64_EF_R28 ++#define EF_R29 MIPS64_EF_R29 ++#define EF_R30 MIPS64_EF_R30 ++#define EF_R31 MIPS64_EF_R31 ++#define EF_LO MIPS64_EF_LO ++#define EF_HI MIPS64_EF_HI ++#define EF_CP0_EPC MIPS64_EF_CP0_EPC ++#define EF_CP0_BADVADDR MIPS64_EF_CP0_BADVADDR ++#define EF_CP0_STATUS MIPS64_EF_CP0_STATUS ++#define EF_CP0_CAUSE MIPS64_EF_CP0_CAUSE ++#define EF_SIZE MIPS64_EF_SIZE + + #endif /* CONFIG_64BIT */ + +diff --git a/arch/mips/kernel/binfmt_elfo32.c b/arch/mips/kernel/binfmt_elfo32.c +index 7faf5f2bee25..71df942fb77c 100644 +--- a/arch/mips/kernel/binfmt_elfo32.c ++++ b/arch/mips/kernel/binfmt_elfo32.c +@@ -72,12 +72,6 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG]; + + #include <asm/processor.h> + +-/* +- * When this file is selected, we are definitely running a 64bit kernel. +- * So using the right regs define in asm/reg.h +- */ +-#define WANT_COMPAT_REG_H +- + /* These MUST be defined before elf.h gets included */ + extern void elf32_core_copy_regs(elf_gregset_t grp, struct pt_regs *regs); + #define ELF_CORE_COPY_REGS(_dest, _regs) elf32_core_copy_regs(_dest, _regs); +@@ -149,21 +143,21 @@ void elf32_core_copy_regs(elf_gregset_t grp, struct pt_regs *regs) + { + int i; + +- for (i = 0; i < EF_R0; i++) ++ for (i = 0; i < MIPS32_EF_R0; i++) + grp[i] = 0; +- grp[EF_R0] = 0; ++ grp[MIPS32_EF_R0] = 0; + for (i = 1; i <= 31; i++) +- grp[EF_R0 + i] = (elf_greg_t) regs->regs[i]; +- grp[EF_R26] = 0; +- grp[EF_R27] = 0; +- grp[EF_LO] = (elf_greg_t) regs->lo; +- grp[EF_HI] = (elf_greg_t) regs->hi; +- grp[EF_CP0_EPC] = (elf_greg_t) regs->cp0_epc; +- grp[EF_CP0_BADVADDR] = (elf_greg_t) regs->cp0_badvaddr; +- grp[EF_CP0_STATUS] = (elf_greg_t) regs->cp0_status; +- grp[EF_CP0_CAUSE] = (elf_greg_t) regs->cp0_cause; +-#ifdef EF_UNUSED0 +- grp[EF_UNUSED0] = 0; ++ grp[MIPS32_EF_R0 + i] = (elf_greg_t) regs->regs[i]; ++ grp[MIPS32_EF_R26] = 0; ++ grp[MIPS32_EF_R27] = 0; ++ grp[MIPS32_EF_LO] = (elf_greg_t) regs->lo; ++ grp[MIPS32_EF_HI] = (elf_greg_t) regs->hi; ++ grp[MIPS32_EF_CP0_EPC] = (elf_greg_t) regs->cp0_epc; ++ grp[MIPS32_EF_CP0_BADVADDR] = (elf_greg_t) regs->cp0_badvaddr; ++ grp[MIPS32_EF_CP0_STATUS] = (elf_greg_t) regs->cp0_status; ++ grp[MIPS32_EF_CP0_CAUSE] = (elf_greg_t) regs->cp0_cause; ++#ifdef MIPS32_EF_UNUSED0 ++ grp[MIPS32_EF_UNUSED0] = 0; + #endif + } + +diff --git a/arch/mips/kernel/irq-gic.c b/arch/mips/kernel/irq-gic.c +index 5b5ddb231f26..78f18436cdf2 100644 +--- a/arch/mips/kernel/irq-gic.c ++++ b/arch/mips/kernel/irq-gic.c +@@ -255,11 +255,13 @@ static void __init gic_setup_intr(unsigned int intr, unsigned int cpu, + + /* Setup Intr to Pin mapping */ + if (pin & GIC_MAP_TO_NMI_MSK) { ++ int i; ++ + GICWRITE(GIC_REG_ADDR(SHARED, GIC_SH_MAP_TO_PIN(intr)), pin); + /* FIXME: hack to route NMI to all cpu's */ +- for (cpu = 0; cpu < NR_CPUS; cpu += 32) { ++ for (i = 0; i < NR_CPUS; i += 32) { + GICWRITE(GIC_REG_ADDR(SHARED, +- GIC_SH_MAP_TO_VPE_REG_OFF(intr, cpu)), ++ GIC_SH_MAP_TO_VPE_REG_OFF(intr, i)), + 0xffffffff); + } + } else { +diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c +index 7da9b76db4d9..60f48febe762 100644 +--- a/arch/mips/kernel/ptrace.c ++++ b/arch/mips/kernel/ptrace.c +@@ -170,6 +170,7 @@ int ptrace_setfpregs(struct task_struct *child, __u32 __user *data) + __get_user(fregs[i], i + (__u64 __user *) data); + + __get_user(child->thread.fpu.fcr31, data + 64); ++ child->thread.fpu.fcr31 &= ~FPU_CSR_ALL_X; + + /* FIR may not be written. */ + +@@ -265,36 +266,160 @@ int ptrace_set_watch_regs(struct task_struct *child, + + /* regset get/set implementations */ + +-static int gpr_get(struct task_struct *target, +- const struct user_regset *regset, +- unsigned int pos, unsigned int count, +- void *kbuf, void __user *ubuf) ++#if defined(CONFIG_32BIT) || defined(CONFIG_MIPS32_O32) ++ ++static int gpr32_get(struct task_struct *target, ++ const struct user_regset *regset, ++ unsigned int pos, unsigned int count, ++ void *kbuf, void __user *ubuf) + { + struct pt_regs *regs = task_pt_regs(target); ++ u32 uregs[ELF_NGREG] = {}; ++ unsigned i; + +- return user_regset_copyout(&pos, &count, &kbuf, &ubuf, +- regs, 0, sizeof(*regs)); ++ for (i = MIPS32_EF_R1; i <= MIPS32_EF_R31; i++) { ++ /* k0/k1 are copied as zero. */ ++ if (i == MIPS32_EF_R26 || i == MIPS32_EF_R27) ++ continue; ++ ++ uregs[i] = regs->regs[i - MIPS32_EF_R0]; ++ } ++ ++ uregs[MIPS32_EF_LO] = regs->lo; ++ uregs[MIPS32_EF_HI] = regs->hi; ++ uregs[MIPS32_EF_CP0_EPC] = regs->cp0_epc; ++ uregs[MIPS32_EF_CP0_BADVADDR] = regs->cp0_badvaddr; ++ uregs[MIPS32_EF_CP0_STATUS] = regs->cp0_status; ++ uregs[MIPS32_EF_CP0_CAUSE] = regs->cp0_cause; ++ ++ return user_regset_copyout(&pos, &count, &kbuf, &ubuf, uregs, 0, ++ sizeof(uregs)); + } + +-static int gpr_set(struct task_struct *target, +- const struct user_regset *regset, +- unsigned int pos, unsigned int count, +- const void *kbuf, const void __user *ubuf) ++static int gpr32_set(struct task_struct *target, ++ const struct user_regset *regset, ++ unsigned int pos, unsigned int count, ++ const void *kbuf, const void __user *ubuf) + { +- struct pt_regs newregs; +- int ret; ++ struct pt_regs *regs = task_pt_regs(target); ++ u32 uregs[ELF_NGREG]; ++ unsigned start, num_regs, i; ++ int err; + +- ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, +- &newregs, +- 0, sizeof(newregs)); +- if (ret) +- return ret; ++ start = pos / sizeof(u32); ++ num_regs = count / sizeof(u32); + +- *task_pt_regs(target) = newregs; ++ if (start + num_regs > ELF_NGREG) ++ return -EIO; ++ ++ err = user_regset_copyin(&pos, &count, &kbuf, &ubuf, uregs, 0, ++ sizeof(uregs)); ++ if (err) ++ return err; ++ ++ for (i = start; i < num_regs; i++) { ++ /* ++ * Cast all values to signed here so that if this is a 64-bit ++ * kernel, the supplied 32-bit values will be sign extended. ++ */ ++ switch (i) { ++ case MIPS32_EF_R1 ... MIPS32_EF_R25: ++ /* k0/k1 are ignored. */ ++ case MIPS32_EF_R28 ... MIPS32_EF_R31: ++ regs->regs[i - MIPS32_EF_R0] = (s32)uregs[i]; ++ break; ++ case MIPS32_EF_LO: ++ regs->lo = (s32)uregs[i]; ++ break; ++ case MIPS32_EF_HI: ++ regs->hi = (s32)uregs[i]; ++ break; ++ case MIPS32_EF_CP0_EPC: ++ regs->cp0_epc = (s32)uregs[i]; ++ break; ++ } ++ } + + return 0; + } + ++#endif /* CONFIG_32BIT || CONFIG_MIPS32_O32 */ ++ ++#ifdef CONFIG_64BIT ++ ++static int gpr64_get(struct task_struct *target, ++ const struct user_regset *regset, ++ unsigned int pos, unsigned int count, ++ void *kbuf, void __user *ubuf) ++{ ++ struct pt_regs *regs = task_pt_regs(target); ++ u64 uregs[ELF_NGREG] = {}; ++ unsigned i; ++ ++ for (i = MIPS64_EF_R1; i <= MIPS64_EF_R31; i++) { ++ /* k0/k1 are copied as zero. */ ++ if (i == MIPS64_EF_R26 || i == MIPS64_EF_R27) ++ continue; ++ ++ uregs[i] = regs->regs[i - MIPS64_EF_R0]; ++ } ++ ++ uregs[MIPS64_EF_LO] = regs->lo; ++ uregs[MIPS64_EF_HI] = regs->hi; ++ uregs[MIPS64_EF_CP0_EPC] = regs->cp0_epc; ++ uregs[MIPS64_EF_CP0_BADVADDR] = regs->cp0_badvaddr; ++ uregs[MIPS64_EF_CP0_STATUS] = regs->cp0_status; ++ uregs[MIPS64_EF_CP0_CAUSE] = regs->cp0_cause; ++ ++ return user_regset_copyout(&pos, &count, &kbuf, &ubuf, uregs, 0, ++ sizeof(uregs)); ++} ++ ++static int gpr64_set(struct task_struct *target, ++ const struct user_regset *regset, ++ unsigned int pos, unsigned int count, ++ const void *kbuf, const void __user *ubuf) ++{ ++ struct pt_regs *regs = task_pt_regs(target); ++ u64 uregs[ELF_NGREG]; ++ unsigned start, num_regs, i; ++ int err; ++ ++ start = pos / sizeof(u64); ++ num_regs = count / sizeof(u64); ++ ++ if (start + num_regs > ELF_NGREG) ++ return -EIO; ++ ++ err = user_regset_copyin(&pos, &count, &kbuf, &ubuf, uregs, 0, ++ sizeof(uregs)); ++ if (err) ++ return err; ++ ++ for (i = start; i < num_regs; i++) { ++ switch (i) { ++ case MIPS64_EF_R1 ... MIPS64_EF_R25: ++ /* k0/k1 are ignored. */ ++ case MIPS64_EF_R28 ... MIPS64_EF_R31: ++ regs->regs[i - MIPS64_EF_R0] = uregs[i]; ++ break; ++ case MIPS64_EF_LO: ++ regs->lo = uregs[i]; ++ break; ++ case MIPS64_EF_HI: ++ regs->hi = uregs[i]; ++ break; ++ case MIPS64_EF_CP0_EPC: ++ regs->cp0_epc = uregs[i]; ++ break; ++ } ++ } ++ ++ return 0; ++} ++ ++#endif /* CONFIG_64BIT */ ++ + static int fpr_get(struct task_struct *target, + const struct user_regset *regset, + unsigned int pos, unsigned int count, +@@ -322,14 +447,16 @@ enum mips_regset { + REGSET_FPR, + }; + ++#if defined(CONFIG_32BIT) || defined(CONFIG_MIPS32_O32) ++ + static const struct user_regset mips_regsets[] = { + [REGSET_GPR] = { + .core_note_type = NT_PRSTATUS, + .n = ELF_NGREG, + .size = sizeof(unsigned int), + .align = sizeof(unsigned int), +- .get = gpr_get, +- .set = gpr_set, ++ .get = gpr32_get, ++ .set = gpr32_set, + }, + [REGSET_FPR] = { + .core_note_type = NT_PRFPREG, +@@ -349,14 +476,18 @@ static const struct user_regset_view user_mips_view = { + .n = ARRAY_SIZE(mips_regsets), + }; + ++#endif /* CONFIG_32BIT || CONFIG_MIPS32_O32 */ ++ ++#ifdef CONFIG_64BIT ++ + static const struct user_regset mips64_regsets[] = { + [REGSET_GPR] = { + .core_note_type = NT_PRSTATUS, + .n = ELF_NGREG, + .size = sizeof(unsigned long), + .align = sizeof(unsigned long), +- .get = gpr_get, +- .set = gpr_set, ++ .get = gpr64_get, ++ .set = gpr64_set, + }, + [REGSET_FPR] = { + .core_note_type = NT_PRFPREG, +@@ -369,25 +500,26 @@ static const struct user_regset mips64_regsets[] = { + }; + + static const struct user_regset_view user_mips64_view = { +- .name = "mips", ++ .name = "mips64", + .e_machine = ELF_ARCH, + .ei_osabi = ELF_OSABI, + .regsets = mips64_regsets, +- .n = ARRAY_SIZE(mips_regsets), ++ .n = ARRAY_SIZE(mips64_regsets), + }; + ++#endif /* CONFIG_64BIT */ ++ + const struct user_regset_view *task_user_regset_view(struct task_struct *task) + { + #ifdef CONFIG_32BIT + return &user_mips_view; +-#endif +- ++#else + #ifdef CONFIG_MIPS32_O32 +- if (test_thread_flag(TIF_32BIT_REGS)) +- return &user_mips_view; ++ if (test_tsk_thread_flag(task, TIF_32BIT_REGS)) ++ return &user_mips_view; + #endif +- + return &user_mips64_view; ++#endif + } + + long arch_ptrace(struct task_struct *child, long request, +@@ -593,7 +725,7 @@ long arch_ptrace(struct task_struct *child, long request, + break; + #endif + case FPC_CSR: +- child->thread.fpu.fcr31 = data; ++ child->thread.fpu.fcr31 = data & ~FPU_CSR_ALL_X; + break; + case DSP_BASE ... DSP_BASE + 5: { + dspreg_t *dregs; +diff --git a/arch/mips/kernel/unaligned.c b/arch/mips/kernel/unaligned.c +index c369a5d35527..b897dde93e7a 100644 +--- a/arch/mips/kernel/unaligned.c ++++ b/arch/mips/kernel/unaligned.c +@@ -605,7 +605,6 @@ static void emulate_load_store_insn(struct pt_regs *regs, + case sdc1_op: + die_if_kernel("Unaligned FP access in kernel code", regs); + BUG_ON(!used_math()); +- BUG_ON(!is_fpu_owner()); + + lose_fpu(1); /* Save FPU state for the emulator. */ + res = fpu_emulator_cop1Handler(regs, ¤t->thread.fpu, 1, +diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c +index b234b1b5ccad..65d452aa1fda 100644 +--- a/arch/mips/mm/tlbex.c ++++ b/arch/mips/mm/tlbex.c +@@ -1295,6 +1295,7 @@ static void build_r4000_tlb_refill_handler(void) + } + #ifdef CONFIG_MIPS_HUGE_TLB_SUPPORT + uasm_l_tlb_huge_update(&l, p); ++ UASM_i_LW(&p, K0, 0, K1); + build_huge_update_entries(&p, htlb_info.huge_pte, K1); + build_huge_tlb_write_entry(&p, &l, &r, K0, tlb_random, + htlb_info.restore_scratch); +diff --git a/arch/powerpc/include/asm/machdep.h b/arch/powerpc/include/asm/machdep.h +index ad3025d0880b..f20786825b8f 100644 +--- a/arch/powerpc/include/asm/machdep.h ++++ b/arch/powerpc/include/asm/machdep.h +@@ -57,10 +57,10 @@ struct machdep_calls { + void (*hpte_removebolted)(unsigned long ea, + int psize, int ssize); + void (*flush_hash_range)(unsigned long number, int local); +- void (*hugepage_invalidate)(struct mm_struct *mm, ++ void (*hugepage_invalidate)(unsigned long vsid, ++ unsigned long addr, + unsigned char *hpte_slot_array, +- unsigned long addr, int psize); +- ++ int psize, int ssize); + /* special for kexec, to be called in real mode, linear mapping is + * destroyed as well */ + void (*hpte_clear_all)(void); +diff --git a/arch/powerpc/include/asm/pgtable-ppc64.h b/arch/powerpc/include/asm/pgtable-ppc64.h +index eb9261024f51..7b3d54fae46f 100644 +--- a/arch/powerpc/include/asm/pgtable-ppc64.h ++++ b/arch/powerpc/include/asm/pgtable-ppc64.h +@@ -413,7 +413,7 @@ static inline char *get_hpte_slot_array(pmd_t *pmdp) + } + + extern void hpte_do_hugepage_flush(struct mm_struct *mm, unsigned long addr, +- pmd_t *pmdp); ++ pmd_t *pmdp, unsigned long old_pmd); + #ifdef CONFIG_TRANSPARENT_HUGEPAGE + extern pmd_t pfn_pmd(unsigned long pfn, pgprot_t pgprot); + extern pmd_t mk_pmd(struct page *page, pgprot_t pgprot); +diff --git a/arch/powerpc/include/asm/pte-hash64-64k.h b/arch/powerpc/include/asm/pte-hash64-64k.h +index d836d945068d..9ecede1e124c 100644 +--- a/arch/powerpc/include/asm/pte-hash64-64k.h ++++ b/arch/powerpc/include/asm/pte-hash64-64k.h +@@ -46,11 +46,31 @@ + * in order to deal with 64K made of 4K HW pages. Thus we override the + * generic accessors and iterators here + */ +-#define __real_pte(e,p) ((real_pte_t) { \ +- (e), (pte_val(e) & _PAGE_COMBO) ? \ +- (pte_val(*((p) + PTRS_PER_PTE))) : 0 }) +-#define __rpte_to_hidx(r,index) ((pte_val((r).pte) & _PAGE_COMBO) ? \ +- (((r).hidx >> ((index)<<2)) & 0xf) : ((pte_val((r).pte) >> 12) & 0xf)) ++#define __real_pte __real_pte ++static inline real_pte_t __real_pte(pte_t pte, pte_t *ptep) ++{ ++ real_pte_t rpte; ++ ++ rpte.pte = pte; ++ rpte.hidx = 0; ++ if (pte_val(pte) & _PAGE_COMBO) { ++ /* ++ * Make sure we order the hidx load against the _PAGE_COMBO ++ * check. The store side ordering is done in __hash_page_4K ++ */ ++ smp_rmb(); ++ rpte.hidx = pte_val(*((ptep) + PTRS_PER_PTE)); ++ } ++ return rpte; ++} ++ ++static inline unsigned long __rpte_to_hidx(real_pte_t rpte, unsigned long index) ++{ ++ if ((pte_val(rpte.pte) & _PAGE_COMBO)) ++ return (rpte.hidx >> (index<<2)) & 0xf; ++ return (pte_val(rpte.pte) >> 12) & 0xf; ++} ++ + #define __rpte_to_pte(r) ((r).pte) + #define __rpte_sub_valid(rpte, index) \ + (pte_val(rpte.pte) & (_PAGE_HPTE_SUB0 >> (index))) +diff --git a/arch/powerpc/mm/hash_native_64.c b/arch/powerpc/mm/hash_native_64.c +index 3ea26c25590b..838de8e17dc5 100644 +--- a/arch/powerpc/mm/hash_native_64.c ++++ b/arch/powerpc/mm/hash_native_64.c +@@ -418,18 +418,18 @@ static void native_hpte_invalidate(unsigned long slot, unsigned long vpn, + local_irq_restore(flags); + } + +-static void native_hugepage_invalidate(struct mm_struct *mm, ++static void native_hugepage_invalidate(unsigned long vsid, ++ unsigned long addr, + unsigned char *hpte_slot_array, +- unsigned long addr, int psize) ++ int psize, int ssize) + { +- int ssize = 0, i; +- int lock_tlbie; ++ int i; + struct hash_pte *hptep; + int actual_psize = MMU_PAGE_16M; + unsigned int max_hpte_count, valid; + unsigned long flags, s_addr = addr; + unsigned long hpte_v, want_v, shift; +- unsigned long hidx, vpn = 0, vsid, hash, slot; ++ unsigned long hidx, vpn = 0, hash, slot; + + shift = mmu_psize_defs[psize].shift; + max_hpte_count = 1U << (PMD_SHIFT - shift); +@@ -443,15 +443,6 @@ static void native_hugepage_invalidate(struct mm_struct *mm, + + /* get the vpn */ + addr = s_addr + (i * (1ul << shift)); +- if (!is_kernel_addr(addr)) { +- ssize = user_segment_size(addr); +- vsid = get_vsid(mm->context.id, addr, ssize); +- WARN_ON(vsid == 0); +- } else { +- vsid = get_kernel_vsid(addr, mmu_kernel_ssize); +- ssize = mmu_kernel_ssize; +- } +- + vpn = hpt_vpn(addr, vsid, ssize); + hash = hpt_hash(vpn, shift, ssize); + if (hidx & _PTEIDX_SECONDARY) +@@ -471,22 +462,13 @@ static void native_hugepage_invalidate(struct mm_struct *mm, + else + /* Invalidate the hpte. NOTE: this also unlocks it */ + hptep->v = 0; ++ /* ++ * We need to do tlb invalidate for all the address, tlbie ++ * instruction compares entry_VA in tlb with the VA specified ++ * here ++ */ ++ tlbie(vpn, psize, actual_psize, ssize, 0); + } +- /* +- * Since this is a hugepage, we just need a single tlbie. +- * use the last vpn. +- */ +- lock_tlbie = !mmu_has_feature(MMU_FTR_LOCKLESS_TLBIE); +- if (lock_tlbie) +- raw_spin_lock(&native_tlbie_lock); +- +- asm volatile("ptesync":::"memory"); +- __tlbie(vpn, psize, actual_psize, ssize); +- asm volatile("eieio; tlbsync; ptesync":::"memory"); +- +- if (lock_tlbie) +- raw_spin_unlock(&native_tlbie_lock); +- + local_irq_restore(flags); + } + +diff --git a/arch/powerpc/mm/hugepage-hash64.c b/arch/powerpc/mm/hugepage-hash64.c +index 826893fcb3a7..5f5e6328c21c 100644 +--- a/arch/powerpc/mm/hugepage-hash64.c ++++ b/arch/powerpc/mm/hugepage-hash64.c +@@ -18,6 +18,57 @@ + #include <linux/mm.h> + #include <asm/machdep.h> + ++static void invalidate_old_hpte(unsigned long vsid, unsigned long addr, ++ pmd_t *pmdp, unsigned int psize, int ssize) ++{ ++ int i, max_hpte_count, valid; ++ unsigned long s_addr; ++ unsigned char *hpte_slot_array; ++ unsigned long hidx, shift, vpn, hash, slot; ++ ++ s_addr = addr & HPAGE_PMD_MASK; ++ hpte_slot_array = get_hpte_slot_array(pmdp); ++ /* ++ * IF we try to do a HUGE PTE update after a withdraw is done. ++ * we will find the below NULL. This happens when we do ++ * split_huge_page_pmd ++ */ ++ if (!hpte_slot_array) ++ return; ++ ++ if (ppc_md.hugepage_invalidate) ++ return ppc_md.hugepage_invalidate(vsid, s_addr, hpte_slot_array, ++ psize, ssize); ++ /* ++ * No bluk hpte removal support, invalidate each entry ++ */ ++ shift = mmu_psize_defs[psize].shift; ++ max_hpte_count = HPAGE_PMD_SIZE >> shift; ++ for (i = 0; i < max_hpte_count; i++) { ++ /* ++ * 8 bits per each hpte entries ++ * 000| [ secondary group (one bit) | hidx (3 bits) | valid bit] ++ */ ++ valid = hpte_valid(hpte_slot_array, i); ++ if (!valid) ++ continue; ++ hidx = hpte_hash_index(hpte_slot_array, i); ++ ++ /* get the vpn */ ++ addr = s_addr + (i * (1ul << shift)); ++ vpn = hpt_vpn(addr, vsid, ssize); ++ hash = hpt_hash(vpn, shift, ssize); ++ if (hidx & _PTEIDX_SECONDARY) ++ hash = ~hash; ++ ++ slot = (hash & htab_hash_mask) * HPTES_PER_GROUP; ++ slot += hidx & _PTEIDX_GROUP_IX; ++ ppc_md.hpte_invalidate(slot, vpn, psize, ++ MMU_PAGE_16M, ssize, 0); ++ } ++} ++ ++ + int __hash_page_thp(unsigned long ea, unsigned long access, unsigned long vsid, + pmd_t *pmdp, unsigned long trap, int local, int ssize, + unsigned int psize) +@@ -33,7 +84,9 @@ int __hash_page_thp(unsigned long ea, unsigned long access, unsigned long vsid, + * atomically mark the linux large page PMD busy and dirty + */ + do { +- old_pmd = pmd_val(*pmdp); ++ pmd_t pmd = ACCESS_ONCE(*pmdp); ++ ++ old_pmd = pmd_val(pmd); + /* If PMD busy, retry the access */ + if (unlikely(old_pmd & _PAGE_BUSY)) + return 0; +@@ -85,6 +138,15 @@ int __hash_page_thp(unsigned long ea, unsigned long access, unsigned long vsid, + vpn = hpt_vpn(ea, vsid, ssize); + hash = hpt_hash(vpn, shift, ssize); + hpte_slot_array = get_hpte_slot_array(pmdp); ++ if (psize == MMU_PAGE_4K) { ++ /* ++ * invalidate the old hpte entry if we have that mapped via 64K ++ * base page size. This is because demote_segment won't flush ++ * hash page table entries. ++ */ ++ if ((old_pmd & _PAGE_HASHPTE) && !(old_pmd & _PAGE_COMBO)) ++ invalidate_old_hpte(vsid, ea, pmdp, MMU_PAGE_64K, ssize); ++ } + + valid = hpte_valid(hpte_slot_array, index); + if (valid) { +@@ -107,11 +169,8 @@ int __hash_page_thp(unsigned long ea, unsigned long access, unsigned long vsid, + * safely update this here. + */ + valid = 0; +- new_pmd &= ~_PAGE_HPTEFLAGS; + hpte_slot_array[index] = 0; +- } else +- /* clear the busy bits and set the hash pte bits */ +- new_pmd = (new_pmd & ~_PAGE_HPTEFLAGS) | _PAGE_HASHPTE; ++ } + } + + if (!valid) { +@@ -119,11 +178,7 @@ int __hash_page_thp(unsigned long ea, unsigned long access, unsigned long vsid, + + /* insert new entry */ + pa = pmd_pfn(__pmd(old_pmd)) << PAGE_SHIFT; +-repeat: +- hpte_group = ((hash & htab_hash_mask) * HPTES_PER_GROUP) & ~0x7UL; +- +- /* clear the busy bits and set the hash pte bits */ +- new_pmd = (new_pmd & ~_PAGE_HPTEFLAGS) | _PAGE_HASHPTE; ++ new_pmd |= _PAGE_HASHPTE; + + /* Add in WIMG bits */ + rflags |= (new_pmd & (_PAGE_WRITETHRU | _PAGE_NO_CACHE | +@@ -132,6 +187,8 @@ repeat: + * enable the memory coherence always + */ + rflags |= HPTE_R_M; ++repeat: ++ hpte_group = ((hash & htab_hash_mask) * HPTES_PER_GROUP) & ~0x7UL; + + /* Insert into the hash table, primary slot */ + slot = ppc_md.hpte_insert(hpte_group, vpn, pa, rflags, 0, +@@ -172,8 +229,17 @@ repeat: + mark_hpte_slot_valid(hpte_slot_array, index, slot); + } + /* +- * No need to use ldarx/stdcx here ++ * Mark the pte with _PAGE_COMBO, if we are trying to hash it with ++ * base page size 4k. ++ */ ++ if (psize == MMU_PAGE_4K) ++ new_pmd |= _PAGE_COMBO; ++ /* ++ * The hpte valid is stored in the pgtable whose address is in the ++ * second half of the PMD. Order this against clearing of the busy bit in ++ * huge pmd. + */ ++ smp_wmb(); + *pmdp = __pmd(new_pmd & ~_PAGE_BUSY); + return 0; + } +diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c +index 30a42e24bf14..a5fff173be4f 100644 +--- a/arch/powerpc/mm/numa.c ++++ b/arch/powerpc/mm/numa.c +@@ -610,8 +610,8 @@ static int cpu_numa_callback(struct notifier_block *nfb, unsigned long action, + case CPU_UP_CANCELED: + case CPU_UP_CANCELED_FROZEN: + unmap_cpu_from_node(lcpu); +- break; + ret = NOTIFY_OK; ++ break; + #endif + } + return ret; +diff --git a/arch/powerpc/mm/pgtable_64.c b/arch/powerpc/mm/pgtable_64.c +index 62bf5e8e78da..c64da56d7582 100644 +--- a/arch/powerpc/mm/pgtable_64.c ++++ b/arch/powerpc/mm/pgtable_64.c +@@ -538,7 +538,7 @@ unsigned long pmd_hugepage_update(struct mm_struct *mm, unsigned long addr, + *pmdp = __pmd((old & ~clr) | set); + #endif + if (old & _PAGE_HASHPTE) +- hpte_do_hugepage_flush(mm, addr, pmdp); ++ hpte_do_hugepage_flush(mm, addr, pmdp, old); + return old; + } + +@@ -645,7 +645,7 @@ void pmdp_splitting_flush(struct vm_area_struct *vma, + if (!(old & _PAGE_SPLITTING)) { + /* We need to flush the hpte */ + if (old & _PAGE_HASHPTE) +- hpte_do_hugepage_flush(vma->vm_mm, address, pmdp); ++ hpte_do_hugepage_flush(vma->vm_mm, address, pmdp, old); + } + } + +@@ -718,7 +718,7 @@ void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address, + * neesd to be flushed. + */ + void hpte_do_hugepage_flush(struct mm_struct *mm, unsigned long addr, +- pmd_t *pmdp) ++ pmd_t *pmdp, unsigned long old_pmd) + { + int ssize, i; + unsigned long s_addr; +@@ -740,12 +740,29 @@ void hpte_do_hugepage_flush(struct mm_struct *mm, unsigned long addr, + if (!hpte_slot_array) + return; + +- /* get the base page size */ ++ /* get the base page size,vsid and segment size */ ++#ifdef CONFIG_DEBUG_VM + psize = get_slice_psize(mm, s_addr); ++ BUG_ON(psize == MMU_PAGE_16M); ++#endif ++ if (old_pmd & _PAGE_COMBO) ++ psize = MMU_PAGE_4K; ++ else ++ psize = MMU_PAGE_64K; ++ ++ if (!is_kernel_addr(s_addr)) { ++ ssize = user_segment_size(s_addr); ++ vsid = get_vsid(mm->context.id, s_addr, ssize); ++ WARN_ON(vsid == 0); ++ } else { ++ vsid = get_kernel_vsid(s_addr, mmu_kernel_ssize); ++ ssize = mmu_kernel_ssize; ++ } + + if (ppc_md.hugepage_invalidate) +- return ppc_md.hugepage_invalidate(mm, hpte_slot_array, +- s_addr, psize); ++ return ppc_md.hugepage_invalidate(vsid, s_addr, ++ hpte_slot_array, ++ psize, ssize); + /* + * No bluk hpte removal support, invalidate each entry + */ +@@ -763,15 +780,6 @@ void hpte_do_hugepage_flush(struct mm_struct *mm, unsigned long addr, + + /* get the vpn */ + addr = s_addr + (i * (1ul << shift)); +- if (!is_kernel_addr(addr)) { +- ssize = user_segment_size(addr); +- vsid = get_vsid(mm->context.id, addr, ssize); +- WARN_ON(vsid == 0); +- } else { +- vsid = get_kernel_vsid(addr, mmu_kernel_ssize); +- ssize = mmu_kernel_ssize; +- } +- + vpn = hpt_vpn(addr, vsid, ssize); + hash = hpt_hash(vpn, shift, ssize); + if (hidx & _PTEIDX_SECONDARY) +diff --git a/arch/powerpc/mm/tlb_hash64.c b/arch/powerpc/mm/tlb_hash64.c +index c99f6510a0b2..9adda5790463 100644 +--- a/arch/powerpc/mm/tlb_hash64.c ++++ b/arch/powerpc/mm/tlb_hash64.c +@@ -216,7 +216,7 @@ void __flush_hash_table_range(struct mm_struct *mm, unsigned long start, + if (!(pte & _PAGE_HASHPTE)) + continue; + if (unlikely(hugepage_shift && pmd_trans_huge(*(pmd_t *)pte))) +- hpte_do_hugepage_flush(mm, start, (pmd_t *)pte); ++ hpte_do_hugepage_flush(mm, start, (pmd_t *)ptep, pte); + else + hpte_need_flush(mm, start, ptep, pte, 0); + } +diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c +index 9590dbb756f2..b9a82042760f 100644 +--- a/arch/powerpc/platforms/pseries/hotplug-memory.c ++++ b/arch/powerpc/platforms/pseries/hotplug-memory.c +@@ -160,7 +160,7 @@ static int pseries_remove_memory(struct device_node *np) + static inline int pseries_remove_memblock(unsigned long base, + unsigned int memblock_size) + { +- return -EOPNOTSUPP; ++ return 0; + } + static inline int pseries_remove_memory(struct device_node *np) + { +diff --git a/arch/powerpc/platforms/pseries/iommu.c b/arch/powerpc/platforms/pseries/iommu.c +index 33b552ffbe57..4642d6a4d356 100644 +--- a/arch/powerpc/platforms/pseries/iommu.c ++++ b/arch/powerpc/platforms/pseries/iommu.c +@@ -721,13 +721,13 @@ static int __init disable_ddw_setup(char *str) + + early_param("disable_ddw", disable_ddw_setup); + +-static void remove_ddw(struct device_node *np) ++static void remove_ddw(struct device_node *np, bool remove_prop) + { + struct dynamic_dma_window_prop *dwp; + struct property *win64; + const u32 *ddw_avail; + u64 liobn; +- int len, ret; ++ int len, ret = 0; + + ddw_avail = of_get_property(np, "ibm,ddw-applicable", &len); + win64 = of_find_property(np, DIRECT64_PROPNAME, NULL); +@@ -761,7 +761,8 @@ static void remove_ddw(struct device_node *np) + np->full_name, ret, ddw_avail[2], liobn); + + delprop: +- ret = of_remove_property(np, win64); ++ if (remove_prop) ++ ret = of_remove_property(np, win64); + if (ret) + pr_warning("%s: failed to remove direct window property: %d\n", + np->full_name, ret); +@@ -805,7 +806,7 @@ static int find_existing_ddw_windows(void) + window = kzalloc(sizeof(*window), GFP_KERNEL); + if (!window || len < sizeof(struct dynamic_dma_window_prop)) { + kfree(window); +- remove_ddw(pdn); ++ remove_ddw(pdn, true); + continue; + } + +@@ -1045,7 +1046,7 @@ out_free_window: + kfree(window); + + out_clear_window: +- remove_ddw(pdn); ++ remove_ddw(pdn, true); + + out_free_prop: + kfree(win64->name); +@@ -1255,7 +1256,14 @@ static int iommu_reconfig_notifier(struct notifier_block *nb, unsigned long acti + + switch (action) { + case OF_RECONFIG_DETACH_NODE: +- remove_ddw(np); ++ /* ++ * Removing the property will invoke the reconfig ++ * notifier again, which causes dead-lock on the ++ * read-write semaphore of the notifier chain. So ++ * we have to remove the property when releasing ++ * the device node. ++ */ ++ remove_ddw(np, false); + if (pci && pci->iommu_table) + iommu_free_table(pci->iommu_table, np->full_name); + +diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c +index b02af9ef3ff6..ccf6f162f69c 100644 +--- a/arch/powerpc/platforms/pseries/lpar.c ++++ b/arch/powerpc/platforms/pseries/lpar.c +@@ -430,16 +430,17 @@ static void __pSeries_lpar_hugepage_invalidate(unsigned long *slot, + spin_unlock_irqrestore(&pSeries_lpar_tlbie_lock, flags); + } + +-static void pSeries_lpar_hugepage_invalidate(struct mm_struct *mm, +- unsigned char *hpte_slot_array, +- unsigned long addr, int psize) ++static void pSeries_lpar_hugepage_invalidate(unsigned long vsid, ++ unsigned long addr, ++ unsigned char *hpte_slot_array, ++ int psize, int ssize) + { +- int ssize = 0, i, index = 0; ++ int i, index = 0; + unsigned long s_addr = addr; + unsigned int max_hpte_count, valid; + unsigned long vpn_array[PPC64_HUGE_HPTE_BATCH]; + unsigned long slot_array[PPC64_HUGE_HPTE_BATCH]; +- unsigned long shift, hidx, vpn = 0, vsid, hash, slot; ++ unsigned long shift, hidx, vpn = 0, hash, slot; + + shift = mmu_psize_defs[psize].shift; + max_hpte_count = 1U << (PMD_SHIFT - shift); +@@ -452,15 +453,6 @@ static void pSeries_lpar_hugepage_invalidate(struct mm_struct *mm, + + /* get the vpn */ + addr = s_addr + (i * (1ul << shift)); +- if (!is_kernel_addr(addr)) { +- ssize = user_segment_size(addr); +- vsid = get_vsid(mm->context.id, addr, ssize); +- WARN_ON(vsid == 0); +- } else { +- vsid = get_kernel_vsid(addr, mmu_kernel_ssize); +- ssize = mmu_kernel_ssize; +- } +- + vpn = hpt_vpn(addr, vsid, ssize); + hash = hpt_hash(vpn, shift, ssize); + if (hidx & _PTEIDX_SECONDARY) +diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig +index bb74b21f007a..a0a3bed6e4dc 100644 +--- a/arch/s390/Kconfig ++++ b/arch/s390/Kconfig +@@ -93,6 +93,7 @@ config S390 + select ARCH_INLINE_WRITE_UNLOCK_IRQ + select ARCH_INLINE_WRITE_UNLOCK_IRQRESTORE + select ARCH_SAVE_PAGE_KEYS if HIBERNATION ++ select ARCH_SUPPORTS_ATOMIC_RMW + select ARCH_USE_CMPXCHG_LOCKREF + select ARCH_WANT_IPC_PARSE_VERSION + select BUILDTIME_EXTABLE_SORT +diff --git a/drivers/acpi/acpica/utcopy.c b/drivers/acpi/acpica/utcopy.c +index edff4e653d9a..c66bca17e736 100644 +--- a/drivers/acpi/acpica/utcopy.c ++++ b/drivers/acpi/acpica/utcopy.c +@@ -1001,5 +1001,11 @@ acpi_ut_copy_iobject_to_iobject(union acpi_operand_object *source_desc, + status = acpi_ut_copy_simple_object(source_desc, *dest_desc); + } + ++ /* Delete the allocated object if copy failed */ ++ ++ if (ACPI_FAILURE(status)) { ++ acpi_ut_remove_reference(*dest_desc); ++ } ++ + return_ACPI_STATUS(status); + } +diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c +index 3dca36d4ad26..17f9ec501972 100644 +--- a/drivers/acpi/processor_idle.c ++++ b/drivers/acpi/processor_idle.c +@@ -1071,9 +1071,9 @@ int acpi_processor_cst_has_changed(struct acpi_processor *pr) + + if (pr->id == 0 && cpuidle_get_driver() == &acpi_idle_driver) { + +- cpuidle_pause_and_lock(); + /* Protect against cpu-hotplug */ + get_online_cpus(); ++ cpuidle_pause_and_lock(); + + /* Disable all cpuidle devices */ + for_each_online_cpu(cpu) { +@@ -1100,8 +1100,8 @@ int acpi_processor_cst_has_changed(struct acpi_processor *pr) + cpuidle_enable_device(dev); + } + } +- put_online_cpus(); + cpuidle_resume_and_unlock(); ++ put_online_cpus(); + } + + return 0; +diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c +index 57b053f424d1..92d5184e3654 100644 +--- a/drivers/acpi/scan.c ++++ b/drivers/acpi/scan.c +@@ -329,7 +329,8 @@ static int acpi_scan_hot_remove(struct acpi_device *device) + unsigned long long sta; + acpi_status status; + +- if (device->handler->hotplug.demand_offline && !acpi_force_hot_remove) { ++ if (device->handler && device->handler->hotplug.demand_offline ++ && !acpi_force_hot_remove) { + if (!acpi_scan_is_offline(device, true)) + return -EBUSY; + } else { +@@ -660,8 +661,14 @@ static ssize_t + acpi_device_sun_show(struct device *dev, struct device_attribute *attr, + char *buf) { + struct acpi_device *acpi_dev = to_acpi_device(dev); ++ acpi_status status; ++ unsigned long long sun; ++ ++ status = acpi_evaluate_integer(acpi_dev->handle, "_SUN", NULL, &sun); ++ if (ACPI_FAILURE(status)) ++ return -ENODEV; + +- return sprintf(buf, "%lu\n", acpi_dev->pnp.sun); ++ return sprintf(buf, "%llu\n", sun); + } + static DEVICE_ATTR(sun, 0444, acpi_device_sun_show, NULL); + +@@ -683,7 +690,6 @@ static int acpi_device_setup_files(struct acpi_device *dev) + { + struct acpi_buffer buffer = {ACPI_ALLOCATE_BUFFER, NULL}; + acpi_status status; +- unsigned long long sun; + int result = 0; + + /* +@@ -724,14 +730,10 @@ static int acpi_device_setup_files(struct acpi_device *dev) + if (dev->pnp.unique_id) + result = device_create_file(&dev->dev, &dev_attr_uid); + +- status = acpi_evaluate_integer(dev->handle, "_SUN", NULL, &sun); +- if (ACPI_SUCCESS(status)) { +- dev->pnp.sun = (unsigned long)sun; ++ if (acpi_has_method(dev->handle, "_SUN")) { + result = device_create_file(&dev->dev, &dev_attr_sun); + if (result) + goto end; +- } else { +- dev->pnp.sun = (unsigned long)-1; + } + + if (acpi_has_method(dev->handle, "_STA")) { +@@ -915,12 +917,17 @@ static void acpi_device_notify(acpi_handle handle, u32 event, void *data) + device->driver->ops.notify(device, event); + } + +-static acpi_status acpi_device_notify_fixed(void *data) ++static void acpi_device_notify_fixed(void *data) + { + struct acpi_device *device = data; + + /* Fixed hardware devices have no handles */ + acpi_device_notify(NULL, ACPI_FIXED_HARDWARE_EVENT, device); ++} ++ ++static acpi_status acpi_device_fixed_event(void *data) ++{ ++ acpi_os_execute(OSL_NOTIFY_HANDLER, acpi_device_notify_fixed, data); + return AE_OK; + } + +@@ -931,12 +938,12 @@ static int acpi_device_install_notify_handler(struct acpi_device *device) + if (device->device_type == ACPI_BUS_TYPE_POWER_BUTTON) + status = + acpi_install_fixed_event_handler(ACPI_EVENT_POWER_BUTTON, +- acpi_device_notify_fixed, ++ acpi_device_fixed_event, + device); + else if (device->device_type == ACPI_BUS_TYPE_SLEEP_BUTTON) + status = + acpi_install_fixed_event_handler(ACPI_EVENT_SLEEP_BUTTON, +- acpi_device_notify_fixed, ++ acpi_device_fixed_event, + device); + else + status = acpi_install_notify_handler(device->handle, +@@ -953,10 +960,10 @@ static void acpi_device_remove_notify_handler(struct acpi_device *device) + { + if (device->device_type == ACPI_BUS_TYPE_POWER_BUTTON) + acpi_remove_fixed_event_handler(ACPI_EVENT_POWER_BUTTON, +- acpi_device_notify_fixed); ++ acpi_device_fixed_event); + else if (device->device_type == ACPI_BUS_TYPE_SLEEP_BUTTON) + acpi_remove_fixed_event_handler(ACPI_EVENT_SLEEP_BUTTON, +- acpi_device_notify_fixed); ++ acpi_device_fixed_event); + else + acpi_remove_notify_handler(device->handle, ACPI_DEVICE_NOTIFY, + acpi_device_notify); +diff --git a/drivers/bluetooth/btmrvl_drv.h b/drivers/bluetooth/btmrvl_drv.h +index 7399303d7d99..9e81a3d01d2b 100644 +--- a/drivers/bluetooth/btmrvl_drv.h ++++ b/drivers/bluetooth/btmrvl_drv.h +@@ -66,6 +66,7 @@ struct btmrvl_adapter { + u8 hs_state; + u8 wakeup_tries; + wait_queue_head_t cmd_wait_q; ++ wait_queue_head_t event_hs_wait_q; + u8 cmd_complete; + bool is_suspended; + }; +diff --git a/drivers/bluetooth/btmrvl_main.c b/drivers/bluetooth/btmrvl_main.c +index 1e0320af00c6..49d20989b45a 100644 +--- a/drivers/bluetooth/btmrvl_main.c ++++ b/drivers/bluetooth/btmrvl_main.c +@@ -112,6 +112,7 @@ int btmrvl_process_event(struct btmrvl_private *priv, struct sk_buff *skb) + adapter->hs_state = HS_ACTIVATED; + if (adapter->psmode) + adapter->ps_state = PS_SLEEP; ++ wake_up_interruptible(&adapter->event_hs_wait_q); + BT_DBG("HS ACTIVATED!"); + } else { + BT_DBG("HS Enable failed"); +@@ -251,11 +252,31 @@ EXPORT_SYMBOL_GPL(btmrvl_enable_ps); + + int btmrvl_enable_hs(struct btmrvl_private *priv) + { ++ struct btmrvl_adapter *adapter = priv->adapter; + int ret; + + ret = btmrvl_send_sync_cmd(priv, BT_CMD_HOST_SLEEP_ENABLE, NULL, 0); +- if (ret) ++ if (ret) { + BT_ERR("Host sleep enable command failed\n"); ++ return ret; ++ } ++ ++ ret = wait_event_interruptible_timeout(adapter->event_hs_wait_q, ++ adapter->hs_state, ++ msecs_to_jiffies(WAIT_UNTIL_HS_STATE_CHANGED)); ++ if (ret < 0) { ++ BT_ERR("event_hs_wait_q terminated (%d): %d,%d,%d", ++ ret, adapter->hs_state, adapter->ps_state, ++ adapter->wakeup_tries); ++ } else if (!ret) { ++ BT_ERR("hs_enable timeout: %d,%d,%d", adapter->hs_state, ++ adapter->ps_state, adapter->wakeup_tries); ++ ret = -ETIMEDOUT; ++ } else { ++ BT_DBG("host sleep enabled: %d,%d,%d", adapter->hs_state, ++ adapter->ps_state, adapter->wakeup_tries); ++ ret = 0; ++ } + + return ret; + } +@@ -341,6 +362,7 @@ static void btmrvl_init_adapter(struct btmrvl_private *priv) + priv->adapter->ps_state = PS_AWAKE; + + init_waitqueue_head(&priv->adapter->cmd_wait_q); ++ init_waitqueue_head(&priv->adapter->event_hs_wait_q); + } + + static void btmrvl_free_adapter(struct btmrvl_private *priv) +@@ -648,6 +670,7 @@ int btmrvl_remove_card(struct btmrvl_private *priv) + hdev = priv->btmrvl_dev.hcidev; + + wake_up_interruptible(&priv->adapter->cmd_wait_q); ++ wake_up_interruptible(&priv->adapter->event_hs_wait_q); + + kthread_stop(priv->main_thread.task); + +diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c +index 62e10fd1e1cb..6af17002a115 100644 +--- a/drivers/char/tpm/tpm-interface.c ++++ b/drivers/char/tpm/tpm-interface.c +@@ -491,11 +491,10 @@ static int tpm_startup(struct tpm_chip *chip, __be16 startup_type) + int tpm_get_timeouts(struct tpm_chip *chip) + { + struct tpm_cmd_t tpm_cmd; +- struct timeout_t *timeout_cap; ++ unsigned long new_timeout[4]; ++ unsigned long old_timeout[4]; + struct duration_t *duration_cap; + ssize_t rc; +- u32 timeout; +- unsigned int scale = 1; + + tpm_cmd.header.in = tpm_getcap_header; + tpm_cmd.params.getcap_in.cap = TPM_CAP_PROP; +@@ -529,25 +528,46 @@ int tpm_get_timeouts(struct tpm_chip *chip) + != sizeof(tpm_cmd.header.out) + sizeof(u32) + 4 * sizeof(u32)) + return -EINVAL; + +- timeout_cap = &tpm_cmd.params.getcap_out.cap.timeout; +- /* Don't overwrite default if value is 0 */ +- timeout = be32_to_cpu(timeout_cap->a); +- if (timeout && timeout < 1000) { +- /* timeouts in msec rather usec */ +- scale = 1000; +- chip->vendor.timeout_adjusted = true; ++ old_timeout[0] = be32_to_cpu(tpm_cmd.params.getcap_out.cap.timeout.a); ++ old_timeout[1] = be32_to_cpu(tpm_cmd.params.getcap_out.cap.timeout.b); ++ old_timeout[2] = be32_to_cpu(tpm_cmd.params.getcap_out.cap.timeout.c); ++ old_timeout[3] = be32_to_cpu(tpm_cmd.params.getcap_out.cap.timeout.d); ++ memcpy(new_timeout, old_timeout, sizeof(new_timeout)); ++ ++ /* ++ * Provide ability for vendor overrides of timeout values in case ++ * of misreporting. ++ */ ++ if (chip->ops->update_timeouts != NULL) ++ chip->vendor.timeout_adjusted = ++ chip->ops->update_timeouts(chip, new_timeout); ++ ++ if (!chip->vendor.timeout_adjusted) { ++ /* Don't overwrite default if value is 0 */ ++ if (new_timeout[0] != 0 && new_timeout[0] < 1000) { ++ int i; ++ ++ /* timeouts in msec rather usec */ ++ for (i = 0; i != ARRAY_SIZE(new_timeout); i++) ++ new_timeout[i] *= 1000; ++ chip->vendor.timeout_adjusted = true; ++ } ++ } ++ ++ /* Report adjusted timeouts */ ++ if (chip->vendor.timeout_adjusted) { ++ dev_info(chip->dev, ++ HW_ERR "Adjusting reported timeouts: A %lu->%luus B %lu->%luus C %lu->%luus D %lu->%luus\n", ++ old_timeout[0], new_timeout[0], ++ old_timeout[1], new_timeout[1], ++ old_timeout[2], new_timeout[2], ++ old_timeout[3], new_timeout[3]); + } +- if (timeout) +- chip->vendor.timeout_a = usecs_to_jiffies(timeout * scale); +- timeout = be32_to_cpu(timeout_cap->b); +- if (timeout) +- chip->vendor.timeout_b = usecs_to_jiffies(timeout * scale); +- timeout = be32_to_cpu(timeout_cap->c); +- if (timeout) +- chip->vendor.timeout_c = usecs_to_jiffies(timeout * scale); +- timeout = be32_to_cpu(timeout_cap->d); +- if (timeout) +- chip->vendor.timeout_d = usecs_to_jiffies(timeout * scale); ++ ++ chip->vendor.timeout_a = usecs_to_jiffies(new_timeout[0]); ++ chip->vendor.timeout_b = usecs_to_jiffies(new_timeout[1]); ++ chip->vendor.timeout_c = usecs_to_jiffies(new_timeout[2]); ++ chip->vendor.timeout_d = usecs_to_jiffies(new_timeout[3]); + + duration: + tpm_cmd.header.in = tpm_getcap_header; +@@ -991,13 +1011,13 @@ int tpm_get_random(u32 chip_num, u8 *out, size_t max) + int err, total = 0, retries = 5; + u8 *dest = out; + ++ if (!out || !num_bytes || max > TPM_MAX_RNG_DATA) ++ return -EINVAL; ++ + chip = tpm_chip_find_get(chip_num); + if (chip == NULL) + return -ENODEV; + +- if (!out || !num_bytes || max > TPM_MAX_RNG_DATA) +- return -EINVAL; +- + do { + tpm_cmd.header.in = tpm_getrandom_header; + tpm_cmd.params.getrandom_in.num_bytes = cpu_to_be32(num_bytes); +@@ -1016,6 +1036,7 @@ int tpm_get_random(u32 chip_num, u8 *out, size_t max) + num_bytes -= recd; + } while (retries-- && total < max); + ++ tpm_chip_put(chip); + return total ? total : -EIO; + } + EXPORT_SYMBOL_GPL(tpm_get_random); +@@ -1095,7 +1116,7 @@ struct tpm_chip *tpm_register_hardware(struct device *dev, + goto del_misc; + + if (tpm_add_ppi(&dev->kobj)) +- goto del_misc; ++ goto del_sysfs; + + chip->bios_dir = tpm_bios_log_setup(chip->devname); + +@@ -1106,6 +1127,8 @@ struct tpm_chip *tpm_register_hardware(struct device *dev, + + return chip; + ++del_sysfs: ++ tpm_sysfs_del_device(chip); + del_misc: + tpm_dev_del_device(chip); + put_device: +diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c +index a9ed2270c25d..2c46734b266d 100644 +--- a/drivers/char/tpm/tpm_tis.c ++++ b/drivers/char/tpm/tpm_tis.c +@@ -373,6 +373,36 @@ out_err: + return rc; + } + ++struct tis_vendor_timeout_override { ++ u32 did_vid; ++ unsigned long timeout_us[4]; ++}; ++ ++static const struct tis_vendor_timeout_override vendor_timeout_overrides[] = { ++ /* Atmel 3204 */ ++ { 0x32041114, { (TIS_SHORT_TIMEOUT*1000), (TIS_LONG_TIMEOUT*1000), ++ (TIS_SHORT_TIMEOUT*1000), (TIS_SHORT_TIMEOUT*1000) } }, ++}; ++ ++static bool tpm_tis_update_timeouts(struct tpm_chip *chip, ++ unsigned long *timeout_cap) ++{ ++ int i; ++ u32 did_vid; ++ ++ did_vid = ioread32(chip->vendor.iobase + TPM_DID_VID(0)); ++ ++ for (i = 0; i != ARRAY_SIZE(vendor_timeout_overrides); i++) { ++ if (vendor_timeout_overrides[i].did_vid != did_vid) ++ continue; ++ memcpy(timeout_cap, vendor_timeout_overrides[i].timeout_us, ++ sizeof(vendor_timeout_overrides[i].timeout_us)); ++ return true; ++ } ++ ++ return false; ++} ++ + /* + * Early probing for iTPM with STS_DATA_EXPECT flaw. + * Try sending command without itpm flag set and if that +@@ -437,6 +467,7 @@ static const struct tpm_class_ops tpm_tis = { + .recv = tpm_tis_recv, + .send = tpm_tis_send, + .cancel = tpm_tis_ready, ++ .update_timeouts = tpm_tis_update_timeouts, + .req_complete_mask = TPM_STS_DATA_AVAIL | TPM_STS_VALID, + .req_complete_val = TPM_STS_DATA_AVAIL | TPM_STS_VALID, + .req_canceled = tpm_tis_req_canceled, +diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c +index b22659cccca4..e6125522860a 100644 +--- a/drivers/firmware/efi/vars.c ++++ b/drivers/firmware/efi/vars.c +@@ -481,7 +481,7 @@ EXPORT_SYMBOL_GPL(efivar_entry_remove); + */ + static void efivar_entry_list_del_unlock(struct efivar_entry *entry) + { +- WARN_ON(!spin_is_locked(&__efivars->lock)); ++ lockdep_assert_held(&__efivars->lock); + + list_del(&entry->list); + spin_unlock_irq(&__efivars->lock); +@@ -507,7 +507,7 @@ int __efivar_entry_delete(struct efivar_entry *entry) + const struct efivar_operations *ops = __efivars->ops; + efi_status_t status; + +- WARN_ON(!spin_is_locked(&__efivars->lock)); ++ lockdep_assert_held(&__efivars->lock); + + status = ops->set_variable(entry->var.VariableName, + &entry->var.VendorGuid, +@@ -667,7 +667,7 @@ struct efivar_entry *efivar_entry_find(efi_char16_t *name, efi_guid_t guid, + int strsize1, strsize2; + bool found = false; + +- WARN_ON(!spin_is_locked(&__efivars->lock)); ++ lockdep_assert_held(&__efivars->lock); + + list_for_each_entry_safe(entry, n, head, list) { + strsize1 = ucs2_strsize(name, 1024); +@@ -739,7 +739,7 @@ int __efivar_entry_get(struct efivar_entry *entry, u32 *attributes, + const struct efivar_operations *ops = __efivars->ops; + efi_status_t status; + +- WARN_ON(!spin_is_locked(&__efivars->lock)); ++ lockdep_assert_held(&__efivars->lock); + + status = ops->get_variable(entry->var.VariableName, + &entry->var.VendorGuid, +diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.h b/drivers/gpu/drm/nouveau/nouveau_drm.h +index 23ca7a517246..74ed08a750f4 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_drm.h ++++ b/drivers/gpu/drm/nouveau/nouveau_drm.h +@@ -10,7 +10,7 @@ + + #define DRIVER_MAJOR 1 + #define DRIVER_MINOR 1 +-#define DRIVER_PATCHLEVEL 1 ++#define DRIVER_PATCHLEVEL 2 + + /* + * 1.1.1: +@@ -21,6 +21,8 @@ + * to control registers on the MPs to enable performance counters, + * and to control the warp error enable mask (OpenGL requires out of + * bounds access to local memory to be silently ignored / return 0). ++ * 1.1.2: ++ * - fixes multiple bugs in flip completion events and timestamping + */ + + #include <core/client.h> +diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c +index bc9e56eb4e9c..7b3537c55c77 100644 +--- a/drivers/gpu/drm/radeon/cik.c ++++ b/drivers/gpu/drm/radeon/cik.c +@@ -7779,6 +7779,7 @@ restart_ih: + static int cik_startup(struct radeon_device *rdev) + { + struct radeon_ring *ring; ++ u32 nop; + int r; + + /* enable pcie gen2/3 link */ +@@ -7896,9 +7897,15 @@ static int cik_startup(struct radeon_device *rdev) + } + cik_irq_set(rdev); + ++ if (rdev->family == CHIP_HAWAII) { ++ nop = RADEON_CP_PACKET2; ++ } else { ++ nop = PACKET3(PACKET3_NOP, 0x3FFF); ++ } ++ + ring = &rdev->ring[RADEON_RING_TYPE_GFX_INDEX]; + r = radeon_ring_init(rdev, ring, ring->ring_size, RADEON_WB_CP_RPTR_OFFSET, +- PACKET3(PACKET3_NOP, 0x3FFF)); ++ nop); + if (r) + return r; + +@@ -7906,7 +7913,7 @@ static int cik_startup(struct radeon_device *rdev) + /* type-2 packets are deprecated on MEC, use type-3 instead */ + ring = &rdev->ring[CAYMAN_RING_TYPE_CP1_INDEX]; + r = radeon_ring_init(rdev, ring, ring->ring_size, RADEON_WB_CP1_RPTR_OFFSET, +- PACKET3(PACKET3_NOP, 0x3FFF)); ++ nop); + if (r) + return r; + ring->me = 1; /* first MEC */ +@@ -7917,7 +7924,7 @@ static int cik_startup(struct radeon_device *rdev) + /* type-2 packets are deprecated on MEC, use type-3 instead */ + ring = &rdev->ring[CAYMAN_RING_TYPE_CP2_INDEX]; + r = radeon_ring_init(rdev, ring, ring->ring_size, RADEON_WB_CP2_RPTR_OFFSET, +- PACKET3(PACKET3_NOP, 0x3FFF)); ++ nop); + if (r) + return r; + /* dGPU only have 1 MEC */ +diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c +index 3d2e489ab732..ff9163dc1596 100644 +--- a/drivers/infiniband/core/iwcm.c ++++ b/drivers/infiniband/core/iwcm.c +@@ -46,6 +46,7 @@ + #include <linux/completion.h> + #include <linux/slab.h> + #include <linux/module.h> ++#include <linux/sysctl.h> + + #include <rdma/iw_cm.h> + #include <rdma/ib_addr.h> +@@ -65,6 +66,20 @@ struct iwcm_work { + struct list_head free_list; + }; + ++static unsigned int default_backlog = 256; ++ ++static struct ctl_table_header *iwcm_ctl_table_hdr; ++static struct ctl_table iwcm_ctl_table[] = { ++ { ++ .procname = "default_backlog", ++ .data = &default_backlog, ++ .maxlen = sizeof(default_backlog), ++ .mode = 0644, ++ .proc_handler = proc_dointvec, ++ }, ++ { } ++}; ++ + /* + * The following services provide a mechanism for pre-allocating iwcm_work + * elements. The design pre-allocates them based on the cm_id type: +@@ -425,6 +440,9 @@ int iw_cm_listen(struct iw_cm_id *cm_id, int backlog) + + cm_id_priv = container_of(cm_id, struct iwcm_id_private, id); + ++ if (!backlog) ++ backlog = default_backlog; ++ + ret = alloc_work_entries(cm_id_priv, backlog); + if (ret) + return ret; +@@ -1030,11 +1048,20 @@ static int __init iw_cm_init(void) + if (!iwcm_wq) + return -ENOMEM; + ++ iwcm_ctl_table_hdr = register_net_sysctl(&init_net, "net/iw_cm", ++ iwcm_ctl_table); ++ if (!iwcm_ctl_table_hdr) { ++ pr_err("iw_cm: couldn't register sysctl paths\n"); ++ destroy_workqueue(iwcm_wq); ++ return -ENOMEM; ++ } ++ + return 0; + } + + static void __exit iw_cm_cleanup(void) + { ++ unregister_net_sysctl_table(iwcm_ctl_table_hdr); + destroy_workqueue(iwcm_wq); + } + +diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c +index e96c07ee6756..ca0bc6c67abe 100644 +--- a/drivers/infiniband/ulp/srp/ib_srp.c ++++ b/drivers/infiniband/ulp/srp/ib_srp.c +@@ -120,6 +120,7 @@ static void srp_send_completion(struct ib_cq *cq, void *target_ptr); + static int srp_cm_handler(struct ib_cm_id *cm_id, struct ib_cm_event *event); + + static struct scsi_transport_template *ib_srp_transport_template; ++static struct workqueue_struct *srp_remove_wq; + + static struct ib_client srp_client = { + .name = "srp", +@@ -539,7 +540,7 @@ static bool srp_queue_remove_work(struct srp_target_port *target) + spin_unlock_irq(&target->lock); + + if (changed) +- queue_work(system_long_wq, &target->remove_work); ++ queue_work(srp_remove_wq, &target->remove_work); + + return changed; + } +@@ -2886,9 +2887,10 @@ static void srp_remove_one(struct ib_device *device) + spin_unlock(&host->target_lock); + + /* +- * Wait for target port removal tasks. ++ * Wait for tl_err and target port removal tasks. + */ + flush_workqueue(system_long_wq); ++ flush_workqueue(srp_remove_wq); + + kfree(host); + } +@@ -2940,16 +2942,22 @@ static int __init srp_init_module(void) + indirect_sg_entries = cmd_sg_entries; + } + ++ srp_remove_wq = create_workqueue("srp_remove"); ++ if (IS_ERR(srp_remove_wq)) { ++ ret = PTR_ERR(srp_remove_wq); ++ goto out; ++ } ++ ++ ret = -ENOMEM; + ib_srp_transport_template = + srp_attach_transport(&ib_srp_transport_functions); + if (!ib_srp_transport_template) +- return -ENOMEM; ++ goto destroy_wq; + + ret = class_register(&srp_class); + if (ret) { + pr_err("couldn't register class infiniband_srp\n"); +- srp_release_transport(ib_srp_transport_template); +- return ret; ++ goto release_tr; + } + + ib_sa_register_client(&srp_sa_client); +@@ -2957,13 +2965,22 @@ static int __init srp_init_module(void) + ret = ib_register_client(&srp_client); + if (ret) { + pr_err("couldn't register IB client\n"); +- srp_release_transport(ib_srp_transport_template); +- ib_sa_unregister_client(&srp_sa_client); +- class_unregister(&srp_class); +- return ret; ++ goto unreg_sa; + } + +- return 0; ++out: ++ return ret; ++ ++unreg_sa: ++ ib_sa_unregister_client(&srp_sa_client); ++ class_unregister(&srp_class); ++ ++release_tr: ++ srp_release_transport(ib_srp_transport_template); ++ ++destroy_wq: ++ destroy_workqueue(srp_remove_wq); ++ goto out; + } + + static void __exit srp_cleanup_module(void) +@@ -2972,6 +2989,7 @@ static void __exit srp_cleanup_module(void) + ib_sa_unregister_client(&srp_sa_client); + class_unregister(&srp_class); + srp_release_transport(ib_srp_transport_template); ++ destroy_workqueue(srp_remove_wq); + } + + module_init(srp_init_module); +diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c +index 71776ff5aedc..9cbef59d404a 100644 +--- a/drivers/iommu/amd_iommu.c ++++ b/drivers/iommu/amd_iommu.c +@@ -3227,14 +3227,16 @@ free_domains: + + static void cleanup_domain(struct protection_domain *domain) + { +- struct iommu_dev_data *dev_data, *next; ++ struct iommu_dev_data *entry; + unsigned long flags; + + write_lock_irqsave(&amd_iommu_devtable_lock, flags); + +- list_for_each_entry_safe(dev_data, next, &domain->dev_list, list) { +- __detach_device(dev_data); +- atomic_set(&dev_data->bind, 0); ++ while (!list_empty(&domain->dev_list)) { ++ entry = list_first_entry(&domain->dev_list, ++ struct iommu_dev_data, list); ++ __detach_device(entry); ++ atomic_set(&entry->bind, 0); + } + + write_unlock_irqrestore(&amd_iommu_devtable_lock, flags); +diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c +index 56e24c072b62..d7690f86fdb9 100644 +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -1501,12 +1501,12 @@ static void error(struct mddev *mddev, struct md_rdev *rdev) + mddev->degraded++; + set_bit(Faulty, &rdev->flags); + spin_unlock_irqrestore(&conf->device_lock, flags); +- /* +- * if recovery is running, make sure it aborts. +- */ +- set_bit(MD_RECOVERY_INTR, &mddev->recovery); + } else + set_bit(Faulty, &rdev->flags); ++ /* ++ * if recovery is running, make sure it aborts. ++ */ ++ set_bit(MD_RECOVERY_INTR, &mddev->recovery); + set_bit(MD_CHANGE_DEVS, &mddev->flags); + printk(KERN_ALERT + "md/raid1:%s: Disk failure on %s, disabling device.\n" +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index cb882aae9e20..a46124ecafc7 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -1684,13 +1684,12 @@ static void error(struct mddev *mddev, struct md_rdev *rdev) + spin_unlock_irqrestore(&conf->device_lock, flags); + return; + } +- if (test_and_clear_bit(In_sync, &rdev->flags)) { ++ if (test_and_clear_bit(In_sync, &rdev->flags)) + mddev->degraded++; +- /* +- * if recovery is running, make sure it aborts. +- */ +- set_bit(MD_RECOVERY_INTR, &mddev->recovery); +- } ++ /* ++ * If recovery is running, make sure it aborts. ++ */ ++ set_bit(MD_RECOVERY_INTR, &mddev->recovery); + set_bit(Blocked, &rdev->flags); + set_bit(Faulty, &rdev->flags); + set_bit(MD_CHANGE_DEVS, &mddev->flags); +@@ -2954,6 +2953,7 @@ static sector_t sync_request(struct mddev *mddev, sector_t sector_nr, + */ + if (test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery)) { + end_reshape(conf); ++ close_sync(conf); + return 0; + } + +@@ -4411,7 +4411,7 @@ read_more: + read_bio->bi_private = r10_bio; + read_bio->bi_end_io = end_sync_read; + read_bio->bi_rw = READ; +- read_bio->bi_flags &= ~(BIO_POOL_MASK - 1); ++ read_bio->bi_flags &= (~0UL << BIO_RESET_BITS); + read_bio->bi_flags |= 1 << BIO_UPTODATE; + read_bio->bi_vcnt = 0; + read_bio->bi_iter.bi_size = 0; +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index 16f5c21963db..18cda77b4f79 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -3779,6 +3779,8 @@ static void handle_stripe(struct stripe_head *sh) + set_bit(R5_Wantwrite, &dev->flags); + if (prexor) + continue; ++ if (s.failed > 1) ++ continue; + if (!test_bit(R5_Insync, &dev->flags) || + ((i == sh->pd_idx || i == sh->qd_idx) && + s.failed == 0)) +diff --git a/drivers/media/common/siano/Kconfig b/drivers/media/common/siano/Kconfig +index f953d33ee151..4bfbd5f463d1 100644 +--- a/drivers/media/common/siano/Kconfig ++++ b/drivers/media/common/siano/Kconfig +@@ -22,8 +22,7 @@ config SMS_SIANO_DEBUGFS + bool "Enable debugfs for smsdvb" + depends on SMS_SIANO_MDTV + depends on DEBUG_FS +- depends on SMS_USB_DRV +- depends on CONFIG_SMS_USB_DRV = CONFIG_SMS_SDIO_DRV ++ depends on SMS_USB_DRV = SMS_SDIO_DRV + + ---help--- + Choose Y to enable visualizing a dump of the frontend +diff --git a/drivers/media/i2c/mt9v032.c b/drivers/media/i2c/mt9v032.c +index 36c504b78f2c..008ac87a9031 100644 +--- a/drivers/media/i2c/mt9v032.c ++++ b/drivers/media/i2c/mt9v032.c +@@ -305,8 +305,8 @@ mt9v032_update_hblank(struct mt9v032 *mt9v032) + + if (mt9v032->version->version == MT9V034_CHIP_ID_REV1) + min_hblank += (mt9v032->hratio - 1) * 10; +- min_hblank = max_t(unsigned int, (int)mt9v032->model->data->min_row_time - crop->width, +- (int)min_hblank); ++ min_hblank = max_t(int, mt9v032->model->data->min_row_time - crop->width, ++ min_hblank); + hblank = max_t(unsigned int, mt9v032->hblank, min_hblank); + + return mt9v032_write(client, MT9V032_HORIZONTAL_BLANKING, hblank); +diff --git a/drivers/media/media-device.c b/drivers/media/media-device.c +index 703560fa5e73..88c1606fd555 100644 +--- a/drivers/media/media-device.c ++++ b/drivers/media/media-device.c +@@ -106,8 +106,6 @@ static long media_device_enum_entities(struct media_device *mdev, + if (ent->name) { + strncpy(u_ent.name, ent->name, sizeof(u_ent.name)); + u_ent.name[sizeof(u_ent.name) - 1] = '\0'; +- } else { +- memset(u_ent.name, 0, sizeof(u_ent.name)); + } + u_ent.type = ent->type; + u_ent.revision = ent->revision; +diff --git a/drivers/media/platform/vsp1/vsp1_video.c b/drivers/media/platform/vsp1/vsp1_video.c +index b4687a834f85..7245cca89257 100644 +--- a/drivers/media/platform/vsp1/vsp1_video.c ++++ b/drivers/media/platform/vsp1/vsp1_video.c +@@ -635,8 +635,6 @@ static int vsp1_video_buffer_prepare(struct vb2_buffer *vb) + if (vb->num_planes < format->num_planes) + return -EINVAL; + +- buf->video = video; +- + for (i = 0; i < vb->num_planes; ++i) { + buf->addr[i] = vb2_dma_contig_plane_dma_addr(vb, i); + buf->length[i] = vb2_plane_size(vb, i); +diff --git a/drivers/media/platform/vsp1/vsp1_video.h b/drivers/media/platform/vsp1/vsp1_video.h +index d8612a378345..47b7a8ab5e2f 100644 +--- a/drivers/media/platform/vsp1/vsp1_video.h ++++ b/drivers/media/platform/vsp1/vsp1_video.h +@@ -89,7 +89,6 @@ static inline struct vsp1_pipeline *to_vsp1_pipeline(struct media_entity *e) + } + + struct vsp1_video_buffer { +- struct vsp1_video *video; + struct vb2_buffer buf; + struct list_head queue; + +diff --git a/drivers/media/tuners/xc4000.c b/drivers/media/tuners/xc4000.c +index 2018befabb5a..e71decbfd0af 100644 +--- a/drivers/media/tuners/xc4000.c ++++ b/drivers/media/tuners/xc4000.c +@@ -93,7 +93,7 @@ struct xc4000_priv { + struct firmware_description *firm; + int firm_size; + u32 if_khz; +- u32 freq_hz; ++ u32 freq_hz, freq_offset; + u32 bandwidth; + u8 video_standard; + u8 rf_mode; +@@ -1157,14 +1157,14 @@ static int xc4000_set_params(struct dvb_frontend *fe) + case SYS_ATSC: + dprintk(1, "%s() VSB modulation\n", __func__); + priv->rf_mode = XC_RF_MODE_AIR; +- priv->freq_hz = c->frequency - 1750000; ++ priv->freq_offset = 1750000; + priv->video_standard = XC4000_DTV6; + type = DTV6; + break; + case SYS_DVBC_ANNEX_B: + dprintk(1, "%s() QAM modulation\n", __func__); + priv->rf_mode = XC_RF_MODE_CABLE; +- priv->freq_hz = c->frequency - 1750000; ++ priv->freq_offset = 1750000; + priv->video_standard = XC4000_DTV6; + type = DTV6; + break; +@@ -1173,23 +1173,23 @@ static int xc4000_set_params(struct dvb_frontend *fe) + dprintk(1, "%s() OFDM\n", __func__); + if (bw == 0) { + if (c->frequency < 400000000) { +- priv->freq_hz = c->frequency - 2250000; ++ priv->freq_offset = 2250000; + } else { +- priv->freq_hz = c->frequency - 2750000; ++ priv->freq_offset = 2750000; + } + priv->video_standard = XC4000_DTV7_8; + type = DTV78; + } else if (bw <= 6000000) { + priv->video_standard = XC4000_DTV6; +- priv->freq_hz = c->frequency - 1750000; ++ priv->freq_offset = 1750000; + type = DTV6; + } else if (bw <= 7000000) { + priv->video_standard = XC4000_DTV7; +- priv->freq_hz = c->frequency - 2250000; ++ priv->freq_offset = 2250000; + type = DTV7; + } else { + priv->video_standard = XC4000_DTV8; +- priv->freq_hz = c->frequency - 2750000; ++ priv->freq_offset = 2750000; + type = DTV8; + } + priv->rf_mode = XC_RF_MODE_AIR; +@@ -1200,6 +1200,8 @@ static int xc4000_set_params(struct dvb_frontend *fe) + goto fail; + } + ++ priv->freq_hz = c->frequency - priv->freq_offset; ++ + dprintk(1, "%s() frequency=%d (compensated)\n", + __func__, priv->freq_hz); + +@@ -1520,7 +1522,7 @@ static int xc4000_get_frequency(struct dvb_frontend *fe, u32 *freq) + { + struct xc4000_priv *priv = fe->tuner_priv; + +- *freq = priv->freq_hz; ++ *freq = priv->freq_hz + priv->freq_offset; + + if (debug) { + mutex_lock(&priv->lock); +diff --git a/drivers/media/tuners/xc5000.c b/drivers/media/tuners/xc5000.c +index 5cd09a681b6a..b2d9e9cb97f7 100644 +--- a/drivers/media/tuners/xc5000.c ++++ b/drivers/media/tuners/xc5000.c +@@ -55,7 +55,7 @@ struct xc5000_priv { + + u32 if_khz; + u16 xtal_khz; +- u32 freq_hz; ++ u32 freq_hz, freq_offset; + u32 bandwidth; + u8 video_standard; + u8 rf_mode; +@@ -755,13 +755,13 @@ static int xc5000_set_params(struct dvb_frontend *fe) + case SYS_ATSC: + dprintk(1, "%s() VSB modulation\n", __func__); + priv->rf_mode = XC_RF_MODE_AIR; +- priv->freq_hz = freq - 1750000; ++ priv->freq_offset = 1750000; + priv->video_standard = DTV6; + break; + case SYS_DVBC_ANNEX_B: + dprintk(1, "%s() QAM modulation\n", __func__); + priv->rf_mode = XC_RF_MODE_CABLE; +- priv->freq_hz = freq - 1750000; ++ priv->freq_offset = 1750000; + priv->video_standard = DTV6; + break; + case SYS_ISDBT: +@@ -776,15 +776,15 @@ static int xc5000_set_params(struct dvb_frontend *fe) + switch (bw) { + case 6000000: + priv->video_standard = DTV6; +- priv->freq_hz = freq - 1750000; ++ priv->freq_offset = 1750000; + break; + case 7000000: + priv->video_standard = DTV7; +- priv->freq_hz = freq - 2250000; ++ priv->freq_offset = 2250000; + break; + case 8000000: + priv->video_standard = DTV8; +- priv->freq_hz = freq - 2750000; ++ priv->freq_offset = 2750000; + break; + default: + printk(KERN_ERR "xc5000 bandwidth not set!\n"); +@@ -798,15 +798,15 @@ static int xc5000_set_params(struct dvb_frontend *fe) + priv->rf_mode = XC_RF_MODE_CABLE; + if (bw <= 6000000) { + priv->video_standard = DTV6; +- priv->freq_hz = freq - 1750000; ++ priv->freq_offset = 1750000; + b = 6; + } else if (bw <= 7000000) { + priv->video_standard = DTV7; +- priv->freq_hz = freq - 2250000; ++ priv->freq_offset = 2250000; + b = 7; + } else { + priv->video_standard = DTV7_8; +- priv->freq_hz = freq - 2750000; ++ priv->freq_offset = 2750000; + b = 8; + } + dprintk(1, "%s() Bandwidth %dMHz (%d)\n", __func__, +@@ -817,6 +817,8 @@ static int xc5000_set_params(struct dvb_frontend *fe) + return -EINVAL; + } + ++ priv->freq_hz = freq - priv->freq_offset; ++ + dprintk(1, "%s() frequency=%d (compensated to %d)\n", + __func__, freq, priv->freq_hz); + +@@ -1067,7 +1069,7 @@ static int xc5000_get_frequency(struct dvb_frontend *fe, u32 *freq) + { + struct xc5000_priv *priv = fe->tuner_priv; + dprintk(1, "%s()\n", __func__); +- *freq = priv->freq_hz; ++ *freq = priv->freq_hz + priv->freq_offset; + return 0; + } + +diff --git a/drivers/media/usb/au0828/au0828-video.c b/drivers/media/usb/au0828/au0828-video.c +index f6154546b5c0..7ed75efa1c36 100644 +--- a/drivers/media/usb/au0828/au0828-video.c ++++ b/drivers/media/usb/au0828/au0828-video.c +@@ -787,11 +787,27 @@ static int au0828_i2s_init(struct au0828_dev *dev) + + /* + * Auvitek au0828 analog stream enable +- * Please set interface0 to AS5 before enable the stream + */ + static int au0828_analog_stream_enable(struct au0828_dev *d) + { ++ struct usb_interface *iface; ++ int ret; ++ + dprintk(1, "au0828_analog_stream_enable called\n"); ++ ++ iface = usb_ifnum_to_if(d->usbdev, 0); ++ if (iface && iface->cur_altsetting->desc.bAlternateSetting != 5) { ++ dprintk(1, "Changing intf#0 to alt 5\n"); ++ /* set au0828 interface0 to AS5 here again */ ++ ret = usb_set_interface(d->usbdev, 0, 5); ++ if (ret < 0) { ++ printk(KERN_INFO "Au0828 can't set alt setting to 5!\n"); ++ return -EBUSY; ++ } ++ } ++ ++ /* FIXME: size should be calculated using d->width, d->height */ ++ + au0828_writereg(d, AU0828_SENSORCTRL_VBI_103, 0x00); + au0828_writereg(d, 0x106, 0x00); + /* set x position */ +@@ -1002,15 +1018,6 @@ static int au0828_v4l2_open(struct file *filp) + return -ERESTARTSYS; + } + if (dev->users == 0) { +- /* set au0828 interface0 to AS5 here again */ +- ret = usb_set_interface(dev->usbdev, 0, 5); +- if (ret < 0) { +- mutex_unlock(&dev->lock); +- printk(KERN_INFO "Au0828 can't set alternate to 5!\n"); +- kfree(fh); +- return -EBUSY; +- } +- + au0828_analog_stream_enable(dev); + au0828_analog_stream_reset(dev); + +@@ -1252,13 +1259,6 @@ static int au0828_set_format(struct au0828_dev *dev, unsigned int cmd, + } + } + +- /* set au0828 interface0 to AS5 here again */ +- ret = usb_set_interface(dev->usbdev, 0, 5); +- if (ret < 0) { +- printk(KERN_INFO "Au0828 can't set alt setting to 5!\n"); +- return -EBUSY; +- } +- + au0828_analog_stream_enable(dev); + + return 0; +diff --git a/drivers/mfd/omap-usb-host.c b/drivers/mfd/omap-usb-host.c +index 90b630ccc8bc..0aefe501fd3c 100644 +--- a/drivers/mfd/omap-usb-host.c ++++ b/drivers/mfd/omap-usb-host.c +@@ -445,7 +445,7 @@ static unsigned omap_usbhs_rev1_hostconfig(struct usbhs_hcd_omap *omap, + + for (i = 0; i < omap->nports; i++) { + if (is_ehci_phy_mode(pdata->port_mode[i])) { +- reg &= OMAP_UHH_HOSTCONFIG_ULPI_BYPASS; ++ reg &= ~OMAP_UHH_HOSTCONFIG_ULPI_BYPASS; + break; + } + } +diff --git a/drivers/mtd/ftl.c b/drivers/mtd/ftl.c +index 19d637266fcd..71e4f6ccae2f 100644 +--- a/drivers/mtd/ftl.c ++++ b/drivers/mtd/ftl.c +@@ -1075,7 +1075,6 @@ static void ftl_add_mtd(struct mtd_blktrans_ops *tr, struct mtd_info *mtd) + return; + } + +- ftl_freepart(partition); + kfree(partition); + } + +diff --git a/drivers/mtd/nand/omap2.c b/drivers/mtd/nand/omap2.c +index 6f55d92dc233..64d8e32b6ca0 100644 +--- a/drivers/mtd/nand/omap2.c ++++ b/drivers/mtd/nand/omap2.c +@@ -933,7 +933,7 @@ static int omap_calculate_ecc(struct mtd_info *mtd, const u_char *dat, + u32 val; + + val = readl(info->reg.gpmc_ecc_config); +- if (((val >> ECC_CONFIG_CS_SHIFT) & ~CS_MASK) != info->gpmc_cs) ++ if (((val >> ECC_CONFIG_CS_SHIFT) & CS_MASK) != info->gpmc_cs) + return -EINVAL; + + /* read ecc result */ +diff --git a/drivers/power/bq2415x_charger.c b/drivers/power/bq2415x_charger.c +index 79a37f6d3307..e384844a1ae1 100644 +--- a/drivers/power/bq2415x_charger.c ++++ b/drivers/power/bq2415x_charger.c +@@ -840,8 +840,7 @@ static int bq2415x_notifier_call(struct notifier_block *nb, + if (bq->automode < 1) + return NOTIFY_OK; + +- sysfs_notify(&bq->charger.dev->kobj, NULL, "reported_mode"); +- bq2415x_set_mode(bq, bq->reported_mode); ++ schedule_delayed_work(&bq->work, 0); + + return NOTIFY_OK; + } +@@ -892,6 +891,11 @@ static void bq2415x_timer_work(struct work_struct *work) + int error; + int boost; + ++ if (bq->automode > 0 && (bq->reported_mode != bq->mode)) { ++ sysfs_notify(&bq->charger.dev->kobj, NULL, "reported_mode"); ++ bq2415x_set_mode(bq, bq->reported_mode); ++ } ++ + if (!bq->autotimer) + return; + +diff --git a/drivers/regulator/arizona-ldo1.c b/drivers/regulator/arizona-ldo1.c +index f0ea4fdfde87..8b963a757883 100644 +--- a/drivers/regulator/arizona-ldo1.c ++++ b/drivers/regulator/arizona-ldo1.c +@@ -141,8 +141,6 @@ static struct regulator_ops arizona_ldo1_ops = { + .map_voltage = regulator_map_voltage_linear, + .get_voltage_sel = regulator_get_voltage_sel_regmap, + .set_voltage_sel = regulator_set_voltage_sel_regmap, +- .get_bypass = regulator_get_bypass_regmap, +- .set_bypass = regulator_set_bypass_regmap, + }; + + static const struct regulator_desc arizona_ldo1 = { +diff --git a/drivers/scsi/bfa/bfa_ioc.h b/drivers/scsi/bfa/bfa_ioc.h +index 2e28392c2fb6..a38aafa030b3 100644 +--- a/drivers/scsi/bfa/bfa_ioc.h ++++ b/drivers/scsi/bfa/bfa_ioc.h +@@ -72,7 +72,7 @@ struct bfa_sge_s { + } while (0) + + #define bfa_swap_words(_x) ( \ +- ((_x) << 32) | ((_x) >> 32)) ++ ((u64)(_x) << 32) | ((u64)(_x) >> 32)) + + #ifdef __BIG_ENDIAN + #define bfa_sge_to_be(_x) +diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c +index f969aca0b54e..49014a143c6a 100644 +--- a/drivers/scsi/scsi_devinfo.c ++++ b/drivers/scsi/scsi_devinfo.c +@@ -222,6 +222,7 @@ static struct { + {"PIONEER", "CD-ROM DRM-602X", NULL, BLIST_FORCELUN | BLIST_SINGLELUN}, + {"PIONEER", "CD-ROM DRM-604X", NULL, BLIST_FORCELUN | BLIST_SINGLELUN}, + {"PIONEER", "CD-ROM DRM-624X", NULL, BLIST_FORCELUN | BLIST_SINGLELUN}, ++ {"Promise", "VTrak E610f", NULL, BLIST_SPARSELUN | BLIST_NO_RSOC}, + {"Promise", "", NULL, BLIST_SPARSELUN}, + {"QUANTUM", "XP34301", "1071", BLIST_NOTQ}, + {"REGAL", "CDC-4X", NULL, BLIST_MAX5LUN | BLIST_SINGLELUN}, +diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c +index 4109530e92a0..054ec2c412a4 100644 +--- a/drivers/scsi/scsi_scan.c ++++ b/drivers/scsi/scsi_scan.c +@@ -922,6 +922,12 @@ static int scsi_add_lun(struct scsi_device *sdev, unsigned char *inq_result, + if (*bflags & BLIST_USE_10_BYTE_MS) + sdev->use_10_for_ms = 1; + ++ /* some devices don't like REPORT SUPPORTED OPERATION CODES ++ * and will simply timeout causing sd_mod init to take a very ++ * very long time */ ++ if (*bflags & BLIST_NO_RSOC) ++ sdev->no_report_opcodes = 1; ++ + /* set the device running here so that slave configure + * may do I/O */ + ret = scsi_device_set_state(sdev, SDEV_RUNNING); +@@ -950,7 +956,9 @@ static int scsi_add_lun(struct scsi_device *sdev, unsigned char *inq_result, + + sdev->eh_timeout = SCSI_DEFAULT_EH_TIMEOUT; + +- if (*bflags & BLIST_SKIP_VPD_PAGES) ++ if (*bflags & BLIST_TRY_VPD_PAGES) ++ sdev->try_vpd_pages = 1; ++ else if (*bflags & BLIST_SKIP_VPD_PAGES) + sdev->skip_vpd_pages = 1; + + transport_configure_device(&sdev->sdev_gendev); +@@ -1236,6 +1244,12 @@ static void scsi_sequential_lun_scan(struct scsi_target *starget, + max_dev_lun = min(8U, max_dev_lun); + + /* ++ * Stop scanning at 255 unless BLIST_SCSI3LUN ++ */ ++ if (!(bflags & BLIST_SCSI3LUN)) ++ max_dev_lun = min(256U, max_dev_lun); ++ ++ /* + * We have already scanned LUN 0, so start at LUN 1. Keep scanning + * until we reach the max, or no LUN is found and we are not + * sparse_lun. +diff --git a/drivers/scsi/scsi_transport_srp.c b/drivers/scsi/scsi_transport_srp.c +index d47ffc8d3e43..e3e794ee7ddd 100644 +--- a/drivers/scsi/scsi_transport_srp.c ++++ b/drivers/scsi/scsi_transport_srp.c +@@ -473,7 +473,8 @@ static void __srp_start_tl_fail_timers(struct srp_rport *rport) + if (delay > 0) + queue_delayed_work(system_long_wq, &rport->reconnect_work, + 1UL * delay * HZ); +- if (srp_rport_set_state(rport, SRP_RPORT_BLOCKED) == 0) { ++ if ((fast_io_fail_tmo >= 0 || dev_loss_tmo >= 0) && ++ srp_rport_set_state(rport, SRP_RPORT_BLOCKED) == 0) { + pr_debug("%s new state: %d\n", dev_name(&shost->shost_gendev), + rport->state); + scsi_target_block(&shost->shost_gendev); +diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c +index 36d1a23f14be..e8abb731c7ec 100644 +--- a/drivers/scsi/sd.c ++++ b/drivers/scsi/sd.c +@@ -2686,6 +2686,11 @@ static void sd_read_write_same(struct scsi_disk *sdkp, unsigned char *buffer) + + static int sd_try_extended_inquiry(struct scsi_device *sdp) + { ++ /* Attempt VPD inquiry if the device blacklist explicitly calls ++ * for it. ++ */ ++ if (sdp->try_vpd_pages) ++ return 1; + /* + * Although VPD inquiries can go to SCSI-2 type devices, + * some USB ones crash on receiving them, and the pages +diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c +index 9969fa1ef7c4..ed0f899e8aa5 100644 +--- a/drivers/scsi/storvsc_drv.c ++++ b/drivers/scsi/storvsc_drv.c +@@ -33,6 +33,7 @@ + #include <linux/device.h> + #include <linux/hyperv.h> + #include <linux/mempool.h> ++#include <linux/blkdev.h> + #include <scsi/scsi.h> + #include <scsi/scsi_cmnd.h> + #include <scsi/scsi_host.h> +@@ -330,17 +331,17 @@ static int storvsc_timeout = 180; + + static void storvsc_on_channel_callback(void *context); + +-/* +- * In Hyper-V, each port/path/target maps to 1 scsi host adapter. In +- * reality, the path/target is not used (ie always set to 0) so our +- * scsi host adapter essentially has 1 bus with 1 target that contains +- * up to 256 luns. +- */ +-#define STORVSC_MAX_LUNS_PER_TARGET 64 +-#define STORVSC_MAX_TARGETS 1 +-#define STORVSC_MAX_CHANNELS 1 ++#define STORVSC_MAX_LUNS_PER_TARGET 255 ++#define STORVSC_MAX_TARGETS 2 ++#define STORVSC_MAX_CHANNELS 8 + ++#define STORVSC_FC_MAX_LUNS_PER_TARGET 255 ++#define STORVSC_FC_MAX_TARGETS 128 ++#define STORVSC_FC_MAX_CHANNELS 8 + ++#define STORVSC_IDE_MAX_LUNS_PER_TARGET 64 ++#define STORVSC_IDE_MAX_TARGETS 1 ++#define STORVSC_IDE_MAX_CHANNELS 1 + + struct storvsc_cmd_request { + struct list_head entry; +@@ -1017,6 +1018,13 @@ static void storvsc_handle_error(struct vmscsi_request *vm_srb, + case ATA_12: + set_host_byte(scmnd, DID_PASSTHROUGH); + break; ++ /* ++ * On Some Windows hosts TEST_UNIT_READY command can return ++ * SRB_STATUS_ERROR, let the upper level code deal with it ++ * based on the sense information. ++ */ ++ case TEST_UNIT_READY: ++ break; + default: + set_host_byte(scmnd, DID_TARGET_FAILURE); + } +@@ -1518,6 +1526,16 @@ static int storvsc_host_reset_handler(struct scsi_cmnd *scmnd) + return SUCCESS; + } + ++/* ++ * The host guarantees to respond to each command, although I/O latencies might ++ * be unbounded on Azure. Reset the timer unconditionally to give the host a ++ * chance to perform EH. ++ */ ++static enum blk_eh_timer_return storvsc_eh_timed_out(struct scsi_cmnd *scmnd) ++{ ++ return BLK_EH_RESET_TIMER; ++} ++ + static bool storvsc_scsi_cmd_ok(struct scsi_cmnd *scmnd) + { + bool allowed = true; +@@ -1553,9 +1571,19 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd) + struct vmscsi_request *vm_srb; + struct stor_mem_pools *memp = scmnd->device->hostdata; + +- if (!storvsc_scsi_cmd_ok(scmnd)) { +- scmnd->scsi_done(scmnd); +- return 0; ++ if (vmstor_current_major <= VMSTOR_WIN8_MAJOR) { ++ /* ++ * On legacy hosts filter unimplemented commands. ++ * Future hosts are expected to correctly handle ++ * unsupported commands. Furthermore, it is ++ * possible that some of the currently ++ * unsupported commands maybe supported in ++ * future versions of the host. ++ */ ++ if (!storvsc_scsi_cmd_ok(scmnd)) { ++ scmnd->scsi_done(scmnd); ++ return 0; ++ } + } + + request_size = sizeof(struct storvsc_cmd_request); +@@ -1580,26 +1608,24 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd) + vm_srb = &cmd_request->vstor_packet.vm_srb; + vm_srb->win8_extension.time_out_value = 60; + ++ vm_srb->win8_extension.srb_flags |= ++ (SRB_FLAGS_QUEUE_ACTION_ENABLE | ++ SRB_FLAGS_DISABLE_SYNCH_TRANSFER); + + /* Build the SRB */ + switch (scmnd->sc_data_direction) { + case DMA_TO_DEVICE: + vm_srb->data_in = WRITE_TYPE; + vm_srb->win8_extension.srb_flags |= SRB_FLAGS_DATA_OUT; +- vm_srb->win8_extension.srb_flags |= +- (SRB_FLAGS_QUEUE_ACTION_ENABLE | +- SRB_FLAGS_DISABLE_SYNCH_TRANSFER); + break; + case DMA_FROM_DEVICE: + vm_srb->data_in = READ_TYPE; + vm_srb->win8_extension.srb_flags |= SRB_FLAGS_DATA_IN; +- vm_srb->win8_extension.srb_flags |= +- (SRB_FLAGS_QUEUE_ACTION_ENABLE | +- SRB_FLAGS_DISABLE_SYNCH_TRANSFER); + break; + default: + vm_srb->data_in = UNKNOWN_TYPE; +- vm_srb->win8_extension.srb_flags = 0; ++ vm_srb->win8_extension.srb_flags |= (SRB_FLAGS_DATA_IN | ++ SRB_FLAGS_DATA_OUT); + break; + } + +@@ -1687,11 +1713,11 @@ static struct scsi_host_template scsi_driver = { + .bios_param = storvsc_get_chs, + .queuecommand = storvsc_queuecommand, + .eh_host_reset_handler = storvsc_host_reset_handler, ++ .eh_timed_out = storvsc_eh_timed_out, + .slave_alloc = storvsc_device_alloc, + .slave_destroy = storvsc_device_destroy, + .slave_configure = storvsc_device_configure, +- .cmd_per_lun = 1, +- /* 64 max_queue * 1 target */ ++ .cmd_per_lun = 255, + .can_queue = STORVSC_MAX_IO_REQUESTS*STORVSC_MAX_TARGETS, + .this_id = -1, + /* no use setting to 0 since ll_blk_rw reset it to 1 */ +@@ -1743,19 +1769,25 @@ static int storvsc_probe(struct hv_device *device, + * set state to properly communicate with the host. + */ + +- if (vmbus_proto_version == VERSION_WIN8) { +- sense_buffer_size = POST_WIN7_STORVSC_SENSE_BUFFER_SIZE; +- vmscsi_size_delta = 0; +- vmstor_current_major = VMSTOR_WIN8_MAJOR; +- vmstor_current_minor = VMSTOR_WIN8_MINOR; +- } else { ++ switch (vmbus_proto_version) { ++ case VERSION_WS2008: ++ case VERSION_WIN7: + sense_buffer_size = PRE_WIN8_STORVSC_SENSE_BUFFER_SIZE; + vmscsi_size_delta = sizeof(struct vmscsi_win8_extension); + vmstor_current_major = VMSTOR_WIN7_MAJOR; + vmstor_current_minor = VMSTOR_WIN7_MINOR; ++ break; ++ default: ++ sense_buffer_size = POST_WIN7_STORVSC_SENSE_BUFFER_SIZE; ++ vmscsi_size_delta = 0; ++ vmstor_current_major = VMSTOR_WIN8_MAJOR; ++ vmstor_current_minor = VMSTOR_WIN8_MINOR; ++ break; + } + +- ++ if (dev_id->driver_data == SFC_GUID) ++ scsi_driver.can_queue = (STORVSC_MAX_IO_REQUESTS * ++ STORVSC_FC_MAX_TARGETS); + host = scsi_host_alloc(&scsi_driver, + sizeof(struct hv_host_device)); + if (!host) +@@ -1789,12 +1821,25 @@ static int storvsc_probe(struct hv_device *device, + host_dev->path = stor_device->path_id; + host_dev->target = stor_device->target_id; + +- /* max # of devices per target */ +- host->max_lun = STORVSC_MAX_LUNS_PER_TARGET; +- /* max # of targets per channel */ +- host->max_id = STORVSC_MAX_TARGETS; +- /* max # of channels */ +- host->max_channel = STORVSC_MAX_CHANNELS - 1; ++ switch (dev_id->driver_data) { ++ case SFC_GUID: ++ host->max_lun = STORVSC_FC_MAX_LUNS_PER_TARGET; ++ host->max_id = STORVSC_FC_MAX_TARGETS; ++ host->max_channel = STORVSC_FC_MAX_CHANNELS - 1; ++ break; ++ ++ case SCSI_GUID: ++ host->max_lun = STORVSC_MAX_LUNS_PER_TARGET; ++ host->max_id = STORVSC_MAX_TARGETS; ++ host->max_channel = STORVSC_MAX_CHANNELS - 1; ++ break; ++ ++ default: ++ host->max_lun = STORVSC_IDE_MAX_LUNS_PER_TARGET; ++ host->max_id = STORVSC_IDE_MAX_TARGETS; ++ host->max_channel = STORVSC_IDE_MAX_CHANNELS - 1; ++ break; ++ } + /* max cmd length */ + host->max_cmd_len = STORVSC_MAX_CMD_LEN; + +diff --git a/drivers/spi/spi-omap2-mcspi.c b/drivers/spi/spi-omap2-mcspi.c +index a72127f08e39..a64f1557c156 100644 +--- a/drivers/spi/spi-omap2-mcspi.c ++++ b/drivers/spi/spi-omap2-mcspi.c +@@ -147,6 +147,7 @@ struct omap2_mcspi_cs { + void __iomem *base; + unsigned long phys; + int word_len; ++ u16 mode; + struct list_head node; + /* Context save and restore shadow register */ + u32 chconf0; +@@ -899,6 +900,8 @@ static int omap2_mcspi_setup_transfer(struct spi_device *spi, + + mcspi_write_chconf0(spi, l); + ++ cs->mode = spi->mode; ++ + dev_dbg(&spi->dev, "setup: speed %d, sample %s edge, clk %s\n", + OMAP2_MCSPI_MAX_FREQ >> div, + (spi->mode & SPI_CPHA) ? "trailing" : "leading", +@@ -971,6 +974,7 @@ static int omap2_mcspi_setup(struct spi_device *spi) + return -ENOMEM; + cs->base = mcspi->base + spi->chip_select * 0x14; + cs->phys = mcspi->phys + spi->chip_select * 0x14; ++ cs->mode = 0; + cs->chconf0 = 0; + spi->controller_state = cs; + /* Link this to context save list */ +@@ -1051,6 +1055,16 @@ static void omap2_mcspi_work(struct omap2_mcspi *mcspi, struct spi_message *m) + cs = spi->controller_state; + cd = spi->controller_data; + ++ /* ++ * The slave driver could have changed spi->mode in which case ++ * it will be different from cs->mode (the current hardware setup). ++ * If so, set par_override (even though its not a parity issue) so ++ * omap2_mcspi_setup_transfer will be called to configure the hardware ++ * with the correct mode on the first iteration of the loop below. ++ */ ++ if (spi->mode != cs->mode) ++ par_override = 1; ++ + omap2_mcspi_set_enable(spi, 0); + list_for_each_entry(t, &m->transfers, transfer_list) { + if (t->tx_buf == NULL && t->rx_buf == NULL && t->len) { +diff --git a/drivers/spi/spi-orion.c b/drivers/spi/spi-orion.c +index 7f2121fe2622..977b0619bb78 100644 +--- a/drivers/spi/spi-orion.c ++++ b/drivers/spi/spi-orion.c +@@ -404,8 +404,6 @@ static int orion_spi_probe(struct platform_device *pdev) + struct resource *r; + unsigned long tclk_hz; + int status = 0; +- const u32 *iprop; +- int size; + + master = spi_alloc_master(&pdev->dev, sizeof(*spi)); + if (master == NULL) { +@@ -416,10 +414,10 @@ static int orion_spi_probe(struct platform_device *pdev) + if (pdev->id != -1) + master->bus_num = pdev->id; + if (pdev->dev.of_node) { +- iprop = of_get_property(pdev->dev.of_node, "cell-index", +- &size); +- if (iprop && size == sizeof(*iprop)) +- master->bus_num = *iprop; ++ u32 cell_index; ++ if (!of_property_read_u32(pdev->dev.of_node, "cell-index", ++ &cell_index)) ++ master->bus_num = cell_index; + } + + /* we support only mode 0, and no options */ +diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c +index c702fc536a77..ced9ecffa163 100644 +--- a/drivers/spi/spi-pxa2xx.c ++++ b/drivers/spi/spi-pxa2xx.c +@@ -1078,6 +1078,7 @@ static struct acpi_device_id pxa2xx_spi_acpi_match[] = { + { "INT3430", 0 }, + { "INT3431", 0 }, + { "80860F0E", 0 }, ++ { "8086228E", 0 }, + { }, + }; + MODULE_DEVICE_TABLE(acpi, pxa2xx_spi_acpi_match); +diff --git a/drivers/xen/events/events_fifo.c b/drivers/xen/events/events_fifo.c +index 172a8bc27abd..ef7d446e07ee 100644 +--- a/drivers/xen/events/events_fifo.c ++++ b/drivers/xen/events/events_fifo.c +@@ -99,6 +99,25 @@ static unsigned evtchn_fifo_nr_channels(void) + return event_array_pages * EVENT_WORDS_PER_PAGE; + } + ++static int init_control_block(int cpu, ++ struct evtchn_fifo_control_block *control_block) ++{ ++ struct evtchn_fifo_queue *q = &per_cpu(cpu_queue, cpu); ++ struct evtchn_init_control init_control; ++ unsigned int i; ++ ++ /* Reset the control block and the local HEADs. */ ++ clear_page(control_block); ++ for (i = 0; i < EVTCHN_FIFO_MAX_QUEUES; i++) ++ q->head[i] = 0; ++ ++ init_control.control_gfn = virt_to_mfn(control_block); ++ init_control.offset = 0; ++ init_control.vcpu = cpu; ++ ++ return HYPERVISOR_event_channel_op(EVTCHNOP_init_control, &init_control); ++} ++ + static void free_unused_array_pages(void) + { + unsigned i; +@@ -327,7 +346,6 @@ static void evtchn_fifo_resume(void) + + for_each_possible_cpu(cpu) { + void *control_block = per_cpu(cpu_control_block, cpu); +- struct evtchn_init_control init_control; + int ret; + + if (!control_block) +@@ -344,12 +362,7 @@ static void evtchn_fifo_resume(void) + continue; + } + +- init_control.control_gfn = virt_to_mfn(control_block); +- init_control.offset = 0; +- init_control.vcpu = cpu; +- +- ret = HYPERVISOR_event_channel_op(EVTCHNOP_init_control, +- &init_control); ++ ret = init_control_block(cpu, control_block); + if (ret < 0) + BUG(); + } +@@ -377,30 +390,25 @@ static const struct evtchn_ops evtchn_ops_fifo = { + .resume = evtchn_fifo_resume, + }; + +-static int evtchn_fifo_init_control_block(unsigned cpu) ++static int evtchn_fifo_alloc_control_block(unsigned cpu) + { +- struct page *control_block = NULL; +- struct evtchn_init_control init_control; ++ void *control_block = NULL; + int ret = -ENOMEM; + +- control_block = alloc_page(GFP_KERNEL|__GFP_ZERO); ++ control_block = (void *)__get_free_page(GFP_KERNEL); + if (control_block == NULL) + goto error; + +- init_control.control_gfn = virt_to_mfn(page_address(control_block)); +- init_control.offset = 0; +- init_control.vcpu = cpu; +- +- ret = HYPERVISOR_event_channel_op(EVTCHNOP_init_control, &init_control); ++ ret = init_control_block(cpu, control_block); + if (ret < 0) + goto error; + +- per_cpu(cpu_control_block, cpu) = page_address(control_block); ++ per_cpu(cpu_control_block, cpu) = control_block; + + return 0; + + error: +- __free_page(control_block); ++ free_page((unsigned long)control_block); + return ret; + } + +@@ -414,7 +422,7 @@ static int evtchn_fifo_cpu_notification(struct notifier_block *self, + switch (action) { + case CPU_UP_PREPARE: + if (!per_cpu(cpu_control_block, cpu)) +- ret = evtchn_fifo_init_control_block(cpu); ++ ret = evtchn_fifo_alloc_control_block(cpu); + break; + default: + break; +@@ -431,7 +439,7 @@ int __init xen_evtchn_fifo_init(void) + int cpu = get_cpu(); + int ret; + +- ret = evtchn_fifo_init_control_block(cpu); ++ ret = evtchn_fifo_alloc_control_block(cpu); + if (ret < 0) + goto out; + +diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h +index 30f6e9251a4a..f15d4353f30f 100644 +--- a/fs/cifs/cifsglob.h ++++ b/fs/cifs/cifsglob.h +@@ -70,11 +70,6 @@ + #define SERVER_NAME_LENGTH 40 + #define SERVER_NAME_LEN_WITH_NULL (SERVER_NAME_LENGTH + 1) + +-/* used to define string lengths for reversing unicode strings */ +-/* (256+1)*2 = 514 */ +-/* (max path length + 1 for null) * 2 for unicode */ +-#define MAX_NAME 514 +- + /* SMB echo "timeout" -- FIXME: tunable? */ + #define SMB_ECHO_INTERVAL (60 * HZ) + +diff --git a/fs/cifs/file.c b/fs/cifs/file.c +index 87c4dd072cde..8175b18df819 100644 +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -2844,7 +2844,7 @@ cifs_uncached_read_into_pages(struct TCP_Server_Info *server, + total_read += result; + } + +- return total_read > 0 ? total_read : result; ++ return total_read > 0 && result != -EAGAIN ? total_read : result; + } + + static ssize_t +@@ -3267,7 +3267,7 @@ cifs_readpages_read_into_pages(struct TCP_Server_Info *server, + total_read += result; + } + +- return total_read > 0 ? total_read : result; ++ return total_read > 0 && result != -EAGAIN ? total_read : result; + } + + static int cifs_readpages(struct file *file, struct address_space *mapping, +diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c +index aadc2b68678b..f2ddcf7ac9c3 100644 +--- a/fs/cifs/inode.c ++++ b/fs/cifs/inode.c +@@ -1706,13 +1706,22 @@ cifs_rename(struct inode *source_dir, struct dentry *source_dentry, + unlink_target: + /* Try unlinking the target dentry if it's not negative */ + if (target_dentry->d_inode && (rc == -EACCES || rc == -EEXIST)) { +- tmprc = cifs_unlink(target_dir, target_dentry); ++ if (d_is_dir(target_dentry)) ++ tmprc = cifs_rmdir(target_dir, target_dentry); ++ else ++ tmprc = cifs_unlink(target_dir, target_dentry); + if (tmprc) + goto cifs_rename_exit; + rc = cifs_do_rename(xid, source_dentry, from_name, + target_dentry, to_name); + } + ++ /* force revalidate to go get info when needed */ ++ CIFS_I(source_dir)->time = CIFS_I(target_dir)->time = 0; ++ ++ source_dir->i_ctime = source_dir->i_mtime = target_dir->i_ctime = ++ target_dir->i_mtime = current_fs_time(source_dir->i_sb); ++ + cifs_rename_exit: + kfree(info_buf_source); + kfree(from_name); +diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c +index b15862e0f68c..2bbf11b09214 100644 +--- a/fs/cifs/readdir.c ++++ b/fs/cifs/readdir.c +@@ -596,8 +596,8 @@ find_cifs_entry(const unsigned int xid, struct cifs_tcon *tcon, loff_t pos, + if (!cfile->srch_inf.endOfSearch && !cfile->invalidHandle) { + cfile->invalidHandle = true; + spin_unlock(&cifs_file_list_lock); +- if (server->ops->close) +- server->ops->close(xid, tcon, &cfile->fid); ++ if (server->ops->close_dir) ++ server->ops->close_dir(xid, tcon, &cfile->fid); + } else + spin_unlock(&cifs_file_list_lock); + if (cfile->srch_inf.ntwrk_buf_start) { +diff --git a/fs/cifs/smb2file.c b/fs/cifs/smb2file.c +index 3f17b4550831..45992944e238 100644 +--- a/fs/cifs/smb2file.c ++++ b/fs/cifs/smb2file.c +@@ -50,7 +50,7 @@ smb2_open_file(const unsigned int xid, struct cifs_open_parms *oparms, + goto out; + } + +- smb2_data = kzalloc(sizeof(struct smb2_file_all_info) + MAX_NAME * 2, ++ smb2_data = kzalloc(sizeof(struct smb2_file_all_info) + PATH_MAX * 2, + GFP_KERNEL); + if (smb2_data == NULL) { + rc = -ENOMEM; +diff --git a/fs/cifs/smb2inode.c b/fs/cifs/smb2inode.c +index 84c012a6aba0..215f8d3e3e53 100644 +--- a/fs/cifs/smb2inode.c ++++ b/fs/cifs/smb2inode.c +@@ -131,7 +131,7 @@ smb2_query_path_info(const unsigned int xid, struct cifs_tcon *tcon, + *adjust_tz = false; + *symlink = false; + +- smb2_data = kzalloc(sizeof(struct smb2_file_all_info) + MAX_NAME * 2, ++ smb2_data = kzalloc(sizeof(struct smb2_file_all_info) + PATH_MAX * 2, + GFP_KERNEL); + if (smb2_data == NULL) + return -ENOMEM; +diff --git a/fs/cifs/smb2maperror.c b/fs/cifs/smb2maperror.c +index 94bd4fbb13d3..e31a9dfdcd39 100644 +--- a/fs/cifs/smb2maperror.c ++++ b/fs/cifs/smb2maperror.c +@@ -605,7 +605,7 @@ static const struct status_to_posix_error smb2_error_map_table[] = { + {STATUS_MAPPED_FILE_SIZE_ZERO, -EIO, "STATUS_MAPPED_FILE_SIZE_ZERO"}, + {STATUS_TOO_MANY_OPENED_FILES, -EMFILE, "STATUS_TOO_MANY_OPENED_FILES"}, + {STATUS_CANCELLED, -EIO, "STATUS_CANCELLED"}, +- {STATUS_CANNOT_DELETE, -EIO, "STATUS_CANNOT_DELETE"}, ++ {STATUS_CANNOT_DELETE, -EACCES, "STATUS_CANNOT_DELETE"}, + {STATUS_INVALID_COMPUTER_NAME, -EIO, "STATUS_INVALID_COMPUTER_NAME"}, + {STATUS_FILE_DELETED, -EIO, "STATUS_FILE_DELETED"}, + {STATUS_SPECIAL_ACCOUNT, -EIO, "STATUS_SPECIAL_ACCOUNT"}, +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index 35ddc3ed119d..f8977b2d9187 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -339,7 +339,7 @@ smb2_query_file_info(const unsigned int xid, struct cifs_tcon *tcon, + int rc; + struct smb2_file_all_info *smb2_data; + +- smb2_data = kzalloc(sizeof(struct smb2_file_all_info) + MAX_NAME * 2, ++ smb2_data = kzalloc(sizeof(struct smb2_file_all_info) + PATH_MAX * 2, + GFP_KERNEL); + if (smb2_data == NULL) + return -ENOMEM; +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 049a3f2693ba..9aab8fe0e508 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -916,7 +916,8 @@ tcon_exit: + tcon_error_exit: + if (rsp->hdr.Status == STATUS_BAD_NETWORK_NAME) { + cifs_dbg(VFS, "BAD_NETWORK_NAME: %s\n", tree); +- tcon->bad_network_name = true; ++ if (tcon) ++ tcon->bad_network_name = true; + } + goto tcon_exit; + } +@@ -1539,7 +1540,7 @@ SMB2_query_info(const unsigned int xid, struct cifs_tcon *tcon, + { + return query_info(xid, tcon, persistent_fid, volatile_fid, + FILE_ALL_INFORMATION, +- sizeof(struct smb2_file_all_info) + MAX_NAME * 2, ++ sizeof(struct smb2_file_all_info) + PATH_MAX * 2, + sizeof(struct smb2_file_all_info), data); + } + +diff --git a/fs/dcache.c b/fs/dcache.c +index 7f3b4004c6c3..58d57da91d2a 100644 +--- a/fs/dcache.c ++++ b/fs/dcache.c +@@ -106,8 +106,7 @@ static inline struct hlist_bl_head *d_hash(const struct dentry *parent, + unsigned int hash) + { + hash += (unsigned long) parent / L1_CACHE_BYTES; +- hash = hash + (hash >> d_hash_shift); +- return dentry_hashtable + (hash & d_hash_mask); ++ return dentry_hashtable + hash_32(hash, d_hash_shift); + } + + /* Statistics gathering. */ +diff --git a/fs/namei.c b/fs/namei.c +index bdea10963aa5..d5a4faeb39a5 100644 +--- a/fs/namei.c ++++ b/fs/namei.c +@@ -34,6 +34,7 @@ + #include <linux/device_cgroup.h> + #include <linux/fs_struct.h> + #include <linux/posix_acl.h> ++#include <linux/hash.h> + #include <asm/uaccess.h> + + #include "internal.h" +@@ -1624,8 +1625,7 @@ static inline int nested_symlink(struct path *path, struct nameidata *nd) + + static inline unsigned int fold_hash(unsigned long hash) + { +- hash += hash >> (8*sizeof(int)); +- return hash; ++ return hash_64(hash, 32); + } + + #else /* 32-bit case */ +@@ -1797,7 +1797,7 @@ static int link_path_walk(const char *name, struct nameidata *nd) + if (err) + return err; + } +- if (!d_is_directory(nd->path.dentry)) { ++ if (!d_can_lookup(nd->path.dentry)) { + err = -ENOTDIR; + break; + } +@@ -1818,7 +1818,7 @@ static int path_init(int dfd, const char *name, unsigned int flags, + struct dentry *root = nd->root.dentry; + struct inode *inode = root->d_inode; + if (*name) { +- if (!d_is_directory(root)) ++ if (!d_can_lookup(root)) + return -ENOTDIR; + retval = inode_permission(inode, MAY_EXEC); + if (retval) +@@ -1874,7 +1874,7 @@ static int path_init(int dfd, const char *name, unsigned int flags, + dentry = f.file->f_path.dentry; + + if (*name) { +- if (!d_is_directory(dentry)) { ++ if (!d_can_lookup(dentry)) { + fdput(f); + return -ENOTDIR; + } +@@ -1956,7 +1956,7 @@ static int path_lookupat(int dfd, const char *name, + err = complete_walk(nd); + + if (!err && nd->flags & LOOKUP_DIRECTORY) { +- if (!d_is_directory(nd->path.dentry)) { ++ if (!d_can_lookup(nd->path.dentry)) { + path_put(&nd->path); + err = -ENOTDIR; + } +@@ -2416,11 +2416,11 @@ static int may_delete(struct inode *dir, struct dentry *victim, bool isdir) + IS_IMMUTABLE(inode) || IS_SWAPFILE(inode)) + return -EPERM; + if (isdir) { +- if (!d_is_directory(victim) && !d_is_autodir(victim)) ++ if (!d_is_dir(victim)) + return -ENOTDIR; + if (IS_ROOT(victim)) + return -EBUSY; +- } else if (d_is_directory(victim) || d_is_autodir(victim)) ++ } else if (d_is_dir(victim)) + return -EISDIR; + if (IS_DEADDIR(dir)) + return -ENOENT; +@@ -3018,11 +3018,10 @@ finish_open: + } + audit_inode(name, nd->path.dentry, 0); + error = -EISDIR; +- if ((open_flag & O_CREAT) && +- (d_is_directory(nd->path.dentry) || d_is_autodir(nd->path.dentry))) ++ if ((open_flag & O_CREAT) && d_is_dir(nd->path.dentry)) + goto out; + error = -ENOTDIR; +- if ((nd->flags & LOOKUP_DIRECTORY) && !d_is_directory(nd->path.dentry)) ++ if ((nd->flags & LOOKUP_DIRECTORY) && !d_can_lookup(nd->path.dentry)) + goto out; + if (!S_ISREG(nd->inode->i_mode)) + will_truncate = false; +@@ -3746,7 +3745,7 @@ exit1: + slashes: + if (d_is_negative(dentry)) + error = -ENOENT; +- else if (d_is_directory(dentry) || d_is_autodir(dentry)) ++ else if (d_is_dir(dentry)) + error = -EISDIR; + else + error = -ENOTDIR; +@@ -4125,7 +4124,7 @@ int vfs_rename(struct inode *old_dir, struct dentry *old_dentry, + struct inode **delegated_inode) + { + int error; +- int is_dir = d_is_directory(old_dentry) || d_is_autodir(old_dentry); ++ int is_dir = d_is_dir(old_dentry); + const unsigned char *old_name; + + if (old_dentry->d_inode == new_dentry->d_inode) +@@ -4218,7 +4217,7 @@ retry_deleg: + if (d_is_negative(old_dentry)) + goto exit4; + /* unless the source is a directory trailing slashes give -ENOTDIR */ +- if (!d_is_directory(old_dentry) && !d_is_autodir(old_dentry)) { ++ if (!d_is_dir(old_dentry)) { + error = -ENOTDIR; + if (oldnd.last.name[oldnd.last.len]) + goto exit4; +diff --git a/fs/namespace.c b/fs/namespace.c +index 65233a5f390a..75536db4b69b 100644 +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -777,6 +777,20 @@ static void attach_mnt(struct mount *mnt, + list_add_tail(&mnt->mnt_child, &parent->mnt_mounts); + } + ++static void attach_shadowed(struct mount *mnt, ++ struct mount *parent, ++ struct mount *shadows) ++{ ++ if (shadows) { ++ hlist_add_after_rcu(&shadows->mnt_hash, &mnt->mnt_hash); ++ list_add(&mnt->mnt_child, &shadows->mnt_child); ++ } else { ++ hlist_add_head_rcu(&mnt->mnt_hash, ++ m_hash(&parent->mnt, mnt->mnt_mountpoint)); ++ list_add_tail(&mnt->mnt_child, &parent->mnt_mounts); ++ } ++} ++ + /* + * vfsmount lock must be held for write + */ +@@ -795,12 +809,7 @@ static void commit_tree(struct mount *mnt, struct mount *shadows) + + list_splice(&head, n->list.prev); + +- if (shadows) +- hlist_add_after_rcu(&shadows->mnt_hash, &mnt->mnt_hash); +- else +- hlist_add_head_rcu(&mnt->mnt_hash, +- m_hash(&parent->mnt, mnt->mnt_mountpoint)); +- list_add_tail(&mnt->mnt_child, &parent->mnt_mounts); ++ attach_shadowed(mnt, parent, shadows); + touch_mnt_namespace(n); + } + +@@ -887,8 +896,21 @@ static struct mount *clone_mnt(struct mount *old, struct dentry *root, + + mnt->mnt.mnt_flags = old->mnt.mnt_flags & ~(MNT_WRITE_HOLD|MNT_MARKED); + /* Don't allow unprivileged users to change mount flags */ +- if ((flag & CL_UNPRIVILEGED) && (mnt->mnt.mnt_flags & MNT_READONLY)) +- mnt->mnt.mnt_flags |= MNT_LOCK_READONLY; ++ if (flag & CL_UNPRIVILEGED) { ++ mnt->mnt.mnt_flags |= MNT_LOCK_ATIME; ++ ++ if (mnt->mnt.mnt_flags & MNT_READONLY) ++ mnt->mnt.mnt_flags |= MNT_LOCK_READONLY; ++ ++ if (mnt->mnt.mnt_flags & MNT_NODEV) ++ mnt->mnt.mnt_flags |= MNT_LOCK_NODEV; ++ ++ if (mnt->mnt.mnt_flags & MNT_NOSUID) ++ mnt->mnt.mnt_flags |= MNT_LOCK_NOSUID; ++ ++ if (mnt->mnt.mnt_flags & MNT_NOEXEC) ++ mnt->mnt.mnt_flags |= MNT_LOCK_NOEXEC; ++ } + + /* Don't allow unprivileged users to reveal what is under a mount */ + if ((flag & CL_UNPRIVILEGED) && list_empty(&old->mnt_expire)) +@@ -1204,6 +1226,11 @@ static void namespace_unlock(void) + head.first->pprev = &head.first; + INIT_HLIST_HEAD(&unmounted); + ++ /* undo decrements we'd done in umount_tree() */ ++ hlist_for_each_entry(mnt, &head, mnt_hash) ++ if (mnt->mnt_ex_mountpoint.mnt) ++ mntget(mnt->mnt_ex_mountpoint.mnt); ++ + up_write(&namespace_sem); + + synchronize_rcu(); +@@ -1240,6 +1267,9 @@ void umount_tree(struct mount *mnt, int how) + hlist_add_head(&p->mnt_hash, &tmp_list); + } + ++ hlist_for_each_entry(p, &tmp_list, mnt_hash) ++ list_del_init(&p->mnt_child); ++ + if (how) + propagate_umount(&tmp_list); + +@@ -1250,9 +1280,9 @@ void umount_tree(struct mount *mnt, int how) + p->mnt_ns = NULL; + if (how < 2) + p->mnt.mnt_flags |= MNT_SYNC_UMOUNT; +- list_del_init(&p->mnt_child); + if (mnt_has_parent(p)) { + put_mountpoint(p->mnt_mp); ++ mnt_add_count(p->mnt_parent, -1); + /* move the reference to mountpoint into ->mnt_ex_mountpoint */ + p->mnt_ex_mountpoint.dentry = p->mnt_mountpoint; + p->mnt_ex_mountpoint.mnt = &p->mnt_parent->mnt; +@@ -1483,6 +1513,7 @@ struct mount *copy_tree(struct mount *mnt, struct dentry *dentry, + continue; + + for (s = r; s; s = next_mnt(s, r)) { ++ struct mount *t = NULL; + if (!(flag & CL_COPY_UNBINDABLE) && + IS_MNT_UNBINDABLE(s)) { + s = skip_mnt_tree(s); +@@ -1504,7 +1535,14 @@ struct mount *copy_tree(struct mount *mnt, struct dentry *dentry, + goto out; + lock_mount_hash(); + list_add_tail(&q->mnt_list, &res->mnt_list); +- attach_mnt(q, parent, p->mnt_mp); ++ mnt_set_mountpoint(parent, p->mnt_mp, q); ++ if (!list_empty(&parent->mnt_mounts)) { ++ t = list_last_entry(&parent->mnt_mounts, ++ struct mount, mnt_child); ++ if (t->mnt_mp != p->mnt_mp) ++ t = NULL; ++ } ++ attach_shadowed(q, parent, t); + unlock_mount_hash(); + } + } +@@ -1887,9 +1925,6 @@ static int change_mount_flags(struct vfsmount *mnt, int ms_flags) + if (readonly_request == __mnt_is_readonly(mnt)) + return 0; + +- if (mnt->mnt_flags & MNT_LOCK_READONLY) +- return -EPERM; +- + if (readonly_request) + error = mnt_make_readonly(real_mount(mnt)); + else +@@ -1915,6 +1950,33 @@ static int do_remount(struct path *path, int flags, int mnt_flags, + if (path->dentry != path->mnt->mnt_root) + return -EINVAL; + ++ /* Don't allow changing of locked mnt flags. ++ * ++ * No locks need to be held here while testing the various ++ * MNT_LOCK flags because those flags can never be cleared ++ * once they are set. ++ */ ++ if ((mnt->mnt.mnt_flags & MNT_LOCK_READONLY) && ++ !(mnt_flags & MNT_READONLY)) { ++ return -EPERM; ++ } ++ if ((mnt->mnt.mnt_flags & MNT_LOCK_NODEV) && ++ !(mnt_flags & MNT_NODEV)) { ++ return -EPERM; ++ } ++ if ((mnt->mnt.mnt_flags & MNT_LOCK_NOSUID) && ++ !(mnt_flags & MNT_NOSUID)) { ++ return -EPERM; ++ } ++ if ((mnt->mnt.mnt_flags & MNT_LOCK_NOEXEC) && ++ !(mnt_flags & MNT_NOEXEC)) { ++ return -EPERM; ++ } ++ if ((mnt->mnt.mnt_flags & MNT_LOCK_ATIME) && ++ ((mnt->mnt.mnt_flags & MNT_ATIME_MASK) != (mnt_flags & MNT_ATIME_MASK))) { ++ return -EPERM; ++ } ++ + err = security_sb_remount(sb, data); + if (err) + return err; +@@ -1928,7 +1990,7 @@ static int do_remount(struct path *path, int flags, int mnt_flags, + err = do_remount_sb(sb, flags, data, 0); + if (!err) { + lock_mount_hash(); +- mnt_flags |= mnt->mnt.mnt_flags & MNT_PROPAGATION_MASK; ++ mnt_flags |= mnt->mnt.mnt_flags & ~MNT_USER_SETTABLE_MASK; + mnt->mnt.mnt_flags = mnt_flags; + touch_mnt_namespace(mnt->mnt_ns); + unlock_mount_hash(); +@@ -2113,7 +2175,7 @@ static int do_new_mount(struct path *path, const char *fstype, int flags, + */ + if (!(type->fs_flags & FS_USERNS_DEV_MOUNT)) { + flags |= MS_NODEV; +- mnt_flags |= MNT_NODEV; ++ mnt_flags |= MNT_NODEV | MNT_LOCK_NODEV; + } + } + +@@ -2427,6 +2489,14 @@ long do_mount(const char *dev_name, const char *dir_name, + if (flags & MS_RDONLY) + mnt_flags |= MNT_READONLY; + ++ /* The default atime for remount is preservation */ ++ if ((flags & MS_REMOUNT) && ++ ((flags & (MS_NOATIME | MS_NODIRATIME | MS_RELATIME | ++ MS_STRICTATIME)) == 0)) { ++ mnt_flags &= ~MNT_ATIME_MASK; ++ mnt_flags |= path.mnt->mnt_flags & MNT_ATIME_MASK; ++ } ++ + flags &= ~(MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_ACTIVE | MS_BORN | + MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT | + MS_STRICTATIME); +diff --git a/fs/pnode.c b/fs/pnode.c +index a364a704333b..b7f831089500 100644 +--- a/fs/pnode.c ++++ b/fs/pnode.c +@@ -381,6 +381,7 @@ static void __propagate_umount(struct mount *mnt) + * other children + */ + if (child && list_empty(&child->mnt_mounts)) { ++ list_del_init(&child->mnt_child); + hlist_del_init_rcu(&child->mnt_hash); + hlist_add_before_rcu(&child->mnt_hash, &mnt->mnt_hash); + } +diff --git a/fs/proc/array.c b/fs/proc/array.c +index 656e401794de..baf3464bbce0 100644 +--- a/fs/proc/array.c ++++ b/fs/proc/array.c +@@ -297,15 +297,11 @@ static void render_cap_t(struct seq_file *m, const char *header, + seq_puts(m, header); + CAP_FOR_EACH_U32(__capi) { + seq_printf(m, "%08x", +- a->cap[(_KERNEL_CAPABILITY_U32S-1) - __capi]); ++ a->cap[CAP_LAST_U32 - __capi]); + } + seq_putc(m, '\n'); + } + +-/* Remove non-existent capabilities */ +-#define NORM_CAPS(v) (v.cap[CAP_TO_INDEX(CAP_LAST_CAP)] &= \ +- CAP_TO_MASK(CAP_LAST_CAP + 1) - 1) +- + static inline void task_cap(struct seq_file *m, struct task_struct *p) + { + const struct cred *cred; +@@ -319,11 +315,6 @@ static inline void task_cap(struct seq_file *m, struct task_struct *p) + cap_bset = cred->cap_bset; + rcu_read_unlock(); + +- NORM_CAPS(cap_inheritable); +- NORM_CAPS(cap_permitted); +- NORM_CAPS(cap_effective); +- NORM_CAPS(cap_bset); +- + render_cap_t(m, "CapInh:\t", &cap_inheritable); + render_cap_t(m, "CapPrm:\t", &cap_permitted); + render_cap_t(m, "CapEff:\t", &cap_effective); +diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c +index db2cfb067d0b..5d2518b24cea 100644 +--- a/fs/xfs/xfs_aops.c ++++ b/fs/xfs/xfs_aops.c +@@ -1660,11 +1660,72 @@ xfs_vm_readpages( + return mpage_readpages(mapping, pages, nr_pages, xfs_get_blocks); + } + ++/* ++ * This is basically a copy of __set_page_dirty_buffers() with one ++ * small tweak: buffers beyond EOF do not get marked dirty. If we mark them ++ * dirty, we'll never be able to clean them because we don't write buffers ++ * beyond EOF, and that means we can't invalidate pages that span EOF ++ * that have been marked dirty. Further, the dirty state can leak into ++ * the file interior if the file is extended, resulting in all sorts of ++ * bad things happening as the state does not match the underlying data. ++ * ++ * XXX: this really indicates that bufferheads in XFS need to die. Warts like ++ * this only exist because of bufferheads and how the generic code manages them. ++ */ ++STATIC int ++xfs_vm_set_page_dirty( ++ struct page *page) ++{ ++ struct address_space *mapping = page->mapping; ++ struct inode *inode = mapping->host; ++ loff_t end_offset; ++ loff_t offset; ++ int newly_dirty; ++ ++ if (unlikely(!mapping)) ++ return !TestSetPageDirty(page); ++ ++ end_offset = i_size_read(inode); ++ offset = page_offset(page); ++ ++ spin_lock(&mapping->private_lock); ++ if (page_has_buffers(page)) { ++ struct buffer_head *head = page_buffers(page); ++ struct buffer_head *bh = head; ++ ++ do { ++ if (offset < end_offset) ++ set_buffer_dirty(bh); ++ bh = bh->b_this_page; ++ offset += 1 << inode->i_blkbits; ++ } while (bh != head); ++ } ++ newly_dirty = !TestSetPageDirty(page); ++ spin_unlock(&mapping->private_lock); ++ ++ if (newly_dirty) { ++ /* sigh - __set_page_dirty() is static, so copy it here, too */ ++ unsigned long flags; ++ ++ spin_lock_irqsave(&mapping->tree_lock, flags); ++ if (page->mapping) { /* Race with truncate? */ ++ WARN_ON_ONCE(!PageUptodate(page)); ++ account_page_dirtied(page, mapping); ++ radix_tree_tag_set(&mapping->page_tree, ++ page_index(page), PAGECACHE_TAG_DIRTY); ++ } ++ spin_unlock_irqrestore(&mapping->tree_lock, flags); ++ __mark_inode_dirty(mapping->host, I_DIRTY_PAGES); ++ } ++ return newly_dirty; ++} ++ + const struct address_space_operations xfs_address_space_operations = { + .readpage = xfs_vm_readpage, + .readpages = xfs_vm_readpages, + .writepage = xfs_vm_writepage, + .writepages = xfs_vm_writepages, ++ .set_page_dirty = xfs_vm_set_page_dirty, + .releasepage = xfs_vm_releasepage, + .invalidatepage = xfs_vm_invalidatepage, + .write_begin = xfs_vm_write_begin, +diff --git a/fs/xfs/xfs_dquot.c b/fs/xfs/xfs_dquot.c +index 7aeb4c895b32..95f94483c3d7 100644 +--- a/fs/xfs/xfs_dquot.c ++++ b/fs/xfs/xfs_dquot.c +@@ -1011,7 +1011,8 @@ xfs_qm_dqflush( + * Get the buffer containing the on-disk dquot + */ + error = xfs_trans_read_buf(mp, NULL, mp->m_ddev_targp, dqp->q_blkno, +- mp->m_quotainfo->qi_dqchunklen, 0, &bp, NULL); ++ mp->m_quotainfo->qi_dqchunklen, 0, &bp, ++ &xfs_dquot_buf_ops); + if (error) + goto out_unlock; + +diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c +index 64b48eade91d..f50def6018a9 100644 +--- a/fs/xfs/xfs_file.c ++++ b/fs/xfs/xfs_file.c +@@ -302,7 +302,16 @@ xfs_file_aio_read( + xfs_rw_iunlock(ip, XFS_IOLOCK_EXCL); + return ret; + } +- truncate_pagecache_range(VFS_I(ip), pos, -1); ++ ++ /* ++ * Invalidate whole pages. This can return an error if ++ * we fail to invalidate a page, but this should never ++ * happen on XFS. Warn if it does fail. ++ */ ++ ret = invalidate_inode_pages2_range(VFS_I(ip)->i_mapping, ++ pos >> PAGE_CACHE_SHIFT, -1); ++ WARN_ON_ONCE(ret); ++ ret = 0; + } + xfs_rw_ilock_demote(ip, XFS_IOLOCK_EXCL); + } +@@ -683,7 +692,15 @@ xfs_file_dio_aio_write( + pos, -1); + if (ret) + goto out; +- truncate_pagecache_range(VFS_I(ip), pos, -1); ++ /* ++ * Invalidate whole pages. This can return an error if ++ * we fail to invalidate a page, but this should never ++ * happen on XFS. Warn if it does fail. ++ */ ++ ret = invalidate_inode_pages2_range(VFS_I(ip)->i_mapping, ++ pos >> PAGE_CACHE_SHIFT, -1); ++ WARN_ON_ONCE(ret); ++ ret = 0; + } + + /* +diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c +index bce53ac81096..eb26418814fe 100644 +--- a/fs/xfs/xfs_log_recover.c ++++ b/fs/xfs/xfs_log_recover.c +@@ -2125,6 +2125,17 @@ xlog_recover_validate_buf_type( + __uint16_t magic16; + __uint16_t magicda; + ++ /* ++ * We can only do post recovery validation on items on CRC enabled ++ * fielsystems as we need to know when the buffer was written to be able ++ * to determine if we should have replayed the item. If we replay old ++ * metadata over a newer buffer, then it will enter a temporarily ++ * inconsistent state resulting in verification failures. Hence for now ++ * just avoid the verification stage for non-crc filesystems ++ */ ++ if (!xfs_sb_version_hascrc(&mp->m_sb)) ++ return; ++ + magic32 = be32_to_cpu(*(__be32 *)bp->b_addr); + magic16 = be16_to_cpu(*(__be16*)bp->b_addr); + magicda = be16_to_cpu(info->magic); +@@ -2160,8 +2171,6 @@ xlog_recover_validate_buf_type( + bp->b_ops = &xfs_agf_buf_ops; + break; + case XFS_BLFT_AGFL_BUF: +- if (!xfs_sb_version_hascrc(&mp->m_sb)) +- break; + if (magic32 != XFS_AGFL_MAGIC) { + xfs_warn(mp, "Bad AGFL block magic!"); + ASSERT(0); +@@ -2194,10 +2203,6 @@ xlog_recover_validate_buf_type( + #endif + break; + case XFS_BLFT_DINO_BUF: +- /* +- * we get here with inode allocation buffers, not buffers that +- * track unlinked list changes. +- */ + if (magic16 != XFS_DINODE_MAGIC) { + xfs_warn(mp, "Bad INODE block magic!"); + ASSERT(0); +@@ -2277,8 +2282,6 @@ xlog_recover_validate_buf_type( + bp->b_ops = &xfs_attr3_leaf_buf_ops; + break; + case XFS_BLFT_ATTR_RMT_BUF: +- if (!xfs_sb_version_hascrc(&mp->m_sb)) +- break; + if (magic32 != XFS_ATTR3_RMT_MAGIC) { + xfs_warn(mp, "Bad attr remote magic!"); + ASSERT(0); +@@ -2385,16 +2388,7 @@ xlog_recover_do_reg_buffer( + /* Shouldn't be any more regions */ + ASSERT(i == item->ri_total); + +- /* +- * We can only do post recovery validation on items on CRC enabled +- * fielsystems as we need to know when the buffer was written to be able +- * to determine if we should have replayed the item. If we replay old +- * metadata over a newer buffer, then it will enter a temporarily +- * inconsistent state resulting in verification failures. Hence for now +- * just avoid the verification stage for non-crc filesystems +- */ +- if (xfs_sb_version_hascrc(&mp->m_sb)) +- xlog_recover_validate_buf_type(mp, bp, buf_f); ++ xlog_recover_validate_buf_type(mp, bp, buf_f); + } + + /* +@@ -2502,12 +2496,29 @@ xlog_recover_buffer_pass2( + } + + /* +- * recover the buffer only if we get an LSN from it and it's less than ++ * Recover the buffer only if we get an LSN from it and it's less than + * the lsn of the transaction we are replaying. ++ * ++ * Note that we have to be extremely careful of readahead here. ++ * Readahead does not attach verfiers to the buffers so if we don't ++ * actually do any replay after readahead because of the LSN we found ++ * in the buffer if more recent than that current transaction then we ++ * need to attach the verifier directly. Failure to do so can lead to ++ * future recovery actions (e.g. EFI and unlinked list recovery) can ++ * operate on the buffers and they won't get the verifier attached. This ++ * can lead to blocks on disk having the correct content but a stale ++ * CRC. ++ * ++ * It is safe to assume these clean buffers are currently up to date. ++ * If the buffer is dirtied by a later transaction being replayed, then ++ * the verifier will be reset to match whatever recover turns that ++ * buffer into. + */ + lsn = xlog_recover_get_buf_lsn(mp, bp); +- if (lsn && lsn != -1 && XFS_LSN_CMP(lsn, current_lsn) >= 0) ++ if (lsn && lsn != -1 && XFS_LSN_CMP(lsn, current_lsn) >= 0) { ++ xlog_recover_validate_buf_type(mp, bp, buf_f); + goto out_release; ++ } + + if (buf_f->blf_flags & XFS_BLF_INODE_BUF) { + error = xlog_recover_do_inode_buffer(mp, item, bp, buf_f); +diff --git a/fs/xfs/xfs_qm.c b/fs/xfs/xfs_qm.c +index 348e4d2ed6e6..6d7d1de13403 100644 +--- a/fs/xfs/xfs_qm.c ++++ b/fs/xfs/xfs_qm.c +@@ -1176,6 +1176,12 @@ xfs_qm_dqiter_bufs( + if (error) + break; + ++ /* ++ * A corrupt buffer might not have a verifier attached, so ++ * make sure we have the correct one attached before writeback ++ * occurs. ++ */ ++ bp->b_ops = &xfs_dquot_buf_ops; + xfs_qm_reset_dqcounts(mp, bp, firstid, type); + xfs_buf_delwri_queue(bp, buffer_list); + xfs_buf_relse(bp); +@@ -1261,7 +1267,7 @@ xfs_qm_dqiterate( + xfs_buf_readahead(mp->m_ddev_targp, + XFS_FSB_TO_DADDR(mp, rablkno), + mp->m_quotainfo->qi_dqchunklen, +- NULL); ++ &xfs_dquot_buf_ops); + rablkno++; + } + } +diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h +index 8256eb4ad057..e9c4f190ffae 100644 +--- a/include/acpi/acpi_bus.h ++++ b/include/acpi/acpi_bus.h +@@ -228,7 +228,6 @@ struct acpi_device_pnp { + acpi_device_name device_name; /* Driver-determined */ + acpi_device_class device_class; /* " */ + union acpi_object *str_obj; /* unicode string for _STR method */ +- unsigned long sun; /* _SUN */ + }; + + #define acpi_device_bid(d) ((d)->pnp.bus_id) +diff --git a/include/linux/capability.h b/include/linux/capability.h +index 84b13ad67c1c..aa93e5ef594c 100644 +--- a/include/linux/capability.h ++++ b/include/linux/capability.h +@@ -78,8 +78,11 @@ extern const kernel_cap_t __cap_init_eff_set; + # error Fix up hand-coded capability macro initializers + #else /* HAND-CODED capability initializers */ + ++#define CAP_LAST_U32 ((_KERNEL_CAPABILITY_U32S) - 1) ++#define CAP_LAST_U32_VALID_MASK (CAP_TO_MASK(CAP_LAST_CAP + 1) -1) ++ + # define CAP_EMPTY_SET ((kernel_cap_t){{ 0, 0 }}) +-# define CAP_FULL_SET ((kernel_cap_t){{ ~0, ~0 }}) ++# define CAP_FULL_SET ((kernel_cap_t){{ ~0, CAP_LAST_U32_VALID_MASK }}) + # define CAP_FS_SET ((kernel_cap_t){{ CAP_FS_MASK_B0 \ + | CAP_TO_MASK(CAP_LINUX_IMMUTABLE), \ + CAP_FS_MASK_B1 } }) +diff --git a/include/linux/dcache.h b/include/linux/dcache.h +index bf72e9ac6de0..3b50cac7ccb3 100644 +--- a/include/linux/dcache.h ++++ b/include/linux/dcache.h +@@ -429,7 +429,7 @@ static inline unsigned __d_entry_type(const struct dentry *dentry) + return dentry->d_flags & DCACHE_ENTRY_TYPE; + } + +-static inline bool d_is_directory(const struct dentry *dentry) ++static inline bool d_can_lookup(const struct dentry *dentry) + { + return __d_entry_type(dentry) == DCACHE_DIRECTORY_TYPE; + } +@@ -439,6 +439,11 @@ static inline bool d_is_autodir(const struct dentry *dentry) + return __d_entry_type(dentry) == DCACHE_AUTODIR_TYPE; + } + ++static inline bool d_is_dir(const struct dentry *dentry) ++{ ++ return d_can_lookup(dentry) || d_is_autodir(dentry); ++} ++ + static inline bool d_is_symlink(const struct dentry *dentry) + { + return __d_entry_type(dentry) == DCACHE_SYMLINK_TYPE; +diff --git a/include/linux/mount.h b/include/linux/mount.h +index 839bac270904..b0c1e6574e7f 100644 +--- a/include/linux/mount.h ++++ b/include/linux/mount.h +@@ -42,13 +42,20 @@ struct mnt_namespace; + * flag, consider how it interacts with shared mounts. + */ + #define MNT_SHARED_MASK (MNT_UNBINDABLE) +-#define MNT_PROPAGATION_MASK (MNT_SHARED | MNT_UNBINDABLE) ++#define MNT_USER_SETTABLE_MASK (MNT_NOSUID | MNT_NODEV | MNT_NOEXEC \ ++ | MNT_NOATIME | MNT_NODIRATIME | MNT_RELATIME \ ++ | MNT_READONLY) ++#define MNT_ATIME_MASK (MNT_NOATIME | MNT_NODIRATIME | MNT_RELATIME ) + + #define MNT_INTERNAL_FLAGS (MNT_SHARED | MNT_WRITE_HOLD | MNT_INTERNAL | \ + MNT_DOOMED | MNT_SYNC_UMOUNT | MNT_MARKED) + + #define MNT_INTERNAL 0x4000 + ++#define MNT_LOCK_ATIME 0x040000 ++#define MNT_LOCK_NOEXEC 0x080000 ++#define MNT_LOCK_NOSUID 0x100000 ++#define MNT_LOCK_NODEV 0x200000 + #define MNT_LOCK_READONLY 0x400000 + #define MNT_LOCKED 0x800000 + #define MNT_DOOMED 0x1000000 +diff --git a/include/linux/tpm.h b/include/linux/tpm.h +index fff1d0976f80..8350c538b486 100644 +--- a/include/linux/tpm.h ++++ b/include/linux/tpm.h +@@ -39,6 +39,9 @@ struct tpm_class_ops { + int (*send) (struct tpm_chip *chip, u8 *buf, size_t len); + void (*cancel) (struct tpm_chip *chip); + u8 (*status) (struct tpm_chip *chip); ++ bool (*update_timeouts)(struct tpm_chip *chip, ++ unsigned long *timeout_cap); ++ + }; + + #if defined(CONFIG_TCG_TPM) || defined(CONFIG_TCG_TPM_MODULE) +diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h +index b4f1effc9216..409fafb63f63 100644 +--- a/include/scsi/scsi_device.h ++++ b/include/scsi/scsi_device.h +@@ -149,6 +149,7 @@ struct scsi_device { + unsigned skip_ms_page_8:1; /* do not use MODE SENSE page 0x08 */ + unsigned skip_ms_page_3f:1; /* do not use MODE SENSE page 0x3f */ + unsigned skip_vpd_pages:1; /* do not read VPD pages */ ++ unsigned try_vpd_pages:1; /* attempt to read VPD pages */ + unsigned use_192_bytes_for_3f:1; /* ask for 192 bytes from page 0x3f */ + unsigned no_start_on_add:1; /* do not issue start on add */ + unsigned allow_restart:1; /* issue START_UNIT in error handler */ +diff --git a/include/scsi/scsi_devinfo.h b/include/scsi/scsi_devinfo.h +index 447d2d7466fc..183eaab7c380 100644 +--- a/include/scsi/scsi_devinfo.h ++++ b/include/scsi/scsi_devinfo.h +@@ -32,4 +32,9 @@ + #define BLIST_ATTACH_PQ3 0x1000000 /* Scan: Attach to PQ3 devices */ + #define BLIST_NO_DIF 0x2000000 /* Disable T10 PI (DIF) */ + #define BLIST_SKIP_VPD_PAGES 0x4000000 /* Ignore SBC-3 VPD pages */ ++#define BLIST_SCSI3LUN 0x8000000 /* Scan more than 256 LUNs ++ for sequential scan */ ++#define BLIST_TRY_VPD_PAGES 0x10000000 /* Attempt to read VPD pages */ ++#define BLIST_NO_RSOC 0x20000000 /* don't try to issue RSOC */ ++ + #endif +diff --git a/include/uapi/rdma/rdma_user_cm.h b/include/uapi/rdma/rdma_user_cm.h +index 99b80abf360a..3066718eb120 100644 +--- a/include/uapi/rdma/rdma_user_cm.h ++++ b/include/uapi/rdma/rdma_user_cm.h +@@ -34,6 +34,7 @@ + #define RDMA_USER_CM_H + + #include <linux/types.h> ++#include <linux/socket.h> + #include <linux/in6.h> + #include <rdma/ib_user_verbs.h> + #include <rdma/ib_user_sa.h> +diff --git a/kernel/audit.c b/kernel/audit.c +index 0c9dc860cc15..2c0ecd1753de 100644 +--- a/kernel/audit.c ++++ b/kernel/audit.c +@@ -1628,7 +1628,7 @@ void audit_log_cap(struct audit_buffer *ab, char *prefix, kernel_cap_t *cap) + audit_log_format(ab, " %s=", prefix); + CAP_FOR_EACH_U32(i) { + audit_log_format(ab, "%08x", +- cap->cap[(_KERNEL_CAPABILITY_U32S-1) - i]); ++ cap->cap[CAP_LAST_U32 - i]); + } + } + +diff --git a/kernel/capability.c b/kernel/capability.c +index 1191a44786df..00adb2193d01 100644 +--- a/kernel/capability.c ++++ b/kernel/capability.c +@@ -268,6 +268,10 @@ SYSCALL_DEFINE2(capset, cap_user_header_t, header, const cap_user_data_t, data) + i++; + } + ++ effective.cap[CAP_LAST_U32] &= CAP_LAST_U32_VALID_MASK; ++ permitted.cap[CAP_LAST_U32] &= CAP_LAST_U32_VALID_MASK; ++ inheritable.cap[CAP_LAST_U32] &= CAP_LAST_U32_VALID_MASK; ++ + new = prepare_creds(); + if (!new) + return -ENOMEM; +diff --git a/kernel/smp.c b/kernel/smp.c +index ffee35bef179..ff87d4479558 100644 +--- a/kernel/smp.c ++++ b/kernel/smp.c +@@ -617,7 +617,7 @@ void on_each_cpu_cond(bool (*cond_func)(int cpu, void *info), + if (cond_func(cpu, info)) { + ret = smp_call_function_single(cpu, func, + info, wait); +- WARN_ON_ONCE(!ret); ++ WARN_ON_ONCE(ret); + } + preempt_enable(); + } +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index 0954450df7dc..a53f1bbc546b 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -1981,7 +1981,7 @@ rb_add_time_stamp(struct ring_buffer_event *event, u64 delta) + + /** + * rb_update_event - update event type and data +- * @event: the even to update ++ * @event: the event to update + * @type: the type of event + * @length: the size of the event field in the ring buffer + * +@@ -3354,21 +3354,16 @@ static void rb_iter_reset(struct ring_buffer_iter *iter) + struct ring_buffer_per_cpu *cpu_buffer = iter->cpu_buffer; + + /* Iterator usage is expected to have record disabled */ +- if (list_empty(&cpu_buffer->reader_page->list)) { +- iter->head_page = rb_set_head_page(cpu_buffer); +- if (unlikely(!iter->head_page)) +- return; +- iter->head = iter->head_page->read; +- } else { +- iter->head_page = cpu_buffer->reader_page; +- iter->head = cpu_buffer->reader_page->read; +- } ++ iter->head_page = cpu_buffer->reader_page; ++ iter->head = cpu_buffer->reader_page->read; ++ ++ iter->cache_reader_page = iter->head_page; ++ iter->cache_read = iter->head; ++ + if (iter->head) + iter->read_stamp = cpu_buffer->read_stamp; + else + iter->read_stamp = iter->head_page->page->time_stamp; +- iter->cache_reader_page = cpu_buffer->reader_page; +- iter->cache_read = cpu_buffer->read; + } + + /** +@@ -3761,12 +3756,14 @@ rb_iter_peek(struct ring_buffer_iter *iter, u64 *ts) + return NULL; + + /* +- * We repeat when a time extend is encountered. +- * Since the time extend is always attached to a data event, +- * we should never loop more than once. +- * (We never hit the following condition more than twice). ++ * We repeat when a time extend is encountered or we hit ++ * the end of the page. Since the time extend is always attached ++ * to a data event, we should never loop more than three times. ++ * Once for going to next page, once on time extend, and ++ * finally once to get the event. ++ * (We never hit the following condition more than thrice). + */ +- if (RB_WARN_ON(cpu_buffer, ++nr_loops > 2)) ++ if (RB_WARN_ON(cpu_buffer, ++nr_loops > 3)) + return NULL; + + if (rb_per_cpu_empty(cpu_buffer)) +diff --git a/lib/assoc_array.c b/lib/assoc_array.c +index c0b1007011e1..2404d03e251a 100644 +--- a/lib/assoc_array.c ++++ b/lib/assoc_array.c +@@ -1723,11 +1723,13 @@ ascend_old_tree: + shortcut = assoc_array_ptr_to_shortcut(ptr); + slot = shortcut->parent_slot; + cursor = shortcut->back_pointer; ++ if (!cursor) ++ goto gc_complete; + } else { + slot = node->parent_slot; + cursor = ptr; + } +- BUG_ON(!ptr); ++ BUG_ON(!cursor); + node = assoc_array_ptr_to_node(cursor); + slot++; + goto continue_node; +@@ -1735,7 +1737,7 @@ ascend_old_tree: + gc_complete: + edit->set[0].to = new_root; + assoc_array_apply_edit(edit); +- edit->array->nr_leaves_on_tree = nr_leaves_on_tree; ++ array->nr_leaves_on_tree = nr_leaves_on_tree; + return 0; + + enomem: +diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c +index 27ae84154586..06a7a769737f 100644 +--- a/net/bluetooth/l2cap_sock.c ++++ b/net/bluetooth/l2cap_sock.c +@@ -1112,7 +1112,8 @@ static int l2cap_sock_shutdown(struct socket *sock, int how) + l2cap_chan_close(chan, 0); + lock_sock(sk); + +- if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime) ++ if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime && ++ !(current->flags & PF_EXITING)) + err = bt_sock_wait_state(sk, BT_CLOSED, + sk->sk_lingertime); + } +diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c +index facd8a79c038..b08865111024 100644 +--- a/net/bluetooth/rfcomm/core.c ++++ b/net/bluetooth/rfcomm/core.c +@@ -1859,10 +1859,13 @@ static struct rfcomm_session *rfcomm_process_rx(struct rfcomm_session *s) + /* Get data directly from socket receive queue without copying it. */ + while ((skb = skb_dequeue(&sk->sk_receive_queue))) { + skb_orphan(skb); +- if (!skb_linearize(skb)) ++ if (!skb_linearize(skb)) { + s = rfcomm_recv_frame(s, skb); +- else ++ if (!s) ++ break; ++ } else { + kfree_skb(skb); ++ } + } + + if (s && (sk->sk_state == BT_CLOSED)) +diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c +index 3c2d3e4aa2f5..a0050de6f1f1 100644 +--- a/net/bluetooth/rfcomm/sock.c ++++ b/net/bluetooth/rfcomm/sock.c +@@ -898,7 +898,8 @@ static int rfcomm_sock_shutdown(struct socket *sock, int how) + sk->sk_shutdown = SHUTDOWN_MASK; + __rfcomm_sock_close(sk); + +- if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime) ++ if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime && ++ !(current->flags & PF_EXITING)) + err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime); + } + release_sock(sk); +diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c +index 24fa3964b3c8..316dd4e0af39 100644 +--- a/net/bluetooth/sco.c ++++ b/net/bluetooth/sco.c +@@ -909,7 +909,8 @@ static int sco_sock_shutdown(struct socket *sock, int how) + sco_sock_clear_timer(sk); + __sco_sock_close(sk); + +- if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime) ++ if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime && ++ !(current->flags & PF_EXITING)) + err = bt_sock_wait_state(sk, BT_CLOSED, + sk->sk_lingertime); + } +@@ -929,7 +930,8 @@ static int sco_sock_release(struct socket *sock) + + sco_sock_close(sk); + +- if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime) { ++ if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime && ++ !(current->flags & PF_EXITING)) { + lock_sock(sk); + err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime); + release_sock(sk); +diff --git a/net/ceph/auth_x.c b/net/ceph/auth_x.c +index 96238ba95f2b..de6662b14e1f 100644 +--- a/net/ceph/auth_x.c ++++ b/net/ceph/auth_x.c +@@ -13,8 +13,6 @@ + #include "auth_x.h" + #include "auth_x_protocol.h" + +-#define TEMP_TICKET_BUF_LEN 256 +- + static void ceph_x_validate_tickets(struct ceph_auth_client *ac, int *pneed); + + static int ceph_x_is_authenticated(struct ceph_auth_client *ac) +@@ -64,7 +62,7 @@ static int ceph_x_encrypt(struct ceph_crypto_key *secret, + } + + static int ceph_x_decrypt(struct ceph_crypto_key *secret, +- void **p, void *end, void *obuf, size_t olen) ++ void **p, void *end, void **obuf, size_t olen) + { + struct ceph_x_encrypt_header head; + size_t head_len = sizeof(head); +@@ -75,8 +73,14 @@ static int ceph_x_decrypt(struct ceph_crypto_key *secret, + return -EINVAL; + + dout("ceph_x_decrypt len %d\n", len); +- ret = ceph_decrypt2(secret, &head, &head_len, obuf, &olen, +- *p, len); ++ if (*obuf == NULL) { ++ *obuf = kmalloc(len, GFP_NOFS); ++ if (!*obuf) ++ return -ENOMEM; ++ olen = len; ++ } ++ ++ ret = ceph_decrypt2(secret, &head, &head_len, *obuf, &olen, *p, len); + if (ret) + return ret; + if (head.struct_v != 1 || le64_to_cpu(head.magic) != CEPHX_ENC_MAGIC) +@@ -129,139 +133,120 @@ static void remove_ticket_handler(struct ceph_auth_client *ac, + kfree(th); + } + +-static int ceph_x_proc_ticket_reply(struct ceph_auth_client *ac, +- struct ceph_crypto_key *secret, +- void *buf, void *end) ++static int process_one_ticket(struct ceph_auth_client *ac, ++ struct ceph_crypto_key *secret, ++ void **p, void *end) + { + struct ceph_x_info *xi = ac->private; +- int num; +- void *p = buf; ++ int type; ++ u8 tkt_struct_v, blob_struct_v; ++ struct ceph_x_ticket_handler *th; ++ void *dbuf = NULL; ++ void *dp, *dend; ++ int dlen; ++ char is_enc; ++ struct timespec validity; ++ struct ceph_crypto_key old_key; ++ void *ticket_buf = NULL; ++ void *tp, *tpend; ++ struct ceph_timespec new_validity; ++ struct ceph_crypto_key new_session_key; ++ struct ceph_buffer *new_ticket_blob; ++ unsigned long new_expires, new_renew_after; ++ u64 new_secret_id; + int ret; +- char *dbuf; +- char *ticket_buf; +- u8 reply_struct_v; + +- dbuf = kmalloc(TEMP_TICKET_BUF_LEN, GFP_NOFS); +- if (!dbuf) +- return -ENOMEM; ++ ceph_decode_need(p, end, sizeof(u32) + 1, bad); + +- ret = -ENOMEM; +- ticket_buf = kmalloc(TEMP_TICKET_BUF_LEN, GFP_NOFS); +- if (!ticket_buf) +- goto out_dbuf; ++ type = ceph_decode_32(p); ++ dout(" ticket type %d %s\n", type, ceph_entity_type_name(type)); + +- ceph_decode_need(&p, end, 1 + sizeof(u32), bad); +- reply_struct_v = ceph_decode_8(&p); +- if (reply_struct_v != 1) ++ tkt_struct_v = ceph_decode_8(p); ++ if (tkt_struct_v != 1) + goto bad; +- num = ceph_decode_32(&p); +- dout("%d tickets\n", num); +- while (num--) { +- int type; +- u8 tkt_struct_v, blob_struct_v; +- struct ceph_x_ticket_handler *th; +- void *dp, *dend; +- int dlen; +- char is_enc; +- struct timespec validity; +- struct ceph_crypto_key old_key; +- void *tp, *tpend; +- struct ceph_timespec new_validity; +- struct ceph_crypto_key new_session_key; +- struct ceph_buffer *new_ticket_blob; +- unsigned long new_expires, new_renew_after; +- u64 new_secret_id; +- +- ceph_decode_need(&p, end, sizeof(u32) + 1, bad); +- +- type = ceph_decode_32(&p); +- dout(" ticket type %d %s\n", type, ceph_entity_type_name(type)); +- +- tkt_struct_v = ceph_decode_8(&p); +- if (tkt_struct_v != 1) +- goto bad; +- +- th = get_ticket_handler(ac, type); +- if (IS_ERR(th)) { +- ret = PTR_ERR(th); +- goto out; +- } + +- /* blob for me */ +- dlen = ceph_x_decrypt(secret, &p, end, dbuf, +- TEMP_TICKET_BUF_LEN); +- if (dlen <= 0) { +- ret = dlen; +- goto out; +- } +- dout(" decrypted %d bytes\n", dlen); +- dend = dbuf + dlen; +- dp = dbuf; ++ th = get_ticket_handler(ac, type); ++ if (IS_ERR(th)) { ++ ret = PTR_ERR(th); ++ goto out; ++ } + +- tkt_struct_v = ceph_decode_8(&dp); +- if (tkt_struct_v != 1) +- goto bad; ++ /* blob for me */ ++ dlen = ceph_x_decrypt(secret, p, end, &dbuf, 0); ++ if (dlen <= 0) { ++ ret = dlen; ++ goto out; ++ } ++ dout(" decrypted %d bytes\n", dlen); ++ dp = dbuf; ++ dend = dp + dlen; + +- memcpy(&old_key, &th->session_key, sizeof(old_key)); +- ret = ceph_crypto_key_decode(&new_session_key, &dp, dend); +- if (ret) +- goto out; ++ tkt_struct_v = ceph_decode_8(&dp); ++ if (tkt_struct_v != 1) ++ goto bad; + +- ceph_decode_copy(&dp, &new_validity, sizeof(new_validity)); +- ceph_decode_timespec(&validity, &new_validity); +- new_expires = get_seconds() + validity.tv_sec; +- new_renew_after = new_expires - (validity.tv_sec / 4); +- dout(" expires=%lu renew_after=%lu\n", new_expires, +- new_renew_after); ++ memcpy(&old_key, &th->session_key, sizeof(old_key)); ++ ret = ceph_crypto_key_decode(&new_session_key, &dp, dend); ++ if (ret) ++ goto out; + +- /* ticket blob for service */ +- ceph_decode_8_safe(&p, end, is_enc, bad); +- tp = ticket_buf; +- if (is_enc) { +- /* encrypted */ +- dout(" encrypted ticket\n"); +- dlen = ceph_x_decrypt(&old_key, &p, end, ticket_buf, +- TEMP_TICKET_BUF_LEN); +- if (dlen < 0) { +- ret = dlen; +- goto out; +- } +- dlen = ceph_decode_32(&tp); +- } else { +- /* unencrypted */ +- ceph_decode_32_safe(&p, end, dlen, bad); +- ceph_decode_need(&p, end, dlen, bad); +- ceph_decode_copy(&p, ticket_buf, dlen); ++ ceph_decode_copy(&dp, &new_validity, sizeof(new_validity)); ++ ceph_decode_timespec(&validity, &new_validity); ++ new_expires = get_seconds() + validity.tv_sec; ++ new_renew_after = new_expires - (validity.tv_sec / 4); ++ dout(" expires=%lu renew_after=%lu\n", new_expires, ++ new_renew_after); ++ ++ /* ticket blob for service */ ++ ceph_decode_8_safe(p, end, is_enc, bad); ++ if (is_enc) { ++ /* encrypted */ ++ dout(" encrypted ticket\n"); ++ dlen = ceph_x_decrypt(&old_key, p, end, &ticket_buf, 0); ++ if (dlen < 0) { ++ ret = dlen; ++ goto out; + } +- tpend = tp + dlen; +- dout(" ticket blob is %d bytes\n", dlen); +- ceph_decode_need(&tp, tpend, 1 + sizeof(u64), bad); +- blob_struct_v = ceph_decode_8(&tp); +- new_secret_id = ceph_decode_64(&tp); +- ret = ceph_decode_buffer(&new_ticket_blob, &tp, tpend); +- if (ret) ++ tp = ticket_buf; ++ dlen = ceph_decode_32(&tp); ++ } else { ++ /* unencrypted */ ++ ceph_decode_32_safe(p, end, dlen, bad); ++ ticket_buf = kmalloc(dlen, GFP_NOFS); ++ if (!ticket_buf) { ++ ret = -ENOMEM; + goto out; +- +- /* all is well, update our ticket */ +- ceph_crypto_key_destroy(&th->session_key); +- if (th->ticket_blob) +- ceph_buffer_put(th->ticket_blob); +- th->session_key = new_session_key; +- th->ticket_blob = new_ticket_blob; +- th->validity = new_validity; +- th->secret_id = new_secret_id; +- th->expires = new_expires; +- th->renew_after = new_renew_after; +- dout(" got ticket service %d (%s) secret_id %lld len %d\n", +- type, ceph_entity_type_name(type), th->secret_id, +- (int)th->ticket_blob->vec.iov_len); +- xi->have_keys |= th->service; ++ } ++ tp = ticket_buf; ++ ceph_decode_need(p, end, dlen, bad); ++ ceph_decode_copy(p, ticket_buf, dlen); + } ++ tpend = tp + dlen; ++ dout(" ticket blob is %d bytes\n", dlen); ++ ceph_decode_need(&tp, tpend, 1 + sizeof(u64), bad); ++ blob_struct_v = ceph_decode_8(&tp); ++ new_secret_id = ceph_decode_64(&tp); ++ ret = ceph_decode_buffer(&new_ticket_blob, &tp, tpend); ++ if (ret) ++ goto out; ++ ++ /* all is well, update our ticket */ ++ ceph_crypto_key_destroy(&th->session_key); ++ if (th->ticket_blob) ++ ceph_buffer_put(th->ticket_blob); ++ th->session_key = new_session_key; ++ th->ticket_blob = new_ticket_blob; ++ th->validity = new_validity; ++ th->secret_id = new_secret_id; ++ th->expires = new_expires; ++ th->renew_after = new_renew_after; ++ dout(" got ticket service %d (%s) secret_id %lld len %d\n", ++ type, ceph_entity_type_name(type), th->secret_id, ++ (int)th->ticket_blob->vec.iov_len); ++ xi->have_keys |= th->service; + +- ret = 0; + out: + kfree(ticket_buf); +-out_dbuf: + kfree(dbuf); + return ret; + +@@ -270,6 +255,34 @@ bad: + goto out; + } + ++static int ceph_x_proc_ticket_reply(struct ceph_auth_client *ac, ++ struct ceph_crypto_key *secret, ++ void *buf, void *end) ++{ ++ void *p = buf; ++ u8 reply_struct_v; ++ u32 num; ++ int ret; ++ ++ ceph_decode_8_safe(&p, end, reply_struct_v, bad); ++ if (reply_struct_v != 1) ++ return -EINVAL; ++ ++ ceph_decode_32_safe(&p, end, num, bad); ++ dout("%d tickets\n", num); ++ ++ while (num--) { ++ ret = process_one_ticket(ac, secret, &p, end); ++ if (ret) ++ return ret; ++ } ++ ++ return 0; ++ ++bad: ++ return -EINVAL; ++} ++ + static int ceph_x_build_authorizer(struct ceph_auth_client *ac, + struct ceph_x_ticket_handler *th, + struct ceph_x_authorizer *au) +@@ -583,13 +596,14 @@ static int ceph_x_verify_authorizer_reply(struct ceph_auth_client *ac, + struct ceph_x_ticket_handler *th; + int ret = 0; + struct ceph_x_authorize_reply reply; ++ void *preply = &reply; + void *p = au->reply_buf; + void *end = p + sizeof(au->reply_buf); + + th = get_ticket_handler(ac, au->service); + if (IS_ERR(th)) + return PTR_ERR(th); +- ret = ceph_x_decrypt(&th->session_key, &p, end, &reply, sizeof(reply)); ++ ret = ceph_x_decrypt(&th->session_key, &p, end, &preply, sizeof(reply)); + if (ret < 0) + return ret; + if (ret != sizeof(reply)) +diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c +index 988721a629eb..0a31298737ac 100644 +--- a/net/ceph/messenger.c ++++ b/net/ceph/messenger.c +@@ -900,7 +900,7 @@ static void ceph_msg_data_pages_cursor_init(struct ceph_msg_data_cursor *cursor, + BUG_ON(page_count > (int)USHRT_MAX); + cursor->page_count = (unsigned short)page_count; + BUG_ON(length > SIZE_MAX - cursor->page_offset); +- cursor->last_piece = (size_t)cursor->page_offset + length <= PAGE_SIZE; ++ cursor->last_piece = cursor->page_offset + cursor->resid <= PAGE_SIZE; + } + + static struct page * +diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c +index 2ac9ef35110b..dbcbf5a4707f 100644 +--- a/net/ceph/mon_client.c ++++ b/net/ceph/mon_client.c +@@ -1041,7 +1041,15 @@ static struct ceph_msg *mon_alloc_msg(struct ceph_connection *con, + if (!m) { + pr_info("alloc_msg unknown type %d\n", type); + *skip = 1; ++ } else if (front_len > m->front_alloc_len) { ++ pr_warning("mon_alloc_msg front %d > prealloc %d (%u#%llu)\n", ++ front_len, m->front_alloc_len, ++ (unsigned int)con->peer_name.type, ++ le64_to_cpu(con->peer_name.num)); ++ ceph_msg_put(m); ++ m = ceph_msg_new(type, front_len, GFP_NOFS, false); + } ++ + return m; + } + +diff --git a/security/commoncap.c b/security/commoncap.c +index b9d613e0ef14..963dc5981661 100644 +--- a/security/commoncap.c ++++ b/security/commoncap.c +@@ -421,6 +421,9 @@ int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data + cpu_caps->inheritable.cap[i] = le32_to_cpu(caps.data[i].inheritable); + } + ++ cpu_caps->permitted.cap[CAP_LAST_U32] &= CAP_LAST_U32_VALID_MASK; ++ cpu_caps->inheritable.cap[CAP_LAST_U32] &= CAP_LAST_U32_VALID_MASK; ++ + return 0; + } + +diff --git a/sound/soc/blackfin/bf5xx-i2s-pcm.c b/sound/soc/blackfin/bf5xx-i2s-pcm.c +index a3881c4381c9..bcf591373a7a 100644 +--- a/sound/soc/blackfin/bf5xx-i2s-pcm.c ++++ b/sound/soc/blackfin/bf5xx-i2s-pcm.c +@@ -290,19 +290,19 @@ static int bf5xx_pcm_silence(struct snd_pcm_substream *substream, + unsigned int sample_size = runtime->sample_bits / 8; + void *buf = runtime->dma_area; + struct bf5xx_i2s_pcm_data *dma_data; +- unsigned int offset, size; ++ unsigned int offset, samples; + + dma_data = snd_soc_dai_get_dma_data(rtd->cpu_dai, substream); + + if (dma_data->tdm_mode) { + offset = pos * 8 * sample_size; +- size = count * 8 * sample_size; ++ samples = count * 8; + } else { + offset = frames_to_bytes(runtime, pos); +- size = frames_to_bytes(runtime, count); ++ samples = count * runtime->channels; + } + +- snd_pcm_format_set_silence(runtime->format, buf + offset, size); ++ snd_pcm_format_set_silence(runtime->format, buf + offset, samples); + + return 0; + } +diff --git a/sound/soc/codecs/adau1701.c b/sound/soc/codecs/adau1701.c +index d71c59cf7bdd..370b742117ef 100644 +--- a/sound/soc/codecs/adau1701.c ++++ b/sound/soc/codecs/adau1701.c +@@ -230,8 +230,10 @@ static int adau1701_reg_read(void *context, unsigned int reg, + + *value = 0; + +- for (i = 0; i < size; i++) +- *value |= recv_buf[i] << (i * 8); ++ for (i = 0; i < size; i++) { ++ *value <<= 8; ++ *value |= recv_buf[i]; ++ } + + return 0; + } +diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c +index b3f7c9026a29..ddfb0fddd030 100644 +--- a/sound/soc/codecs/max98090.c ++++ b/sound/soc/codecs/max98090.c +@@ -2250,7 +2250,7 @@ static int max98090_probe(struct snd_soc_codec *codec) + /* Register for interrupts */ + dev_dbg(codec->dev, "irq = %d\n", max98090->irq); + +- ret = request_threaded_irq(max98090->irq, NULL, ++ ret = devm_request_threaded_irq(codec->dev, max98090->irq, NULL, + max98090_interrupt, IRQF_TRIGGER_FALLING | IRQF_ONESHOT, + "max98090_interrupt", codec); + if (ret < 0) { +diff --git a/sound/soc/codecs/rt5640.c b/sound/soc/codecs/rt5640.c +index 886924934aa5..5cb515b08a32 100644 +--- a/sound/soc/codecs/rt5640.c ++++ b/sound/soc/codecs/rt5640.c +@@ -2071,6 +2071,7 @@ static struct snd_soc_codec_driver soc_codec_dev_rt5640 = { + static const struct regmap_config rt5640_regmap = { + .reg_bits = 8, + .val_bits = 16, ++ .use_single_rw = true, + + .max_register = RT5640_VENDOR_ID2 + 1 + (ARRAY_SIZE(rt5640_ranges) * + RT5640_PR_SPACING), +diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c +index adb72063d44e..d98e52f647d2 100644 +--- a/sound/soc/codecs/wm8994.c ++++ b/sound/soc/codecs/wm8994.c +@@ -3497,6 +3497,7 @@ static irqreturn_t wm8994_mic_irq(int irq, void *data) + return IRQ_HANDLED; + } + ++/* Should be called with accdet_lock held */ + static void wm1811_micd_stop(struct snd_soc_codec *codec) + { + struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec); +@@ -3504,14 +3505,10 @@ static void wm1811_micd_stop(struct snd_soc_codec *codec) + if (!wm8994->jackdet) + return; + +- mutex_lock(&wm8994->accdet_lock); +- + snd_soc_update_bits(codec, WM8958_MIC_DETECT_1, WM8958_MICD_ENA, 0); + + wm1811_jackdet_set_mode(codec, WM1811_JACKDET_MODE_JACK); + +- mutex_unlock(&wm8994->accdet_lock); +- + if (wm8994->wm8994->pdata.jd_ext_cap) + snd_soc_dapm_disable_pin(&codec->dapm, + "MICBIAS2"); +@@ -3552,10 +3549,10 @@ static void wm8958_open_circuit_work(struct work_struct *work) + open_circuit_work.work); + struct device *dev = wm8994->wm8994->dev; + +- wm1811_micd_stop(wm8994->hubs.codec); +- + mutex_lock(&wm8994->accdet_lock); + ++ wm1811_micd_stop(wm8994->hubs.codec); ++ + dev_dbg(dev, "Reporting open circuit\n"); + + wm8994->jack_mic = false; +diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c +index 444626fcab40..53c03aff762e 100644 +--- a/sound/soc/codecs/wm_adsp.c ++++ b/sound/soc/codecs/wm_adsp.c +@@ -1745,3 +1745,5 @@ int wm_adsp2_init(struct wm_adsp *adsp, bool dvfs) + return 0; + } + EXPORT_SYMBOL_GPL(wm_adsp2_init); ++ ++MODULE_LICENSE("GPL v2"); +diff --git a/sound/soc/pxa/pxa-ssp.c b/sound/soc/pxa/pxa-ssp.c +index a3119a00d8fa..6c6b35e471c8 100644 +--- a/sound/soc/pxa/pxa-ssp.c ++++ b/sound/soc/pxa/pxa-ssp.c +@@ -725,7 +725,8 @@ static int pxa_ssp_probe(struct snd_soc_dai *dai) + ssp_handle = of_parse_phandle(dev->of_node, "port", 0); + if (!ssp_handle) { + dev_err(dev, "unable to get 'port' phandle\n"); +- return -ENODEV; ++ ret = -ENODEV; ++ goto err_priv; + } + + priv->ssp = pxa_ssp_request_of(ssp_handle, "SoC audio"); +@@ -766,9 +767,7 @@ static int pxa_ssp_remove(struct snd_soc_dai *dai) + SNDRV_PCM_RATE_48000 | SNDRV_PCM_RATE_64000 | \ + SNDRV_PCM_RATE_88200 | SNDRV_PCM_RATE_96000) + +-#define PXA_SSP_FORMATS (SNDRV_PCM_FMTBIT_S16_LE |\ +- SNDRV_PCM_FMTBIT_S24_LE | \ +- SNDRV_PCM_FMTBIT_S32_LE) ++#define PXA_SSP_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S32_LE) + + static const struct snd_soc_dai_ops pxa_ssp_dai_ops = { + .startup = pxa_ssp_startup, +diff --git a/sound/soc/samsung/i2s.c b/sound/soc/samsung/i2s.c +index 0a9b44c940ce..5dae66002a11 100644 +--- a/sound/soc/samsung/i2s.c ++++ b/sound/soc/samsung/i2s.c +@@ -915,11 +915,9 @@ static int i2s_suspend(struct snd_soc_dai *dai) + { + struct i2s_dai *i2s = to_info(dai); + +- if (dai->active) { +- i2s->suspend_i2smod = readl(i2s->addr + I2SMOD); +- i2s->suspend_i2scon = readl(i2s->addr + I2SCON); +- i2s->suspend_i2spsr = readl(i2s->addr + I2SPSR); +- } ++ i2s->suspend_i2smod = readl(i2s->addr + I2SMOD); ++ i2s->suspend_i2scon = readl(i2s->addr + I2SCON); ++ i2s->suspend_i2spsr = readl(i2s->addr + I2SPSR); + + return 0; + } +@@ -928,11 +926,9 @@ static int i2s_resume(struct snd_soc_dai *dai) + { + struct i2s_dai *i2s = to_info(dai); + +- if (dai->active) { +- writel(i2s->suspend_i2scon, i2s->addr + I2SCON); +- writel(i2s->suspend_i2smod, i2s->addr + I2SMOD); +- writel(i2s->suspend_i2spsr, i2s->addr + I2SPSR); +- } ++ writel(i2s->suspend_i2scon, i2s->addr + I2SCON); ++ writel(i2s->suspend_i2smod, i2s->addr + I2SMOD); ++ writel(i2s->suspend_i2spsr, i2s->addr + I2SPSR); + + return 0; + } +diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c +index 47e1ce771e65..02733ded2cb1 100644 +--- a/sound/soc/soc-pcm.c ++++ b/sound/soc/soc-pcm.c +@@ -2011,6 +2011,7 @@ int soc_dpcm_runtime_update(struct snd_soc_card *card) + dpcm_be_disconnect(fe, SNDRV_PCM_STREAM_PLAYBACK); + } + ++ dpcm_path_put(&list); + capture: + /* skip if FE doesn't have capture capability */ + if (!fe->cpu_dai->driver->capture.channels_min) +diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile +index 32487ed18354..3d5979b23e50 100644 +--- a/tools/testing/selftests/Makefile ++++ b/tools/testing/selftests/Makefile +@@ -4,6 +4,7 @@ TARGETS += efivarfs + TARGETS += kcmp + TARGETS += memory-hotplug + TARGETS += mqueue ++TARGETS += mount + TARGETS += net + TARGETS += ptrace + TARGETS += timers +diff --git a/tools/testing/selftests/mount/Makefile b/tools/testing/selftests/mount/Makefile +new file mode 100644 +index 000000000000..337d853c2b72 +--- /dev/null ++++ b/tools/testing/selftests/mount/Makefile +@@ -0,0 +1,17 @@ ++# Makefile for mount selftests. ++ ++all: unprivileged-remount-test ++ ++unprivileged-remount-test: unprivileged-remount-test.c ++ gcc -Wall -O2 unprivileged-remount-test.c -o unprivileged-remount-test ++ ++# Allow specific tests to be selected. ++test_unprivileged_remount: unprivileged-remount-test ++ @if [ -f /proc/self/uid_map ] ; then ./unprivileged-remount-test ; fi ++ ++run_tests: all test_unprivileged_remount ++ ++clean: ++ rm -f unprivileged-remount-test ++ ++.PHONY: all test_unprivileged_remount +diff --git a/tools/testing/selftests/mount/unprivileged-remount-test.c b/tools/testing/selftests/mount/unprivileged-remount-test.c +new file mode 100644 +index 000000000000..1b3ff2fda4d0 +--- /dev/null ++++ b/tools/testing/selftests/mount/unprivileged-remount-test.c +@@ -0,0 +1,242 @@ ++#define _GNU_SOURCE ++#include <sched.h> ++#include <stdio.h> ++#include <errno.h> ++#include <string.h> ++#include <sys/types.h> ++#include <sys/mount.h> ++#include <sys/wait.h> ++#include <stdlib.h> ++#include <unistd.h> ++#include <fcntl.h> ++#include <grp.h> ++#include <stdbool.h> ++#include <stdarg.h> ++ ++#ifndef CLONE_NEWNS ++# define CLONE_NEWNS 0x00020000 ++#endif ++#ifndef CLONE_NEWUTS ++# define CLONE_NEWUTS 0x04000000 ++#endif ++#ifndef CLONE_NEWIPC ++# define CLONE_NEWIPC 0x08000000 ++#endif ++#ifndef CLONE_NEWNET ++# define CLONE_NEWNET 0x40000000 ++#endif ++#ifndef CLONE_NEWUSER ++# define CLONE_NEWUSER 0x10000000 ++#endif ++#ifndef CLONE_NEWPID ++# define CLONE_NEWPID 0x20000000 ++#endif ++ ++#ifndef MS_RELATIME ++#define MS_RELATIME (1 << 21) ++#endif ++#ifndef MS_STRICTATIME ++#define MS_STRICTATIME (1 << 24) ++#endif ++ ++static void die(char *fmt, ...) ++{ ++ va_list ap; ++ va_start(ap, fmt); ++ vfprintf(stderr, fmt, ap); ++ va_end(ap); ++ exit(EXIT_FAILURE); ++} ++ ++static void write_file(char *filename, char *fmt, ...) ++{ ++ char buf[4096]; ++ int fd; ++ ssize_t written; ++ int buf_len; ++ va_list ap; ++ ++ va_start(ap, fmt); ++ buf_len = vsnprintf(buf, sizeof(buf), fmt, ap); ++ va_end(ap); ++ if (buf_len < 0) { ++ die("vsnprintf failed: %s\n", ++ strerror(errno)); ++ } ++ if (buf_len >= sizeof(buf)) { ++ die("vsnprintf output truncated\n"); ++ } ++ ++ fd = open(filename, O_WRONLY); ++ if (fd < 0) { ++ die("open of %s failed: %s\n", ++ filename, strerror(errno)); ++ } ++ written = write(fd, buf, buf_len); ++ if (written != buf_len) { ++ if (written >= 0) { ++ die("short write to %s\n", filename); ++ } else { ++ die("write to %s failed: %s\n", ++ filename, strerror(errno)); ++ } ++ } ++ if (close(fd) != 0) { ++ die("close of %s failed: %s\n", ++ filename, strerror(errno)); ++ } ++} ++ ++static void create_and_enter_userns(void) ++{ ++ uid_t uid; ++ gid_t gid; ++ ++ uid = getuid(); ++ gid = getgid(); ++ ++ if (unshare(CLONE_NEWUSER) !=0) { ++ die("unshare(CLONE_NEWUSER) failed: %s\n", ++ strerror(errno)); ++ } ++ ++ write_file("/proc/self/uid_map", "0 %d 1", uid); ++ write_file("/proc/self/gid_map", "0 %d 1", gid); ++ ++ if (setgroups(0, NULL) != 0) { ++ die("setgroups failed: %s\n", ++ strerror(errno)); ++ } ++ if (setgid(0) != 0) { ++ die ("setgid(0) failed %s\n", ++ strerror(errno)); ++ } ++ if (setuid(0) != 0) { ++ die("setuid(0) failed %s\n", ++ strerror(errno)); ++ } ++} ++ ++static ++bool test_unpriv_remount(int mount_flags, int remount_flags, int invalid_flags) ++{ ++ pid_t child; ++ ++ child = fork(); ++ if (child == -1) { ++ die("fork failed: %s\n", ++ strerror(errno)); ++ } ++ if (child != 0) { /* parent */ ++ pid_t pid; ++ int status; ++ pid = waitpid(child, &status, 0); ++ if (pid == -1) { ++ die("waitpid failed: %s\n", ++ strerror(errno)); ++ } ++ if (pid != child) { ++ die("waited for %d got %d\n", ++ child, pid); ++ } ++ if (!WIFEXITED(status)) { ++ die("child did not terminate cleanly\n"); ++ } ++ return WEXITSTATUS(status) == EXIT_SUCCESS ? true : false; ++ } ++ ++ create_and_enter_userns(); ++ if (unshare(CLONE_NEWNS) != 0) { ++ die("unshare(CLONE_NEWNS) failed: %s\n", ++ strerror(errno)); ++ } ++ ++ if (mount("testing", "/tmp", "ramfs", mount_flags, NULL) != 0) { ++ die("mount of /tmp failed: %s\n", ++ strerror(errno)); ++ } ++ ++ create_and_enter_userns(); ++ ++ if (unshare(CLONE_NEWNS) != 0) { ++ die("unshare(CLONE_NEWNS) failed: %s\n", ++ strerror(errno)); ++ } ++ ++ if (mount("/tmp", "/tmp", "none", ++ MS_REMOUNT | MS_BIND | remount_flags, NULL) != 0) { ++ /* system("cat /proc/self/mounts"); */ ++ die("remount of /tmp failed: %s\n", ++ strerror(errno)); ++ } ++ ++ if (mount("/tmp", "/tmp", "none", ++ MS_REMOUNT | MS_BIND | invalid_flags, NULL) == 0) { ++ /* system("cat /proc/self/mounts"); */ ++ die("remount of /tmp with invalid flags " ++ "succeeded unexpectedly\n"); ++ } ++ exit(EXIT_SUCCESS); ++} ++ ++static bool test_unpriv_remount_simple(int mount_flags) ++{ ++ return test_unpriv_remount(mount_flags, mount_flags, 0); ++} ++ ++static bool test_unpriv_remount_atime(int mount_flags, int invalid_flags) ++{ ++ return test_unpriv_remount(mount_flags, mount_flags, invalid_flags); ++} ++ ++int main(int argc, char **argv) ++{ ++ if (!test_unpriv_remount_simple(MS_RDONLY|MS_NODEV)) { ++ die("MS_RDONLY malfunctions\n"); ++ } ++ if (!test_unpriv_remount_simple(MS_NODEV)) { ++ die("MS_NODEV malfunctions\n"); ++ } ++ if (!test_unpriv_remount_simple(MS_NOSUID|MS_NODEV)) { ++ die("MS_NOSUID malfunctions\n"); ++ } ++ if (!test_unpriv_remount_simple(MS_NOEXEC|MS_NODEV)) { ++ die("MS_NOEXEC malfunctions\n"); ++ } ++ if (!test_unpriv_remount_atime(MS_RELATIME|MS_NODEV, ++ MS_NOATIME|MS_NODEV)) ++ { ++ die("MS_RELATIME malfunctions\n"); ++ } ++ if (!test_unpriv_remount_atime(MS_STRICTATIME|MS_NODEV, ++ MS_NOATIME|MS_NODEV)) ++ { ++ die("MS_STRICTATIME malfunctions\n"); ++ } ++ if (!test_unpriv_remount_atime(MS_NOATIME|MS_NODEV, ++ MS_STRICTATIME|MS_NODEV)) ++ { ++ die("MS_RELATIME malfunctions\n"); ++ } ++ if (!test_unpriv_remount_atime(MS_RELATIME|MS_NODIRATIME|MS_NODEV, ++ MS_NOATIME|MS_NODEV)) ++ { ++ die("MS_RELATIME malfunctions\n"); ++ } ++ if (!test_unpriv_remount_atime(MS_STRICTATIME|MS_NODIRATIME|MS_NODEV, ++ MS_NOATIME|MS_NODEV)) ++ { ++ die("MS_RELATIME malfunctions\n"); ++ } ++ if (!test_unpriv_remount_atime(MS_NOATIME|MS_NODIRATIME|MS_NODEV, ++ MS_STRICTATIME|MS_NODEV)) ++ { ++ die("MS_RELATIME malfunctions\n"); ++ } ++ if (!test_unpriv_remount(MS_STRICTATIME|MS_NODEV, MS_NODEV, ++ MS_NOATIME|MS_NODEV)) ++ { ++ die("Default atime malfunctions\n"); ++ } ++ return EXIT_SUCCESS; ++} |